@open-everywhere/adapters 0.6.0 → 0.7.0

package/agent/oe-oauth/token-vault.ts

@@ -2,8 +2,25 @@
 // encrypted KV. Refresh is single-flight in-process AND cross-process, because the provider ROTATES tokens.
 
 import type { EncryptedKvVault } from "@open-everywhere/core/agent/adapter-api.js";
-import { agentDisplayName, encryptedKvVault, getSecretVia, OE_OAUTH_CALLBACK_PATH } from "@open-everywhere/core/agent/adapter-api.js";
-import { isStaticConfidential, OE_OAUTH_MODE_STATIC, type OeOauthProviderConfig, type OeOauthStaticProviderConfig } from "./config.js";
+import {
+  agentDisplayName,
+  checkXaaIdentityBinding,
+  encryptedKvVault,
+  recordXaaRefusal,
+  getSecretVia,
+  OE_OAUTH_CALLBACK_PATH,
+  verifyOidcIdToken,
+  type XaaBindingVerdict,
+} from "@open-everywhere/core/agent/adapter-api.js";
+import {
+  isStaticConfidential,
+  isXaa,
+  OE_OAUTH_MODE_STATIC,
+  OE_OAUTH_MODE_XAA,
+  type OeOauthProviderConfig,
+  type OeOauthStaticProviderConfig,
+  type OeOauthXaaProviderConfig,
+} from "./config.js";
 import {
   discoverEndpoints,
   registerClient,
@@ -15,13 +32,18 @@ import {
   refreshTokenConfidential,
   revokeToken,
   revokeTokenConfidential,
+  discoverOidc,
+  fetchJwks,
+  requestIdJag,
+  jwtBearerGrant,
   type ConfidentialClient,
+  type OidcEndpoints,
   type OAuthFetch,
   type OAuthTokenResponse,
 } from "./oauth-client.js";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { makePkce, makeState } from "./pkce.js";
-import { OeOauthNeedsConsentError, OeOauthNeedsReconsentError, OeOauthRefreshContendedError, isInvalidGrant } from "./errors.js";
+import { OeOauthAccessRemovedError, OeOauthNeedsConsentError, OeOauthNeedsReconsentError, OeOauthRefreshContendedError, isInvalidGrant } from "./errors.js";
 
 /** A subject a token is minted for — the service identity, or a specific user principal. */
 export type OeOauthSubject = { readonly type: "user"; readonly id: string } | { readonly type: "app" };
@@ -77,9 +99,11 @@ interface PendingRecord {
   /** The RFC 8707 resource indicator. ABSENT on a `static-confidential` row — that dialect sends
    *  none — and present on every discovery row, including every row written before OPE-1086. */
   readonly resource?: string;
-  /** Stamped ONLY on a `static-confidential` row, from the config's declared mode at mint time. Its
+  /** Stamped ONLY on a `static-confidential` or an `xaa` row, from the config's declared mode at mint time. Its
    *  absence is the discovery dialect, which is what every pre-OPE-1086 row means. */
-  readonly mode?: typeof OE_OAUTH_MODE_STATIC;
+  readonly mode?: typeof OE_OAUTH_MODE_STATIC | typeof OE_OAUTH_MODE_XAA;
+  /** The OIDC `nonce` of an `xaa` sign-in (OPE-2453): the id token must carry it back. Absent on other rows. */
+  readonly nonce?: string;
   readonly redirectUri: string;
   readonly scopes?: readonly string[];
   readonly createdAt: number;
@@ -106,6 +130,31 @@ interface PendingSweepReport {
   readonly unreadable: number;
 }
 
+/**
+ * A person's IdP grant for Cross App Access (OPE-2453): the IdP refresh token their one sign-in yielded, and the
+ * IdP account (`sub`) the identity-link plane confirmed as theirs. ONE row per (IdP client, person), shared by every
+ * `xaa` connection that names the same IdP client — so one sign-in serves every paired app.
+ */
+interface IdpGrantRecord {
+  readonly refreshToken: string;
+  readonly idpSubject: string;
+  readonly obtainedAt: number;
+}
+
+/** The IdP scopes the Cross App Access sign-in asks for: an id token (`openid`) and a refresh token to exchange
+ *  (`offline_access`). Fixed — the app's own scopes ride leg 1 and leg 2, never this sign-in. */
+const XAA_IDP_SCOPES = ["openid", "offline_access"] as const;
+
+/** RFC 6749 / 8693 error codes that mean the IdP REFUSED this person's ID-JAG on policy (the admin removed the
+ *  pairing or the assignment). `invalid_grant` is NOT here: it means the IdP sign-in itself lapsed, and a new
+ *  sign-in fixes that. */
+const XAA_IDP_REFUSALS: ReadonlySet<string> = new Set(["access_denied", "unauthorized_client", "invalid_target"]);
+/** Error codes that mean the APP refused the ID-JAG for this person. No new sign-in fixes these. */
+const XAA_APP_REFUSALS: ReadonlySet<string> = new Set(["invalid_grant", "access_denied", "unauthorized_client"]);
+
+/** How long a discovered OIDC document is reused before it is fetched again. */
+const OIDC_DISCOVERY_TTL_MS = 60 * 60 * 1000;
+
 /** A persisted token record. `expiresAt` absent ⇒ no known expiry (never proactively refreshed). */
 interface TokenRecord {
   readonly accessToken: string;
@@ -156,6 +205,20 @@ export interface OeOauthVaultDeps {
    * every other stored secret takes. Read PER TOKEN CALL, so a rotated secret takes effect at once.
    */
   readonly resolveSecret?: (broker: string | undefined, ref: string) => Promise<string>;
+  /** Mints the OIDC nonce of an `xaa` sign-in. Default: the same generator as the opaque state. */
+  readonly newNonce?: () => string;
+  /** Verify an `xaa` sign-in's id token. Default: core's `verifyOidcIdToken` (jose, full signature check). */
+  readonly verifyIdToken?: typeof verifyOidcIdToken;
+  /** Decide whether the IdP account that signed in may complete this requester's `xaa` link. Default: core's
+   *  `checkXaaIdentityBinding` — a confirmed `okta` account on the requester's link-set, refusal by default. */
+  readonly bindIdentity?: (input: {
+    readonly principalSubject: string;
+    readonly signerSubject: string | undefined;
+    readonly connection: string;
+    readonly stage?: "sign-in" | "mint";
+  }) => Promise<XaaBindingVerdict>;
+  /** Audit an `xaa` sign-in refused before the binding ran. Default: core's `recordXaaRefusal`. */
+  readonly recordRefusal?: typeof recordXaaRefusal;
 }
 
 function subjectKey(subject: OeOauthSubject): string {
@@ -191,10 +254,18 @@ export function makeOeOauthTokenVault(source: OeOauthProviderSource, deps: OeOau
   const newClaimId = deps.newClaimId ?? (() => randomUUID());
   const sleep = deps.sleep ?? realSleep;
   const resolveSecret = deps.resolveSecret ?? ((broker: string | undefined, ref: string) => getSecretVia(broker, ref));
+  const newNonce = deps.newNonce ?? makeState;
+  const verifyIdToken = deps.verifyIdToken ?? verifyOidcIdToken;
+  const bindIdentity = deps.bindIdentity ?? checkXaaIdentityBinding;
+  const recordRefusal = deps.recordRefusal ?? recordXaaRefusal;
 
   const dcrRef = (providerRef: string) => `oe-oauth:dcr:${providerRef}`;
   const pendRef = (state: string) => `oe-oauth:pend:${state}`;
   const tokRef = (providerRef: string, subject: OeOauthSubject) => `oe-oauth:tok:${providerRef}:${subjectKey(subject)}`;
+  // The IdP grant is keyed by the IdP CLIENT (issuer + client id), not by the connection: every `xaa` connection
+  // that names the same IdP client shares one person's sign-in. Hashed so the ref carries no URL punctuation.
+  const idpKey = (cfg: OeOauthXaaProviderConfig) => createHash("sha256").update(`${cfg.idpIssuer}\n${cfg.idpClientId}`).digest("hex").slice(0, 32);
+  const idpRef = (cfg: OeOauthXaaProviderConfig, subject: OeOauthSubject) => `oe-oauth:xaa-idp:${idpKey(cfg)}:${subjectKey(subject)}`;
 
   function providerConfig(providerRef: string): OeOauthProviderConfig {
     const cfg = providersNow().get(providerRef);
@@ -234,6 +305,7 @@ export function makeOeOauthTokenVault(source: OeOauthProviderSource, deps: OeOau
     // function entirely. Stated as a refusal rather than a cast so a future caller that reaches it
     // directly gets an error instead of a discovery request built from an absent `resource`.
     if (isStaticConfidential(cfg)) throw new Error(`connection "${providerRef}": declares the "${OE_OAUTH_MODE_STATIC}" mode, which registers no dynamic client.`);
+    if (isXaa(cfg)) throw new Error(`connection "${providerRef}": declares the "${OE_OAUTH_MODE_XAA}" mode, which registers no dynamic client.`);
     return vault.withLock(dcrRef(providerRef), async () => {
       const again = await readJson<DcrClientRecord>(dcrRef(providerRef));
       if (again && !dcrRecordNeedsBackfill(again)) return again; // another caller already completed it
@@ -324,6 +396,230 @@ export function makeOeOauthTokenVault(source: OeOauthProviderSource, deps: OeOau
     };
   }
 
+  /** A confidential client for one `xaa` leg, secret read through its broker PER CALL. The error names the ref. */
+  async function xaaClient(cfg: OeOauthXaaProviderConfig, leg: "idp" | "app"): Promise<ConfidentialClient> {
+    const [clientId, secretRef, broker] =
+      leg === "idp" ? [cfg.idpClientId, cfg.idpClientSecretRef, cfg.idpClientSecretBroker] : [cfg.resourceClientId, cfg.resourceClientSecretRef, cfg.resourceClientSecretBroker];
+    const secret = await resolveSecret(broker, secretRef);
+    if (typeof secret !== "string" || secret === "") {
+      throw new Error(
+        `connection "${cfg.ref}": the ${leg === "idp" ? "identity-provider" : "app"} client secret at ref "${secretRef}" (broker "${broker}") has no stored value — ` +
+          `store it with \`oe secret set ${secretRef}\` before this connection can mint a token.`,
+      );
+    }
+    return { clientId, clientSecret: secret, bodyEncoding: "form" };
+  }
+
+  // The IdP's discovered endpoints, per issuer, reused for an hour: every mint's leg 1 needs the token endpoint,
+  // and a discovery hop per mint would double the IdP traffic for nothing.
+  const oidcCache = new Map<string, { readonly at: number; readonly endpoints: OidcEndpoints }>();
+  async function oidcFor(cfg: OeOauthXaaProviderConfig): Promise<OidcEndpoints> {
+    const hit = oidcCache.get(cfg.idpIssuer);
+    if (hit && now() - hit.at < OIDC_DISCOVERY_TTL_MS) return hit.endpoints;
+    const endpoints = await discoverOidc(cfg.idpIssuer, doFetch);
+    oidcCache.set(cfg.idpIssuer, { at: now(), endpoints });
+    return endpoints;
+  }
+
+  /** An `xaa` connection acts only AS A PERSON: the ID-JAG names a human. There is no service account to mint. */
+  function requireXaaPerson(providerRef: string, subject: OeOauthSubject): asserts subject is { readonly type: "user"; readonly id: string } {
+    if (subject.type !== "user") {
+      throw new Error(`connection "${providerRef}": the "${OE_OAUTH_MODE_XAA}" sign-in acts only as a person — it has no service account to mint for.`);
+    }
+  }
+
+  /**
+   * Start the person's IdP sign-in for an `xaa` connection: OIDC auth code with PKCE and a nonce, `openid` +
+   * `offline_access`. The pending row is the same shape as the other dialects', stamped `mode: "xaa"`.
+   */
+  async function xaaStartAuthorization(
+    cfg: OeOauthXaaProviderConfig,
+    subject: OeOauthSubject,
+    options: { readonly expiresInMs?: number; readonly consent?: unknown },
+  ): Promise<{ url: string }> {
+    requireXaaPerson(cfg.ref, subject);
+    const oidc = await oidcFor(cfg);
+    const redirectUri = redirectUriOf();
+    if (!redirectUri) throw new Error(`connection "${cfg.ref}": OE_PUBLIC_BASE_URL is unset — cannot build a redirect_uri.`);
+    const state = newState();
+    const pkce = newPkce();
+    const nonce = newNonce();
+    const pending: PendingRecord = {
+      providerRef: cfg.ref,
+      subject,
+      pkceVerifier: pkce.verifier,
+      tokenEndpoint: oidc.tokenEndpoint,
+      clientId: cfg.idpClientId,
+      mode: OE_OAUTH_MODE_XAA,
+      nonce,
+      redirectUri,
+      scopes: XAA_IDP_SCOPES,
+      createdAt: now(),
+      expiresAt: now() + (options.expiresInMs ?? pendingTtl),
+      ...(options.consent ? { consent: options.consent } : {}),
+    };
+    await vault.write(pendRef(state), JSON.stringify(pending), { connector: cfg.ref });
+    // The PKCE pair and the nonce ride `extraParams`: this function's own parameters (client_id, redirect_uri,
+    // state, scope) are applied after them and win, so nothing here can be overridden.
+    const url = buildStaticAuthorizationUrl({
+      authorizationEndpoint: oidc.authorizationEndpoint,
+      clientId: cfg.idpClientId,
+      redirectUri,
+      state,
+      scopes: XAA_IDP_SCOPES,
+      extraParams: { nonce, code_challenge: pkce.challenge, code_challenge_method: "S256" },
+    });
+    return { url };
+  }
+
+  /**
+   * Complete an `xaa` sign-in: exchange the code at the IdP, VERIFY the id token (signature, iss, aud, nonce), and
+   * admit the sign-in only when the identity-link plane confirms the IdP account is the requester's own. Then store
+   * the person's IdP refresh token as their IdP grant. A refusal SPENDS the link (the pending row is consumed).
+   */
+  async function xaaCompleteAuthorization(state: string, pending: PendingRecord, code: string): Promise<{ rebound: boolean }> {
+    const cfg = providersNow().get(pending.providerRef);
+    if (cfg === undefined || !isXaa(cfg) || cfg.idpClientId !== pending.clientId) {
+      throw new Error(`connection "${pending.providerRef}": this sign-in started under an "${OE_OAUTH_MODE_XAA}" declaration that no longer stands — start again.`);
+    }
+    const spend = () => vault.write(pendRef(state), JSON.stringify({ ...pending, consumed: true, pkceVerifier: "", nonce: "", consent: undefined }), { connector: pending.providerRef });
+    const tok = await exchangeCodeConfidential(pending.tokenEndpoint, { code, redirectUri: pending.redirectUri, codeVerifier: pending.pkceVerifier }, await xaaClient(cfg, "idp"), doFetch);
+    let signer: string | undefined;
+    try {
+      if (!tok.id_token) throw new Error("the IdP returned no id token");
+      const oidc = await oidcFor(cfg);
+      signer = (await verifyIdToken(tok.id_token, { jwks: (await fetchJwks(oidc.jwksUri, doFetch)) as Parameters<typeof verifyOidcIdToken>[1]["jwks"], issuer: cfg.idpIssuer, audience: cfg.idpClientId, nonce: pending.nonce ?? "" })).sub;
+    } catch (e) {
+      await spend();
+      const reason = e instanceof Error ? e.message : String(e);
+      // Every refused attempt leaves one audit row — a forged or replayed id token most of all.
+      if (pending.subject.type === "user") await recordRefusal({ principalSubject: pending.subject.id, connection: pending.providerRef, reason });
+      throw new Error(`connection "${pending.providerRef}": the identity-provider sign-in was refused — ${reason}.`);
+    }
+    if (pending.subject.type !== "user") {
+      await spend();
+      throw new Error(`connection "${pending.providerRef}": the "${OE_OAUTH_MODE_XAA}" sign-in acts only as a person.`);
+    }
+    // 🔴 THE BINDING. Whoever opened the link signed in; the grant is stored for the requester only when that IdP
+    // account is a CONFIRMED account of theirs. Otherwise one person could mint another person's app tokens.
+    const verdict = await bindIdentity({ principalSubject: pending.subject.id, signerSubject: signer, connection: pending.providerRef });
+    if (!verdict.ok) {
+      await spend();
+      throw new Error(`connection "${pending.providerRef}": the identity-provider sign-in was refused — ${verdict.reason}.`);
+    }
+    if (!tok.refresh_token) {
+      await spend();
+      await recordRefusal({ principalSubject: pending.subject.id, connection: pending.providerRef, reason: "the IdP returned no refresh token", signerSubject: verdict.idpNativeId });
+      throw new Error(`connection "${pending.providerRef}": the IdP returned no refresh token — the OE app at the IdP must allow the refresh-token grant and the offline_access scope.`);
+    }
+    const gRef = idpRef(cfg, pending.subject);
+    const rebound = (await readJson<IdpGrantRecord>(gRef)) !== null;
+    const grant: IdpGrantRecord = { refreshToken: tok.refresh_token, idpSubject: verdict.idpNativeId, obtainedAt: now() };
+    await vault.write(gRef, JSON.stringify(grant), { connector: pending.providerRef });
+    await spend();
+    return { rebound };
+  }
+
+  /** The RFC 6749 `error` code an upstream failure carried, if any. */
+  function oauthErrorOf(e: unknown): string | undefined {
+    const code = (e as { oauthError?: unknown } | null)?.oauthError;
+    return typeof code === "string" ? code.toLowerCase() : undefined;
+  }
+
+  /** ONE `xaa` mint, run by the claim winner: leg 1 at the IdP, leg 2 at the app, then cache the app token for its
+   *  lifetime. Never a refresh token from the app — a re-mint is the only refresh. */
+  async function xaaMint(cfg: OeOauthXaaProviderConfig, providerRef: string, subject: OeOauthSubject, grant: IdpGrantRecord): Promise<string> {
+    const oidc = await oidcFor(cfg);
+    const legParams = { ...(cfg.resource ? { resource: cfg.resource } : {}), ...(cfg.scopes ? { scopes: cfg.scopes } : {}) };
+    let idJag: string;
+    try {
+      idJag = await requestIdJag(oidc.tokenEndpoint, { subjectToken: grant.refreshToken, audience: cfg.audience, ...legParams }, await xaaClient(cfg, "idp"), doFetch);
+    } catch (e) {
+      const code = oauthErrorOf(e);
+      if (code === "invalid_grant") throw new OeOauthNeedsReconsentError(providerRef, subject, "the identity-provider sign-in is no longer valid (invalid_grant)");
+      if (code !== undefined && XAA_IDP_REFUSALS.has(code)) throw new OeOauthAccessRemovedError(providerRef, subject, "idp", code);
+      throw e;
+    }
+    let tok: OAuthTokenResponse;
+    try {
+      tok = await jwtBearerGrant(cfg.resourceTokenEndpoint, { assertion: idJag, ...legParams }, await xaaClient(cfg, "app"), doFetch);
+    } catch (e) {
+      const code = oauthErrorOf(e);
+      if (code !== undefined && XAA_APP_REFUSALS.has(code)) throw new OeOauthAccessRemovedError(providerRef, subject, "app", code);
+      throw e;
+    }
+    const { refresh_token: _ignored, ...withoutRefresh } = tok;
+    return (await storeToken(providerRef, subject, withoutRefresh)).accessToken;
+  }
+
+  /**
+   * Read-or-mint an `xaa` connection's app token. A cached token serves until its expiry (less the skew), so a
+   * person costs ONE mint per token lifetime — the IdP caps ID-JAGs per person per app per month. The CROSS-PROCESS
+   * claim sits on the person's IdP GRANT row (it always exists here; the app-token row may not yet), and a loser
+   * polls for the winner's token or for the claim to come free, bounded like the refresh path.
+   */
+  async function xaaAccessTokenFor(cfg: OeOauthXaaProviderConfig, providerRef: string, subject: OeOauthSubject): Promise<string> {
+    requireXaaPerson(providerRef, subject);
+    const ref = tokRef(providerRef, subject);
+    const fast = await readJson<TokenRecord>(ref);
+    if (fast && !isExpired(fast)) return fast.accessToken;
+    const gRef = idpRef(cfg, subject);
+    return vault.withLock(ref, async () => {
+      const deadline = now() + LOSER_WAIT_BUDGET_MS;
+      for (;;) {
+        const rec = await readJson<TokenRecord>(ref);
+        if (rec && !isExpired(rec)) return rec.accessToken;
+        const grant = await readJson<IdpGrantRecord>(gRef);
+        if (!grant) throw new OeOauthNeedsConsentError(providerRef, subject);
+        const claimId = newClaimId();
+        if (await vault.claim(gRef, claimId, now(), CLAIM_LEASE_TTL_MS)) {
+          try {
+            // Another process may have minted and released between our read and our claim: adopt its token.
+            const won = await readJson<TokenRecord>(ref);
+            if (won && !isExpired(won)) return won.accessToken;
+            // 🔴 RE-CHECK THE BINDING AT EACH MINT, not only at sign-in. An operator who revokes the `okta` link or
+            // suspends the set must stop the minting at once; the stored grant alone would keep minting until the
+            // IdP refresh token dies. The check runs per MINT (once per token lifetime), never per cached read.
+            const still = await bindIdentity({ principalSubject: subject.id, signerSubject: grant.idpSubject, connection: providerRef, stage: "mint" });
+            // An UNREADABLE link plane says nothing about the person: refuse this mint, keep the grant, and let a
+            // retry succeed. Only a definite refusal (the link is gone) deletes the grant.
+            if (!still.ok && still.unreadable) {
+              throw new Error(`connection "${providerRef}": the identity-link plane could not be read, so the Okta grant could not be re-checked — retry.`);
+            }
+            if (!still.ok) {
+              await vault.delete(gRef);
+              throw new OeOauthNeedsConsentError(providerRef, subject);
+            }
+            return await xaaMint(cfg, providerRef, subject, grant);
+          } finally {
+            await vault.releaseClaim(gRef, claimId);
+          }
+        }
+        if (now() >= deadline) throw new OeOauthRefreshContendedError(providerRef, subject);
+        await sleep(LOSER_POLL_MS);
+      }
+    });
+  }
+
+  /** Purge a person's IdP grant: revoke the IdP refresh token at the IdP (best-effort), then delete the row. */
+  async function forgetIdpGrant(cfg: OeOauthXaaProviderConfig, subject: OeOauthSubject): Promise<boolean> {
+    const gRef = idpRef(cfg, subject);
+    return vault.withLock(gRef, async () => {
+      const grant = await readJson<IdpGrantRecord>(gRef);
+      if (grant) {
+        try {
+          const oidc = await oidcFor(cfg);
+          if (oidc.revocationEndpoint) {
+            await revokeTokenConfidential(oidc.revocationEndpoint, { token: grant.refreshToken, tokenTypeHint: "refresh_token" }, await xaaClient(cfg, "idp"), doFetch);
+          }
+        } catch (e) {
+          console.warn(`[oe-oauth] IdP revocation failed for "${cfg.ref}" (purging locally anyway): ${e instanceof Error ? e.message : String(e)}`);
+        }
+      }
+      return vault.delete(gRef);
+    });
+  }
+
   /**
    * Exchange the callback's `code` against ONE pending row, in the dialect that row was minted in.
    * 🔴 The row's stamp and the live config must AGREE: a disagreement is REFUSED rather than resolved.
@@ -333,6 +629,9 @@ export function makeOeOauthTokenVault(source: OeOauthProviderSource, deps: OeOau
     // mode existed, and it must not start failing on a config-absent ref now. The drift check below
     // therefore runs only when there IS a config to compare against.
     const cfg = providersNow().get(pending.providerRef);
+    if (cfg !== undefined && isXaa(cfg)) {
+      throw new Error(`connection "${pending.providerRef}": this authorization started under another dialect, but the provider config now declares "${OE_OAUTH_MODE_XAA}" — start again.`);
+    }
     const startedStatic = pending.mode === OE_OAUTH_MODE_STATIC;
     if (cfg !== undefined && isStaticConfidential(cfg) !== startedStatic) {
       throw new Error(
@@ -469,7 +768,39 @@ export function makeOeOauthTokenVault(source: OeOauthProviderSource, deps: OeOau
           lastError = e;
         }
       }
-      if (failures > 0 && purged === 0 && failures === all.size) throw lastError;
+      // (OPE-2453) A person's IdP grant is shared by every `xaa` connection naming one IdP client, so it is purged
+      // once per IdP client, after the per-connection rows. It is the credential that mints all of them.
+      const seenIdp = new Set<string>();
+      for (const cfg of all.values()) {
+        if (!isXaa(cfg) || seenIdp.has(idpKey(cfg))) continue;
+        seenIdp.add(idpKey(cfg));
+        try {
+          if (await forgetIdpGrant(cfg, subject)) purged++;
+        } catch (e) {
+          failures++;
+          lastError = e;
+        }
+      }
+      // An IdP grant whose declaration is GONE is still a live IdP refresh token at rest. With no config there is no
+      // client to revoke it with, so it is deleted locally and the gap is said out loud.
+      // The ref is `oe-oauth:xaa-idp:<32 hex>:<subject key>`; the subject key is matched EXACTLY, never by suffix.
+      const covered = new Set([...all.values()].filter(isXaa).map((cfg) => idpRef(cfg, subject)));
+      const orphanRef = /^oe-oauth:xaa-idp:[0-9a-f]{32}:(.*)$/u;
+      let orphanFailed = false;
+      try {
+        for (const ref of await vault.listRefs("oe-oauth:xaa-idp:")) {
+          if (orphanRef.exec(ref)?.[1] !== subjectKey(subject) || covered.has(ref)) continue;
+          console.warn(`[oe-oauth] an IdP grant with no declared xaa connection was deleted locally — it could not be revoked at the IdP.`);
+          if (await vault.delete(ref)) purged++;
+        }
+      } catch (e) {
+        failures++;
+        lastError = e;
+        orphanFailed = true;
+      }
+      // "Every purge attempt failed" counts only the attempts that ran: the orphan sweep is one attempt only when
+      // it failed. Counting it always would let a purge where every provider failed return 0 with no error.
+      if (failures > 0 && purged === 0 && failures === all.size + seenIdp.size + (orphanFailed ? 1 : 0)) throw lastError;
       return purged;
     },
 
@@ -480,7 +811,11 @@ export function makeOeOauthTokenVault(source: OeOauthProviderSource, deps: OeOau
      * counts as absent (mirrors the mint's readJson semantics — fail toward re-consent, never crash).
      */
     async hasToken(providerRef: string, subject: OeOauthSubject): Promise<boolean> {
-      return (await readJson<TokenRecord>(tokRef(providerRef, subject))) !== null;
+      if ((await readJson<TokenRecord>(tokRef(providerRef, subject))) !== null) return true;
+      // (OPE-2453) For an `xaa` connection the person's GRANT is their IdP sign-in: with it, the next mint
+      // succeeds with no consent screen, even for an app this person has never used.
+      const cfg = providersNow().get(providerRef);
+      return cfg !== undefined && isXaa(cfg) && (await readJson<IdpGrantRecord>(idpRef(cfg, subject))) !== null;
     },
 
     /**
@@ -492,6 +827,16 @@ export function makeOeOauthTokenVault(source: OeOauthProviderSource, deps: OeOau
       subject: OeOauthSubject,
       options: { readonly expiresInMs?: number; readonly consent?: unknown },
     ): Promise<{ url: string }> {
+      const xaaCfg = providersNow().get(providerRef);
+      if (xaaCfg !== undefined && isXaa(xaaCfg)) {
+        const out = await xaaStartAuthorization(xaaCfg, subject, options);
+        try {
+          await sweepExpiredPending();
+        } catch (e) {
+          console.warn(`[oe-oauth] the expired-pending sweep failed (the authorization URL is unaffected): ${e instanceof Error ? e.message : String(e)}`);
+        }
+        return out;
+      }
       const client = await ensureClient(providerRef);
       const redirectUri = redirectUriOf();
       if (!redirectUri) throw new Error(`connection "${providerRef}": OE_PUBLIC_BASE_URL is unset — cannot build a redirect_uri.`);
@@ -552,6 +897,10 @@ export function makeOeOauthTokenVault(source: OeOauthProviderSource, deps: OeOau
       if (!pending) throw new Error("unknown or expired authorization state");
       if (pending.consumed) throw new Error("authorization state already used");
       if (now() > pending.expiresAt) throw new Error("authorization state expired");
+      if (pending.mode === OE_OAUTH_MODE_XAA) {
+        const { rebound } = await xaaCompleteAuthorization(state, pending, code);
+        return { providerRef: pending.providerRef, subject: pending.subject, rebound, ...(pending.consent ? { consent: pending.consent } : {}) };
+      }
       const tok = await exchangeForPending(pending, code);
       // 🔴 READ BEFORE THE WRITE. `storeToken` writes the row unconditionally (last-write-wins), so the
       // only moment the REBIND is observable is here, before it. A second admin replacing the app row
@@ -586,6 +935,8 @@ export function makeOeOauthTokenVault(source: OeOauthProviderSource, deps: OeOau
      * single-flight runs — an in-process mutex, then a cross-process row CLAIM that elects ONE refresher.
      */
     async accessTokenFor(providerRef: string, subject: OeOauthSubject): Promise<string> {
+      const xaaCfg = providersNow().get(providerRef);
+      if (xaaCfg !== undefined && isXaa(xaaCfg)) return xaaAccessTokenFor(xaaCfg, providerRef, subject);
       const ref = tokRef(providerRef, subject);
       const fast = await readJson<TokenRecord>(ref);
       if (!fast) throw new OeOauthNeedsConsentError(providerRef, subject);

package/dist/agent/directory/okta.d.ts

@@ -8,7 +8,17 @@ export interface OktaDirectoryDeps {
     readonly fetch?: FetchLike;
     /** Resolve the API token. Default: core's broker seam — see config.ts's header. */
     readonly resolveToken?: (broker: string, ref: string) => Promise<string>;
+    /** Does a connection sign people in through THIS Okta org for Cross App Access? Default: a declared `xaa`
+     *  sign-in whose `idpIssuer` has this org's origin. See {@link xaaNamesOrg}. */
+    readonly proposeOwnAccount?: () => boolean;
 }
+/**
+ * (OPE-2453) True when a declared `xaa` sign-in names this Okta org as its IdP. Only then does the arm propose each
+ * person's OWN Okta account (`okta`, the Okta user id) beside the app accounts: the Cross App Access completion
+ * admits a sign-in only for a confirmed `okta` account, and nothing else writes one. With no `xaa` declaration
+ * the arm proposes exactly what it did before, so a deployment that does not use Cross App Access sees no change.
+ */
+export declare function xaaNamesOrg(orgUrl: string, declared?: ReadonlyMap<string, unknown>): boolean;
 /**
  * The `rel="next"` URL from the RFC-5988 `Link` header. Okta paginates with an opaque cursor and no total
  * count, so following the header is the ONLY correct way to page — an offset would truncate or duplicate.

package/dist/agent/directory/okta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"okta.d.ts","sourceRoot":"","sources":["../../../agent/directory/okta.ts"],"names":[],"mappings":"AAGA,OAAO,EAA6D,KAAK,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/I,OAAO,KAAK,EAAkB,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvE,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAoDrC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1E;AAUD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAO9E;AAED,2GAA2G;AAC3G,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CA8HpF"}
+{"version":3,"file":"okta.d.ts","sourceRoot":"","sources":["../../../agent/directory/okta.ts"],"names":[],"mappings":"AAGA,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAkB,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvE,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAoDrC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE;oFACgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC;CAC5C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAA+B,GAAG,OAAO,CAiBzH;AAUD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAO9E;AAED,2GAA2G;AAC3G,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAkIpF"}

package/dist/agent/directory/okta.js

@@ -1,6 +1,6 @@
 // THE OKTA DIRECTORY ADAPTER — everything it returns is a PROPOSAL, and nothing here confirms a link. The
 // grade follows the field: `externalId` is attested (the SCIM write-back), `credentials.userName` asserted.
-import { getSecretVia } from "@open-everywhere/core/agent/adapter-api.js";
+import { declaredConnectionSignIns, getSecretVia, OKTA_LINK_PLATFORM, } from "@open-everywhere/core/agent/adapter-api.js";
 /** Okta user statuses that mean "this person is deactivated". Everything else (ACTIVE, PROVISIONED,
  *  STAGED, RECOVERY, LOCKED_OUT, PASSWORD_EXPIRED) is a live human with an access problem, not a
  *  departed one — and treating a locked-out person as deprovisioned would suspend their identity
@@ -13,6 +13,34 @@ const APP_PAGE_LIMIT = 500;
 /** A hard cap on pages followed per resource — a runaway `Link: rel="next"` loop (a proxy rewriting
  *  the header, a vendor bug) must not spin forever inside a scheduled tick. 200 pages ≈ 40k users. */
 const MAX_PAGES = 200;
+/**
+ * (OPE-2453) True when a declared `xaa` sign-in names this Okta org as its IdP. Only then does the arm propose each
+ * person's OWN Okta account (`okta`, the Okta user id) beside the app accounts: the Cross App Access completion
+ * admits a sign-in only for a confirmed `okta` account, and nothing else writes one. With no `xaa` declaration
+ * the arm proposes exactly what it did before, so a deployment that does not use Cross App Access sees no change.
+ */
+export function xaaNamesOrg(orgUrl, declared = declaredConnectionSignIns()) {
+    let origin;
+    try {
+        origin = new URL(orgUrl).origin;
+    }
+    catch {
+        return false;
+    }
+    for (const v of declared.values()) {
+        const rec = v;
+        if (rec.mode !== "xaa" || typeof rec.idpIssuer !== "string")
+            continue;
+        try {
+            if (new URL(rec.idpIssuer).origin === origin)
+                return true;
+        }
+        catch {
+            continue;
+        }
+    }
+    return false;
+}
 /** The display name to show a human, from whichever profile fields Okta actually filled in. DISPLAY
  *  ONLY — link-store.ts invariant 4 means it can never become a lookup key, here or downstream. */
 function displayNameOf(user) {
@@ -39,6 +67,7 @@ export function makeOktaDirectoryProvider(deps) {
     const { config } = deps;
     const fetchImpl = deps.fetch ?? fetch;
     const resolveToken = deps.resolveToken ?? ((broker, ref) => getSecretVia(broker, ref));
+    const proposeOwnAccount = deps.proposeOwnAccount ?? (() => xaaNamesOrg(config.orgUrl));
     // The operator's OWN Okta origin — the ONLY origin the SSWS token may ever be sent to. Computed
     // once; every request in getAll (the first AND every `Link: rel="next"` hop) is checked against it.
     const orgOrigin = new URL(config.orgUrl).origin;
@@ -148,6 +177,8 @@ export function makeOktaDirectoryProvider(deps) {
             const users = await getAll(`/api/v1/users?limit=${PAGE_LIMIT}`, token);
             const groups = await groupsByUser(token);
             const accounts = await accountsByUser(token);
+            // Read once per sync, like the token: a declaration change takes effect at the next tick.
+            const ownAccount = proposeOwnAccount();
             const people = [];
             for (const user of users) {
                 if (!user.id)
@@ -157,7 +188,8 @@ export function makeOktaDirectoryProvider(deps) {
                     externalId: user.id,
                     displayName: displayNameOf(user),
                     ...(email ? { email } : {}),
-                    accounts: accounts.get(user.id) ?? [],
+                    // The Okta user id IS Okta's own answer for its own account, so the grade is "attested".
+                    accounts: ownAccount ? [...(accounts.get(user.id) ?? []), { platform: OKTA_LINK_PLATFORM, nativeId: user.id, grade: "attested" }] : (accounts.get(user.id) ?? []),
                     groups: (groups.get(user.id) ?? []).slice().sort(),
                     deprovisioned: DEPROVISIONED_STATUSES.has((user.status ?? "").toUpperCase()),
                 });

package/dist/agent/directory/okta.js.map

@@ -1 +1 @@
-{"version":3,"file":"okta.js","sourceRoot":"","sources":["../../../agent/directory/okta.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,4GAA4G;AAE5G,OAAO,EAAE,YAAY,EAAuE,MAAM,4CAA4C,CAAC;AAM/I;;;+CAG+C;AAC/C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AAEvE;wEACwE;AACxE,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;sGACsG;AACtG,MAAM,SAAS,GAAG,GAAG,CAAC;AA6CtB;mGACmG;AACnG,SAAS,aAAa,CAAC,IAAc;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;AACrG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAiC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,yBAAyB,CAAC,IAAuB;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,MAAc,EAAE,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAEvG,gGAAgG;IAChG,oGAAoG;IACpG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAEhD,sGAAsG;IACtG,KAAK,UAAU,MAAM,CAAI,IAAY,EAAE,KAAa;QAClD,IAAI,GAAG,GAAuB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACzF,MAAM,GAAG,GAAQ,EAAE,CAAC;QACpB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YACnD,6GAA6G;YAC7G,0FAA0F;YAC1F,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,SAAS,MAAM,SAAS,2CAA2C,SAAS,GAAG,CAAC,CAAC;YACrJ,CAAC;YACD,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,KAAK;oBACb,oFAAoF;oBACpF,sFAAsF;oBACtF,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sFAAsF;gBACtF,yCAAyC;gBACzC,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;oBAC7C,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3E,CAAC;gBAAC,MAAM,CAAC;oBACP,gEAAgE;gBAClE,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAI,IAAY,CAAC,CAAC;YACpD,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,YAAY,CAAC,KAAa;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAY,wBAAwB,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI;gBAAE,SAAS;YACjC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAW,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1H,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,SAAS;gBACpB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+EAA+E;IAC/E,KAAK,UAAU,cAAc,CAAC,KAAa;QACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAc,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;YACpI,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,SAAS;gBACpB,0FAA0F;gBAC1F,oFAAoF;gBACpF,oEAAoE;gBACpE,IAAI,CAAC,CAAC,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;oBAAE,SAAS;gBAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACpC,8GAA8G;gBAC9G,uGAAuG;gBACvG,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC1J,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,GAAG;QAC/B,KAAK,CAAC,UAAU;YACd,2FAA2F;YAC3F,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAW,uBAAuB,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAE7C,MAAM,MAAM,GAAsB,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,SAAS;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC;oBACV,UAAU,EAAE,IAAI,CAAC,EAAE;oBACnB,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC;oBAChC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;oBACrC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE;oBAClD,aAAa,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;iBAC7E,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,UAAuB,EAAE,GAAmB;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChG,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC"}
+{"version":3,"file":"okta.js","sourceRoot":"","sources":["../../../agent/directory/okta.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,4GAA4G;AAE5G,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,kBAAkB,GAInB,MAAM,4CAA4C,CAAC;AAMpD;;;+CAG+C;AAC/C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AAEvE;wEACwE;AACxE,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;sGACsG;AACtG,MAAM,SAAS,GAAG,GAAG,CAAC;AAgDtB;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,QAAQ,GAAiC,yBAAyB,EAAE;IAC9G,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,CAA4C,CAAC;QACzD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;YAAE,SAAS;QACtE,IAAI,CAAC;YACH,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;mGACmG;AACnG,SAAS,aAAa,CAAC,IAAc;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC;AACrG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAiC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,yBAAyB,CAAC,IAAuB;IAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,MAAc,EAAE,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACvG,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvF,gGAAgG;IAChG,oGAAoG;IACpG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAEhD,sGAAsG;IACtG,KAAK,UAAU,MAAM,CAAI,IAAY,EAAE,KAAa;QAClD,IAAI,GAAG,GAAuB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACzF,MAAM,GAAG,GAAQ,EAAE,CAAC;QACpB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YACnD,6GAA6G;YAC7G,0FAA0F;YAC1F,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,SAAS,MAAM,SAAS,2CAA2C,SAAS,GAAG,CAAC,CAAC;YACrJ,CAAC;YACD,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,KAAK;oBACb,oFAAoF;oBACpF,sFAAsF;oBACtF,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sFAAsF;gBACtF,yCAAyC;gBACzC,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;oBAC7C,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3E,CAAC;gBAAC,MAAM,CAAC;oBACP,gEAAgE;gBAClE,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAI,IAAY,CAAC,CAAC;YACpD,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,YAAY,CAAC,KAAa;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAY,wBAAwB,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI;gBAAE,SAAS;YACjC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAW,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1H,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,SAAS;gBACpB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+EAA+E;IAC/E,KAAK,UAAU,cAAc,CAAC,KAAa;QACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAc,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;YACpI,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,SAAS;gBACpB,0FAA0F;gBAC1F,oFAAoF;gBACpF,oEAAoE;gBACpE,IAAI,CAAC,CAAC,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;oBAAE,SAAS;gBAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBACpC,8GAA8G;gBAC9G,uGAAuG;gBACvG,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC1J,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,GAAG;QAC/B,KAAK,CAAC,UAAU;YACd,2FAA2F;YAC3F,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAW,uBAAuB,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC7C,0FAA0F;YAC1F,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;YAEvC,MAAM,MAAM,GAAsB,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,SAAS;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC;oBACV,UAAU,EAAE,IAAI,CAAC,EAAE;oBACnB,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC;oBAChC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,yFAAyF;oBACzF,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBACjK,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE;oBAClD,aAAa,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;iBAC7E,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,UAAuB,EAAE,GAAmB;IAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChG,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC"}

package/dist/agent/oe-oauth/config.d.ts

@@ -2,6 +2,8 @@
 export declare const OE_OAUTH_MODE_DISCOVERY = "discovery-dcr-pkce";
 /** The static confidential-client dialect (OPE-1086) — no discovery, no registration, HTTP Basic. */
 export declare const OE_OAUTH_MODE_STATIC = "static-confidential";
+/** The Cross App Access dialect (OPE-2453) — an IdP sign-in once, then an ID-JAG mint per app token. */
+export declare const OE_OAUTH_MODE_XAA = "xaa";
 /** How a static provider encodes its token-request body. Declared, never inferred: Notion's REST
  *  token endpoint takes JSON, the RFC 6749 default is form-encoded, and sending the wrong one reads
  *  as an authentication failure rather than as a shape error. */
@@ -50,8 +52,32 @@ export interface OeOauthStaticProviderConfig extends OeOauthProviderConfigBase {
     /** How the token-request body is encoded. */
     readonly bodyEncoding: OeOauthBodyEncoding;
 }
-/** One provider's OAuth target, in one of the two declared modes. */
-export type OeOauthProviderConfig = OeOauthDiscoveryProviderConfig | OeOauthStaticProviderConfig;
+/**
+ * A Cross App Access provider (OPE-2453). The person signs in to the IdP (`idpIssuer`) once; each mint then trades
+ * the person's IdP refresh token for an ID-JAG (RFC 8693, at the IdP) and the ID-JAG for the app's access token
+ * (RFC 7523, at `resourceTokenEndpoint`). Two confidential clients, two secret REFS, no literal secret.
+ */
+export interface OeOauthXaaProviderConfig extends OeOauthProviderConfigBase {
+    readonly mode: typeof OE_OAUTH_MODE_XAA;
+    /** The IdP's OIDC issuer. Its `/.well-known/openid-configuration` names the authorize, token, JWKS and
+     *  revocation endpoints. HTTPS only. */
+    readonly idpIssuer: string;
+    readonly idpClientId: string;
+    readonly idpClientSecretRef: string;
+    readonly idpClientSecretBroker: string;
+    /** The app's authorization server issuer — the ID-JAG `audience`. */
+    readonly audience: string;
+    /** The RFC 8707 resource both legs name, when the app asks for one. */
+    readonly resource?: string;
+    readonly resourceTokenEndpoint: string;
+    readonly resourceClientId: string;
+    readonly resourceClientSecretRef: string;
+    readonly resourceClientSecretBroker: string;
+}
+/** One provider's OAuth target, in one of the three declared modes. */
+export type OeOauthProviderConfig = OeOauthDiscoveryProviderConfig | OeOauthStaticProviderConfig | OeOauthXaaProviderConfig;
+/** Narrow a provider config to the Cross App Access mode. Reads the DECLARED `mode` only. */
+export declare function isXaa(cfg: OeOauthProviderConfig): cfg is OeOauthXaaProviderConfig;
 /** Narrow a provider config to the static confidential-client mode. Reads the DECLARED `mode` and
  *  nothing else — never the presence of a field. */
 export declare function isStaticConfidential(cfg: OeOauthProviderConfig): cfg is OeOauthStaticProviderConfig;