@plumbus/core 0.1.0

package/dist/auth/saml-adapter.js

@@ -0,0 +1,209 @@
+import { createPublicKey, createVerify } from 'node:crypto';
+const defaultAttributeMapping = {
+    userId: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier',
+    email: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
+    roles: 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role',
+    tenantId: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/tenantid',
+    displayName: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name',
+};
+/**
+ * SAML 2.0 auth adapter. Two modes of operation:
+ *
+ * 1. `authenticate(header)` — extracts a Bearer token containing a
+ *    base64-encoded SAML assertion (used for API calls after SSO login).
+ *
+ * 2. `processSamlResponse(samlResponse)` — directly validates a SAML
+ *    Response from the IdP (used in SSO callback handlers).
+ */
+export function createSamlAdapter(config) {
+    const mapping = { ...defaultAttributeMapping, ...config.attributeMapping };
+    function parseAssertion(xml) {
+        // Extract Issuer
+        const issuerMatch = xml.match(/<(?:saml2?:)?Issuer[^>]*>([^<]+)<\//);
+        if (!issuerMatch?.[1] || issuerMatch[1] !== config.issuer) {
+            return null;
+        }
+        // Validate signature
+        if (!validateSignature(xml, config.idpCertificate)) {
+            return null;
+        }
+        // Check Conditions (audience + time)
+        if (!validateConditions(xml, config.audience)) {
+            return null;
+        }
+        // Extract NameID
+        const nameIdMatch = xml.match(/<(?:saml2?:)?NameID[^>]*>([^<]+)<\//);
+        const nameId = nameIdMatch?.[1] ?? '';
+        // Extract attributes
+        const attributes = extractAttributes(xml);
+        // Map to AuthContext
+        const userIdValues = attributes[mapping.userId] ?? [];
+        const userId = userIdValues[0] ?? nameId;
+        const roleValues = attributes[mapping.roles] ?? [];
+        const tenantValues = attributes[mapping.tenantId] ?? [];
+        return {
+            userId,
+            roles: roleValues,
+            scopes: [],
+            tenantId: tenantValues[0],
+            provider: 'saml',
+            authenticatedAt: new Date(),
+            nameId,
+            attributes,
+        };
+    }
+    return {
+        async authenticate(authorizationHeader) {
+            if (!authorizationHeader)
+                return null;
+            if (!authorizationHeader.startsWith('Bearer '))
+                return null;
+            const encoded = authorizationHeader.slice(7);
+            let xml;
+            try {
+                xml = Buffer.from(encoded, 'base64').toString('utf-8');
+            }
+            catch {
+                return null;
+            }
+            if (!xml.includes('saml') && !xml.includes('Assertion')) {
+                return null;
+            }
+            return parseAssertion(xml);
+        },
+        processSamlResponse(samlResponseB64) {
+            let xml;
+            try {
+                xml = Buffer.from(samlResponseB64, 'base64').toString('utf-8');
+            }
+            catch {
+                return null;
+            }
+            return parseAssertion(xml);
+        },
+    };
+}
+// ── XML Signature Validation ──
+function validateSignature(xml, certPem) {
+    // Extract SignatureValue
+    const sigValueMatch = xml.match(/<(?:ds:)?SignatureValue[^>]*>\s*([A-Za-z0-9+/=\s]+?)\s*<\//);
+    if (!sigValueMatch?.[1])
+        return false;
+    const signatureB64 = sigValueMatch[1].replace(/\s/g, '');
+    // Extract SignedInfo element for verification
+    const signedInfoMatch = xml.match(/<(?:ds:)?SignedInfo[\s\S]*?<\/(?:ds:)?SignedInfo>/);
+    if (!signedInfoMatch?.[0])
+        return false;
+    // Canonicalize SignedInfo (exclusive C14N — normalize namespace, whitespace)
+    const signedInfo = canonicalizeSignedInfo(signedInfoMatch[0], xml);
+    // Extract signature algorithm (specifically from SignatureMethod, not CanonicalizationMethod)
+    const algMatch = signedInfo.match(/SignatureMethod\s+Algorithm="([^"]+)"/);
+    const sigAlg = algMatch?.[1] ?? '';
+    let nodeAlg;
+    if (sigAlg.includes('rsa-sha256') || sigAlg.includes('RSA-SHA256')) {
+        nodeAlg = 'RSA-SHA256';
+    }
+    else if (sigAlg.includes('rsa-sha1') || sigAlg.includes('RSA-SHA1')) {
+        nodeAlg = 'RSA-SHA1';
+    }
+    else {
+        return false; // Unsupported algorithm
+    }
+    try {
+        const cert = normalizeCertificate(certPem);
+        const publicKey = createPublicKey(cert);
+        const verifier = createVerify(nodeAlg);
+        verifier.update(signedInfo);
+        return verifier.verify(publicKey, signatureB64, 'base64');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Minimal exclusive C14N for SignedInfo.
+ * Resolves the default SAML namespace prefix propagation needed for
+ * enveloped signature verification.
+ */
+function canonicalizeSignedInfo(signedInfo, fullXml) {
+    let result = signedInfo;
+    // If SignedInfo uses namespace prefixes defined in ancestor elements,
+    // we need to include those namespace declarations
+    if (!result.includes('xmlns:ds') && fullXml.includes('xmlns:ds')) {
+        const dsNsMatch = fullXml.match(/xmlns:ds="([^"]+)"/);
+        if (dsNsMatch) {
+            result = result.replace(/<(?:ds:)?SignedInfo/, `<ds:SignedInfo xmlns:ds="${dsNsMatch[1]}"`);
+        }
+    }
+    // Normalize self-closing tags
+    result = result.replace(/<([^/][^>]*)\s*\/>/g, '<$1></$1>');
+    return result;
+}
+function normalizeCertificate(cert) {
+    // If it already has PEM headers, return as-is
+    if (cert.includes('-----BEGIN'))
+        return cert;
+    // Strip whitespace and wrap in PEM
+    const clean = cert.replace(/\s/g, '');
+    const lines = clean.match(/.{1,64}/g) ?? [];
+    return `-----BEGIN CERTIFICATE-----\n${lines.join('\n')}\n-----END CERTIFICATE-----`;
+}
+// ── Conditions Validation ──
+function validateConditions(xml, audience) {
+    const conditionsMatch = xml.match(/<(?:saml2?:)?Conditions([^>]*)>/);
+    if (!conditionsMatch)
+        return true; // No conditions = valid
+    const attrs = conditionsMatch[1] ?? '';
+    // Check NotBefore
+    const notBeforeMatch = attrs.match(/NotBefore="([^"]+)"/);
+    if (notBeforeMatch?.[1]) {
+        const notBefore = new Date(notBeforeMatch[1]).getTime();
+        // Allow 5 minutes clock skew
+        if (Date.now() < notBefore - 5 * 60 * 1000)
+            return false;
+    }
+    // Check NotOnOrAfter
+    const notOnOrAfterMatch = attrs.match(/NotOnOrAfter="([^"]+)"/);
+    if (notOnOrAfterMatch?.[1]) {
+        const notOnOrAfter = new Date(notOnOrAfterMatch[1]).getTime();
+        // Allow 5 minutes clock skew
+        if (Date.now() >= notOnOrAfter + 5 * 60 * 1000)
+            return false;
+    }
+    // Check AudienceRestriction
+    const audienceMatch = xml.match(/<(?:saml2?:)?AudienceRestriction>[\s\S]*?<(?:saml2?:)?Audience>([^<]+)<\//);
+    if (audienceMatch?.[1] && audienceMatch[1] !== audience) {
+        return false;
+    }
+    return true;
+}
+// ── Attribute Extraction ──
+function extractAttributes(xml) {
+    const attributes = {};
+    // Match all Attribute elements
+    const attrRegex = /<(?:saml2?:)?Attribute\s+Name="([^"]+)"[^>]*>([\s\S]*?)<\/(?:saml2?:)?Attribute>/g;
+    let match;
+    while (true) {
+        match = attrRegex.exec(xml);
+        if (!match)
+            break;
+        const name = match[1];
+        const body = match[2];
+        if (!name || !body)
+            continue;
+        const values = [];
+        const valueRegex = /<(?:saml2?:)?AttributeValue[^>]*>([^<]*)<\//g;
+        let valueMatch;
+        while (true) {
+            valueMatch = valueRegex.exec(body);
+            if (!valueMatch)
+                break;
+            if (valueMatch[1] !== undefined) {
+                values.push(valueMatch[1]);
+            }
+        }
+        attributes[name] = values;
+    }
+    return attributes;
+}
+//# sourceMappingURL=saml-adapter.js.map

package/dist/auth/saml-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-adapter.js","sourceRoot":"","sources":["../../src/auth/saml-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAmC5D,MAAM,uBAAuB,GAAyB;IACpD,MAAM,EAAE,sEAAsE;IAC9E,KAAK,EAAE,oEAAoE;IAC3E,KAAK,EAAE,8DAA8D;IACrE,QAAQ,EAAE,gEAAgE;IAC1E,WAAW,EAAE,4DAA4D;CAC1E,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAyB;IAEzB,MAAM,OAAO,GAAG,EAAE,GAAG,uBAAuB,EAAE,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAE3E,SAAS,cAAc,CAAC,GAAW;QACjC,iBAAiB;QACjB,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iBAAiB;QACjB,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEtC,qBAAqB;QACrB,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAE1C,qBAAqB;QACrB,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;QAEzC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAExD,OAAO;YACL,MAAM;YACN,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;YACzB,QAAQ,EAAE,MAAM;YAChB,eAAe,EAAE,IAAI,IAAI,EAAE;YAC3B,MAAM;YACN,UAAU;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,mBAAuC;YACxD,IAAI,CAAC,mBAAmB;gBAAE,OAAO,IAAI,CAAC;YAEtC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5D,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAE7C,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,mBAAmB,CAAC,eAAuB;YACzC,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iCAAiC;AAEjC,SAAS,iBAAiB,CAAC,GAAW,EAAE,OAAe;IACrD,yBAAyB;IACzB,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC9F,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEzD,8CAA8C;IAC9C,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvF,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAExC,6EAA6E;IAC7E,MAAM,UAAU,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEnE,8FAA8F;IAC9F,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEnC,IAAI,OAAe,CAAC;IACpB,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,OAAO,GAAG,YAAY,CAAC;IACzB,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,GAAG,UAAU,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,OAAO,KAAK,CAAC,CAAC,wBAAwB;IACxC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,UAAkB,EAAE,OAAe;IACjE,IAAI,MAAM,GAAG,UAAU,CAAC;IAExB,sEAAsE;IACtE,kDAAkD;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,4BAA4B,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IAE5D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,8CAA8C;IAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,mCAAmC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;AACvF,CAAC;AAED,8BAA8B;AAE9B,SAAS,kBAAkB,CAAC,GAAW,EAAE,QAAgB;IACvD,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrE,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAE3D,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvC,kBAAkB;IAClB,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC1D,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,6BAA6B;QAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IAC3D,CAAC;IAED,qBAAqB;IACrB,MAAM,iBAAiB,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAChE,IAAI,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC9D,6BAA6B;QAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IAC/D,CAAC;IAED,4BAA4B;IAC5B,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAC7B,2EAA2E,CAC5E,CAAC;IACF,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6BAA6B;AAE7B,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,UAAU,GAA6B,EAAE,CAAC;IAEhD,+BAA+B;IAC/B,MAAM,SAAS,GACb,mFAAmF,CAAC;IACtF,IAAI,KAA6B,CAAC;IAElC,OAAO,IAAI,EAAE,CAAC;QACZ,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,MAAM;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,SAAS;QAE7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,8CAA8C,CAAC;QAClE,IAAI,UAAkC,CAAC;QACvC,OAAO,IAAI,EAAE,CAAC;YACZ,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU;gBAAE,MAAM;YACvB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IAC5B,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/auth/scim.d.ts

@@ -0,0 +1,134 @@
+export interface ScimServiceConfig {
+    /** Bearer token for authenticating SCIM requests from the IdP */
+    bearerToken: string;
+    /** Base URL for SCIM resource locations (e.g., https://app.example.com/scim/v2) */
+    baseUrl: string;
+}
+export interface ScimUser {
+    /** Internal user ID (set by the application, not the IdP) */
+    id?: string;
+    /** IdP-assigned external identifier */
+    externalId: string;
+    /** Username (typically email) */
+    userName: string;
+    /** Display name */
+    displayName: string;
+    /** Email addresses */
+    emails: ScimEmail[];
+    /** Active status */
+    active: boolean;
+    /** Group memberships (optional) */
+    groups?: string[];
+}
+export interface ScimEmail {
+    value: string;
+    primary?: boolean;
+    type?: string;
+}
+export interface ScimListResponse {
+    totalResults: number;
+    startIndex: number;
+    itemsPerPage: number;
+    Resources: ScimUserResource[];
+}
+export interface ScimUserResource {
+    schemas: string[];
+    id: string;
+    externalId: string;
+    userName: string;
+    displayName: string;
+    emails: ScimEmail[];
+    active: boolean;
+    groups?: {
+        value: string;
+        display?: string;
+    }[];
+    meta: {
+        resourceType: string;
+        location: string;
+        created?: string;
+        lastModified?: string;
+    };
+}
+export interface ScimError {
+    schemas: string[];
+    status: string;
+    detail: string;
+}
+/**
+ * Repository interface that apps implement to connect SCIM to their data layer.
+ */
+export interface ScimUserRepository {
+    create(user: Omit<ScimUser, 'id'>): Promise<ScimUser & {
+        id: string;
+    }>;
+    findById(id: string): Promise<ScimUser | null>;
+    findByExternalId(externalId: string): Promise<ScimUser | null>;
+    findByUserName(userName: string): Promise<ScimUser | null>;
+    update(id: string, updates: Partial<Omit<ScimUser, 'id'>>): Promise<ScimUser>;
+    deactivate(id: string): Promise<void>;
+    list(startIndex: number, count: number): Promise<{
+        users: ScimUser[];
+        total: number;
+    }>;
+}
+/**
+ * Create a SCIM 2.0 service that handles user provisioning operations.
+ * The service validates the bearer token, processes SCIM requests, and
+ * delegates to the provided repository.
+ */
+export declare function createScimService(config: ScimServiceConfig, repository: ScimUserRepository): {
+    /**
+     * Validate the SCIM bearer token.
+     * Returns true if the request is authorized.
+     */
+    authenticateRequest: (authorizationHeader: string | undefined) => boolean;
+    /**
+     * POST /Users — Create a new user.
+     */
+    createUser(authHeader: string | undefined, body: Record<string, unknown>): Promise<{
+        status: number;
+        body: ScimUserResource | ScimError;
+    }>;
+    /**
+     * GET /Users/:id — Get a user by ID.
+     */
+    getUser(authHeader: string | undefined, id: string): Promise<{
+        status: number;
+        body: ScimUserResource | ScimError;
+    }>;
+    /**
+     * PUT /Users/:id — Replace a user.
+     */
+    replaceUser(authHeader: string | undefined, id: string, body: Record<string, unknown>): Promise<{
+        status: number;
+        body: ScimUserResource | ScimError;
+    }>;
+    /**
+     * PATCH /Users/:id — Update specific user fields.
+     * Supports the standard SCIM PATCH 'replace' operation.
+     */
+    patchUser(authHeader: string | undefined, id: string, body: Record<string, unknown>): Promise<{
+        status: number;
+        body: ScimUserResource | ScimError;
+    }>;
+    /**
+     * DELETE /Users/:id — Deactivate a user.
+     */
+    deleteUser(authHeader: string | undefined, id: string): Promise<{
+        status: number;
+        body?: ScimError;
+    }>;
+    /**
+     * GET /Users — List/search users.
+     */
+    listUsers(authHeader: string | undefined, params: {
+        startIndex?: number;
+        count?: number;
+    }): Promise<{
+        status: number;
+        body: ScimListResponse | ScimError;
+    }>;
+};
+export type ScimService = ReturnType<typeof createScimService>;
+//# sourceMappingURL=scim.d.ts.map

package/dist/auth/scim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.d.ts","sourceRoot":"","sources":["../../src/auth/scim.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,6DAA6D;IAC7D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB;IACtB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,oBAAoB;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,gBAAgB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/C,IAAI,EAAE;QACJ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC/C,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC/D,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9E,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxF;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,kBAAkB;IAoCvF;;;OAGG;+CAtC6C,MAAM,GAAG,SAAS,KAAG,OAAO;IAyC5E;;OAEG;2BAEW,MAAM,GAAG,SAAS,QACxB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAAA;KAAE,CAAC;IAiClE;;OAEG;wBAEW,MAAM,GAAG,SAAS,MAC1B,MAAM,GACT,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAAA;KAAE,CAAC;IAalE;;OAEG;4BAEW,MAAM,GAAG,SAAS,MAC1B,MAAM,QACJ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAAA;KAAE,CAAC;IAqBlE;;;OAGG;0BAEW,MAAM,GAAG,SAAS,MAC1B,MAAM,QACJ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAAA;KAAE,CAAC;IAsDlE;;OAEG;2BAEW,MAAM,GAAG,SAAS,MAC1B,MAAM,GACT,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAchD;;OAEG;0BAEW,MAAM,GAAG,SAAS,UACtB;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAAA;KAAE,CAAC;EAsBrE;AAaD,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/auth/scim.js

@@ -0,0 +1,207 @@
+// ── SCIM 2.0 Service ──
+// Implements the core SCIM 2.0 user provisioning protocol.
+// Apps provide a repository adapter; the framework handles SCIM schema mapping,
+// filtering, and response formatting.
+const SCIM_USER_SCHEMA = 'urn:ietf:params:scim:schemas:core:2.0:User';
+const SCIM_LIST_SCHEMA = 'urn:ietf:params:scim:api:messages:2.0:ListResponse';
+const SCIM_ERROR_SCHEMA = 'urn:ietf:params:scim:api:messages:2.0:Error';
+/**
+ * Create a SCIM 2.0 service that handles user provisioning operations.
+ * The service validates the bearer token, processes SCIM requests, and
+ * delegates to the provided repository.
+ */
+export function createScimService(config, repository) {
+    function authenticateRequest(authorizationHeader) {
+        if (!authorizationHeader)
+            return false;
+        if (!authorizationHeader.startsWith('Bearer '))
+            return false;
+        return authorizationHeader.slice(7) === config.bearerToken;
+    }
+    function toScimResource(user) {
+        return {
+            schemas: [SCIM_USER_SCHEMA],
+            id: user.id ?? '',
+            externalId: user.externalId,
+            userName: user.userName,
+            displayName: user.displayName,
+            emails: user.emails,
+            active: user.active,
+            groups: user.groups?.map((g) => ({ value: g })),
+            meta: {
+                resourceType: 'User',
+                location: `${config.baseUrl}/Users/${user.id ?? ''}`,
+            },
+        };
+    }
+    function scimError(status, detail) {
+        return {
+            status,
+            body: {
+                schemas: [SCIM_ERROR_SCHEMA],
+                status: String(status),
+                detail,
+            },
+        };
+    }
+    return {
+        /**
+         * Validate the SCIM bearer token.
+         * Returns true if the request is authorized.
+         */
+        authenticateRequest,
+        /**
+         * POST /Users — Create a new user.
+         */
+        async createUser(authHeader, body) {
+            if (!authenticateRequest(authHeader)) {
+                return scimError(401, 'Unauthorized');
+            }
+            const externalId = String(body.externalId ?? '');
+            const userName = String(body.userName ?? '');
+            const displayName = String(body.displayName ?? '');
+            const active = body.active !== false;
+            if (!userName) {
+                return scimError(400, 'userName is required');
+            }
+            // Check for duplicate
+            const existing = await repository.findByExternalId(externalId);
+            if (existing) {
+                return scimError(409, 'User already exists');
+            }
+            const emails = parseEmails(body.emails);
+            const user = await repository.create({
+                externalId,
+                userName,
+                displayName: displayName || userName,
+                emails,
+                active,
+            });
+            return { status: 201, body: toScimResource(user) };
+        },
+        /**
+         * GET /Users/:id — Get a user by ID.
+         */
+        async getUser(authHeader, id) {
+            if (!authenticateRequest(authHeader)) {
+                return scimError(401, 'Unauthorized');
+            }
+            const user = await repository.findById(id);
+            if (!user) {
+                return scimError(404, 'User not found');
+            }
+            return { status: 200, body: toScimResource(user) };
+        },
+        /**
+         * PUT /Users/:id — Replace a user.
+         */
+        async replaceUser(authHeader, id, body) {
+            if (!authenticateRequest(authHeader)) {
+                return scimError(401, 'Unauthorized');
+            }
+            const existing = await repository.findById(id);
+            if (!existing) {
+                return scimError(404, 'User not found');
+            }
+            const updated = await repository.update(id, {
+                externalId: String(body.externalId ?? existing.externalId),
+                userName: String(body.userName ?? existing.userName),
+                displayName: String(body.displayName ?? existing.displayName),
+                emails: parseEmails(body.emails) ?? existing.emails,
+                active: body.active !== undefined ? body.active !== false : existing.active,
+            });
+            return { status: 200, body: toScimResource(updated) };
+        },
+        /**
+         * PATCH /Users/:id — Update specific user fields.
+         * Supports the standard SCIM PATCH 'replace' operation.
+         */
+        async patchUser(authHeader, id, body) {
+            if (!authenticateRequest(authHeader)) {
+                return scimError(401, 'Unauthorized');
+            }
+            const existing = await repository.findById(id);
+            if (!existing) {
+                return scimError(404, 'User not found');
+            }
+            const operations = body.Operations;
+            if (!operations || !Array.isArray(operations)) {
+                return scimError(400, 'Operations array is required');
+            }
+            const updates = {};
+            for (const op of operations) {
+                if (op.op !== 'replace')
+                    continue;
+                if (op.path === 'active' ||
+                    (!op.path && typeof op.value === 'object' && op.value !== null && 'active' in op.value)) {
+                    const active = op.path === 'active' ? op.value : op.value.active;
+                    updates.active = active !== false;
+                    // Deactivation
+                    if (updates.active === false) {
+                        await repository.deactivate(id);
+                        const deactivated = await repository.findById(id);
+                        return {
+                            status: 200,
+                            body: toScimResource(deactivated ?? { ...existing, active: false }),
+                        };
+                    }
+                }
+                if (op.path === 'displayName') {
+                    updates.displayName = String(op.value);
+                }
+                if (op.path === 'userName') {
+                    updates.userName = String(op.value);
+                }
+            }
+            const updated = await repository.update(id, updates);
+            return { status: 200, body: toScimResource(updated) };
+        },
+        /**
+         * DELETE /Users/:id — Deactivate a user.
+         */
+        async deleteUser(authHeader, id) {
+            if (!authenticateRequest(authHeader)) {
+                return scimError(401, 'Unauthorized');
+            }
+            const existing = await repository.findById(id);
+            if (!existing) {
+                return scimError(404, 'User not found');
+            }
+            await repository.deactivate(id);
+            return { status: 204 };
+        },
+        /**
+         * GET /Users — List/search users.
+         */
+        async listUsers(authHeader, params) {
+            if (!authenticateRequest(authHeader)) {
+                return scimError(401, 'Unauthorized');
+            }
+            const startIndex = params.startIndex ?? 1;
+            const count = Math.min(params.count ?? 100, 200);
+            const { users, total } = await repository.list(startIndex, count);
+            return {
+                status: 200,
+                body: {
+                    schemas: [SCIM_LIST_SCHEMA],
+                    totalResults: total,
+                    startIndex,
+                    itemsPerPage: users.length,
+                    Resources: users.map(toScimResource),
+                },
+            };
+        },
+    };
+}
+function parseEmails(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw
+        .filter((e) => typeof e === 'object' && e !== null)
+        .map((e) => ({
+        value: String(e.value ?? ''),
+        primary: e.primary === true,
+        type: e.type ? String(e.type) : undefined,
+    }));
+}
+//# sourceMappingURL=scim.js.map

package/dist/auth/scim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.js","sourceRoot":"","sources":["../../src/auth/scim.ts"],"names":[],"mappings":"AAAA,yBAAyB;AACzB,2DAA2D;AAC3D,gFAAgF;AAChF,sCAAsC;AA2EtC,MAAM,gBAAgB,GAAG,4CAA4C,CAAC;AACtE,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,iBAAiB,GAAG,6CAA6C,CAAC;AAExE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB,EAAE,UAA8B;IACzF,SAAS,mBAAmB,CAAC,mBAAuC;QAClE,IAAI,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,WAAW,CAAC;IAC7D,CAAC;IAED,SAAS,cAAc,CAAC,IAAc;QACpC,OAAO;YACL,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,EAAE;gBACJ,YAAY,EAAE,MAAM;gBACpB,QAAQ,EAAE,GAAG,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE;aACrD;SACF,CAAC;IACJ,CAAC;IAED,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc;QAC/C,OAAO;YACL,MAAM;YACN,IAAI,EAAE;gBACJ,OAAO,EAAE,CAAC,iBAAiB,CAAC;gBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,MAAM;aACP;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL;;;WAGG;QACH,mBAAmB;QAEnB;;WAEG;QACH,KAAK,CAAC,UAAU,CACd,UAA8B,EAC9B,IAA6B;YAE7B,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrC,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC;YAErC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAChD,CAAC;YAED,sBAAsB;YACtB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC/D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAExC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;gBACnC,UAAU;gBACV,QAAQ;gBACR,WAAW,EAAE,WAAW,IAAI,QAAQ;gBACpC,MAAM;gBACN,MAAM;aACP,CAAC,CAAC;YAEH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,OAAO,CACX,UAA8B,EAC9B,EAAU;YAEV,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrC,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAC1C,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,WAAW,CACf,UAA8B,EAC9B,EAAU,EACV,IAA6B;YAE7B,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrC,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE;gBAC1C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC;gBAC1D,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;gBACpD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC;gBAC7D,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM;gBACnD,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;aAC5E,CAAC,CAAC;YAEH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,SAAS,CACb,UAA8B,EAC9B,EAAU,EACV,IAA6B;YAE7B,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrC,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAEX,CAAC;YACd,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,OAAO,SAAS,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,OAAO,GAAkC,EAAE,CAAC;YAElD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,IAAI,EAAE,CAAC,EAAE,KAAK,SAAS;oBAAE,SAAS;gBAElC,IACE,EAAE,CAAC,IAAI,KAAK,QAAQ;oBACpB,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,EACvF,CAAC;oBACD,MAAM,MAAM,GACV,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,KAAiC,CAAC,MAAM,CAAC;oBACjF,OAAO,CAAC,MAAM,GAAG,MAAM,KAAK,KAAK,CAAC;oBAElC,eAAe;oBACf,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;wBAC7B,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;wBAChC,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;wBAClD,OAAO;4BACL,MAAM,EAAE,GAAG;4BACX,IAAI,EAAE,cAAc,CAAC,WAAW,IAAI,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;yBACpE,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,IAAI,EAAE,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBAC9B,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;gBACzC,CAAC;gBAED,IAAI,EAAE,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC3B,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACrD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,UAAU,CACd,UAA8B,EAC9B,EAAU;YAEV,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrC,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACzB,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,SAAS,CACb,UAA8B,EAC9B,MAA+C;YAE/C,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrC,OAAO,SAAS,CAAC,GAAG,EAAE,cAAc,CAAwC,CAAC;YAC/E,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;YAEjD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAElE,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,OAAO,EAAE,CAAC,gBAAgB,CAAC;oBAC3B,YAAY,EAAE,KAAK;oBACnB,UAAU;oBACV,YAAY,EAAE,KAAK,CAAC,MAAM;oBAC1B,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;iBACrC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,GAAG;SACP,MAAM,CAAC,CAAC,CAAC,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI;QAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC1C,CAAC,CAAC,CAAC;AACR,CAAC"}

package/dist/cli/__tests__/agent.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent.test.d.ts.map

package/dist/cli/__tests__/agent.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.test.d.ts","sourceRoot":"","sources":["../../../src/cli/__tests__/agent.test.ts"],"names":[],"mappings":""}

package/dist/cli/__tests__/agent.test.js

@@ -0,0 +1,63 @@
+import { describe, expect, it } from 'vitest';
+import { z } from 'zod';
+import { FieldClassification } from '../../types/enums.js';
+import { generateCapabilityBrief, generateEntityBrief, generateProjectBriefFromResources, } from '../commands/agent.js';
+describe('plumbus agent', () => {
+    describe('generateCapabilityBrief', () => {
+        it('includes capability metadata', () => {
+            const cap = {
+                name: 'approveRefund',
+                kind: 'action',
+                domain: 'billing',
+                description: 'Approve a refund request',
+                input: z.object({}),
+                output: z.object({}),
+                access: { roles: ['admin', 'manager'], tenantScoped: true },
+                effects: { data: ['refunds'], events: ['refund.approved'], external: [], ai: false },
+                handler: async () => ({}),
+            };
+            const brief = generateCapabilityBrief(cap);
+            expect(brief).toContain('approveRefund');
+            expect(brief).toContain('billing');
+            expect(brief).toContain('action');
+            expect(brief).toContain('admin, manager');
+            expect(brief).toContain('refund.approved');
+        });
+    });
+    describe('generateEntityBrief', () => {
+        it('includes field classifications', () => {
+            const entity = {
+                name: 'Customer',
+                tenantScoped: true,
+                fields: {
+                    id: { type: 'id', options: {} },
+                    email: { type: 'string', options: { classification: FieldClassification.Personal } },
+                },
+            };
+            const brief = generateEntityBrief(entity);
+            expect(brief).toContain('Customer');
+            expect(brief).toContain('email');
+            expect(brief).toContain('personal');
+            expect(brief).toContain('Tenant-scoped');
+        });
+    });
+    describe('generateProjectBriefFromResources', () => {
+        it('lists all resource counts', () => {
+            const brief = generateProjectBriefFromResources([], [], [], [], []);
+            expect(brief).toContain('Entities (0)');
+            expect(brief).toContain('Capabilities (0)');
+            expect(brief).toContain('Flows (0)');
+            expect(brief).toContain('Events (0)');
+            expect(brief).toContain('Prompts (0)');
+        });
+        it('includes entity details when provided', () => {
+            const entities = [
+                { name: 'Customer', tenantScoped: true, fields: { id: { type: 'id', options: {} } } },
+            ];
+            const brief = generateProjectBriefFromResources([], entities, [], [], []);
+            expect(brief).toContain('Customer');
+            expect(brief).toContain('tenant-scoped');
+        });
+    });
+});
+//# sourceMappingURL=agent.test.js.map

package/dist/cli/__tests__/agent.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.test.js","sourceRoot":"","sources":["../../../src/cli/__tests__/agent.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iCAAiC,GAClC,MAAM,sBAAsB,CAAC;AAE9B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,GAAG,GAAuB;gBAC9B,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,0BAA0B;gBACvC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpB,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE;gBAC3D,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;gBACpF,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC1B,CAAC;YACF,MAAM,KAAK,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,MAAM,GAAqB;gBAC/B,IAAI,EAAE,UAAU;gBAChB,YAAY,EAAE,IAAI;gBAClB,MAAM,EAAE;oBACN,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;oBAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE,EAAE;iBACrF;aACF,CAAC;YACF,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;QACjD,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,KAAK,GAAG,iCAAiC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,QAAQ,GAAuB;gBACnC,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE;aACtF,CAAC;YACF,MAAM,KAAK,GAAG,iCAAiC,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1E,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli/__tests__/certify.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=certify.test.d.ts.map