@plumbus/core 0.6.18 → 0.7.0

package/dist/api/cookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/api/cookies.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/api/cookies.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACrB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/audit/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGxD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,kBAAkB,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CA0B3E"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGxD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,kBAAkB,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAwC3E"}

package/dist/audit/service.js

@@ -1,3 +1,5 @@
+import { z } from 'zod';
+import { createErrorService } from '../errors/index.js';
 import { createDatabaseAuditWriter } from './writer.js';
 /**
  * Creates a persistent AuditService that writes records to PostgreSQL.
@@ -7,13 +9,19 @@ export function createAuditService(config) {
     const writer = config.writer ?? createDatabaseAuditWriter(db);
     return {
         async record(eventType, metadata) {
-            const outcome = metadata?.outcome ?? 'success';
+            const parsedOutcome = z
+                .enum(['success', 'failure', 'denied'])
+                .safeParse(metadata?.outcome ?? 'success');
+            if (!parsedOutcome.success)
+                throw createErrorService().validation('Invalid audit outcome');
+            const outcome = parsedOutcome.data;
             const maskedFields = metadata?._maskedFields ?? undefined;
             const storedMetadata = metadata ? { ...metadata } : undefined;
             if (storedMetadata) {
                 delete storedMetadata._maskedFields;
             }
-            await writer.write({
+            const event = {
+                id: crypto.randomUUID(),
                 actor: auth.userId ?? 'anonymous',
                 tenantId: auth.tenantId,
                 component,
@@ -22,7 +30,17 @@ export function createAuditService(config) {
                 timestamp: new Date(),
                 metadata: storedMetadata,
                 maskedFields,
-            });
+            };
+            for (let attempt = 0; attempt < 3; attempt++) {
+                try {
+                    await writer.write(event);
+                    return;
+                }
+                catch (error) {
+                    if (attempt === 2)
+                        throw createErrorService().internal('Audit persistence failed', { cause: error });
+                }
+            }
         },
     };
 }

package/dist/audit/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAUxD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAE9D,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,QAAkC;YAChE,MAAM,OAAO,GAAI,QAAQ,EAAE,OAA4C,IAAI,SAAS,CAAC;YACrF,MAAM,YAAY,GAAI,QAAQ,EAAE,aAA0B,IAAI,SAAS,CAAC;YAExE,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,cAAc,CAAC,aAAa,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS;gBACT,MAAM,EAAE,SAAS;gBACjB,OAAO;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,QAAQ,EAAE,cAAc;gBACxB,YAAY;aACb,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAUxD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAE9D,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,QAAkC;YAChE,MAAM,aAAa,GAAG,CAAC;iBACpB,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;iBACtC,SAAS,CAAC,QAAQ,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,aAAa,CAAC,OAAO;gBAAE,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;YAC3F,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC;YACnC,MAAM,YAAY,GAAI,QAAQ,EAAE,aAA0B,IAAI,SAAS,CAAC;YAExE,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,cAAc,CAAC,aAAa,CAAC;YACtC,CAAC;YAED,MAAM,KAAK,GAAG;gBACZ,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS;gBACT,MAAM,EAAE,SAAS;gBACjB,OAAO;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,QAAQ,EAAE,cAAc;gBACxB,YAAY;aACb,CAAC;YACF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC1B,OAAO;gBACT,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,OAAO,KAAK,CAAC;wBACf,MAAM,kBAAkB,EAAE,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/audit/writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../src/audit/writer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGjE,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,kBAAkB,GAAG,WAAW,CAc7E"}
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../src/audit/writer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAc,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGjE,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,kBAAkB,GAAG,WAAW,CAmB7E"}

package/dist/audit/writer.js

@@ -2,7 +2,10 @@ import { auditRecords } from './schema.js';
 export function createDatabaseAuditWriter(db) {
     return {
         async write(event) {
-            await db.insert(auditRecords).values({
+            await db
+                .insert(auditRecords)
+                .values({
+                id: event.id ?? crypto.randomUUID(),
                 actor: event.actor ?? 'anonymous',
                 tenantId: event.tenantId ?? null,
                 component: event.component,
@@ -10,7 +13,9 @@ export function createDatabaseAuditWriter(db) {
                 outcome: event.outcome,
                 metadata: event.metadata ?? null,
                 maskedFields: event.maskedFields ?? null,
-            });
+                timestamp: event.timestamp ?? new Date(),
+            })
+                .onConflictDoNothing({ target: auditRecords.id });
         },
     };
 }

package/dist/audit/writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"writer.js","sourceRoot":"","sources":["../../src/audit/writer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,UAAU,yBAAyB,CAAC,EAAsB;IAC9D,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAiB;YAC3B,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;gBACnC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,WAAW;gBACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;aACzC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"writer.js","sourceRoot":"","sources":["../../src/audit/writer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,UAAU,yBAAyB,CAAC,EAAsB;IAC9D,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAiB;YAC3B,MAAM,EAAE;iBACL,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC;gBACN,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE;gBACnC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,WAAW;gBACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;gBACxC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE;aACzC,CAAC;iBACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/adapter.d.ts

@@ -17,6 +17,8 @@ export interface JwtAdapterConfig {
     issuer?: string;
     /** Expected audience (aud claim) */
     audience?: string;
+    /** Optional maximum accepted token lifetime in seconds; omitted preserves issuer-selected finite lifetimes. */
+    maxTokenLifetimeSeconds?: number;
     /**
      * Map JWT claims to AuthContext fields.
      * Defaults: sub→userId, roles→roles, scope→scopes, tenant_id→tenantId
@@ -45,7 +47,9 @@ export interface SignJwtOptions {
     expiresIn?: number;
     /** Issuer */
     issuer?: string;
-    /** Additional claims */
+    /** Expected token audience */
+    audience?: string;
+    /** Additional claims (reserved authentication claims are rejected) */
     claims?: Record<string, unknown>;
 }
 /**

package/dist/auth/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/auth/adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,YAAY,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAeD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CA+DtE;AA6DD,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAwBvD"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/auth/adapter.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,YAAY,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+GAA+G;IAC/G,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAeD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAgFtE;AA6DD,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAsCvD"}

package/dist/auth/adapter.js

@@ -1,3 +1,6 @@
+import { z } from 'zod';
+import { createErrorService } from '../errors/index.js';
+import { isValidJwtSecret } from './jwt-policy.js';
 import { createHmac, timingSafeEqual } from 'node:crypto';
 const defaultClaimMapping = {
     userId: 'sub',
@@ -11,9 +14,12 @@ const defaultClaimMapping = {
  */
 const MIN_JWT_SECRET_LENGTH = 32;
 export function createJwtAdapter(config) {
-    if (config.secret.length < MIN_JWT_SECRET_LENGTH) {
-        throw new Error(`JWT secret must be at least ${MIN_JWT_SECRET_LENGTH} characters for HS256 verification`);
+    if (!isValidJwtSecret(config.secret)) {
+        throw createErrorService().validation(`JWT secret must be at least ${MIN_JWT_SECRET_LENGTH} non-padding characters and must not be a development placeholder`);
     }
+    if (config.maxTokenLifetimeSeconds != null &&
+        !z.number().finite().positive().safeParse(config.maxTokenLifetimeSeconds).success)
+        throw createErrorService().validation('Invalid JWT maximum lifetime');
     const mapping = { ...defaultClaimMapping, ...config.claimMapping };
     return {
         async authenticate(authorizationHeader) {
@@ -38,11 +44,24 @@ export function createJwtAdapter(config) {
                     return null;
                 }
             }
-            // Check expiration
-            const exp = payload.exp;
-            if (typeof exp === 'number' && exp * 1000 < Date.now()) {
+            const now = Date.now() / 1000;
+            const times = z
+                .object({
+                exp: z.number().finite(),
+                iat: z.number().finite().optional(),
+                nbf: z.number().finite().optional(),
+            })
+                .safeParse(payload);
+            if (!times.success)
+                return null;
+            const { exp, iat, nbf } = times.data;
+            if (exp <= now || (nbf != null && nbf > now) || (iat != null && iat > now))
+                return null;
+            if (config.maxTokenLifetimeSeconds != null &&
+                exp - (iat ?? now) > config.maxTokenLifetimeSeconds)
+                return null;
+            if (!z.string().min(1).safeParse(payload[mapping.userId]).success)
                 return null;
-            }
             // Map claims to AuthContext
             const rawRoles = payload[mapping.roles];
             const rawScopes = payload[mapping.scopes];
@@ -121,6 +140,15 @@ function verifyJwtHs256(token, secret) {
  * Returns the signed token string (header.payload.signature).
  */
 export function signJwt(options) {
+    const reserved = ['sub', 'iat', 'exp', 'nbf', 'iss', 'aud', 'roles', 'scope', 'tenant_id'];
+    if (reserved.some((claim) => Object.hasOwn(options.claims ?? {}, claim)))
+        throw createErrorService().validation('JWT additional claims must not override reserved authentication claims');
+    if (!z
+        .number()
+        .finite()
+        .positive()
+        .safeParse(options.expiresIn ?? 86400).success)
+        throw createErrorService().validation('Invalid JWT expiration');
     const now = Math.floor(Date.now() / 1000);
     const exp = now + (options.expiresIn ?? 86400);
     const header = { alg: 'HS256', typ: 'JWT' };
@@ -138,6 +166,8 @@ export function signJwt(options) {
         payload.tenant_id = options.tenantId;
     if (options.issuer)
         payload.iss = options.issuer;
+    if (options.audience)
+        payload.aud = options.audience;
     const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
     const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
     const signature = createHmac('sha256', options.secret)

package/dist/auth/adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../src/auth/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAoC1D,MAAM,mBAAmB,GAAoB;IAC3C,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,+BAA+B,qBAAqB,oCAAoC,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;IAEnE,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,mBAAuC;YACxD,IAAI,CAAC,mBAAmB;gBAAE,OAAO,IAAI,CAAC;YAEtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;YAE7B,gCAAgC;YAChC,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,kCAAkC;YAClC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;gBACxB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,mBAAmB;YACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,4BAA4B;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAE1C,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7C,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;oBAC5B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;oBACtB,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ;wBAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAClD,CAAC,CAAC,EAAE;gBACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;oBAC9B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;oBACvB,CAAC,CAAC,OAAO,SAAS,KAAK,QAAQ;wBAC7B,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;wBACtC,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnF,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACxD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAE,OAAO,CAAC,GAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;aACpF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC;IAChE,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAExE,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAG5E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAE1D,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAuBD;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,OAAuB;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,GAAG;QACR,GAAG;QACH,GAAG,OAAO,CAAC,MAAM;KAClB,CAAC;IAEF,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAEjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;SACnD,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;SACpC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;AACnD,CAAC"}
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../src/auth/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAsC1D,MAAM,mBAAmB,GAAoB;IAC3C,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,kBAAkB,EAAE,CAAC,UAAU,CACnC,+BAA+B,qBAAqB,mEAAmE,CACxH,CAAC;IACJ,CAAC;IAED,IACE,MAAM,CAAC,uBAAuB,IAAI,IAAI;QACtC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,OAAO;QAEjF,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;IAEnE,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,mBAAuC;YACxD,IAAI,CAAC,mBAAmB;gBAAE,OAAO,IAAI,CAAC;YAEtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;YAE7B,gCAAgC;YAChC,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,kCAAkC;YAClC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;gBACxB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzC,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC9B,MAAM,KAAK,GAAG,CAAC;iBACZ,MAAM,CAAC;gBACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;gBACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;gBACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aACpC,CAAC;iBACD,SAAS,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;YACrC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxF,IACE,MAAM,CAAC,uBAAuB,IAAI,IAAI;gBACtC,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,uBAAuB;gBAEnD,OAAO,IAAI,CAAC;YACd,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE/E,4BAA4B;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAE1C,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7C,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;oBAC5B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;oBACtB,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ;wBAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAClD,CAAC,CAAC,EAAE;gBACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;oBAC9B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;oBACvB,CAAC,CAAC,OAAO,SAAS,KAAK,QAAQ;wBAC7B,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;wBACtC,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnF,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACxD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAE,OAAO,CAAC,GAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;aACpF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC;IAChE,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAExE,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAG5E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAE1D,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAyBD;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,OAAuB;IAC7C,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,kBAAkB,EAAE,CAAC,UAAU,CACnC,wEAAwE,CACzE,CAAC;IACJ,IACE,CAAC,CAAC;SACC,MAAM,EAAE;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,SAAS,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,OAAO;QAEhD,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,GAAG;QACR,GAAG;QACH,GAAG,OAAO,CAAC,MAAM;KAClB,CAAC;IAEF,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACjD,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;SACnD,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;SACpC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;AACnD,CAAC"}

package/dist/auth/index.d.ts

@@ -10,4 +10,5 @@ export { createSamlAdapter } from './saml-adapter.js';
 export type { SamlAdapterConfig } from './saml-adapter.js';
 export { createScimService } from './scim.js';
 export type { ScimEmail, ScimError, ScimListResponse, ScimService, ScimServiceConfig, ScimUser, ScimUserRepository, ScimUserResource, } from './scim.js';
+export { isValidJwtSecret } from './jwt-policy.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACzD,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnG,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mCAAmC,EACnC,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,UAAU,IAAI,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EACV,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACzD,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnG,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mCAAmC,EACnC,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,UAAU,IAAI,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EACV,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/auth/index.js

@@ -7,4 +7,5 @@ export { createOidcAdapter } from './oidc-adapter.js';
 export { hashPassword, verifyPassword } from './password.js';
 export { createSamlAdapter } from './saml-adapter.js';
 export { createScimService } from './scim.js';
+export { isValidJwtSecret } from './jwt-policy.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,iEAAiE;AACjE,gFAAgF;AAEhF,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAOzD,OAAO,EACL,mCAAmC,EACnC,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,iEAAiE;AACjE,gFAAgF;AAEhF,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAOzD,OAAO,EACL,mCAAmC,EACnC,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAY9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/auth/jwt-policy.d.ts

@@ -0,0 +1,3 @@
+/** Reject known shared defaults and short/padded HMAC keys in every environment. */
+export declare function isValidJwtSecret(secret: unknown): secret is string;
+//# sourceMappingURL=jwt-policy.d.ts.map

package/dist/auth/jwt-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-policy.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-policy.ts"],"names":[],"mappings":"AAUA,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,MAAM,CAElE"}

package/dist/auth/jwt-policy.js

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+const secretSchema = z.string().refine((secret) => {
+    const value = secret.trim();
+    return (value.length >= 32 &&
+        !['development-secret', 'development-secret-placeholder-32chars-min'].includes(value));
+});
+/** Reject known shared defaults and short/padded HMAC keys in every environment. */
+export function isValidJwtSecret(secret) {
+    return secretSchema.safeParse(secret).success;
+}
+//# sourceMappingURL=jwt-policy.js.map

package/dist/auth/jwt-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-policy.js","sourceRoot":"","sources":["../../src/auth/jwt-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,CACL,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,CAAC,CAAC,oBAAoB,EAAE,4CAA4C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC9C,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;AAChD,CAAC"}

package/dist/auth/oidc-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-adapter.d.ts","sourceRoot":"","sources":["../../src/auth/oidc-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAMjE,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACxC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAgBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAuHxE"}
+{"version":3,"file":"oidc-adapter.d.ts","sourceRoot":"","sources":["../../src/auth/oidc-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAMjE,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACxC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAgBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CA6HxE"}

package/dist/auth/oidc-adapter.js

@@ -15,12 +15,14 @@ export function createOidcAdapter(config) {
     const cacheTtl = (config.jwksCacheTtl ?? 3600) * 1000;
     const fetchFn = config.fetchFn ?? globalThis.fetch;
     let jwksCache = null;
+    let lastRefreshAt = -Infinity;
+    let refreshPromise;
     let discoveredJwksUri = config.jwksUri ?? null;
     async function discoverJwksUri() {
         if (discoveredJwksUri)
             return discoveredJwksUri;
         const discoveryUrl = `${config.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
-        const response = await fetchFn(discoveryUrl);
+        const response = await fetchFn(discoveryUrl, { signal: AbortSignal.timeout(10_000) });
         if (!response.ok) {
             throw new Error(`OIDC discovery failed: ${response.status}`);
         }
@@ -31,19 +33,31 @@ export function createOidcAdapter(config) {
         discoveredJwksUri = doc.jwks_uri;
         return discoveredJwksUri;
     }
-    async function fetchJwks() {
-        if (jwksCache && jwksCache.expiresAt > Date.now()) {
+    async function fetchJwks(force = false) {
+        if (!force && jwksCache && jwksCache.expiresAt > Date.now())
             return jwksCache.keys;
+        if (refreshPromise)
+            return refreshPromise;
+        // One bounded cooldown covers all unknown kids, including random-kid floods.
+        if (Date.now() - lastRefreshAt < 30_000)
+            return jwksCache?.keys ?? [];
+        lastRefreshAt = Date.now();
+        refreshPromise = (async () => {
+            const jwksUri = await discoverJwksUri();
+            const response = await fetchFn(jwksUri, { signal: AbortSignal.timeout(10_000) });
+            if (!response.ok)
+                throw new Error(`JWKS fetch failed: ${response.status}`);
+            const jwks = (await response.json());
+            const keys = jwks.keys ?? [];
+            jwksCache = { keys, expiresAt: Date.now() + cacheTtl };
+            return keys;
+        })();
+        try {
+            return await refreshPromise;
         }
-        const jwksUri = await discoverJwksUri();
-        const response = await fetchFn(jwksUri);
-        if (!response.ok) {
-            throw new Error(`JWKS fetch failed: ${response.status}`);
+        finally {
+            refreshPromise = undefined;
         }
-        const jwks = (await response.json());
-        const keys = jwks.keys ?? [];
-        jwksCache = { keys, expiresAt: Date.now() + cacheTtl };
-        return keys;
     }
     function findKey(kid, keys) {
         if (kid) {
@@ -89,9 +103,8 @@ export function createOidcAdapter(config) {
             const jwk = findKey(header.kid, keys);
             if (!jwk) {
                 // Key not found — try refreshing cache in case of rotation
-                jwksCache = null;
                 try {
-                    keys = await fetchJwks();
+                    keys = await fetchJwks(true);
                 }
                 catch {
                     return null;
@@ -106,6 +119,10 @@ export function createOidcAdapter(config) {
     };
 }
 function verifyAndMap(_token, headerStr, payloadStr, signatureStr, jwk, alg, config, mapping) {
+    if ((jwk.alg && jwk.alg !== alg) ||
+        (alg === 'RS256' && jwk.kty !== 'RSA') ||
+        (alg === 'ES256' && (jwk.kty !== 'EC' || jwk.crv !== 'P-256')))
+        return null;
     // Verify signature
     try {
         const publicKey = createPublicKey({ key: jwk, format: 'jwk' });

package/dist/auth/oidc-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-adapter.js","sourceRoot":"","sources":["../../src/auth/oidc-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAwCtD,MAAM,mBAAmB,GAAoB;IAC3C,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;IAEnD,IAAI,SAAS,GAAqB,IAAI,CAAC;IACvC,IAAI,iBAAiB,GAAkB,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;IAE9D,KAAK,UAAU,eAAe;QAC5B,IAAI,iBAAiB;YAAE,OAAO,iBAAiB,CAAC;QAEhD,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;QAC5F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,iBAAiB,GAAG,GAAG,CAAC,QAAQ,CAAC;QACjC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,KAAK,UAAU,SAAS;QACtB,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClD,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAE7B,SAAS,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,OAAO,CAAC,GAAuB,EAAE,IAAkB;QAC1D,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QAC5D,CAAC;QACD,iDAAiD;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,mBAAuC;YACxD,IAAI,CAAC,mBAAmB;gBAAE,OAAO,IAAI,CAAC;YAEtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAE5D,mCAAmC;YACnC,IAAI,MAAsC,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mCAAmC;YACnC,IAAI,IAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,2DAA2D;gBAC3D,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/C,IAAI,CAAC,YAAY;oBAAE,OAAO,IAAI,CAAC;gBAC/B,OAAO,YAAY,CACjB,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,MAAM,CAAC,GAAG,EACV,MAAM,EACN,OAAO,CACR,CAAC;YACJ,CAAC;YAED,OAAO,YAAY,CACjB,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACZ,GAAG,EACH,MAAM,CAAC,GAAG,EACV,MAAM,EACN,OAAO,CACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAc,EACd,SAAiB,EACjB,UAAkB,EAClB,YAAoB,EACpB,GAAe,EACf,GAAW,EACX,MAAyB,EACzB,OAAwB;IAExB,mBAAmB;IACnB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iBAAiB;IACjB,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE/C,oBAAoB;IACpB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,mBAAmB;IACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAEpE,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC5B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YACtB,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClD,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAC9B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YACvB,CAAC,CAAC,OAAO,SAAS,KAAK,QAAQ;gBAC7B,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBACtC,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACxD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAE,OAAO,CAAC,GAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"oidc-adapter.js","sourceRoot":"","sources":["../../src/auth/oidc-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAwCtD,MAAM,mBAAmB,GAAoB;IAC3C,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;IAEnD,IAAI,SAAS,GAAqB,IAAI,CAAC;IACvC,IAAI,aAAa,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,cAAiD,CAAC;IACtD,IAAI,iBAAiB,GAAkB,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;IAE9D,KAAK,UAAU,eAAe;QAC5B,IAAI,iBAAiB;YAAE,OAAO,iBAAiB,CAAC;QAEhD,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;QAC5F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,iBAAiB,GAAG,GAAG,CAAC,QAAQ,CAAC;QACjC,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,KAAK,GAAG,KAAK;QACpC,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC;QACnF,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,6EAA6E;QAC7E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,MAAM;YAAE,OAAO,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;QACtE,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC7B,SAAS,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,cAAc,GAAG,SAAS,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,SAAS,OAAO,CAAC,GAAuB,EAAE,IAAkB;QAC1D,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QAC5D,CAAC;QACD,iDAAiD;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,mBAAuC;YACxD,IAAI,CAAC,mBAAmB;gBAAE,OAAO,IAAI,CAAC;YAEtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAE5D,mCAAmC;YACnC,IAAI,MAAsC,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mCAAmC;YACnC,IAAI,IAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,2DAA2D;gBAC3D,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC/C,IAAI,CAAC,YAAY;oBAAE,OAAO,IAAI,CAAC;gBAC/B,OAAO,YAAY,CACjB,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,MAAM,CAAC,GAAG,EACV,MAAM,EACN,OAAO,CACR,CAAC;YACJ,CAAC;YAED,OAAO,YAAY,CACjB,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACZ,GAAG,EACH,MAAM,CAAC,GAAG,EACV,MAAM,EACN,OAAO,CACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAc,EACd,SAAiB,EACjB,UAAkB,EAClB,YAAoB,EACpB,GAAe,EACf,GAAW,EACX,MAAyB,EACzB,OAAwB;IAExB,IACE,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC;QAC5B,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC;QACtC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;QAE9D,OAAO,IAAI,CAAC;IAEd,mBAAmB;IACnB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iBAAiB;IACjB,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kBAAkB;IAClB,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE/C,oBAAoB;IACpB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,mBAAmB;IACnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAEpE,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC5B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YACtB,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClD,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAC9B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YACvB,CAAC,CAAC,OAAO,SAAS,KAAK,QAAQ;gBAC7B,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBACtC,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACxD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAE,OAAO,CAAC,GAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/saml-adapter.d.ts

@@ -7,6 +7,12 @@ export interface SamlAdapterConfig {
     issuer: string;
     /** Expected audience (SP entity ID / ACS URL) */
     audience: string;
+    /** Assertion consumer endpoint; defaults to audience for compatibility. */
+    recipient?: string;
+    /** Explicit opt-in to IdP-initiated / bearer assertions without a request ID. */
+    allowUnsolicited?: boolean;
+    /** Optional atomic replay check for an application-owned synchronous shared store. */
+    consumeAssertion?: (id: string, expiresAt: Date) => boolean;
     /** Attribute mapping for SAML claim extraction */
     attributeMapping?: Partial<SamlAttributeMapping>;
 }
@@ -33,6 +39,6 @@ export interface SamlAuthResult extends AuthContext {
  *    Response from the IdP (used in SSO callback handlers).
  */
 export declare function createSamlAdapter(config: SamlAdapterConfig): AuthAdapter & {
-    processSamlResponse(samlResponseB64: string): SamlAuthResult | null;
+    processSamlResponse(samlResponseB64: string, expectedRequestId?: string): SamlAuthResult | null;
 };
 //# sourceMappingURL=saml-adapter.d.ts.map

package/dist/auth/saml-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml-adapter.d.ts","sourceRoot":"","sources":["../../src/auth/saml-adapter.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAOhD,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,GACxB,WAAW,GAAG;IAAE,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;CAAE,CAoEvF"}
+{"version":3,"file":"saml-adapter.d.ts","sourceRoot":"","sources":["../../src/auth/saml-adapter.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAOhD,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sFAAsF;IACtF,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC;IAC5D,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,GAAG;IAC1E,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAC;CACjG,CAgHA"}

package/dist/auth/saml-adapter.js

@@ -25,7 +25,9 @@ function asDomNode(node) {
  */
 export function createSamlAdapter(config) {
     const mapping = { ...defaultAttributeMapping, ...config.attributeMapping };
-    function parseAssertion(xml) {
+    const consumed = new Map();
+    const recipient = config.recipient ?? config.audience;
+    function parseAssertion(xml, expectedRequestId) {
         let verifiedAssertion;
         try {
             verifiedAssertion = verifySignedAssertion(xml, config.idpCertificate);
@@ -40,6 +42,41 @@ export function createSamlAdapter(config) {
             return null;
         if (!validateConditions(verifiedAssertion, config.audience))
             return null;
+        if (!expectedRequestId && !config.allowUnsolicited)
+            return null;
+        const assertion = xpath.select(ASSERTION_XPATH, asDomNode(verifiedAssertion))[0];
+        const assertionId = assertion?.getAttribute('ID');
+        if (!assertionId)
+            return null;
+        const confirmations = xpath.select("//*[local-name()='SubjectConfirmationData' and namespace-uri()='urn:oasis:names:tc:SAML:2.0:assertion']", asDomNode(verifiedAssertion));
+        if (confirmations.length !== 1)
+            return null;
+        const confirmation = confirmations[0];
+        if (confirmation?.getAttribute('Recipient') !== recipient)
+            return null;
+        if (expectedRequestId && confirmation.getAttribute('InResponseTo') !== expectedRequestId)
+            return null;
+        const confirmationExpiry = Date.parse(confirmation.getAttribute('NotOnOrAfter') ?? '');
+        if (!Number.isFinite(confirmationExpiry) || confirmationExpiry <= Date.now())
+            return null;
+        const rawDoc = new DOMParser().parseFromString(xml, 'text/xml');
+        const response = rawDoc.documentElement;
+        if (response?.localName === 'Response') {
+            if (response.getAttribute('Destination') !== recipient)
+                return null;
+            if (expectedRequestId && response.getAttribute('InResponseTo') !== expectedRequestId)
+                return null;
+        }
+        const conditions = xpath.select("//*[local-name()='Conditions']", asDomNode(verifiedAssertion))[0];
+        const expiry = Math.min(confirmationExpiry, Date.parse(conditions?.getAttribute('NotOnOrAfter') ?? ''));
+        for (const [id, expiresAt] of consumed)
+            if (expiresAt <= Date.now())
+                consumed.delete(id);
+        if (consumed.has(assertionId) || consumed.size >= 10_000)
+            return null;
+        if (config.consumeAssertion && config.consumeAssertion(assertionId, new Date(expiry)) !== true)
+            return null;
+        consumed.set(assertionId, expiry);
         const nameId = readElementText(verifiedAssertion, 'NameID') ?? '';
         const attributes = extractAttributes(verifiedAssertion);
         const userIdValues = attributes[mapping.userId] ?? [];
@@ -76,7 +113,7 @@ export function createSamlAdapter(config) {
             }
             return parseAssertion(xml);
         },
-        processSamlResponse(samlResponseB64) {
+        processSamlResponse(samlResponseB64, expectedRequestId) {
             let xml;
             try {
                 xml = Buffer.from(samlResponseB64, 'base64').toString('utf-8');
@@ -84,7 +121,7 @@ export function createSamlAdapter(config) {
             catch {
                 return null;
             }
-            return parseAssertion(xml);
+            return parseAssertion(xml, expectedRequestId);
         },
     };
 }
@@ -124,14 +161,14 @@ function validateConditions(assertionDoc, audience) {
     const notBefore = conditions.getAttribute('NotBefore');
     if (notBefore) {
         const notBeforeMs = new Date(notBefore).getTime();
-        if (Date.now() < notBeforeMs - 5 * 60 * 1000)
+        if (!Number.isFinite(notBeforeMs) || Date.now() < notBeforeMs)
             return false;
     }
     const notOnOrAfter = conditions.getAttribute('NotOnOrAfter');
     if (!notOnOrAfter)
         return false;
     const notOnOrAfterMs = new Date(notOnOrAfter).getTime();
-    if (Date.now() >= notOnOrAfterMs + 5 * 60 * 1000)
+    if (!Number.isFinite(notOnOrAfterMs) || Date.now() >= notOnOrAfterMs)
         return false;
     const audienceNodes = xpath.select("//*[local-name()='Audience' and namespace-uri()='urn:oasis:names:tc:SAML:2.0:assertion']", asDomNode(assertionDoc));
     if (audienceNodes.length === 0)

package/dist/auth/saml-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"saml-adapter.js","sourceRoot":"","sources":["../../src/auth/saml-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,GAGV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAmC/B,MAAM,uBAAuB,GAAyB;IACpD,MAAM,EAAE,sEAAsE;IAC9E,KAAK,EAAE,oEAAoE;IAC3E,KAAK,EAAE,8DAA8D;IACrE,QAAQ,EAAE,gEAAgE;IAC1E,WAAW,EAAE,4DAA4D;CAC1E,CAAC;AAEF,MAAM,eAAe,GACnB,2FAA2F,CAAC;AAC9F,MAAM,eAAe,GACnB,wFAAwF,CAAC;AAE3F,qEAAqE;AACrE,SAAS,SAAS,CAAC,IAA8B;IAC/C,OAAO,IAAuB,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAyB;IAEzB,MAAM,OAAO,GAAG,EAAE,GAAG,uBAAuB,EAAE,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAE3E,SAAS,cAAc,CAAC,GAAW;QACjC,IAAI,iBAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,iBAAiB,GAAG,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAErD,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzE,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,UAAU,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QAExD,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;QACzC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAExD,OAAO;YACL,MAAM;YACN,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;YACzB,QAAQ,EAAE,MAAM;YAChB,eAAe,EAAE,IAAI,IAAI,EAAE;YAC3B,MAAM;YACN,UAAU;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,mBAAuC;YACxD,IAAI,CAAC,mBAAmB;gBAAE,OAAO,IAAI,CAAC;YACtC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5D,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAE7C,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,mBAAmB,CAAC,eAAuB;YACzC,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,OAAe;IACzD,MAAM,GAAG,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,CAAW,CAAC;IAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,CAAW,CAAC;IAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzE,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAS,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,UAAU,GAAG,GAAG,CAAC,mBAAmB,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,WAAW,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACrF,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,WAAW,CAAC,CAAW,CAAC;IAC3F,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;AACvF,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAyB,EAAE,QAAgB;IACrE,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAClC,4FAA4F,EAC5F,SAAS,CAAC,YAAY,CAAC,CACd,CAAC;IACZ,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAA0B,CAAC;IAC/D,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IAC7D,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;IACxD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IAE/D,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAChC,0FAA0F,EAC1F,SAAS,CAAC,YAAY,CAAC,CACd,CAAC;IACZ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAgB,EAAE,SAAiB;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CACxB,qBAAqB,SAAS,gEAAgE,EAC9F,SAAS,CAAC,GAAG,CAAC,CACL,CAAC;IACZ,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,OAAO,IAAI,IAAI,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAyB;IAClD,MAAM,UAAU,GAA6B,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAC5B,2FAA2F,EAC3F,SAAS,CAAC,YAAY,CAAC,CACG,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAC7B,qCAAqC,EACrC,SAAS,CAAC,IAAI,CAAC,CACN,CAAC;QACZ,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9F,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IAC5B,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"saml-adapter.js","sourceRoot":"","sources":["../../src/auth/saml-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,GAGV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAyC/B,MAAM,uBAAuB,GAAyB;IACpD,MAAM,EAAE,sEAAsE;IAC9E,KAAK,EAAE,oEAAoE;IAC3E,KAAK,EAAE,8DAA8D;IACrE,QAAQ,EAAE,gEAAgE;IAC1E,WAAW,EAAE,4DAA4D;CAC1E,CAAC;AAEF,MAAM,eAAe,GACnB,2FAA2F,CAAC;AAC9F,MAAM,eAAe,GACnB,wFAAwF,CAAC;AAE3F,qEAAqE;AACrE,SAAS,SAAS,CAAC,IAA8B;IAC/C,OAAO,IAAuB,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IAGzD,MAAM,OAAO,GAAG,EAAE,GAAG,uBAAuB,EAAE,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC;IAEtD,SAAS,cAAc,CAAC,GAAW,EAAE,iBAA0B;QAC7D,IAAI,iBAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,iBAAiB,GAAG,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAErD,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACzE,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAC3D,CAAC,CAAC,CAAC,CAAC;QACL,MAAM,WAAW,GAAG,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAChC,yGAAyG,EACzG,SAAS,CAAC,iBAAiB,CAAC,CACF,CAAC;QAC7B,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACvE,IAAI,iBAAiB,IAAI,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,iBAAiB;YACtF,OAAO,IAAI,CAAC;QACd,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1F,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC;QACxC,IAAI,QAAQ,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACpE,IAAI,iBAAiB,IAAI,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,iBAAiB;gBAClF,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,UAAU,GACd,KAAK,CAAC,MAAM,CACV,gCAAgC,EAChC,SAAS,CAAC,iBAAiB,CAAC,CAE/B,CAAC,CAAC,CAAC,CAAC;QACL,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CACrB,kBAAkB,EAClB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAC3D,CAAC;QACF,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,QAAQ;YAAE,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,IAAI,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;QACtE,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI;YAC5F,OAAO,IAAI,CAAC;QACd,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,UAAU,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QAExD,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;QACzC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAExD,OAAO;YACL,MAAM;YACN,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;YACzB,QAAQ,EAAE,MAAM;YAChB,eAAe,EAAE,IAAI,IAAI,EAAE;YAC3B,MAAM;YACN,UAAU;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,mBAAuC;YACxD,IAAI,CAAC,mBAAmB;gBAAE,OAAO,IAAI,CAAC;YACtC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5D,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAE7C,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,mBAAmB,CACjB,eAAuB,EACvB,iBAA0B;YAE1B,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,OAAe;IACzD,MAAM,GAAG,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,CAAW,CAAC;IAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,CAAW,CAAC;IAC3E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzE,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAS,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,UAAU,GAAG,GAAG,CAAC,mBAAmB,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,WAAW,GAAG,IAAI,SAAS,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACrF,MAAM,kBAAkB,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,WAAW,CAAC,CAAW,CAAC;IAC3F,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;AACvF,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAyB,EAAE,QAAgB;IACrE,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAClC,4FAA4F,EAC5F,SAAS,CAAC,YAAY,CAAC,CACd,CAAC;IACZ,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAA0B,CAAC;IAC/D,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;YAAE,OAAO,KAAK,CAAC;IAC9E,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,cAAc;QAAE,OAAO,KAAK,CAAC;IAEnF,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAChC,0FAA0F,EAC1F,SAAS,CAAC,YAAY,CAAC,CACd,CAAC;IACZ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAgB,EAAE,SAAiB;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CACxB,qBAAqB,SAAS,gEAAgE,EAC9F,SAAS,CAAC,GAAG,CAAC,CACL,CAAC;IACZ,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,OAAO,IAAI,IAAI,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAyB;IAClD,MAAM,UAAU,GAA6B,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAC5B,2FAA2F,EAC3F,SAAS,CAAC,YAAY,CAAC,CACG,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAC7B,qCAAqC,EACrC,SAAS,CAAC,IAAI,CAAC,CACN,CAAC;QACZ,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9F,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IAC5B,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/cli/commands/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/create.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,GACrB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CA4NrB;AAoTD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2D5D"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/create.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAqBD,wEAAwE;AACxE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,GACrB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CA6NrB;AAoTD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4D5D"}

package/dist/cli/commands/create.js

@@ -1,10 +1,30 @@
 // ── plumbus create <app-name> ──
 // Interactive project scaffolding
+import { z } from 'zod';
+import { createErrorService } from '../../errors/index.js';
+import { assertScaffoldName } from '../scaffold-validation.js';
 import { execSync } from 'node:child_process';
 import * as path from 'node:path';
 import { error, exists, info, success, toKebabCase, warn, writeFile } from '../utils.js';
+function validateCreateInputs(appName, options) {
+    assertScaffoldName(appName);
+    const identifier = z.string().regex(/^[A-Za-z][A-Za-z0-9_-]*$/);
+    if (!z
+        .object({
+        database: identifier.optional(),
+        auth: identifier.optional(),
+        ai: identifier.optional(),
+    })
+        .safeParse(options).success ||
+        (options.compliance != null &&
+            !z.array(identifier).safeParse(options.compliance.split(',').map((value) => value.trim()))
+                .success)) {
+        throw createErrorService().validation('Invalid scaffold provider or compliance identifier');
+    }
+}
 /** Generate the repository directory structure for a new Plumbus app */
 export function generateProjectStructure(appName, options) {
+    validateCreateInputs(appName, options);
     if (options.monorepo) {
         return generateMonorepoStructure(appName, options);
     }
@@ -382,6 +402,7 @@ export function registerCreateCommand(program) {
         .option('--git', 'Initialize a git repository')
         .option('--skip-install', 'Skip dependency installation')
         .action(async (appName, opts) => {
+        validateCreateInputs(appName, opts);
         const targetDir = path.resolve(process.cwd(), toKebabCase(appName));
         if (exists(targetDir)) {
             error(`Directory "${toKebabCase(appName)}" already exists`);