@songsid/agend 2.3.5-alpha.5 → 2.3.5-beta.1

package/dist/hub/directory/directory.js

@@ -1,320 +0,0 @@
-/**
- * The Hub's directory client (S-43). Every operation opens its own connection, proves it is verified TLS before any
- * bind, and closes it; nothing is cached, so each Hub request sees the directory's current answer (design #3095 §4).
- *
- * Transport rules:
- * - ldaps:// only (decision 7e5b8a8f); the certificate is verified against the configured CA (or Node's roots) and the
- *   host name, always. A plain ldap:// socket is never created: createConnection refuses outright.
- * - One TLS connection per client. ldapts would otherwise reconnect transparently after a drop; every operation is a
- *   fresh session instead, and a bind is sent only on the verified socket this session opened.
- * - The library is imported lazily, so it never loads while the Hub is off.
- *
- * Passwords: the user's password is used for exactly one bind and is never stored, logged or returned. An empty
- * password is refused before the network (to LDAP it would be an unauthenticated bind that "succeeds").
- */
-import { isIP } from "node:net";
-import * as tls from "node:tls";
-import { HubDirectoryConfigError, resolveDirectoryConfig } from "./config.js";
-import { PROFILES, escapeFilterValue, isDisabled, objectIdMatch, readObjectId, readText, readTextList } from "./profiles.js";
-class InsecureTransportError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "InsecureTransportError";
-    }
-}
-let ldaptsModule;
-function loadLdapts() {
-    ldaptsModule ??= import("ldapts");
-    return ldaptsModule;
-}
-const LOGIN_MAX = 256;
-const PASSWORD_MAX = 1024;
-// A login is matched by the directory, not parsed by us; refuse only what can never be a login.
-const LOGIN_SHAPE = /^[^\u0000-\u001f\u007f\s](?:[^\u0000-\u001f\u007f]*[^\u0000-\u001f\u007f\s])?$/;
-function validLogin(login) {
-    return typeof login === "string" && login.length > 0 && login.length <= LOGIN_MAX && LOGIN_SHAPE.test(login);
-}
-function validPassword(password) {
-    return typeof password === "string" && password.length > 0 && password.length <= PASSWORD_MAX && !password.includes("\u0000");
-}
-/** One verified-TLS LDAP connection that refuses to reconnect. */
-class Session {
-    cfg;
-    client;
-    connections = 0;
-    tlsSocket;
-    constructor(cfg, client) {
-        this.cfg = cfg;
-        this.client = client;
-    }
-    static async open(cfg) {
-        const { Client } = await loadLdapts();
-        let session;
-        const tlsOptions = () => ({
-            ...(cfg.caPem !== undefined ? { ca: cfg.caPem } : {}),
-            rejectUnauthorized: true,
-            minVersion: "TLSv1.2",
-            host: cfg.host,
-            ...(isIP(cfg.host) ? {} : { servername: cfg.host }),
-            checkServerIdentity: tls.checkServerIdentity,
-        });
-        const client = new Client({
-            url: cfg.url,
-            timeout: cfg.timeoutMs,
-            connectTimeout: cfg.timeoutMs,
-            strictDN: true,
-            autoRebind: false,
-            // Never a plaintext socket, whatever the URL parsing inside the library decides.
-            createConnection: (() => {
-                throw new InsecureTransportError("hub directory: refusing a plaintext LDAP connection");
-            }),
-            // Verification settings come from here only; anything the library passes is ignored.
-            createSecureConnection: (() => {
-                session.claimConnection();
-                const socket = tls.connect({ ...tlsOptions(), port: cfg.port });
-                session.tlsSocket = socket;
-                return socket;
-            }),
-        });
-        session = new Session(cfg, client);
-        return session;
-    }
-    claimConnection() {
-        this.connections += 1;
-        if (this.connections > 1)
-            throw new InsecureTransportError("hub directory: connection lost; refusing to reconnect within one operation");
-    }
-    /** Throws unless the live connection is the one verified TLS socket this session made. */
-    assertSecure() {
-        const s = this.tlsSocket;
-        if (!s || s.destroyed || !s.authorized || !s.encrypted || this.connections !== 1 || !this.client.isConnected) {
-            throw new InsecureTransportError("hub directory: no verified TLS connection; refusing to send credentials");
-        }
-    }
-    async bind(dn, password) {
-        // ldapts connects lazily inside bind(): a fresh session's first bind opens the socket through
-        // createSecureConnection above (verified TLS, or no connection at all), and the bind is written only after
-        // 'secureConnect'. A session that already has a socket must still be on that one verified socket.
-        if (this.connections > 0)
-            this.assertSecure();
-        await this.client.bind(dn, password);
-        this.assertSecure();
-    }
-    async search(filter, attributes, binary, scope = "sub", base = this.cfg.baseDn) {
-        this.assertSecure();
-        const { searchEntries } = await this.client.search(base, {
-            scope,
-            filter,
-            attributes,
-            explicitBufferAttributes: [...binary],
-            sizeLimit: 2,
-            derefAliases: "never",
-        });
-        return searchEntries;
-    }
-    async close() {
-        try {
-            await this.client.unbind();
-        }
-        catch {
-            /* already closed */
-        }
-    }
-}
-export function createHubDirectory(config, secrets, options = {}) {
-    const cfg = resolveDirectoryConfig(config);
-    if (!secrets || typeof secrets.bindPassword !== "string" || !validPassword(secrets.bindPassword)) {
-        throw new HubDirectoryConfigError("hub directory: the service account password is missing");
-    }
-    const bindPassword = secrets.bindPassword;
-    const shape = PROFILES[cfg.profile];
-    const now = options.now ?? Date.now;
-    const attributes = [shape.idAttribute, cfg.loginAttribute, "displayName", "cn", "mail", shape.departmentAttribute, "memberOf", ...shape.statusAttributes];
-    const report = (op, outcome, error) => {
-        if (!options.onDiagnostic)
-            return;
-        const message = error instanceof Error ? `${error.name}: ${error.message}` : error === undefined ? undefined : String(error);
-        try {
-            options.onDiagnostic({ op, outcome, ...(message !== undefined ? { error: message } : {}) });
-        }
-        catch {
-            /* a diagnostic sink never changes the answer */
-        }
-    };
-    const toPerson = (entry, objectId) => {
-        const displayName = readText(entry, "displayName") ?? readText(entry, "cn");
-        const email = readText(entry, "mail");
-        const department = readText(entry, shape.departmentAttribute);
-        return Object.freeze({
-            key: Object.freeze({ realm: cfg.realm, objectId }),
-            login: readText(entry, cfg.loginAttribute) ?? "",
-            dn: entry.dn,
-            ...(displayName !== undefined ? { displayName } : {}),
-            ...(email !== undefined ? { email } : {}),
-            ...(department !== undefined ? { department } : {}),
-            groups: Object.freeze(readTextList(entry, "memberOf")),
-        });
-    };
-    const openService = async () => {
-        const session = await Session.open(cfg);
-        try {
-            await session.bind(cfg.bindDn, bindPassword);
-            return session;
-        }
-        catch (err) {
-            await session.close();
-            throw err;
-        }
-    };
-    const findById = async (session, objectId) => {
-        const match = objectIdMatch(cfg.profile, objectId);
-        if (!match)
-            return [];
-        const { AndFilter, EqualityFilter, FilterParser } = await loadLdapts();
-        const filter = new AndFilter({ filters: [FilterParser.parseString(cfg.userFilter), new EqualityFilter(match)] });
-        return session.search(filter, attributes, shape.binaryAttributes);
-    };
-    let closed = false;
-    // Shared with sign-in so local designation never acquires a weaker identity/eligibility rule.
-    const selectLogin = async (service, login) => {
-        const found = await service.search(`(&${cfg.userFilter}(${cfg.loginAttribute}=${escapeFilterValue(login)}))`, attributes, shape.binaryAttributes);
-        if (closed)
-            return { ok: false, reason: "unavailable" };
-        if (found.length === 0)
-            return { ok: false, reason: "not-found" };
-        if (found.length !== 1)
-            return { ok: false, reason: "unavailable", detail: "the login matches more than one entry" };
-        const entry = found[0], objectId = readObjectId(cfg.profile, entry);
-        if (!objectId)
-            return { ok: false, reason: "unavailable", detail: `the entry has no usable ${shape.idAttribute}` };
-        if (isDisabled(cfg.profile, entry, now()))
-            return { ok: false, reason: "not-eligible" };
-        return { ok: true, entry, objectId };
-    };
-    const recheck = async (service, entry, objectId, expectedLogin) => {
-        const again = await findById(service, objectId), current = again.length === 1 ? again[0] : undefined;
-        if (closed || !current || readObjectId(cfg.profile, current) !== objectId
-            || current.dn.toLowerCase() !== entry.dn.toLowerCase()
-            || (expectedLogin !== undefined && readText(current, cfg.loginAttribute)?.toLowerCase() !== expectedLogin.toLowerCase()))
-            return { ok: false, reason: "unavailable" };
-        if (isDisabled(cfg.profile, current, now()))
-            return { ok: false, reason: "not-eligible" };
-        return { ok: true, person: toPerson(current, objectId) };
-    };
-    return {
-        realm: cfg.realm,
-        async close() {
-            // Nothing is pooled; after close every call refuses (fail closed) instead of opening a new connection.
-            closed = true;
-        },
-        async lookupForInitialization(login) {
-            if (closed)
-                return { ok: false, reason: "unavailable" };
-            if (!validLogin(login))
-                return { ok: false, reason: "bad-input" };
-            let service;
-            try {
-                service = await openService();
-                const selected = await selectLogin(service, login);
-                if (!selected.ok)
-                    return { ok: false, reason: selected.reason };
-                // Re-read by immutable id; a rename, deletion or replacement while selecting never retargets the plan.
-                return await recheck(service, selected.entry, selected.objectId, login);
-            }
-            catch (err) {
-                // Init diagnostics are local, but server-supplied exception text can repeat a login or DN.
-                const certificate = err instanceof Error && /certificate|self.signed|verify/i.test(err.message);
-                report("initialization-lookup", "unavailable", certificate ? "directory certificate verification failed" : "directory lookup failed");
-                return { ok: false, reason: "unavailable" };
-            }
-            finally {
-                await service?.close();
-            }
-        },
-        async signIn(login, password) {
-            if (closed)
-                return { ok: false, reason: "unavailable" };
-            if (!validLogin(login) || !validPassword(password)) {
-                report("sign-in", "bad-input");
-                return { ok: false, reason: "bad-input" };
-            }
-            let service;
-            try {
-                service = await openService();
-                const selected = await selectLogin(service, login);
-                if (!selected.ok) {
-                    const reason = selected.reason === "not-found" ? "invalid-credentials" : selected.reason;
-                    report("sign-in", reason, selected.detail);
-                    return { ok: false, reason };
-                }
-                const { entry, objectId } = selected;
-                // The password goes to the directory once, on its own connection, for the DN the service search found.
-                const user = await Session.open(cfg);
-                try {
-                    await user.bind(entry.dn, password);
-                }
-                catch (err) {
-                    const { InvalidCredentialsError } = await loadLdapts();
-                    if (err instanceof InvalidCredentialsError) {
-                        report("sign-in", "invalid-credentials");
-                        return { ok: false, reason: "invalid-credentials" };
-                    }
-                    throw err;
-                }
-                finally {
-                    await user.close();
-                }
-                // The bound DN must still be the same object, still enabled (closes a delete/recreate race during the bind).
-                const checked = await recheck(service, entry, objectId);
-                if (!checked.ok) {
-                    const reason = checked.reason === "not-eligible" ? "not-eligible" : "unavailable";
-                    report("sign-in", reason, reason === "unavailable" ? "the entry changed during sign-in" : undefined);
-                    return { ok: false, reason };
-                }
-                return checked;
-            }
-            catch (err) {
-                report("sign-in", "unavailable", err);
-                return { ok: false, reason: "unavailable" };
-            }
-            finally {
-                await service?.close();
-            }
-        },
-        async checkEligibility(key) {
-            if (closed)
-                return { eligible: false, reason: "unavailable" };
-            if (!key || key.realm !== cfg.realm || typeof key.objectId !== "string" || !objectIdMatch(cfg.profile, key.objectId)) {
-                report("eligibility", "gone", "not a person key of this realm");
-                return { eligible: false, reason: "gone" };
-            }
-            let service;
-            try {
-                service = await openService();
-                const found = await findById(service, key.objectId);
-                if (found.length > 1) {
-                    report("eligibility", "unavailable", "the object id matches more than one entry");
-                    return { eligible: false, reason: "unavailable" };
-                }
-                const entry = found[0];
-                if (!entry || readObjectId(cfg.profile, entry) !== key.objectId) {
-                    report("eligibility", "gone");
-                    return { eligible: false, reason: "gone" };
-                }
-                if (isDisabled(cfg.profile, entry, now())) {
-                    report("eligibility", "disabled");
-                    return { eligible: false, reason: "disabled" };
-                }
-                return { eligible: true, person: toPerson(entry, key.objectId) };
-            }
-            catch (err) {
-                report("eligibility", "unavailable", err);
-                return { eligible: false, reason: "unavailable" };
-            }
-            finally {
-                await service?.close();
-            }
-        },
-    };
-}
-//# sourceMappingURL=directory.js.map

package/dist/hub/directory/directory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"directory.js","sourceRoot":"","sources":["../../../src/hub/directory/directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAgC,MAAM,aAAa,CAAC;AAC5G,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAsB7H,MAAM,sBAAuB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAGD,IAAI,YAAyC,CAAC;AAC9C,SAAS,UAAU;IACjB,YAAY,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,gGAAgG;AAChG,MAAM,WAAW,GAAG,gFAAgF,CAAC;AAErG,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,aAAa,CAAC,QAAiB;IACtC,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,YAAY,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChI,CAAC;AAED,kEAAkE;AAClE,MAAM,OAAO;IAKQ,GAAG;IACX,MAAM;IALT,WAAW,GAAG,CAAC,CAAC;IAChB,SAAS,CAA4B;IAE7C,YACmB,GAA4B,EACpC,MAAkB;mBADV,GAAG;sBACX,MAAM;IACd,CAAC;IAEJ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAA4B;QAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QACtC,IAAI,OAA4B,CAAC;QACjC,MAAM,UAAU,GAAG,GAA0B,EAAE,CAAC,CAAC;YAC/C,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,kBAAkB,EAAE,IAAI;YACxB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACnD,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;SAC7C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;YACxB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,cAAc,EAAE,GAAG,CAAC,SAAS;YAC7B,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,KAAK;YACjB,iFAAiF;YACjF,gBAAgB,EAAE,CAAC,GAAG,EAAE;gBACtB,MAAM,IAAI,sBAAsB,CAAC,qDAAqD,CAAC,CAAC;YAC1F,CAAC,CAAuB;YACxB,qFAAqF;YACrF,sBAAsB,EAAE,CAAC,GAAG,EAAE;gBAC5B,OAAQ,CAAC,eAAe,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChE,OAAQ,CAAC,SAAS,GAAG,MAAM,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC,CAAuB;SACzB,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC;YAAE,MAAM,IAAI,sBAAsB,CAAC,4EAA4E,CAAC,CAAC;IAC3I,CAAC;IAED,0FAA0F;IAClF,YAAY;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7G,MAAM,IAAI,sBAAsB,CAAC,yEAAyE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU,EAAE,QAAgB;QACrC,8FAA8F;QAC9F,2GAA2G;QAC3G,kGAAkG;QAClG,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAuB,EAAE,UAAoB,EAAE,MAAyB,EAAE,KAAK,GAAmB,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM;QAC1I,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACvD,KAAK;YACL,MAAM;YACN,UAAU;YACV,wBAAwB,EAAE,CAAC,GAAG,MAAM,CAAC;YACrC,SAAS,EAAE,CAAC;YACZ,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;QACH,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAe,EAAE,OAA4B,EAAE,OAAO,GAAwB,EAAE;IACjH,MAAM,GAAG,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,uBAAuB,CAAC,wDAAwD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,mBAAmB,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1J,MAAM,MAAM,GAAG,CAAC,EAAgC,EAAE,OAAe,EAAE,KAAe,EAAE,EAAE;QACpF,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO;QAClC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7H,IAAI,CAAC;YACH,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,KAAY,EAAE,QAAgB,EAAmB,EAAE;QACnE,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;YAClD,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;YAChD,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;SACvD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,IAAsB,EAAE;QAC/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC7C,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAgB,EAAE,QAAgB,EAAoB,EAAE;QAC9E,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACjH,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpE,CAAC,CAAC;IAEF,IAAI,MAAM,GAAG,KAAK,CAAC;IAInB,8FAA8F;IAC9F,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgB,EAAE,KAAa,EAAsB,EAAE;QAChF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,cAAc,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAClJ,IAAI,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QACrH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,2BAA2B,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACnH,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,EAAE,OAAgB,EAAE,KAAY,EAAE,QAAgB,EAAE,aAAsB,EAAuC,EAAE;QACtI,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrG,IAAI,MAAM,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,QAAQ;eACpE,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE;eACnD,CAAC,aAAa,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACxK,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;IAC3D,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAEhB,KAAK,CAAC,KAAK;YACT,uGAAuG;YACvG,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,KAAa;YACzC,IAAI,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACxD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAClE,IAAI,OAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACnD,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAChE,uGAAuG;gBACvG,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,2FAA2F;gBAC3F,MAAM,WAAW,GAAG,GAAG,YAAY,KAAK,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChG,MAAM,CAAC,uBAAuB,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;gBACtI,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC9C,CAAC;oBAAS,CAAC;gBAAC,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;YAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB;YAC1C,IAAI,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACxD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,OAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACnD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACzF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;gBAErC,uGAAuG;gBACvG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;oBACvD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;wBAC3C,MAAM,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;wBACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;oBACtD,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;wBAAS,CAAC;oBACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;gBAED,6GAA6G;gBAC7G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACxD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC;oBAClF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;oBACrG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC/B,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;gBACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC9C,CAAC;oBAAS,CAAC;gBACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,GAAc;YACnC,IAAI,MAAM;gBAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC9D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrH,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,gCAAgC,CAAC,CAAC;gBAChE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC7C,CAAC;YACD,IAAI,OAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACpD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,2CAA2C,CAAC,CAAC;oBAClF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;gBACpD,CAAC;gBACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;oBAChE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;oBAC9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC7C,CAAC;gBACD,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;oBAClC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;gBACjD,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;gBAC1C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACpD,CAAC;oBAAS,CAAC;gBACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/hub/directory/index.d.ts

@@ -1,7 +0,0 @@
-/** AgEnD Hub directory sign-in (S-43). Import this module only when the Hub is enabled; it loads the LDAP client lazily. */
-export type { DirectoryPerson, Eligibility, HubDirectory, IneligibleReason, InitializationLookupResult, PersonKey, SignInRefusal, SignInResult } from "./types.js";
-export { personKeyString, samePerson } from "./types.js";
-export type { DirectoryProfile, HubDirectoryConfig } from "./config.js";
-export { HubDirectoryConfigError, resolveDirectoryConfig } from "./config.js";
-export type { HubDirectoryDiagnostic, HubDirectoryOptions, HubDirectorySecrets } from "./directory.js";
-export { createHubDirectory } from "./directory.js";

package/dist/hub/directory/index.js

@@ -1,4 +0,0 @@
-export { personKeyString, samePerson } from "./types.js";
-export { HubDirectoryConfigError, resolveDirectoryConfig } from "./config.js";
-export { createHubDirectory } from "./directory.js";
-//# sourceMappingURL=index.js.map

package/dist/hub/directory/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hub/directory/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/hub/directory/profiles.d.ts

@@ -1,41 +0,0 @@
-/**
- * How each directory flavour names the things the Hub needs: the immutable object id, the login, and "disabled".
- *
- * - ad: objectGUID (16 bytes; shown in the usual mixed-endian GUID text form), sAMAccountName, userAccountControl bit 2
- *   (ACCOUNTDISABLE) and accountExpires (FILETIME; 0 and 0x7FFFFFFFFFFFFFFF mean never).
- * - openldap: entryUUID (RFC 4530), uid, and the ppolicy administrative lock (pwdAccountLockedTime 000001010000Z).
- *   A temporary password lockout is left to the server, which refuses the bind while it lasts.
- */
-import type { DirectoryProfile } from "./config.js";
-export interface ProfileShape {
-    readonly idAttribute: string;
-    /** Attributes the search must return as raw bytes. */
-    readonly binaryAttributes: readonly string[];
-    readonly departmentAttribute: string;
-    readonly statusAttributes: readonly string[];
-}
-export declare const PROFILES: Record<DirectoryProfile, ProfileShape>;
-export declare function isCanonicalObjectId(value: string): boolean;
-/** objectGUID bytes → the GUID text AD tools show (first three groups little-endian), lowercase. */
-export declare function guidBytesToString(bytes: Uint8Array): string | undefined;
-/** The inverse of guidBytesToString. */
-export declare function guidStringToBytes(guid: string): Buffer | undefined;
-/** RFC 4515 assertion-value escaping for text. */
-export declare function escapeFilterValue(value: string): string;
-/**
- * The equality match that finds exactly the entry with this object id. A binary objectGUID is matched with its raw
- * bytes in a filter object: ldapts turns "\xx" escapes in a filter string into characters and re-encodes them as
- * UTF-8, which changes every byte above 0x7f, so an escaped string would never match.
- */
-export declare function objectIdMatch(profile: DirectoryProfile, objectId: string): {
-    attribute: string;
-    value: string | Buffer;
-} | undefined;
-type Values = string | Buffer | readonly (string | Buffer)[] | undefined;
-/** The entry's canonical object id, or undefined when it is missing or malformed (the entry is then refused). */
-export declare function readObjectId(profile: DirectoryProfile, entry: Record<string, Values>): string | undefined;
-/** True when the directory marks the account disabled or expired. Unparseable status counts as disabled. */
-export declare function isDisabled(profile: DirectoryProfile, entry: Record<string, Values>, nowMs: number): boolean;
-export declare function readText(entry: Record<string, Values>, attribute: string): string | undefined;
-export declare function readTextList(entry: Record<string, Values>, attribute: string): string[];
-export {};

package/dist/hub/directory/profiles.js

@@ -1,90 +0,0 @@
-export const PROFILES = {
-    ad: { idAttribute: "objectGUID", binaryAttributes: ["objectGUID"], departmentAttribute: "department", statusAttributes: ["userAccountControl", "accountExpires"] },
-    openldap: { idAttribute: "entryUUID", binaryAttributes: [], departmentAttribute: "departmentNumber", statusAttributes: ["pwdAccountLockedTime"] },
-};
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-export function isCanonicalObjectId(value) {
-    return UUID.test(value);
-}
-/** objectGUID bytes → the GUID text AD tools show (first three groups little-endian), lowercase. */
-export function guidBytesToString(bytes) {
-    if (bytes.length !== 16)
-        return undefined;
-    const h = (i) => bytes[i].toString(16).padStart(2, "0");
-    const order = [3, 2, 1, 0, -1, 5, 4, -1, 7, 6, -1, 8, 9, -1, 10, 11, 12, 13, 14, 15];
-    return order.map((i) => (i < 0 ? "-" : h(i))).join("");
-}
-/** The inverse of guidBytesToString. */
-export function guidStringToBytes(guid) {
-    if (!UUID.test(guid))
-        return undefined;
-    const hex = guid.replace(/-/g, "");
-    const b = Buffer.from(hex, "hex");
-    return Buffer.from([b[3], b[2], b[1], b[0], b[5], b[4], b[7], b[6], ...b.subarray(8)]);
-}
-/** RFC 4515 assertion-value escaping for text. */
-export function escapeFilterValue(value) {
-    return value.replace(/[\\*()\u0000]/g, (c) => `\\${c.charCodeAt(0).toString(16).padStart(2, "0")}`);
-}
-/**
- * The equality match that finds exactly the entry with this object id. A binary objectGUID is matched with its raw
- * bytes in a filter object: ldapts turns "\xx" escapes in a filter string into characters and re-encodes them as
- * UTF-8, which changes every byte above 0x7f, so an escaped string would never match.
- */
-export function objectIdMatch(profile, objectId) {
-    if (!isCanonicalObjectId(objectId))
-        return undefined;
-    if (profile === "ad") {
-        const bytes = guidStringToBytes(objectId);
-        return bytes ? { attribute: "objectGUID", value: bytes } : undefined;
-    }
-    return { attribute: "entryUUID", value: objectId };
-}
-function first(v) {
-    return Array.isArray(v) ? v[0] : v;
-}
-/** The entry's canonical object id, or undefined when it is missing or malformed (the entry is then refused). */
-export function readObjectId(profile, entry) {
-    const raw = first(entry[PROFILES[profile].idAttribute]);
-    if (profile === "ad")
-        return Buffer.isBuffer(raw) ? guidBytesToString(raw) : undefined;
-    if (typeof raw !== "string")
-        return undefined;
-    const id = raw.toLowerCase();
-    return isCanonicalObjectId(id) ? id : undefined;
-}
-const NEVER_EXPIRES = 0x7fffffffffffffffn;
-const FILETIME_EPOCH_OFFSET_MS = 11644473600000n;
-/** True when the directory marks the account disabled or expired. Unparseable status counts as disabled. */
-export function isDisabled(profile, entry, nowMs) {
-    if (profile === "ad") {
-        const uacText = first(entry.userAccountControl);
-        if (typeof uacText !== "string" || !/^-?\d{1,10}$/.test(uacText))
-            return true; // AD always has it: missing = refuse
-        if ((Number(uacText) & 0x2) !== 0)
-            return true;
-        const exp = first(entry.accountExpires);
-        if (exp === undefined)
-            return false;
-        if (typeof exp !== "string" || !/^-?\d{1,20}$/.test(exp))
-            return true;
-        const ft = BigInt(exp);
-        if (ft === 0n || ft === NEVER_EXPIRES)
-            return false;
-        const expiresMs = ft / 10000n - FILETIME_EPOCH_OFFSET_MS;
-        return expiresMs <= BigInt(Math.floor(nowMs));
-    }
-    const locked = entry.pwdAccountLockedTime;
-    const values = (Array.isArray(locked) ? locked : locked === undefined ? [] : [locked]);
-    return values.some((v) => String(v) === "000001010000Z");
-}
-export function readText(entry, attribute) {
-    const v = first(entry[attribute]);
-    return typeof v === "string" && v.length > 0 ? v : undefined;
-}
-export function readTextList(entry, attribute) {
-    const v = entry[attribute];
-    const list = Array.isArray(v) ? v : v === undefined ? [] : [v];
-    return list.filter((x) => typeof x === "string");
-}
-//# sourceMappingURL=profiles.js.map

package/dist/hub/directory/profiles.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../src/hub/directory/profiles.ts"],"names":[],"mappings":"AAkBA,MAAM,CAAC,MAAM,QAAQ,GAA2C;IAC9D,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,EAAE;IAClK,QAAQ,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAAE,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,sBAAsB,CAAC,EAAE;CAClJ,CAAC;AAEF,MAAM,IAAI,GAAG,gEAAgE,CAAC;AAE9E,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,KAAiB;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAyB,EAAE,QAAgB;IACvE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACrD,CAAC;AAID,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAiC,CAAC;AACtE,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,YAAY,CAAC,OAAyB,EAAE,KAA6B;IACnF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,wBAAwB,GAAG,eAAmB,CAAC;AAErD,4GAA4G;AAC5G,MAAM,UAAU,UAAU,CAAC,OAAyB,EAAE,KAA6B,EAAE,KAAa;IAChG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,qCAAqC;QACpH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,aAAa;YAAE,OAAO,KAAK,CAAC;QACpD,MAAM,SAAS,GAAG,EAAE,GAAG,MAAO,GAAG,wBAAwB,CAAC;QAC1D,OAAO,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAwB,CAAC;IAC9G,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAA6B,EAAE,SAAiB;IACvE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAA6B,EAAE,SAAiB;IAC3E,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAChE,CAAC"}

package/dist/hub/directory/types.d.ts

@@ -1,71 +0,0 @@
-/**
- * AgEnD Hub — directory sign-in (S-43, design issue #3095 §2 and §4 "Revoke or change roles").
- *
- * A person is the directory realm plus the directory's immutable object id (entryUUID, or objectGUID decoded). The login
- * name, display name and email are attributes that can change; they never identify anyone. A renamed account keeps
- * its key; a deleted-and-recreated account with the same login gets a new key and inherits nothing.
- */
-/**
- * The only identity the Hub stores or authorizes against. realm: a stable configured id ([a-z][a-z0-9_-]{0,63});
- * objectId: a lowercase canonical UUID. Neither contains "/", so personKeyString is unambiguous.
- */
-export interface PersonKey {
-    readonly realm: string;
-    readonly objectId: string;
-}
-/**
- * What the directory says about a person right now. Never cached by this module. Server-side only: UI, member and
- * envelope DTOs project it and never forward dn, groups or anything about the service account (S-42 contract).
- */
-export interface DirectoryPerson {
-    readonly key: PersonKey;
-    /** The current login (it changes on a rename). Display only. */
-    readonly login: string;
-    readonly dn: string;
-    readonly displayName?: string;
-    readonly email?: string;
-    readonly department?: string;
-    /** Group DNs from memberOf. Informational in P1: grants are personal (design §4). */
-    readonly groups: readonly string[];
-}
-/**
- * Why a sign-in was refused. For the audit log only: the sign-in page shows one generic refusal for all of them, so it
- * never reveals whether a login exists or is disabled.
- */
-export type SignInRefusal = "bad-input" | "invalid-credentials" | "not-eligible" | "unavailable";
-export type SignInResult = {
-    readonly ok: true;
-    readonly person: DirectoryPerson;
-} | {
-    readonly ok: false;
-    readonly reason: SignInRefusal;
-};
-/** Local initialization only: finding an account does not authenticate it or issue a session. */
-export type InitializationLookupResult = {
-    readonly ok: true;
-    readonly person: DirectoryPerson;
-} | {
-    readonly ok: false;
-    readonly reason: "bad-input" | "not-found" | "not-eligible" | "unavailable";
-};
-export type IneligibleReason = "gone" | "disabled" | "unavailable";
-export type Eligibility = {
-    readonly eligible: true;
-    readonly person: DirectoryPerson;
-} | {
-    readonly eligible: false;
-    readonly reason: IneligibleReason;
-};
-export interface HubDirectory {
-    readonly realm: string;
-    /** Verify a login and password with the directory. The password is used for one bind and never kept. */
-    signIn(login: string, password: string): Promise<SignInResult>;
-    /** Narrow service-account lookup for local init, never exposed as a browser lookup endpoint. Missing = unavailable. */
-    lookupForInitialization?(login: string): Promise<InitializationLookupResult>;
-    /** Per-request eligibility (design §4): exists, same immutable id, enabled. No cache; unreachable = not eligible. */
-    checkEligibility(key: PersonKey): Promise<Eligibility>;
-    /** Release the directory; later calls refuse (unavailable). */
-    close(): Promise<void>;
-}
-export declare function personKeyString(key: PersonKey): string;
-export declare function samePerson(a: PersonKey, b: PersonKey): boolean;

package/dist/hub/directory/types.js

@@ -1,14 +0,0 @@
-/**
- * AgEnD Hub — directory sign-in (S-43, design issue #3095 §2 and §4 "Revoke or change roles").
- *
- * A person is the directory realm plus the directory's immutable object id (entryUUID, or objectGUID decoded). The login
- * name, display name and email are attributes that can change; they never identify anyone. A renamed account keeps
- * its key; a deleted-and-recreated account with the same login gets a new key and inherits nothing.
- */
-export function personKeyString(key) {
-    return `${key.realm}/${key.objectId}`;
-}
-export function samePerson(a, b) {
-    return a.realm === b.realm && a.objectId === b.objectId;
-}
-//# sourceMappingURL=types.js.map

package/dist/hub/directory/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/hub/directory/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmEH,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,OAAO,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAY,EAAE,CAAY;IACnD,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC;AAC1D,CAAC"}

package/dist/hub/execution/cli-provider.d.ts

@@ -1,23 +0,0 @@
-import type { HubIsolatedProvider } from "./service.js";
-import { type HubCliBackend, type HubModelBroker } from "./model-broker.js";
-export declare const HUB_PROVIDER_CLI_VERSIONS: Readonly<{
-    claude: "2.1.316";
-    codex: "0.166.0";
-}>;
-export interface HubCliProviderOptions {
-    backend: HubCliBackend;
-    /** Immutable LOCAL image ID, never a tag or remote ref. No runtime pull. */
-    imageId: string;
-    model: string;
-    modelBroker: HubModelBroker;
-    /** A local Unix socket only. No Docker environment/context or remote daemon is inherited. */
-    dockerSocket?: string;
-}
-export interface HubCliProvider extends HubIsolatedProvider {
-    close(): Promise<void>;
-}
-export declare function hubContainerArguments(imageId: string, name: string, token: string, contextId: string): string[];
-/** Check actual engine state, not just the command that requested isolation. */
-export declare function verifyHubContainer(value: unknown, imageId: string, token: string, contextId?: string): void;
-/** Explicit async availability check; merely importing this module cannot install or start anything. */
-export declare function createHubCliProvider(options: HubCliProviderOptions): Promise<HubCliProvider>;