@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/security/scim/models/scim-protocol.backend.schemas.d.ts

@@ -151,42 +151,80 @@ export interface SCIMListResponse<T = SCIMUserResource> {
     itemsPerPage: number;
     Resources: T[];
 }
-export declare const SCIM_SERVICE_PROVIDER_CONFIG: {
-    readonly schemas: readonly ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"];
-    readonly documentationUri: "https://docs.wildo.ai/scim";
-    readonly patch: {
-        readonly supported: true;
+/**
+ * Where an application's SCIM discovery document sends a directory administrator for
+ * documentation. Authored per application (`auth.scimDocumentation`), because the RFC defines
+ * `documentationUri` as the SERVICE PROVIDER's documentation — and the service provider is the
+ * application, not the framework it was built with.
+ *
+ * spec-cite: RFC 7643 §5 — "An HTTP-addressable URL pointing to the service provider's
+ * human-consumable help documentation. OPTIONAL."
+ */
+export interface ScimDocumentationUris {
+    /** RFC 7643 §5 `documentationUri` on the ServiceProviderConfig itself. */
+    readonly serviceProviderUri?: string;
+    /** RFC 7643 §5 `documentationUri` on the OAuth bearer-token authentication scheme. */
+    readonly authenticationSchemeUri?: string;
+}
+/**
+ * Build the SCIM ServiceProviderConfig this application serves at
+ * `GET /scim/v2/ServiceProviderConfig` (RFC 7643 §5).
+ *
+ * Everything except the two documentation URLs is a statement about THIS implementation and is
+ * therefore fixed: patch and bulk are supported, filtering is capped, `changePassword`, `sort` and
+ * `etag` are not. Those are facts about the code, not choices an application makes.
+ *
+ * ## Why the two URLs are parameters, and why absence OMITS rather than empties
+ *
+ * They were frozen here, pointing at `docs.wildo.ai/scim` and `/scim/auth` — a host with no DNS
+ * record, so every application built on Wildo told its enterprise customers to go somewhere that
+ * does not resolve. Both are OPTIONAL in the RFC, so a discovery document without them is
+ * conformant; one carrying a URL that answers nothing is a false advertisement served to the exact
+ * reader who is trying to integrate.
+ *
+ * spec-cite: RFC 7643 §5 — both the top-level `documentationUri` and the `authenticationSchemes`
+ * sub-attribute of the same name are marked "OPTIONAL."
+ *
+ * An absent value therefore removes the KEY. Emitting `documentationUri: ''` or `null` would
+ * replace an unanswerable URL with a malformed one, and a directory-service client that reads the
+ * field before checking it would be worse off than if the framework had said nothing.
+ */
+export declare function buildScimServiceProviderConfig(documentation?: ScimDocumentationUris): {
+    patch: {
+        supported: boolean;
     };
-    readonly bulk: {
-        readonly supported: true;
-        readonly maxOperations: 100;
-        readonly maxPayloadSize: 1048576;
+    bulk: {
+        supported: boolean;
+        maxOperations: number;
+        maxPayloadSize: number;
     };
-    readonly filter: {
-        readonly supported: true;
-        readonly maxResults: 200;
+    filter: {
+        supported: boolean;
+        maxResults: number;
     };
-    readonly changePassword: {
-        readonly supported: false;
+    changePassword: {
+        supported: boolean;
     };
-    readonly sort: {
-        readonly supported: false;
+    sort: {
+        supported: boolean;
     };
-    readonly etag: {
-        readonly supported: false;
+    etag: {
+        supported: boolean;
     };
-    readonly authenticationSchemes: readonly [{
-        readonly type: "oauthbearertoken";
-        readonly name: "OAuth Bearer Token";
-        readonly description: "Authentication scheme using the OAuth Bearer Token Standard";
-        readonly specUri: "https://www.rfc-editor.org/info/rfc6750";
-        readonly documentationUri: "https://docs.wildo.ai/scim/auth";
-        readonly primary: true;
-    }];
-    readonly meta: {
-        readonly resourceType: "ServiceProviderConfig";
-        readonly location: "/scim/v2/ServiceProviderConfig";
+    authenticationSchemes: {
+        primary: boolean;
+        documentationUri?: string;
+        type: string;
+        name: string;
+        description: string;
+        specUri: string;
+    }[];
+    meta: {
+        resourceType: string;
+        location: string;
     };
+    documentationUri?: string;
+    schemas: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"[];
 };
 export declare const SCIM_USER_SCHEMA_DEFINITION: {
     readonly schemas: readonly ["urn:ietf:params:scim:schemas:core:2.0:Schema"];

package/dist/esm/security/scim/models/scim-protocol.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-protocol.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/models/scim-protocol.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;CAO1B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEhE,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AAMH,eAAO,MAAM,YAAY;;;;;;;;;;;CAWf,CAAC;AAEX,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAe/E;AAMD,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,SAAS,GACT,YAAY,GACZ,YAAY,GACZ,eAAe,GACf,aAAa,GACb,UAAU,GACV,cAAc,GACd,aAAa,GACb,WAAW,CAAC;AAEhB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAMD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAMD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,UAAU,EAAE,yBAAyB,EAAE,CAAC;CACzC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,EAAE;QACJ,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,gBAAgB;IACpD,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,CAAC,EAAE,CAAC;CAChB;AAMD,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqB/B,CAAC;AAMX,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyB9B,CAAC;AAMX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAerB,CAAC"}
+{"version":3,"file":"scim-protocol.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/models/scim-protocol.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;CAO1B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEhE,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AAMH,eAAO,MAAM,YAAY;;;;;;;;;;;CAWf,CAAC;AAEX,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAe/E;AAMD,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,SAAS,GACT,YAAY,GACZ,YAAY,GACZ,eAAe,GACf,aAAa,GACb,UAAU,GACV,cAAc,GACd,aAAa,GACb,WAAW,CAAC;AAEhB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAMD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAMD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,UAAU,EAAE,yBAAyB,EAAE,CAAC;CACzC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,EAAE;QACJ,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,gBAAgB;IACpD,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,CAAC,EAAE,CAAC;CAChB;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sFAAsF;IACtF,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,CAAC,EAAE,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBnF;AAMD,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyB9B,CAAC;AAMX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAerB,CAAC"}

package/dist/esm/security/scim/models/scim-protocol.backend.schemas.js

@@ -101,31 +101,53 @@ export function extractScimDirectoryUnitValue(body) {
     const department = rawDepartment.trim();
     return department.length > 0 ? department : undefined;
 }
-// ═══════════════════════════════════════════════════════════════
-// SCIM ServiceProviderConfig (RFC 7643 §5)
-// ═══════════════════════════════════════════════════════════════
-export const SCIM_SERVICE_PROVIDER_CONFIG = {
-    schemas: [SCIM_SCHEMAS.SERVICE_PROVIDER_CONFIG],
-    documentationUri: 'https://docs.wildo.ai/scim',
-    patch: { supported: true },
-    bulk: { supported: true, maxOperations: 100, maxPayloadSize: 1048576 },
-    filter: { supported: true, maxResults: 200 },
-    changePassword: { supported: false },
-    sort: { supported: false },
-    etag: { supported: false },
-    authenticationSchemes: [{
-            type: 'oauthbearertoken',
-            name: 'OAuth Bearer Token',
-            description: 'Authentication scheme using the OAuth Bearer Token Standard',
-            specUri: 'https://www.rfc-editor.org/info/rfc6750',
-            documentationUri: 'https://docs.wildo.ai/scim/auth',
-            primary: true,
-        }],
-    meta: {
-        resourceType: 'ServiceProviderConfig',
-        location: '/scim/v2/ServiceProviderConfig',
-    },
-};
+/**
+ * Build the SCIM ServiceProviderConfig this application serves at
+ * `GET /scim/v2/ServiceProviderConfig` (RFC 7643 §5).
+ *
+ * Everything except the two documentation URLs is a statement about THIS implementation and is
+ * therefore fixed: patch and bulk are supported, filtering is capped, `changePassword`, `sort` and
+ * `etag` are not. Those are facts about the code, not choices an application makes.
+ *
+ * ## Why the two URLs are parameters, and why absence OMITS rather than empties
+ *
+ * They were frozen here, pointing at `docs.wildo.ai/scim` and `/scim/auth` — a host with no DNS
+ * record, so every application built on Wildo told its enterprise customers to go somewhere that
+ * does not resolve. Both are OPTIONAL in the RFC, so a discovery document without them is
+ * conformant; one carrying a URL that answers nothing is a false advertisement served to the exact
+ * reader who is trying to integrate.
+ *
+ * spec-cite: RFC 7643 §5 — both the top-level `documentationUri` and the `authenticationSchemes`
+ * sub-attribute of the same name are marked "OPTIONAL."
+ *
+ * An absent value therefore removes the KEY. Emitting `documentationUri: ''` or `null` would
+ * replace an unanswerable URL with a malformed one, and a directory-service client that reads the
+ * field before checking it would be worse off than if the framework had said nothing.
+ */
+export function buildScimServiceProviderConfig(documentation) {
+    return {
+        schemas: [SCIM_SCHEMAS.SERVICE_PROVIDER_CONFIG],
+        ...(documentation?.serviceProviderUri ? { documentationUri: documentation.serviceProviderUri } : {}),
+        patch: { supported: true },
+        bulk: { supported: true, maxOperations: 100, maxPayloadSize: 1048576 },
+        filter: { supported: true, maxResults: 200 },
+        changePassword: { supported: false },
+        sort: { supported: false },
+        etag: { supported: false },
+        authenticationSchemes: [{
+                type: 'oauthbearertoken',
+                name: 'OAuth Bearer Token',
+                description: 'Authentication scheme using the OAuth Bearer Token Standard',
+                specUri: 'https://www.rfc-editor.org/info/rfc6750',
+                ...(documentation?.authenticationSchemeUri ? { documentationUri: documentation.authenticationSchemeUri } : {}),
+                primary: true,
+            }],
+        meta: {
+            resourceType: 'ServiceProviderConfig',
+            location: '/scim/v2/ServiceProviderConfig',
+        },
+    };
+}
 // ═══════════════════════════════════════════════════════════════
 // SCIM User Schema Definition (RFC 7643 §7)
 // ═══════════════════════════════════════════════════════════════

package/dist/esm/security/scim/models/scim-protocol.backend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-protocol.backend.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/scim/models/scim-protocol.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU,EAAS,OAAO;IAC1B,gBAAgB,EAAG,WAAW;IAC9B,iBAAiB,EAAE,UAAU;IAC7B,aAAa,EAAM,aAAa;IAChC,QAAQ,EAAW,SAAS,EAAS,kDAAkD;IACvF,YAAY,EAAO,gBAAgB;CAC3B,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA2B,MAAM,CAAC,WAAW,CACrF,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAClF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AAEH,kEAAkE;AAClE,0BAA0B;AAC1B,kEAAkE;AAElE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,4CAA4C;IAClD,eAAe,EAAE,4DAA4D;IAC7E,aAAa,EAAE,oDAAoD;IACnE,KAAK,EAAE,6CAA6C;IACpD,QAAQ,EAAE,+CAA+C;IACzD,YAAY,EAAE,mDAAmD;IACjE,aAAa,EAAE,oDAAoD;IACnE,uBAAuB,EAAE,6DAA6D;IACtF,aAAa,EAAE,oDAAoD;IACnE,MAAM,EAAE,8CAA8C;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhE,MAAM,QAAQ,GAAG,IAA+B,CAAC;IACjD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;IACnE,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,IAAI,IAAI,OAAO,mBAAmB,KAAK,QAAQ;QACrE,CAAC,CAAE,mBAA+C,CAAC,YAAY,CAAC;QAChE,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,oBAAoB,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAExD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AA2GD,kEAAkE;AAClE,2CAA2C;AAC3C,kEAAkE;AAElE,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,OAAO,EAAE,CAAC,YAAY,CAAC,uBAAuB,CAAC;IAC/C,gBAAgB,EAAE,4BAA4B;IAC9C,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;IAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE;IACtE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;IAC5C,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;IACpC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;IAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;IAC1B,qBAAqB,EAAE,CAAC;YACtB,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,6DAA6D;YAC1E,OAAO,EAAE,yCAAyC;YAClD,gBAAgB,EAAE,iCAAiC;YACnD,OAAO,EAAE,IAAI;SACd,CAAC;IACF,IAAI,EAAE;QACJ,YAAY,EAAE,uBAAuB;QACrC,QAAQ,EAAE,gCAAgC;KAC3C;CACO,CAAC;AAEX,kEAAkE;AAClE,4CAA4C;AAC5C,kEAAkE;AAElE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,YAAY,CAAC,IAAI;IACrB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;QAC9J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBACjI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACxH,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzH,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;aACzH,EAAC;QACF,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC1H,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QACtH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBAClI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACrE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACrE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC1E,EAAC;QACF,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;KAC1H;IACD,IAAI,EAAE;QACJ,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,oBAAoB,YAAY,CAAC,IAAI,EAAE;KAClD;CACO,CAAC;AAEX,kEAAkE;AAClE,+CAA+C;AAC/C,kEAAkE;AAElE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;QAClC,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;QACrC,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,cAAc;QAC3B,MAAM,EAAE,YAAY,CAAC,IAAI;QACzB,gBAAgB,EAAE,CAAC;gBACjB,MAAM,EAAE,YAAY,CAAC,eAAe;gBACpC,QAAQ,EAAE,KAAK;aAChB,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,cAAc;YAC5B,QAAQ,EAAE,6BAA6B;SACxC;KACF,CAAU,CAAC","sourcesContent":["/**\n * SCIM Protocol Schemas — Step 20\n * \n * SCIM 2.0 types, attribute mapping, and protocol constants for directory provisioning.\n * \n * Decision 13: Lean SCIM — Users only in v1, no Groups, no generic adapter.\n * SCIM_USER_ATTRIBUTE_MAP maps SCIM attributes → NormalizedUserProfile fields\n * (the same type used by SSO JIT provisioning in Step 4/15).\n *\n * Token schema has moved to @wildo-ai/saas-models (scimTokensPolymorphicDeclaration).\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Attribute Mapping\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Maps SCIM User resource attribute paths to NormalizedUserProfile fields.\n * Hardcoded for v1 — only the SCIM User resource is supported.\n * \n * FUTURE: If SCIM Groups or custom resources are needed, extract this into a\n * generic SCIMResourceMappingRegistry. See Decision 13 for the architecture.\n */\nexport const SCIM_USER_ATTRIBUTE_MAP = {\n  'userName':        'email',\n  'name.givenName':  'firstName',\n  'name.familyName': 'lastName',\n  'displayName':     'displayName',\n  'active':          '_active',        // computed: maps to user status (active/inactive)\n  'externalId':      'providerUserId',\n} as const;\n\n/**\n * Reverse map: NormalizedUserProfile field → SCIM attribute path.\n * Used by the response formatter to build SCIM User resources from internal data.\n */\nexport const PROFILE_TO_SCIM_ATTRIBUTE_MAP: Record<string, string> = Object.fromEntries(\n  Object.entries(SCIM_USER_ATTRIBUTE_MAP).map(([scim, profile]) => [profile, scim])\n);\n\n/**\n * FUTURE: SCIM Groups → Organization Roles\n * SCIM Groups map to role assignments, not departments.\n * Example: Okta group \"Wildo Admins\" → ADMIN role.\n * Implementation: add /scim/v2/Groups endpoints with:\n *   - POST/PUT/PATCH /Groups → create/update org roles\n *   - Group membership changes → OrganizationMember role updates\n *   - Group displayName → role identifier mapping (configurable per org)\n *\n * SCIM User department → OrganizationUnit: IMPLEMENTED (2026-08-01, WS-C). `department` from the\n * Enterprise User extension is bound to an organization unit through the EXPLICIT per-organization\n * `organizationUnitMapping` on the SCIM provisioning config — see\n * {@link extractScimDirectoryUnitValue} and `scim-organization-unit-mapping.shared.ts`. `division`\n * and `manager` remain unmapped: `division` would only be needed to disambiguate a search-based\n * match, and the declared mapping is unambiguous by construction, while `manager` is a reporting\n * relationship rather than a unit membership.\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Protocol Constants\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_SCHEMAS = {\n  USER: 'urn:ietf:params:scim:schemas:core:2.0:User',\n  ENTERPRISE_USER: 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User',\n  LIST_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:ListResponse',\n  ERROR: 'urn:ietf:params:scim:api:messages:2.0:Error',\n  PATCH_OP: 'urn:ietf:params:scim:api:messages:2.0:PatchOp',\n  BULK_REQUEST: 'urn:ietf:params:scim:api:messages:2.0:BulkRequest',\n  BULK_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:BulkResponse',\n  SERVICE_PROVIDER_CONFIG: 'urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig',\n  RESOURCE_TYPE: 'urn:ietf:params:scim:schemas:core:2.0:ResourceType',\n  SCHEMA: 'urn:ietf:params:scim:schemas:core:2.0:Schema',\n} as const;\n\nexport const SCIM_CONTENT_TYPE = 'application/scim+json';\n\n/**\n * Read the directory's `department` from an inbound SCIM User body.\n *\n * ## Why this is NOT an entry in `attributeMapping`\n *\n * Two independent reasons, and both matter:\n *\n * 1. **The path grammar cannot express it.** `resolveScimAttributePath` splits on `.`, and the\n *    extension key is literally `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User` — the\n *    `2.0` contains a dot, so any dotted path would traverse into a key that does not exist.\n * 2. **There is nothing tenant-specific to configure.** `attributeMapping` exists because directories\n *    disagree about where a value lives (`emails[0].value` vs `emails[type eq \"work\"].value`). The\n *    enterprise extension URN is fixed BY THE SCIM SPEC, so a configurable path here would offer a\n *    choice that has exactly one correct answer.\n *\n * The tenant-specific part — what a department VALUE means — is configured, in\n * `organizationUnitMapping`. This function only finds the value.\n *\n * Falls back to a top-level `department` because directories in the wild place it there when they do\n * not send the extension envelope. Returns `undefined` for anything non-string or blank, so an absent\n * department is unambiguous to the caller.\n */\nexport function extractScimDirectoryUnitValue(body: unknown): string | undefined {\n  if (body === null || typeof body !== 'object') return undefined;\n\n  const scimBody = body as Record<string, unknown>;\n  const enterpriseExtension = scimBody[SCIM_SCHEMAS.ENTERPRISE_USER];\n  const enterpriseDepartment =\n    enterpriseExtension !== null && typeof enterpriseExtension === 'object'\n      ? (enterpriseExtension as Record<string, unknown>)['department']\n      : undefined;\n\n  const rawDepartment = enterpriseDepartment ?? scimBody['department'];\n  if (typeof rawDepartment !== 'string') return undefined;\n\n  const department = rawDepartment.trim();\n  return department.length > 0 ? department : undefined;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Error Types (RFC 7644 §3.12)\n// ═══════════════════════════════════════════════════════════════\n\nexport type SCIMErrorType =\n  | 'invalidFilter'\n  | 'tooMany'\n  | 'uniqueness'\n  | 'mutability'\n  | 'invalidSyntax'\n  | 'invalidPath'\n  | 'noTarget'\n  | 'invalidValue'\n  | 'invalidVers'\n  | 'sensitive';\n\nexport interface SCIMErrorResponse {\n  schemas: [typeof SCIM_SCHEMAS.ERROR];\n  status: string;\n  detail: string;\n  scimType?: SCIMErrorType;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM PATCH Operation Types (RFC 7644 §3.5.2)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMPatchOperation {\n  op: 'add' | 'remove' | 'replace';\n  path?: string;\n  value?: unknown;\n}\n\nexport interface SCIMPatchRequest {\n  schemas: string[];\n  Operations: SCIMPatchOperation[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Bulk Operation Types (RFC 7644 §3.7)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMBulkOperation {\n  method: 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n  path: string;\n  bulkId?: string;\n  data?: Record<string, unknown>;\n}\n\nexport interface SCIMBulkRequest {\n  schemas: [typeof SCIM_SCHEMAS.BULK_REQUEST];\n  Operations: SCIMBulkOperation[];\n  failOnErrors?: number;\n}\n\nexport interface SCIMBulkOperationResponse {\n  method: string;\n  bulkId?: string;\n  location?: string;\n  status: string;\n  response?: SCIMErrorResponse;\n}\n\nexport interface SCIMBulkResponse {\n  schemas: [typeof SCIM_SCHEMAS.BULK_RESPONSE];\n  Operations: SCIMBulkOperationResponse[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Resource Type (RFC 7643 §4.1)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMUserResource {\n  schemas: string[];\n  id: string;\n  externalId?: string;\n  userName: string;\n  name?: {\n    formatted?: string;\n    familyName?: string;\n    givenName?: string;\n  };\n  displayName?: string;\n  active: boolean;\n  emails?: Array<{\n    value: string;\n    type?: string;\n    primary?: boolean;\n  }>;\n  meta: {\n    resourceType: 'User';\n    created: string;\n    lastModified: string;\n    location: string;\n  };\n}\n\nexport interface SCIMListResponse<T = SCIMUserResource> {\n  schemas: [typeof SCIM_SCHEMAS.LIST_RESPONSE];\n  totalResults: number;\n  startIndex: number;\n  itemsPerPage: number;\n  Resources: T[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM ServiceProviderConfig (RFC 7643 §5)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_SERVICE_PROVIDER_CONFIG = {\n  schemas: [SCIM_SCHEMAS.SERVICE_PROVIDER_CONFIG],\n  documentationUri: 'https://docs.wildo.ai/scim',\n  patch: { supported: true },\n  bulk: { supported: true, maxOperations: 100, maxPayloadSize: 1048576 },\n  filter: { supported: true, maxResults: 200 },\n  changePassword: { supported: false },\n  sort: { supported: false },\n  etag: { supported: false },\n  authenticationSchemes: [{\n    type: 'oauthbearertoken',\n    name: 'OAuth Bearer Token',\n    description: 'Authentication scheme using the OAuth Bearer Token Standard',\n    specUri: 'https://www.rfc-editor.org/info/rfc6750',\n    documentationUri: 'https://docs.wildo.ai/scim/auth',\n    primary: true,\n  }],\n  meta: {\n    resourceType: 'ServiceProviderConfig',\n    location: '/scim/v2/ServiceProviderConfig',\n  },\n} as const;\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Schema Definition (RFC 7643 §7)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_USER_SCHEMA_DEFINITION = {\n  schemas: [SCIM_SCHEMAS.SCHEMA],\n  id: SCIM_SCHEMAS.USER,\n  name: 'User',\n  description: 'User Account',\n  attributes: [\n    { name: 'userName', type: 'string', multiValued: false, required: true, caseExact: false, mutability: 'readWrite', returned: 'default', uniqueness: 'server' },\n    { name: 'name', type: 'complex', multiValued: false, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'givenName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'familyName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'formatted', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    ]},\n    { name: 'displayName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'active', type: 'boolean', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'emails', type: 'complex', multiValued: true, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'value', type: 'string', multiValued: false, required: true },\n      { name: 'type', type: 'string', multiValued: false, required: false },\n      { name: 'primary', type: 'boolean', multiValued: false, required: false },\n    ]},\n    { name: 'externalId', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n  ],\n  meta: {\n    resourceType: 'Schema',\n    location: `/scim/v2/Schemas/${SCIM_SCHEMAS.USER}`,\n  },\n} as const;\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Resource Types Definition (RFC 7644 §4)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_RESOURCE_TYPES = [{\n  schemas: [SCIM_SCHEMAS.RESOURCE_TYPE],\n  id: 'User',\n  name: 'User',\n  endpoint: '/Users',\n  description: 'User Account',\n  schema: SCIM_SCHEMAS.USER,\n  schemaExtensions: [{\n    schema: SCIM_SCHEMAS.ENTERPRISE_USER,\n    required: false,\n  }],\n  meta: {\n    resourceType: 'ResourceType',\n    location: '/scim/v2/ResourceTypes/User',\n  },\n}] as const;\n"]}
+{"version":3,"file":"scim-protocol.backend.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/scim/models/scim-protocol.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU,EAAS,OAAO;IAC1B,gBAAgB,EAAG,WAAW;IAC9B,iBAAiB,EAAE,UAAU;IAC7B,aAAa,EAAM,aAAa;IAChC,QAAQ,EAAW,SAAS,EAAS,kDAAkD;IACvF,YAAY,EAAO,gBAAgB;CAC3B,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA2B,MAAM,CAAC,WAAW,CACrF,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAClF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AAEH,kEAAkE;AAClE,0BAA0B;AAC1B,kEAAkE;AAElE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,4CAA4C;IAClD,eAAe,EAAE,4DAA4D;IAC7E,aAAa,EAAE,oDAAoD;IACnE,KAAK,EAAE,6CAA6C;IACpD,QAAQ,EAAE,+CAA+C;IACzD,YAAY,EAAE,mDAAmD;IACjE,aAAa,EAAE,oDAAoD;IACnE,uBAAuB,EAAE,6DAA6D;IACtF,aAAa,EAAE,oDAAoD;IACnE,MAAM,EAAE,8CAA8C;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhE,MAAM,QAAQ,GAAG,IAA+B,CAAC;IACjD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;IACnE,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,IAAI,IAAI,OAAO,mBAAmB,KAAK,QAAQ;QACrE,CAAC,CAAE,mBAA+C,CAAC,YAAY,CAAC;QAChE,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,oBAAoB,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAExD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AA+HD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B,CAAC,aAAqC;IAClF,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,CAAC,uBAAuB,CAAC;QAC/C,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;QAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE;QACtE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;QAC5C,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QACpC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QAC1B,qBAAqB,EAAE,CAAC;gBACtB,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,oBAAoB;gBAC1B,WAAW,EAAE,6DAA6D;gBAC1E,OAAO,EAAE,yCAAyC;gBAClD,GAAG,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9G,OAAO,EAAE,IAAI;aACd,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,uBAAuB;YACrC,QAAQ,EAAE,gCAAgC;SAC3C;KACF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,4CAA4C;AAC5C,kEAAkE;AAElE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,YAAY,CAAC,IAAI;IACrB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;QAC9J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBACjI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACxH,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzH,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;aACzH,EAAC;QACF,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC1H,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QACtH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBAClI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACrE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACrE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC1E,EAAC;QACF,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;KAC1H;IACD,IAAI,EAAE;QACJ,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,oBAAoB,YAAY,CAAC,IAAI,EAAE;KAClD;CACO,CAAC;AAEX,kEAAkE;AAClE,+CAA+C;AAC/C,kEAAkE;AAElE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;QAClC,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;QACrC,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,cAAc;QAC3B,MAAM,EAAE,YAAY,CAAC,IAAI;QACzB,gBAAgB,EAAE,CAAC;gBACjB,MAAM,EAAE,YAAY,CAAC,eAAe;gBACpC,QAAQ,EAAE,KAAK;aAChB,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,cAAc;YAC5B,QAAQ,EAAE,6BAA6B;SACxC;KACF,CAAU,CAAC","sourcesContent":["/**\n * SCIM Protocol Schemas — Step 20\n * \n * SCIM 2.0 types, attribute mapping, and protocol constants for directory provisioning.\n * \n * Decision 13: Lean SCIM — Users only in v1, no Groups, no generic adapter.\n * SCIM_USER_ATTRIBUTE_MAP maps SCIM attributes → NormalizedUserProfile fields\n * (the same type used by SSO JIT provisioning in Step 4/15).\n *\n * Token schema has moved to @wildo-ai/saas-models (scimTokensPolymorphicDeclaration).\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Attribute Mapping\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Maps SCIM User resource attribute paths to NormalizedUserProfile fields.\n * Hardcoded for v1 — only the SCIM User resource is supported.\n * \n * FUTURE: If SCIM Groups or custom resources are needed, extract this into a\n * generic SCIMResourceMappingRegistry. See Decision 13 for the architecture.\n */\nexport const SCIM_USER_ATTRIBUTE_MAP = {\n  'userName':        'email',\n  'name.givenName':  'firstName',\n  'name.familyName': 'lastName',\n  'displayName':     'displayName',\n  'active':          '_active',        // computed: maps to user status (active/inactive)\n  'externalId':      'providerUserId',\n} as const;\n\n/**\n * Reverse map: NormalizedUserProfile field → SCIM attribute path.\n * Used by the response formatter to build SCIM User resources from internal data.\n */\nexport const PROFILE_TO_SCIM_ATTRIBUTE_MAP: Record<string, string> = Object.fromEntries(\n  Object.entries(SCIM_USER_ATTRIBUTE_MAP).map(([scim, profile]) => [profile, scim])\n);\n\n/**\n * FUTURE: SCIM Groups → Organization Roles\n * SCIM Groups map to role assignments, not departments.\n * Example: Okta group \"Wildo Admins\" → ADMIN role.\n * Implementation: add /scim/v2/Groups endpoints with:\n *   - POST/PUT/PATCH /Groups → create/update org roles\n *   - Group membership changes → OrganizationMember role updates\n *   - Group displayName → role identifier mapping (configurable per org)\n *\n * SCIM User department → OrganizationUnit: IMPLEMENTED (2026-08-01, WS-C). `department` from the\n * Enterprise User extension is bound to an organization unit through the EXPLICIT per-organization\n * `organizationUnitMapping` on the SCIM provisioning config — see\n * {@link extractScimDirectoryUnitValue} and `scim-organization-unit-mapping.shared.ts`. `division`\n * and `manager` remain unmapped: `division` would only be needed to disambiguate a search-based\n * match, and the declared mapping is unambiguous by construction, while `manager` is a reporting\n * relationship rather than a unit membership.\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Protocol Constants\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_SCHEMAS = {\n  USER: 'urn:ietf:params:scim:schemas:core:2.0:User',\n  ENTERPRISE_USER: 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User',\n  LIST_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:ListResponse',\n  ERROR: 'urn:ietf:params:scim:api:messages:2.0:Error',\n  PATCH_OP: 'urn:ietf:params:scim:api:messages:2.0:PatchOp',\n  BULK_REQUEST: 'urn:ietf:params:scim:api:messages:2.0:BulkRequest',\n  BULK_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:BulkResponse',\n  SERVICE_PROVIDER_CONFIG: 'urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig',\n  RESOURCE_TYPE: 'urn:ietf:params:scim:schemas:core:2.0:ResourceType',\n  SCHEMA: 'urn:ietf:params:scim:schemas:core:2.0:Schema',\n} as const;\n\nexport const SCIM_CONTENT_TYPE = 'application/scim+json';\n\n/**\n * Read the directory's `department` from an inbound SCIM User body.\n *\n * ## Why this is NOT an entry in `attributeMapping`\n *\n * Two independent reasons, and both matter:\n *\n * 1. **The path grammar cannot express it.** `resolveScimAttributePath` splits on `.`, and the\n *    extension key is literally `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User` — the\n *    `2.0` contains a dot, so any dotted path would traverse into a key that does not exist.\n * 2. **There is nothing tenant-specific to configure.** `attributeMapping` exists because directories\n *    disagree about where a value lives (`emails[0].value` vs `emails[type eq \"work\"].value`). The\n *    enterprise extension URN is fixed BY THE SCIM SPEC, so a configurable path here would offer a\n *    choice that has exactly one correct answer.\n *\n * The tenant-specific part — what a department VALUE means — is configured, in\n * `organizationUnitMapping`. This function only finds the value.\n *\n * Falls back to a top-level `department` because directories in the wild place it there when they do\n * not send the extension envelope. Returns `undefined` for anything non-string or blank, so an absent\n * department is unambiguous to the caller.\n */\nexport function extractScimDirectoryUnitValue(body: unknown): string | undefined {\n  if (body === null || typeof body !== 'object') return undefined;\n\n  const scimBody = body as Record<string, unknown>;\n  const enterpriseExtension = scimBody[SCIM_SCHEMAS.ENTERPRISE_USER];\n  const enterpriseDepartment =\n    enterpriseExtension !== null && typeof enterpriseExtension === 'object'\n      ? (enterpriseExtension as Record<string, unknown>)['department']\n      : undefined;\n\n  const rawDepartment = enterpriseDepartment ?? scimBody['department'];\n  if (typeof rawDepartment !== 'string') return undefined;\n\n  const department = rawDepartment.trim();\n  return department.length > 0 ? department : undefined;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Error Types (RFC 7644 §3.12)\n// ═══════════════════════════════════════════════════════════════\n\nexport type SCIMErrorType =\n  | 'invalidFilter'\n  | 'tooMany'\n  | 'uniqueness'\n  | 'mutability'\n  | 'invalidSyntax'\n  | 'invalidPath'\n  | 'noTarget'\n  | 'invalidValue'\n  | 'invalidVers'\n  | 'sensitive';\n\nexport interface SCIMErrorResponse {\n  schemas: [typeof SCIM_SCHEMAS.ERROR];\n  status: string;\n  detail: string;\n  scimType?: SCIMErrorType;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM PATCH Operation Types (RFC 7644 §3.5.2)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMPatchOperation {\n  op: 'add' | 'remove' | 'replace';\n  path?: string;\n  value?: unknown;\n}\n\nexport interface SCIMPatchRequest {\n  schemas: string[];\n  Operations: SCIMPatchOperation[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Bulk Operation Types (RFC 7644 §3.7)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMBulkOperation {\n  method: 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n  path: string;\n  bulkId?: string;\n  data?: Record<string, unknown>;\n}\n\nexport interface SCIMBulkRequest {\n  schemas: [typeof SCIM_SCHEMAS.BULK_REQUEST];\n  Operations: SCIMBulkOperation[];\n  failOnErrors?: number;\n}\n\nexport interface SCIMBulkOperationResponse {\n  method: string;\n  bulkId?: string;\n  location?: string;\n  status: string;\n  response?: SCIMErrorResponse;\n}\n\nexport interface SCIMBulkResponse {\n  schemas: [typeof SCIM_SCHEMAS.BULK_RESPONSE];\n  Operations: SCIMBulkOperationResponse[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Resource Type (RFC 7643 §4.1)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMUserResource {\n  schemas: string[];\n  id: string;\n  externalId?: string;\n  userName: string;\n  name?: {\n    formatted?: string;\n    familyName?: string;\n    givenName?: string;\n  };\n  displayName?: string;\n  active: boolean;\n  emails?: Array<{\n    value: string;\n    type?: string;\n    primary?: boolean;\n  }>;\n  meta: {\n    resourceType: 'User';\n    created: string;\n    lastModified: string;\n    location: string;\n  };\n}\n\nexport interface SCIMListResponse<T = SCIMUserResource> {\n  schemas: [typeof SCIM_SCHEMAS.LIST_RESPONSE];\n  totalResults: number;\n  startIndex: number;\n  itemsPerPage: number;\n  Resources: T[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM ServiceProviderConfig (RFC 7643 §5)\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Where an application's SCIM discovery document sends a directory administrator for\n * documentation. Authored per application (`auth.scimDocumentation`), because the RFC defines\n * `documentationUri` as the SERVICE PROVIDER's documentation — and the service provider is the\n * application, not the framework it was built with.\n *\n * spec-cite: RFC 7643 §5 — \"An HTTP-addressable URL pointing to the service provider's\n * human-consumable help documentation. OPTIONAL.\"\n */\nexport interface ScimDocumentationUris {\n  /** RFC 7643 §5 `documentationUri` on the ServiceProviderConfig itself. */\n  readonly serviceProviderUri?: string;\n  /** RFC 7643 §5 `documentationUri` on the OAuth bearer-token authentication scheme. */\n  readonly authenticationSchemeUri?: string;\n}\n\n/**\n * Build the SCIM ServiceProviderConfig this application serves at\n * `GET /scim/v2/ServiceProviderConfig` (RFC 7643 §5).\n *\n * Everything except the two documentation URLs is a statement about THIS implementation and is\n * therefore fixed: patch and bulk are supported, filtering is capped, `changePassword`, `sort` and\n * `etag` are not. Those are facts about the code, not choices an application makes.\n *\n * ## Why the two URLs are parameters, and why absence OMITS rather than empties\n *\n * They were frozen here, pointing at `docs.wildo.ai/scim` and `/scim/auth` — a host with no DNS\n * record, so every application built on Wildo told its enterprise customers to go somewhere that\n * does not resolve. Both are OPTIONAL in the RFC, so a discovery document without them is\n * conformant; one carrying a URL that answers nothing is a false advertisement served to the exact\n * reader who is trying to integrate.\n *\n * spec-cite: RFC 7643 §5 — both the top-level `documentationUri` and the `authenticationSchemes`\n * sub-attribute of the same name are marked \"OPTIONAL.\" \n *\n * An absent value therefore removes the KEY. Emitting `documentationUri: ''` or `null` would\n * replace an unanswerable URL with a malformed one, and a directory-service client that reads the\n * field before checking it would be worse off than if the framework had said nothing.\n */\nexport function buildScimServiceProviderConfig(documentation?: ScimDocumentationUris) {\n  return {\n    schemas: [SCIM_SCHEMAS.SERVICE_PROVIDER_CONFIG],\n    ...(documentation?.serviceProviderUri ? { documentationUri: documentation.serviceProviderUri } : {}),\n    patch: { supported: true },\n    bulk: { supported: true, maxOperations: 100, maxPayloadSize: 1048576 },\n    filter: { supported: true, maxResults: 200 },\n    changePassword: { supported: false },\n    sort: { supported: false },\n    etag: { supported: false },\n    authenticationSchemes: [{\n      type: 'oauthbearertoken',\n      name: 'OAuth Bearer Token',\n      description: 'Authentication scheme using the OAuth Bearer Token Standard',\n      specUri: 'https://www.rfc-editor.org/info/rfc6750',\n      ...(documentation?.authenticationSchemeUri ? { documentationUri: documentation.authenticationSchemeUri } : {}),\n      primary: true,\n    }],\n    meta: {\n      resourceType: 'ServiceProviderConfig',\n      location: '/scim/v2/ServiceProviderConfig',\n    },\n  };\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Schema Definition (RFC 7643 §7)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_USER_SCHEMA_DEFINITION = {\n  schemas: [SCIM_SCHEMAS.SCHEMA],\n  id: SCIM_SCHEMAS.USER,\n  name: 'User',\n  description: 'User Account',\n  attributes: [\n    { name: 'userName', type: 'string', multiValued: false, required: true, caseExact: false, mutability: 'readWrite', returned: 'default', uniqueness: 'server' },\n    { name: 'name', type: 'complex', multiValued: false, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'givenName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'familyName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'formatted', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    ]},\n    { name: 'displayName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'active', type: 'boolean', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'emails', type: 'complex', multiValued: true, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'value', type: 'string', multiValued: false, required: true },\n      { name: 'type', type: 'string', multiValued: false, required: false },\n      { name: 'primary', type: 'boolean', multiValued: false, required: false },\n    ]},\n    { name: 'externalId', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n  ],\n  meta: {\n    resourceType: 'Schema',\n    location: `/scim/v2/Schemas/${SCIM_SCHEMAS.USER}`,\n  },\n} as const;\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Resource Types Definition (RFC 7644 §4)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_RESOURCE_TYPES = [{\n  schemas: [SCIM_SCHEMAS.RESOURCE_TYPE],\n  id: 'User',\n  name: 'User',\n  endpoint: '/Users',\n  description: 'User Account',\n  schema: SCIM_SCHEMAS.USER,\n  schemaExtensions: [{\n    schema: SCIM_SCHEMAS.ENTERPRISE_USER,\n    required: false,\n  }],\n  meta: {\n    resourceType: 'ResourceType',\n    location: '/scim/v2/ResourceTypes/User',\n  },\n}] as const;\n"]}

package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.d.ts

@@ -41,6 +41,12 @@
  * close it either — DNS can answer differently at connect time (rebinding) — so the complete defence
  * is enforcement in the egress path. Callers that want the intermediate strength
  * ({@link resolvesOnlyToPublicAddresses}) get an explicit check-then-connect with that residual named.
+ *
+ * **That egress-path enforcement now EXISTS**, in the sibling module
+ * `pinned-outbound-fetch.backend.utils.ts`: it classifies inside the connection's `lookup` hook, so
+ * the address validated and the address connected to are one value in one event. Every function here
+ * remains a pure classifier and keeps its stated residual — what changed is that a caller no longer
+ * has to live with it. A caller that makes the request itself, with its own `fetch`, still does.
  */
 /** Why an outbound target was refused. A closed vocabulary so caller messages stay stable. */
 export declare enum OutboundTargetRejection {
@@ -107,8 +113,10 @@ export declare enum OutboundTargetResolution {
  * client picking the other.
  *
  * ⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that changes
- * between the two (rebinding) is not covered. Closing it needs the request pinned to the validated
- * address, which Node's `fetch` does not expose.
+ * between the two (rebinding) is not covered by THIS function. Closing it needs the request pinned to
+ * the validated address — which Node's `fetch` does not expose, but `node:https`'s `lookup` hook
+ * does. `pinnedOutboundFetch` is built on that hook; a caller that issues its request through it has
+ * the residual closed, and a caller that does not, does not.
  *
  * `resolve` is injectable so callers can test the internal/public branches without a resolver.
  */

package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-target-guard.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,8FAA8F;AAC9F,oBAAY,uBAAuB;IACjC,8EAA8E;IAC9E,4BAA4B,iCAAiC;IAC7D,gGAAgG;IAChG,kBAAkB,uBAAuB;IACzC,kGAAkG;IAClG,2BAA2B,gCAAgC;IAC3D,mGAAmG;IACnG,6BAA6B,kCAAkC;CAChE;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlE;AAsCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAsB,GAAG,OAAO,CA6BxG;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,SAAS,CAsB3H;AAED,uGAAuG;AACvG,oBAAY,wBAAwB;IAClC,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GACpD,OAAO,CAAC,wBAAwB,CAAC,CAoBnC"}
+{"version":3,"file":"outbound-target-guard.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,8FAA8F;AAC9F,oBAAY,uBAAuB;IACjC,8EAA8E;IAC9E,4BAA4B,iCAAiC;IAC7D,gGAAgG;IAChG,kBAAkB,uBAAuB;IACzC,kGAAkG;IAClG,2BAA2B,gCAAgC;IAC3D,mGAAmG;IACnG,6BAA6B,kCAAkC;CAChE;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlE;AAsCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAsB,GAAG,OAAO,CA6BxG;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,SAAS,CAsB3H;AAED,uGAAuG;AACvG,oBAAY,wBAAwB;IAClC,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GACpD,OAAO,CAAC,wBAAwB,CAAC,CAoBnC"}

package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.js

@@ -41,6 +41,12 @@
  * close it either — DNS can answer differently at connect time (rebinding) — so the complete defence
  * is enforcement in the egress path. Callers that want the intermediate strength
  * ({@link resolvesOnlyToPublicAddresses}) get an explicit check-then-connect with that residual named.
+ *
+ * **That egress-path enforcement now EXISTS**, in the sibling module
+ * `pinned-outbound-fetch.backend.utils.ts`: it classifies inside the connection's `lookup` hook, so
+ * the address validated and the address connected to are one value in one event. Every function here
+ * remains a pure classifier and keeps its stated residual — what changed is that a caller no longer
+ * has to live with it. A caller that makes the request itself, with its own `fetch`, still does.
  */
 import { isIP } from 'node:net';
 /** Why an outbound target was refused. A closed vocabulary so caller messages stay stable. */
@@ -192,8 +198,10 @@ export var OutboundTargetResolution;
  * client picking the other.
  *
  * ⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that changes
- * between the two (rebinding) is not covered. Closing it needs the request pinned to the validated
- * address, which Node's `fetch` does not expose.
+ * between the two (rebinding) is not covered by THIS function. Closing it needs the request pinned to
+ * the validated address — which Node's `fetch` does not expose, but `node:https`'s `lookup` hook
+ * does. `pinnedOutboundFetch` is built on that hook; a caller that issues its request through it has
+ * the residual closed, and a caller that does not, does not.
  *
  * `resolve` is injectable so callers can test the internal/public branches without a resolver.
  */

package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-target-guard.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,8FAA8F;AAC9F,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,8EAA8E;IAC9E,wFAA6D,CAAA;IAC7D,gGAAgG;IAChG,oEAAyC,CAAA;IACzC,kGAAkG;IAClG,sFAA2D,CAAA;IAC3D,mGAAmG;IACnG,0FAA+D,CAAA;AACjE,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,4DAA4D;IAChH,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,OAAO,CACL,CAAC,KAAK,CAAC,CAAmC,4BAA4B;WACnE,CAAC,KAAK,EAAE,CAA+B,WAAW;WAClD,CAAC,KAAK,GAAG,CAA8B,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAK,6BAA6B;WACpE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,wDAAwD;WAC/F,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAM,WAAW;QACrD;;;;;;;;WAQG;WACA,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAE,wBAAwB;WAC/D,CAAC,IAAI,GAAG,CAA+B,6CAA6C;KACxF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,YAAoB,IAAI,CAAC,OAAO,CAAC;IAC7F,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAS,wBAAwB;IAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAoB,wBAAwB;IAC/E,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAiB,yCAAyC;IAChG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAuB,qBAAqB;IAE5E;;;;;;;OAOG;IACH,MAAM,YAAY,GAAG,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/D,IAAI,YAAY;QAAE,OAAO,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,MAA4B;IACpF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,uBAAuB,CAAC,kBAAkB,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,CAAC;IAED,OAAO,4BAA4B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC;AACzH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAN,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,yDAA6B,CAAA;AAC/B,CAAC,EAJW,wBAAwB,KAAxB,wBAAwB,QAInC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAgB,EAChB,OAAqD;IAErD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;IACrH,CAAC;IAED,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,mGAAmG;IACnG,6DAA6D;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC;IAErE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC,CAAC,wBAAwB,CAAC,QAAQ;QACnC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;AACtC,CAAC","sourcesContent":["/**\n * The ONE classification of \"is this address one the public internet cannot reach?\".\n *\n * ## Why this module exists\n *\n * Wildo makes server-side HTTP requests to destinations that come from application- or\n * tenant-authored configuration: M2M webhook endpoints, A2A push-notification targets, SIEM\n * collectors, SSO metadata documents, OAuth client-metadata documents. Every one of those is a\n * server-side request forgery primitive by construction, and the classic targets are the same in all\n * of them — `169.254.169.254` (cloud instance metadata), loopback admin ports, RFC 1918 space.\n *\n * Before this module the answer was written TWICE, privately, and the two copies disagreed:\n *\n * | Copy | Missing from it |\n * |---|---|\n * | `a2a-push-notification.backend.schemas.ts` (`isPrivateOrReservedAddress`) | IPv6 multicast `ff00::/8` |\n * | `cimd-client-metadata.backend.service.ts` (`isInternalAddress`) | `192.0.0.0/24` (IETF protocol assignments), `198.18.0.0/15` (benchmarking), the IPv4-mapped IPv6 HEX notation (`::ffff:a9fe:a9fe`), and the full `fe80::/10` link-local block (it matched only the literal `fe80:` prefix) |\n *\n * Both were written carefully, by authors who had read OWASP, eight months apart. Neither could see\n * the other because each was a module-private function — the exact shape\n * `.claude/rules/invariant-call-site-enumeration.md` #13 records, where the enumeration returns 1/1\n * and is *correct*, because the other site does not mention the symbol you searched for. The set\n * below is the UNION, so both call sites strictly improve.\n *\n * ## Block-list, not allow-list — and OWASP says why\n *\n * spec-cite: OWASP Server Side Request Forgery Prevention Cheat Sheet — *\"Case 2: application can\n * send request to ANY external IP address or domain name\"*, whose remedy is block-listing the\n * non-public ranges. An allow-list is unavailable here by construction: a tenant's webhook receiver,\n * an unknown OAuth client's metadata host and a customer's SIEM collector are all strangers.\n *\n * The ranges are an ALLOW-NOTHING list rather than a deny-list of known-bad addresses. A new reserved\n * block is far rarer than a new interesting internal service, so an unrecognised shape must not be\n * admitted merely because nobody enumerated it.\n *\n * ## What this CANNOT do, stated rather than hidden\n *\n * {@link isPrivateOrReservedIpAddress} classifies an ADDRESS. {@link classifyOutboundTargetUrl}\n * classifies a URL's SHAPE and, for a literal-IP host, its address. Neither resolves DNS, so\n * `evil.test` with an A record of `10.0.0.5` passes both. Resolving at validation time would not\n * close it either — DNS can answer differently at connect time (rebinding) — so the complete defence\n * is enforcement in the egress path. Callers that want the intermediate strength\n * ({@link resolvesOnlyToPublicAddresses}) get an explicit check-then-connect with that residual named.\n */\n\nimport { isIP } from 'node:net';\n\n/** Why an outbound target was refused. A closed vocabulary so caller messages stay stable. */\nexport enum OutboundTargetRejection {\n  /** Not parseable as an absolute URL, or not on a scheme the caller admits. */\n  NOT_ABSOLUTE_ADMITTED_SCHEME = 'not_absolute_admitted_scheme',\n  /** `https://user:pass@host` — the credentials would be replayed on every request and logged. */\n  CREDENTIALS_IN_URL = 'credentials_in_url',\n  /** A literal IP inside a private, loopback, link-local, multicast or otherwise reserved range. */\n  PRIVATE_OR_RESERVED_ADDRESS = 'private_or_reserved_address',\n  /** A hostname that resolves into the deployment's own network by DEFINITION rather than by DNS. */\n  RESERVED_SPECIAL_USE_HOSTNAME = 'reserved_special_use_hostname',\n}\n\n/**\n * Hostnames that reach the local machine by DEFINITION rather than by DNS answer.\n *\n * Deliberately grounded in special-use name registries instead of a list of cloud metadata\n * hostnames: a vendor list needs maintaining, names vendors in engine code, and is always one\n * provider behind.\n *\n * spec-cite: RFC 6761 §6.3 (`localhost` and any name ending in `.localhost` are special-use and\n * resolve to a loopback address) · RFC 6762 §3 (`.local` is reserved for link-local multicast DNS).\n */\nexport function isReservedSpecialUseHostname(host: string): boolean {\n  const name = host.toLowerCase().replace(/\\.$/, ''); // a trailing dot is a fully-qualified form of the same name\n  return name === 'localhost' || name.endsWith('.localhost') || name === 'local' || name.endsWith('.local');\n}\n\n/**\n * Is this literal IPv4 address one no externally-reachable service can live at?\n *\n * A MALFORMED address returns `true` — fail closed. A caller that cannot even parse the host it is\n * about to connect to has no basis for admitting it, and the alternative (admit what we could not\n * classify) is how notation tricks get through.\n */\nfunction isPrivateOrReservedIpv4(address: string): boolean {\n  const parts = address.split('.').map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {\n    return true;\n  }\n  const [a, b, c] = parts;\n  return (\n    a === 0                                   // \"this network\" — RFC 1122\n    || a === 10                               // RFC 1918\n    || a === 127                              // loopback\n    || (a === 100 && b >= 64 && b <= 127)     // RFC 6598 carrier-grade NAT\n    || (a === 169 && b === 254)               // link-local — INCLUDES 169.254.169.254, cloud metadata\n    || (a === 172 && b >= 16 && b <= 31)      // RFC 1918\n    /**\n     * RFC 6890 IETF protocol assignments — `192.0.0.0/**24**`, not `/16`.\n     *\n     * The A2A copy this list was merged from tested `a === 192 && b === 0`, which is a /16 and\n     * therefore over-blocked ~65,000 ORDINARY PUBLIC addresses (`192.0.1.x`, `192.0.3.x`, …) that are\n     * regular allocated space. Narrowed here to what the registry actually reserves, because an\n     * over-wide range is not \"extra safe\" — it silently refuses legitimate customer endpoints, and it\n     * is exactly the failure the adjacent-public controls in the test suite exist to catch.\n     */\n    || (a === 192 && b === 0 && c === 0)\n    || (a === 192 && b === 168)               // RFC 1918\n    || (a === 198 && (b === 18 || b === 19))  // RFC 2544 benchmarking\n    || a >= 224                               // multicast 224/4, reserved 240/4, broadcast\n  );\n}\n\n/**\n * Is this literal IP address (v4 or v6) one no externally-reachable service can live at?\n *\n * `ipVersion` may be supplied when the caller already computed it; otherwise it is derived. A value\n * that is not an IP at all returns `false` — this function answers a question about ADDRESSES, and a\n * hostname is the caller's job (see {@link isReservedSpecialUseHostname} and\n * {@link resolvesOnlyToPublicAddresses}).\n */\nexport function isPrivateOrReservedIpAddress(address: string, ipVersion: number = isIP(address)): boolean {\n  if (ipVersion === 4) return isPrivateOrReservedIpv4(address);\n  if (ipVersion !== 6) return false;\n\n  const v6 = address.toLowerCase();\n  if (v6 === '::' || v6 === '::1') return true;         // unspecified, loopback\n  if (/^f[cd]/.test(v6)) return true;                    // unique-local fc00::/7\n  if (/^fe[89ab]/.test(v6)) return true;                 // link-local fe80::/10 — the WHOLE block\n  if (/^ff/.test(v6)) return true;                       // multicast ff00::/8\n\n  /**\n   * IPv4-mapped — the same address wearing a different notation, and the notation that got past the\n   * first version of the A2A guard. `new URL()` NORMALISES `::ffff:169.254.169.254` to\n   * `::ffff:a9fe:a9fe`, so matching only the dotted form let the cloud metadata address through while\n   * every dotted-form pin stayed green. Both spellings are handled: the hex form is what arrives from\n   * a parsed URL, the dotted form is what arrives from a config read back out of storage or from a\n   * DNS answer.\n   */\n  const mappedDotted = v6.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (mappedDotted) return isPrivateOrReservedIpv4(mappedDotted[1]);\n\n  const mappedHex = v6.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n  if (mappedHex) {\n    const high = parseInt(mappedHex[1], 16);\n    const low = parseInt(mappedHex[2], 16);\n    return isPrivateOrReservedIpv4(`${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`);\n  }\n\n  return false;\n}\n\n/** Strip the brackets a parsed URL puts around an IPv6 literal, so `isIP` can read it. */\nexport function unwrapUrlHost(hostname: string): string {\n  return hostname.replace(/^\\[|\\]$/g, '');\n}\n\n/** What a caller admits, so one classifier can serve callers with different scheme policies. */\nexport interface OutboundTargetPolicy {\n  /**\n   * Schemes the caller will issue a request on. Pass `['https:']` where the value in transit is a\n   * credential; pass `['https:', 'http:']` where refusing plaintext would break existing authored\n   * configuration and that decision has not been taken.\n   */\n  admittedProtocols: readonly string[];\n}\n\n/**\n * Classify a target URL a caller is about to request, refusing the shapes that turn this server into\n * a request-forgery tool.\n *\n * Returns `undefined` for an admitted target. An ordinary hostname is admitted — see the module\n * header for why that is a stated residual rather than an oversight.\n */\nexport function classifyOutboundTargetUrl(rawUrl: string, policy: OutboundTargetPolicy): OutboundTargetRejection | undefined {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n\n  if (!policy.admittedProtocols.includes(url.protocol)) {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n  if (url.username || url.password) {\n    return OutboundTargetRejection.CREDENTIALS_IN_URL;\n  }\n\n  const host = unwrapUrlHost(url.hostname);\n  const ipVersion = isIP(host);\n  if (ipVersion === 0) {\n    return isReservedSpecialUseHostname(host) ? OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME : undefined;\n  }\n\n  return isPrivateOrReservedIpAddress(host, ipVersion) ? OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS : undefined;\n}\n\n/** Outcome of the DNS-resolving half, kept separate because \"did not resolve\" is not \"is internal\". */\nexport enum OutboundTargetResolution {\n  PUBLIC = 'public',\n  INTERNAL = 'internal',\n  UNRESOLVABLE = 'unresolvable',\n}\n\n/**\n * Resolve a hostname and check EVERY answer, not just the first.\n *\n * DNS is resolved rather than the hostname trusted, because `internal.example.com` may be a public\n * name with a private A record — the attack a shape check cannot see. Every resolved address is\n * checked because a hostile resolver can return one public and one private address and rely on the\n * client picking the other.\n *\n * ⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that changes\n * between the two (rebinding) is not covered. Closing it needs the request pinned to the validated\n * address, which Node's `fetch` does not expose.\n *\n * `resolve` is injectable so callers can test the internal/public branches without a resolver.\n */\nexport async function resolvesOnlyToPublicAddresses(\n  hostname: string,\n  resolve: (host: string) => Promise<readonly string[]>,\n): Promise<OutboundTargetResolution> {\n  const literal = unwrapUrlHost(hostname);\n  if (isIP(literal) !== 0) {\n    return isPrivateOrReservedIpAddress(literal) ? OutboundTargetResolution.INTERNAL : OutboundTargetResolution.PUBLIC;\n  }\n\n  let addresses: readonly string[];\n  try {\n    addresses = await resolve(hostname);\n  } catch {\n    return OutboundTargetResolution.UNRESOLVABLE;\n  }\n\n  // An empty answer is treated as INTERNAL rather than UNRESOLVABLE: the resolver succeeded and told\n  // us nothing usable, which is not evidence the name is safe.\n  if (addresses.length === 0) return OutboundTargetResolution.INTERNAL;\n\n  return addresses.some((address) => isPrivateOrReservedIpAddress(address))\n    ? OutboundTargetResolution.INTERNAL\n    : OutboundTargetResolution.PUBLIC;\n}\n"]}
+{"version":3,"file":"outbound-target-guard.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,8FAA8F;AAC9F,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,8EAA8E;IAC9E,wFAA6D,CAAA;IAC7D,gGAAgG;IAChG,oEAAyC,CAAA;IACzC,kGAAkG;IAClG,sFAA2D,CAAA;IAC3D,mGAAmG;IACnG,0FAA+D,CAAA;AACjE,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,4DAA4D;IAChH,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,OAAO,CACL,CAAC,KAAK,CAAC,CAAmC,4BAA4B;WACnE,CAAC,KAAK,EAAE,CAA+B,WAAW;WAClD,CAAC,KAAK,GAAG,CAA8B,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAK,6BAA6B;WACpE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,wDAAwD;WAC/F,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAM,WAAW;QACrD;;;;;;;;WAQG;WACA,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAE,wBAAwB;WAC/D,CAAC,IAAI,GAAG,CAA+B,6CAA6C;KACxF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,YAAoB,IAAI,CAAC,OAAO,CAAC;IAC7F,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAS,wBAAwB;IAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAoB,wBAAwB;IAC/E,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAiB,yCAAyC;IAChG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAuB,qBAAqB;IAE5E;;;;;;;OAOG;IACH,MAAM,YAAY,GAAG,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/D,IAAI,YAAY;QAAE,OAAO,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,MAA4B;IACpF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,uBAAuB,CAAC,kBAAkB,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,CAAC;IAED,OAAO,4BAA4B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC;AACzH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAN,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,yDAA6B,CAAA;AAC/B,CAAC,EAJW,wBAAwB,KAAxB,wBAAwB,QAInC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAgB,EAChB,OAAqD;IAErD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;IACrH,CAAC;IAED,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,mGAAmG;IACnG,6DAA6D;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC;IAErE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC,CAAC,wBAAwB,CAAC,QAAQ;QACnC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;AACtC,CAAC","sourcesContent":["/**\n * The ONE classification of \"is this address one the public internet cannot reach?\".\n *\n * ## Why this module exists\n *\n * Wildo makes server-side HTTP requests to destinations that come from application- or\n * tenant-authored configuration: M2M webhook endpoints, A2A push-notification targets, SIEM\n * collectors, SSO metadata documents, OAuth client-metadata documents. Every one of those is a\n * server-side request forgery primitive by construction, and the classic targets are the same in all\n * of them — `169.254.169.254` (cloud instance metadata), loopback admin ports, RFC 1918 space.\n *\n * Before this module the answer was written TWICE, privately, and the two copies disagreed:\n *\n * | Copy | Missing from it |\n * |---|---|\n * | `a2a-push-notification.backend.schemas.ts` (`isPrivateOrReservedAddress`) | IPv6 multicast `ff00::/8` |\n * | `cimd-client-metadata.backend.service.ts` (`isInternalAddress`) | `192.0.0.0/24` (IETF protocol assignments), `198.18.0.0/15` (benchmarking), the IPv4-mapped IPv6 HEX notation (`::ffff:a9fe:a9fe`), and the full `fe80::/10` link-local block (it matched only the literal `fe80:` prefix) |\n *\n * Both were written carefully, by authors who had read OWASP, eight months apart. Neither could see\n * the other because each was a module-private function — the exact shape\n * `.claude/rules/invariant-call-site-enumeration.md` #13 records, where the enumeration returns 1/1\n * and is *correct*, because the other site does not mention the symbol you searched for. The set\n * below is the UNION, so both call sites strictly improve.\n *\n * ## Block-list, not allow-list — and OWASP says why\n *\n * spec-cite: OWASP Server Side Request Forgery Prevention Cheat Sheet — *\"Case 2: application can\n * send request to ANY external IP address or domain name\"*, whose remedy is block-listing the\n * non-public ranges. An allow-list is unavailable here by construction: a tenant's webhook receiver,\n * an unknown OAuth client's metadata host and a customer's SIEM collector are all strangers.\n *\n * The ranges are an ALLOW-NOTHING list rather than a deny-list of known-bad addresses. A new reserved\n * block is far rarer than a new interesting internal service, so an unrecognised shape must not be\n * admitted merely because nobody enumerated it.\n *\n * ## What this CANNOT do, stated rather than hidden\n *\n * {@link isPrivateOrReservedIpAddress} classifies an ADDRESS. {@link classifyOutboundTargetUrl}\n * classifies a URL's SHAPE and, for a literal-IP host, its address. Neither resolves DNS, so\n * `evil.test` with an A record of `10.0.0.5` passes both. Resolving at validation time would not\n * close it either — DNS can answer differently at connect time (rebinding) — so the complete defence\n * is enforcement in the egress path. Callers that want the intermediate strength\n * ({@link resolvesOnlyToPublicAddresses}) get an explicit check-then-connect with that residual named.\n *\n * **That egress-path enforcement now EXISTS**, in the sibling module\n * `pinned-outbound-fetch.backend.utils.ts`: it classifies inside the connection's `lookup` hook, so\n * the address validated and the address connected to are one value in one event. Every function here\n * remains a pure classifier and keeps its stated residual — what changed is that a caller no longer\n * has to live with it. A caller that makes the request itself, with its own `fetch`, still does.\n */\n\nimport { isIP } from 'node:net';\n\n/** Why an outbound target was refused. A closed vocabulary so caller messages stay stable. */\nexport enum OutboundTargetRejection {\n  /** Not parseable as an absolute URL, or not on a scheme the caller admits. */\n  NOT_ABSOLUTE_ADMITTED_SCHEME = 'not_absolute_admitted_scheme',\n  /** `https://user:pass@host` — the credentials would be replayed on every request and logged. */\n  CREDENTIALS_IN_URL = 'credentials_in_url',\n  /** A literal IP inside a private, loopback, link-local, multicast or otherwise reserved range. */\n  PRIVATE_OR_RESERVED_ADDRESS = 'private_or_reserved_address',\n  /** A hostname that resolves into the deployment's own network by DEFINITION rather than by DNS. */\n  RESERVED_SPECIAL_USE_HOSTNAME = 'reserved_special_use_hostname',\n}\n\n/**\n * Hostnames that reach the local machine by DEFINITION rather than by DNS answer.\n *\n * Deliberately grounded in special-use name registries instead of a list of cloud metadata\n * hostnames: a vendor list needs maintaining, names vendors in engine code, and is always one\n * provider behind.\n *\n * spec-cite: RFC 6761 §6.3 (`localhost` and any name ending in `.localhost` are special-use and\n * resolve to a loopback address) · RFC 6762 §3 (`.local` is reserved for link-local multicast DNS).\n */\nexport function isReservedSpecialUseHostname(host: string): boolean {\n  const name = host.toLowerCase().replace(/\\.$/, ''); // a trailing dot is a fully-qualified form of the same name\n  return name === 'localhost' || name.endsWith('.localhost') || name === 'local' || name.endsWith('.local');\n}\n\n/**\n * Is this literal IPv4 address one no externally-reachable service can live at?\n *\n * A MALFORMED address returns `true` — fail closed. A caller that cannot even parse the host it is\n * about to connect to has no basis for admitting it, and the alternative (admit what we could not\n * classify) is how notation tricks get through.\n */\nfunction isPrivateOrReservedIpv4(address: string): boolean {\n  const parts = address.split('.').map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {\n    return true;\n  }\n  const [a, b, c] = parts;\n  return (\n    a === 0                                   // \"this network\" — RFC 1122\n    || a === 10                               // RFC 1918\n    || a === 127                              // loopback\n    || (a === 100 && b >= 64 && b <= 127)     // RFC 6598 carrier-grade NAT\n    || (a === 169 && b === 254)               // link-local — INCLUDES 169.254.169.254, cloud metadata\n    || (a === 172 && b >= 16 && b <= 31)      // RFC 1918\n    /**\n     * RFC 6890 IETF protocol assignments — `192.0.0.0/**24**`, not `/16`.\n     *\n     * The A2A copy this list was merged from tested `a === 192 && b === 0`, which is a /16 and\n     * therefore over-blocked ~65,000 ORDINARY PUBLIC addresses (`192.0.1.x`, `192.0.3.x`, …) that are\n     * regular allocated space. Narrowed here to what the registry actually reserves, because an\n     * over-wide range is not \"extra safe\" — it silently refuses legitimate customer endpoints, and it\n     * is exactly the failure the adjacent-public controls in the test suite exist to catch.\n     */\n    || (a === 192 && b === 0 && c === 0)\n    || (a === 192 && b === 168)               // RFC 1918\n    || (a === 198 && (b === 18 || b === 19))  // RFC 2544 benchmarking\n    || a >= 224                               // multicast 224/4, reserved 240/4, broadcast\n  );\n}\n\n/**\n * Is this literal IP address (v4 or v6) one no externally-reachable service can live at?\n *\n * `ipVersion` may be supplied when the caller already computed it; otherwise it is derived. A value\n * that is not an IP at all returns `false` — this function answers a question about ADDRESSES, and a\n * hostname is the caller's job (see {@link isReservedSpecialUseHostname} and\n * {@link resolvesOnlyToPublicAddresses}).\n */\nexport function isPrivateOrReservedIpAddress(address: string, ipVersion: number = isIP(address)): boolean {\n  if (ipVersion === 4) return isPrivateOrReservedIpv4(address);\n  if (ipVersion !== 6) return false;\n\n  const v6 = address.toLowerCase();\n  if (v6 === '::' || v6 === '::1') return true;         // unspecified, loopback\n  if (/^f[cd]/.test(v6)) return true;                    // unique-local fc00::/7\n  if (/^fe[89ab]/.test(v6)) return true;                 // link-local fe80::/10 — the WHOLE block\n  if (/^ff/.test(v6)) return true;                       // multicast ff00::/8\n\n  /**\n   * IPv4-mapped — the same address wearing a different notation, and the notation that got past the\n   * first version of the A2A guard. `new URL()` NORMALISES `::ffff:169.254.169.254` to\n   * `::ffff:a9fe:a9fe`, so matching only the dotted form let the cloud metadata address through while\n   * every dotted-form pin stayed green. Both spellings are handled: the hex form is what arrives from\n   * a parsed URL, the dotted form is what arrives from a config read back out of storage or from a\n   * DNS answer.\n   */\n  const mappedDotted = v6.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (mappedDotted) return isPrivateOrReservedIpv4(mappedDotted[1]);\n\n  const mappedHex = v6.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n  if (mappedHex) {\n    const high = parseInt(mappedHex[1], 16);\n    const low = parseInt(mappedHex[2], 16);\n    return isPrivateOrReservedIpv4(`${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`);\n  }\n\n  return false;\n}\n\n/** Strip the brackets a parsed URL puts around an IPv6 literal, so `isIP` can read it. */\nexport function unwrapUrlHost(hostname: string): string {\n  return hostname.replace(/^\\[|\\]$/g, '');\n}\n\n/** What a caller admits, so one classifier can serve callers with different scheme policies. */\nexport interface OutboundTargetPolicy {\n  /**\n   * Schemes the caller will issue a request on. Pass `['https:']` where the value in transit is a\n   * credential; pass `['https:', 'http:']` where refusing plaintext would break existing authored\n   * configuration and that decision has not been taken.\n   */\n  admittedProtocols: readonly string[];\n}\n\n/**\n * Classify a target URL a caller is about to request, refusing the shapes that turn this server into\n * a request-forgery tool.\n *\n * Returns `undefined` for an admitted target. An ordinary hostname is admitted — see the module\n * header for why that is a stated residual rather than an oversight.\n */\nexport function classifyOutboundTargetUrl(rawUrl: string, policy: OutboundTargetPolicy): OutboundTargetRejection | undefined {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n\n  if (!policy.admittedProtocols.includes(url.protocol)) {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n  if (url.username || url.password) {\n    return OutboundTargetRejection.CREDENTIALS_IN_URL;\n  }\n\n  const host = unwrapUrlHost(url.hostname);\n  const ipVersion = isIP(host);\n  if (ipVersion === 0) {\n    return isReservedSpecialUseHostname(host) ? OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME : undefined;\n  }\n\n  return isPrivateOrReservedIpAddress(host, ipVersion) ? OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS : undefined;\n}\n\n/** Outcome of the DNS-resolving half, kept separate because \"did not resolve\" is not \"is internal\". */\nexport enum OutboundTargetResolution {\n  PUBLIC = 'public',\n  INTERNAL = 'internal',\n  UNRESOLVABLE = 'unresolvable',\n}\n\n/**\n * Resolve a hostname and check EVERY answer, not just the first.\n *\n * DNS is resolved rather than the hostname trusted, because `internal.example.com` may be a public\n * name with a private A record — the attack a shape check cannot see. Every resolved address is\n * checked because a hostile resolver can return one public and one private address and rely on the\n * client picking the other.\n *\n * ⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that changes\n * between the two (rebinding) is not covered by THIS function. Closing it needs the request pinned to\n * the validated address — which Node's `fetch` does not expose, but `node:https`'s `lookup` hook\n * does. `pinnedOutboundFetch` is built on that hook; a caller that issues its request through it has\n * the residual closed, and a caller that does not, does not.\n *\n * `resolve` is injectable so callers can test the internal/public branches without a resolver.\n */\nexport async function resolvesOnlyToPublicAddresses(\n  hostname: string,\n  resolve: (host: string) => Promise<readonly string[]>,\n): Promise<OutboundTargetResolution> {\n  const literal = unwrapUrlHost(hostname);\n  if (isIP(literal) !== 0) {\n    return isPrivateOrReservedIpAddress(literal) ? OutboundTargetResolution.INTERNAL : OutboundTargetResolution.PUBLIC;\n  }\n\n  let addresses: readonly string[];\n  try {\n    addresses = await resolve(hostname);\n  } catch {\n    return OutboundTargetResolution.UNRESOLVABLE;\n  }\n\n  // An empty answer is treated as INTERNAL rather than UNRESOLVABLE: the resolver succeeded and told\n  // us nothing usable, which is not evidence the name is safe.\n  if (addresses.length === 0) return OutboundTargetResolution.INTERNAL;\n\n  return addresses.some((address) => isPrivateOrReservedIpAddress(address))\n    ? OutboundTargetResolution.INTERNAL\n    : OutboundTargetResolution.PUBLIC;\n}\n"]}

package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.d.ts

@@ -0,0 +1,143 @@
+/**
+ * An outbound HTTP request that CONNECTS to the address it VALIDATED — the half
+ * {@link classifyOutboundTargetUrl} and {@link resolvesOnlyToPublicAddresses} structurally cannot do.
+ *
+ * ## The hole this closes, and why the classifier alone could never close it
+ *
+ * Every guard in the sibling module answers a question and then hands the answer to somebody else,
+ * who makes a SEPARATE connection. That is a check-then-connect, and the guard's own header says so:
+ *
+ *   "⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that
+ *    changes between the two (rebinding) is not covered. Closing it needs the request pinned to the
+ *    validated address, which Node's `fetch` does not expose."
+ *
+ * So a name whose A record answers `93.184.216.34` to the validating resolver and `169.254.169.254`
+ * to the connecting one passes every check in this directory and still reaches cloud instance
+ * metadata. The window is small and entirely attacker-controlled: the attacker owns the zone, so the
+ * attacker chooses the TTL and therefore the width of the window.
+ *
+ * The classifier cannot fix this at any level of effort, because the defect is not in the answer —
+ * the answer was correct when it was given. The defect is that the answer is thrown away before the
+ * socket is opened.
+ *
+ * ## The mechanism, chosen after measuring the alternatives
+ *
+ * `net.Socket.connect` accepts a **`lookup` hook**, and `http.request` / `https.request` pass it
+ * straight through. Node calls it at CONNECT time, and the address it returns is the address the
+ * socket is opened to — there is no second resolution and therefore no window. Classifying inside
+ * the hook makes validation and connection the SAME event rather than two events with a gap.
+ *
+ * Measured on this Node (2026-09-08) rather than assumed, because each of these decided the design:
+ *
+ * | probe | result |
+ * |---|---|
+ * | is `lookup` called for a hostname? | yes, as `lookup(host, { hints, all: true }, cb)` — note `all` |
+ * | is `lookup` called for an IP LITERAL? | **no** — `net` short-circuits, so literals need the shape check |
+ * | does an error raised inside the hook reach the caller? | yes, same error object, `message` and `code` intact |
+ * | does TLS still verify against the NAME while connected to the pinned IP? | **yes** — a cert for `pinned.test` validated over a socket to `127.0.0.1` |
+ *
+ * That last row is what makes the whole approach viable. Pinning by rewriting the URL's host to the
+ * validated IP — the obvious alternative — breaks SNI and certificate verification, i.e. it trades an
+ * SSRF hole for a transport-security hole. Pinning through `lookup` keeps the hostname everywhere it
+ * is a security input (SNI, certificate subject, the `Host` header) and replaces it only where it is
+ * a routing input.
+ *
+ * ## Why this is not `fetch` with a dispatcher
+ *
+ * Node's `fetch` exposes no `lookup` hook. The undici route (`new Agent({ connect: { lookup } })`)
+ * would work, but undici is not a declared dependency of this package — it is present in the store
+ * only transitively — so taking it would add a second HTTP stack beside the one Node already embeds,
+ * for a hook `node:https` exposes natively. Rejected on that basis, not on preference.
+ *
+ * `node:https` also gives one property for free that `fetch` needs an option for: **it does not
+ * follow redirects at all.** A 302 arrives as a 302 the caller can see. `redirect: 'error'` is
+ * therefore not something this module has to remember to pass — following a redirect to a target the
+ * guard never saw is unrepresentable here.
+ *
+ * ## What this still does NOT do
+ *
+ * It does not defend a target that is public at connect time and hostile at the application layer,
+ * and it does not stop a public host from being an open proxy into somebody else's private network.
+ * Those are different problems with different answers. What it removes is the specific gap between
+ * "we checked this name" and "we opened this socket".
+ *
+ * assurance-control: WILDO.NETWORK.OUTBOUND_TARGET_CONTROL — a server-side request initiated from
+ * application- or tenant-authored configuration reaches only an address the deployment admits
+ */
+import { type LookupAddress } from 'node:dns';
+import { OutboundTargetRejection, type OutboundTargetPolicy } from '../../security/ssrf/outbound-target-guard.backend.utils';
+/**
+ * Raised when the target was refused. Carries the closed-vocabulary reason so a caller can map it
+ * onto its OWN rejection vocabulary rather than pattern-matching a message.
+ *
+ * `refusedAddress` is present only for a connect-time refusal — it is the address the resolver
+ * returned at the moment of connection, which is the evidence that a rebinding attempt happened
+ * rather than a merely mis-authored URL.
+ */
+export declare class OutboundTargetRefusedError extends Error {
+    readonly rejection: OutboundTargetRejection;
+    readonly refusedAddress?: string;
+    /**
+     * A stable `code` alongside the class, because the error crosses `net`'s internals on its way out
+     * of the `lookup` hook. The class identity survives on this Node (measured), but a `code` is what
+     * every other error in that path carries and it costs nothing to be robust to a future wrap.
+     */
+    readonly code = "WILDO_OUTBOUND_TARGET_REFUSED";
+    constructor(rejection: OutboundTargetRejection, refusedAddress?: string);
+}
+/** The `dns.lookup` shape the connection hook needs, injectable so a test can drive both branches. */
+export type PinnedAddressResolver = (hostname: string) => Promise<readonly LookupAddress[]>;
+export interface PinnedOutboundRequestInit extends OutboundTargetPolicy {
+    method?: string;
+    headers?: Readonly<Record<string, string>>;
+    /** Already-serialized request body. `content-length` is computed here; do not pass one. */
+    body?: string;
+    signal?: AbortSignal;
+    /**
+     * OPERATOR-authored escape: admit an address the public internet cannot reach.
+     *
+     * It exists because one legitimate outbound target class genuinely lives on a private network — a
+     * self-hosted SIEM collector on the same VPC as the application. Refusing that unconditionally
+     * would not be "safe", it would break a supported deployment shape.
+     *
+     * Three properties keep it from being an SSRF bypass with a checkbox, and all three are the
+     * caller's obligation rather than this module's:
+     *
+     * 1. **It is never the default.** Absent means refuse.
+     * 2. **It must be authored by the DEPLOYMENT OPERATOR, never by the tenant whose row supplies the
+     *    URL.** A tenant-settable "allow private addresses" flag hands the attacker the switch that
+     *    disarms the guard aimed at them. This is why the SIEM escape lives on the application
+     *    configuration and not on `siemExportConfig`, which an organization administrator authors.
+     * 3. **It must never reach a target class whose URL comes from an UNAUTHENTICATED stranger.** CIMD
+     *    resolves a `client_id` supplied by anyone who can reach the authorization endpoint; there is
+     *    no operator on earth who means "let strangers address my metadata service".
+     *
+     * Note what it does NOT relax: the scheme policy and the credentials-in-URL refusal still apply,
+     * and the connection is still pinned. It widens WHICH addresses are admitted, never whether the
+     * address that was admitted is the one connected to.
+     */
+    admitPrivateAddresses?: boolean;
+    /**
+     * Resolver used by the connection hook. Defaults to the system resolver.
+     *
+     * Injectable for the same reason `resolvesOnlyToPublicAddresses` takes one: the two branches that
+     * matter (a name that answers public, a name that answers private) cannot be exercised against a
+     * real resolver without owning a zone, and a rebinding pin needs a resolver that answers
+     * DIFFERENTLY on its second call — which is exactly what no real resolver will do on demand.
+     */
+    resolveAddresses?: PinnedAddressResolver;
+}
+/**
+ * Make the request, connecting only to an address classified at the moment of connection.
+ *
+ * Returns a real {@link Response} built over the incoming message, so callers keep `ok`, `status`,
+ * `headers.get()`, `body.getReader()` and `text()` — every surface the `fetch` this replaces gave
+ * them. It is a genuine `Response`, not a look-alike: streaming size enforcement (CIMD reads the body
+ * with a running byte counter and cancels the reader) works unchanged.
+ *
+ * Throws {@link OutboundTargetRefusedError} for a refusal, and whatever `node:http` throws for a
+ * transport failure — callers already distinguish those, and conflating them would turn "your
+ * collector is down" into "your collector is an SSRF attempt".
+ */
+export declare function pinnedOutboundFetch(rawUrl: string, init: PinnedOutboundRequestInit): Promise<Response>;
+//# sourceMappingURL=pinned-outbound-fetch.backend.utils.d.ts.map

package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-outbound-fetch.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/ssrf/pinned-outbound-fetch.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAMnE,OAAO,EACL,uBAAuB,EAGvB,KAAK,oBAAoB,EAC1B,MAAM,sEAAsE,CAAC;AAE9E;;;;;;;GAOG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;aASjC,SAAS,EAAE,uBAAuB;aAClC,cAAc,CAAC,EAAE,MAAM;IATzC;;;;OAIG;IACH,SAAgB,IAAI,mCAAmC;gBAGrC,SAAS,EAAE,uBAAuB,EAClC,cAAc,CAAC,EAAE,MAAM;CAK1C;AAED,sGAAsG;AACtG,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;AAE5F,MAAM,WAAW,yBAA0B,SAAQ,oBAAoB;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AA8CD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoH5G"}