npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1358) hide show

package/dist/esm/security/authentications/models/auth-constants.backend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-constants.backend.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/auth-constants.backend.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;CA0gBlB,CAAC;AAIX,oBAAY,2BAA2B;IACrC,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAIvD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;CAejB,CAAC;AAIX,eAAO,MAAM,iBAAiB;;;CAGpB,CAAC;AAIX,oBAAY,UAAU;IACpB,IAAI,SAAS;IACb,IAAI,SAAS;CACd"}
1	+ {"version":3,"file":"auth-constants.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/auth-constants.backend.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;CA0gBlB,CAAC;AAIX,oBAAY,2BAA2B;IACrC,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAIvD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;CAejB,CAAC;AAIX,eAAO,MAAM,iBAAiB;;;CAGpB,CAAC;AAIX,oBAAY,UAAU;IACpB,IAAI,SAAS;IACb,IAAI,SAAS;CACd"}

package/dist/esm/security/authentications/models/authentications.backend.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentications.backend.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/authentications.backend.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB;;;;;;iBAM7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;oEAEoE;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;oEAEoE;AAEpE,eAAO,MAAM,+CAA+C,EAAE;IAC5D,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,YAAY,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3C,mBAAmB,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,cAAc,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3C,oBAAoB,EAAE,CAAC,CAAC,SAAS,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;IAC1D,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CAoCvC,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;;UA/CzC,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,YAAY,CAAC;YAC9D,CAAC,CAAC,SAAS;mBACJ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;yBACrB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;0BACpB,CAAC,CAAC,SAAS;iBACpB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC;SACpD,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;WACxB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;eAClC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;iBAsCiG,CAAC;AAEzI,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAEjG;;;;;;;;;;;;oEAYoE;AAEpE,eAAO,MAAM,uDAAuD,EAAE;IACpE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,oBAAoB,CAAC,CAAC;IAC/E,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,WAAW,CAAC,CAAC;CASvC,CAAC;AAEF,eAAO,MAAM,4CAA4C;;;;;;UAdjD,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,oBAAoB,CAAC;cACpE,CAAC,CAAC,SAAS;aACZ,CAAC,CAAC,SAAS;WACb,CAAC,CAAC,QAAQ,CAAC,OAAO,WAAW,CAAC;iBAWiH,CAAC;AACzJ,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAEjH,eAAO,MAAM,sDAAsD,EAAE;IACnE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,WAAW,CAAC,CAAC;CASvC,CAAC;AAEF,eAAO,MAAM,2CAA2C;;;;;;UAdhD,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,mBAAmB,CAAC;cACnE,CAAC,CAAC,SAAS;aACZ,CAAC,CAAC,SAAS;WACb,CAAC,CAAC,QAAQ,CAAC,OAAO,WAAW,CAAC;iBAW+G,CAAC;AACvJ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAE/G,kFAAkF;AAClF,MAAM,MAAM,yBAAyB,GAAG,qCAAqC,GAAG,oCAAoC,CAAC;AAErH;;oEAEoE;AAEpE,eAAO,MAAM,oCAAoC;;;;;;;;;iBAI/C,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;oEAEoE;AAEpE,eAAO,MAAM,uDAAuD,EAAE;IACpE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,YAAY,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,mBAAmB,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,cAAc,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3C,oBAAoB,EAAE,CAAC,CAAC,SAAS,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;IAC1D,qBAAqB,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CAmBnD,CAAC;AAEF,eAAO,MAAM,4CAA4C;;;;;;;;UA3BjD,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,YAAY,CAAC;YAC9D,CAAC,CAAC,SAAS;yBACE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;0BACpB,CAAC,CAAC,SAAS;iBACpB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC;2BAClC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;iBAqB6G,CAAC;AAEjK,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAEjH;;oEAEoE;AAEpE;qGACqG;AACrG,MAAM,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;AAC1E;wFACwF;AACxF,MAAM,MAAM,kCAAkC,GAAG,yBAAyB,CAAC;AAC3E,MAAM,MAAM,kCAAkC,GAAG,qCAAqC,CAAC;AAEvF;qFACqF;AACrF,MAAM,MAAM,iBAAiB,GAAG,6BAA6B,GAAG,yBAAyB,CAAC;AAC1F,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAIhE,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAC9E,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAgD,CAAC"}
1	+ {"version":3,"file":"authentications.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/authentications.backend.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB;;;;;;iBAM7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;oEAEoE;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;iBAEvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;oEAEoE;AAEpE,eAAO,MAAM,+CAA+C,EAAE;IAC5D,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,YAAY,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3C,mBAAmB,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,cAAc,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3C,oBAAoB,EAAE,CAAC,CAAC,SAAS,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;IAC1D,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CAoCvC,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;;UA/CzC,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,YAAY,CAAC;YAC9D,CAAC,CAAC,SAAS;mBACJ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;yBACrB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;0BACpB,CAAC,CAAC,SAAS;iBACpB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC;SACpD,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;WACxB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;eAClC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;iBAsCiG,CAAC;AAEzI,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAEjG;;;;;;;;;;;;oEAYoE;AAEpE,eAAO,MAAM,uDAAuD,EAAE;IACpE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,oBAAoB,CAAC,CAAC;IAC/E,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,WAAW,CAAC,CAAC;CASvC,CAAC;AAEF,eAAO,MAAM,4CAA4C;;;;;;UAdjD,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,oBAAoB,CAAC;cACpE,CAAC,CAAC,SAAS;aACZ,CAAC,CAAC,SAAS;WACb,CAAC,CAAC,QAAQ,CAAC,OAAO,WAAW,CAAC;iBAWiH,CAAC;AACzJ,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAEjH,eAAO,MAAM,sDAAsD,EAAE;IACnE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,WAAW,CAAC,CAAC;CASvC,CAAC;AAEF,eAAO,MAAM,2CAA2C;;;;;;UAdhD,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,mBAAmB,CAAC;cACnE,CAAC,CAAC,SAAS;aACZ,CAAC,CAAC,SAAS;WACb,CAAC,CAAC,QAAQ,CAAC,OAAO,WAAW,CAAC;iBAW+G,CAAC;AACvJ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAE/G,kFAAkF;AAClF,MAAM,MAAM,yBAAyB,GAAG,qCAAqC,GAAG,oCAAoC,CAAC;AAErH;;oEAEoE;AAEpE,eAAO,MAAM,oCAAoC;;;;;;;;;iBAI/C,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;oEAEoE;AAEpE,eAAO,MAAM,uDAAuD,EAAE;IACpE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,YAAY,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,mBAAmB,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChD,cAAc,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3C,oBAAoB,EAAE,CAAC,CAAC,SAAS,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;IAC1D,qBAAqB,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CAmBnD,CAAC;AAEF,eAAO,MAAM,4CAA4C;;;;;;;;UA3BjD,CAAC,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,YAAY,CAAC;YAC9D,CAAC,CAAC,SAAS;yBACE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC/B,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;0BACpB,CAAC,CAAC,SAAS;iBACpB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC;2BAClC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;iBAqB6G,CAAC;AAEjK,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAEjH;;oEAEoE;AAEpE;qGACqG;AACrG,MAAM,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;AAC1E;wFACwF;AACxF,MAAM,MAAM,kCAAkC,GAAG,yBAAyB,CAAC;AAC3E,MAAM,MAAM,kCAAkC,GAAG,qCAAqC,CAAC;AAEvF;qFACqF;AACrF,MAAM,MAAM,iBAAiB,GAAG,6BAA6B,GAAG,yBAAyB,CAAC;AAC1F,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAIhE,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAC9E,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAgD,CAAC"}

package/dist/esm/security/authentications/models/authorization-client.backend.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authorization-client.backend.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/authorization-client.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yEAAyE,CAAC;AAElH;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC,4DAA4D;IAC5D,YAAY,iBAAiB;IAC7B,uEAAuE;IACvE,WAAW,gBAAgB;IAC3B;;;;;;OAMG;IACH,YAAY,iBAAiB;CAC9B;AAED,+CAA+C;AAC/C,oBAAY,yBAAyB;IACnC,mFAAmF;IACnF,UAAU,eAAe;IACzB,kEAAkE;IAClE,2BAA2B,gCAAgC;CAC5D;AAED,+FAA+F;AAC/F,UAAU,iCAAiC;IACzC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,0CAA0C;IAC1C,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sCAAsC;IACtC,aAAa,EAAE,SAAS,cAAc,EAAE,CAAC;CAC1C;AAED,6EAA6E;AAC7E,MAAM,WAAW,6BAA8B,SAAQ,iCAAiC;IACtF,MAAM,EAAE,yBAAyB,CAAC,UAAU,CAAC;IAC7C;;;;;;;;;OASG;IACH,OAAO,EACH;QAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACrF;QAAE,IAAI,EAAE,0BAA0B,CAAC,WAAW,CAAA;KAAE,GAChD;QAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,CAAA;KAAE,CAAC;IACtD;;;;;;OAMG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,yFAAyF;AACzF,MAAM,WAAW,2CAA4C,SAAQ,iCAAiC;IACpG,MAAM,EAAE,yBAAyB,CAAC,2BAA2B,CAAC;IAC9D,OAAO,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,CAAA;KAAE,CAAC;IAC3D;;;;;;;;;OASG;IACH,2BAA2B,EAAE,OAAO,CAAC;IACrC,mGAAmG;IACnG,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,MAAM,2BAA2B,GAAG,6BAA6B,GAAG,2CAA2C,CAAC;AAEtH,wGAAwG;AACxG,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,2BAA2B,GAClC,MAAM,IAAI,2CAA2C,CAEvD"}
1	+ {"version":3,"file":"authorization-client.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/authorization-client.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yEAAyE,CAAC;AAElH;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC,4DAA4D;IAC5D,YAAY,iBAAiB;IAC7B,uEAAuE;IACvE,WAAW,gBAAgB;IAC3B;;;;;;OAMG;IACH,YAAY,iBAAiB;CAC9B;AAED,+CAA+C;AAC/C,oBAAY,yBAAyB;IACnC,mFAAmF;IACnF,UAAU,eAAe;IACzB,kEAAkE;IAClE,2BAA2B,gCAAgC;CAC5D;AAED,+FAA+F;AAC/F,UAAU,iCAAiC;IACzC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,0CAA0C;IAC1C,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sCAAsC;IACtC,aAAa,EAAE,SAAS,cAAc,EAAE,CAAC;CAC1C;AAED,6EAA6E;AAC7E,MAAM,WAAW,6BAA8B,SAAQ,iCAAiC;IACtF,MAAM,EAAE,yBAAyB,CAAC,UAAU,CAAC;IAC7C;;;;;;;;;OASG;IACH,OAAO,EACH;QAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,CAAC;QAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACrF;QAAE,IAAI,EAAE,0BAA0B,CAAC,WAAW,CAAA;KAAE,GAChD;QAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,CAAA;KAAE,CAAC;IACtD;;;;;;OAMG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,yFAAyF;AACzF,MAAM,WAAW,2CAA4C,SAAQ,iCAAiC;IACpG,MAAM,EAAE,yBAAyB,CAAC,2BAA2B,CAAC;IAC9D,OAAO,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAC,YAAY,CAAA;KAAE,CAAC;IAC3D;;;;;;;;;OASG;IACH,2BAA2B,EAAE,OAAO,CAAC;IACrC,mGAAmG;IACnG,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,MAAM,2BAA2B,GAAG,6BAA6B,GAAG,2CAA2C,CAAC;AAEtH,wGAAwG;AACxG,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,2BAA2B,GAClC,MAAM,IAAI,2CAA2C,CAEvD"}

package/dist/esm/security/authentications/models/cimd.backend.schemas.d.ts CHANGED Viewed

@@ -115,6 +115,7 @@ export declare const CimdClientMetadataSchema: z.ZodObject<{
     token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
     jwks_uri: z.ZodOptional<z.ZodString>;
     jwks: z.ZodOptional<z.ZodUnknown>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$loose>;
 export type CimdClientMetadata = z.infer<typeof CimdClientMetadataSchema>;
 /**

package/dist/esm/security/authentications/models/cimd.backend.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cimd.backend.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/cimd.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,oBAAY,eAAe;IACzB;;;;;;;OAOG;IACH,QAAQ,aAAa;IACrB;;;;;;;;;OASG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B;;;iBAQtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;iBAUhD,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB~~;;;;;;;;;;;iBAWrB~~,CAAC;AAEjB,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,oBAAY,mBAAmB;IAC7B,2CAA2C;IAC3C,eAAe,oBAAoB;IACnC,uDAAuD;IACvD,gBAAgB,qBAAqB;IACrC,mEAAmE;IACnE,mBAAmB,wBAAwB;IAC3C,qEAAqE;IACrE,mBAAmB,wBAAwB;IAC3C,4EAA4E;IAC5E,WAAW,gBAAgB;IAC3B,8CAA8C;IAC9C,kBAAkB,uBAAuB;IACzC,qEAAqE;IACrE,iBAAiB,sBAAsB;IACvC;;;;;;OAMG;IACH,+BAA+B,oCAAoC;IACnE;;;;;;;OAOG;IACH,iCAAiC,sCAAsC;CACxE;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wCAAwC,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C,EAAE,SAAS,MAAM,EAAwB,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAC3C,eAAO,MAAM,uBAAuB,QAAY,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,eAAO,MAAM,qBAAqB,QAAc,CAAC"}
1	+ {"version":3,"file":"cimd.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/cimd.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,oBAAY,eAAe;IACzB;;;;;;;OAOG;IACH,QAAQ,aAAa;IACrB;;;;;;;;;OASG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B;;;iBAQtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;iBAUhD,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;iBAiCrB,CAAC;AAEjB,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,oBAAY,mBAAmB;IAC7B,2CAA2C;IAC3C,eAAe,oBAAoB;IACnC,uDAAuD;IACvD,gBAAgB,qBAAqB;IACrC,mEAAmE;IACnE,mBAAmB,wBAAwB;IAC3C,qEAAqE;IACrE,mBAAmB,wBAAwB;IAC3C,4EAA4E;IAC5E,WAAW,gBAAgB;IAC3B,8CAA8C;IAC9C,kBAAkB,uBAAuB;IACzC,qEAAqE;IACrE,iBAAiB,sBAAsB;IACvC;;;;;;OAMG;IACH,+BAA+B,oCAAoC;IACnE;;;;;;;OAOG;IACH,iCAAiC,sCAAsC;CACxE;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wCAAwC,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C,EAAE,SAAS,MAAM,EAAwB,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAC3C,eAAO,MAAM,uBAAuB,QAAY,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,eAAO,MAAM,qBAAqB,QAAc,CAAC"}

package/dist/esm/security/authentications/models/cimd.backend.schemas.js CHANGED Viewed

@@ -126,6 +126,28 @@ export const CimdClientMetadataSchema = z.object({
     token_endpoint_auth_method: z.string().optional(),
     jwks_uri: z.string().optional(),
     jwks: z.unknown().optional(),
+    /*
+     * RP-Initiated Logout post-logout redirects, honoured since 2026-09-08 (#464).
+     *
+     * `post_logout_redirect_uris` is the member OpenID Connect RP-Initiated Logout §2 registers, and
+     * it is the ONLY way an OP can admit a post-logout redirect: §3 requires an EXACT match against
+     * previously registered values. Until this was declared, a CIMD client's logout landed on this
+     * application's own page and the client simply found its redirect ignored — silently, which was
+     * the defect rather than the absence.
+     * spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (registration of `post_logout_redirect_uris`)
+     *   and §3 (the OP "MUST NOT perform post-logout redirection if the `post_logout_redirect_uri`
+     *   value supplied does not exactly match one of the previously registered
+     *   `post_logout_redirect_uris` values").
+     *
+     * Same trust model as `redirect_uris`, deliberately: both are authored by the client, in the same
+     * document, fetched over HTTPS from the `client_id` URL through the same SSRF guard and host
+     * allow-list, and both are matched EXACTLY at use — never by prefix or origin, which would turn
+     * one claimed URI into authority over a whole subtree.
+     *
+     * Optional: a client that registers none admits none, and the resolver defaults to an empty set.
+     * That is fail-closed and is what every CIMD client got before this member existed.
+     */
+    post_logout_redirect_uris: z.array(z.string().min(1)).optional(),
 }).passthrough();
 /**
  * Why a `client_id` URL was refused.

package/dist/esm/security/authentications/models/cimd.backend.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cimd.backend.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/models/cimd.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,eA4BX;AA5BD,WAAY,eAAe;IACzB;;;;;;;OAOG;IACH,wCAAqB,CAAA;IACrB;;;;;;;;;OASG;IACH,0CAAuB,CAAA;IACvB;;;;;OAKG;IACH,gCAAa,CAAA;AACf,CAAC,EA5BW,eAAe,KAAf,eAAe,QA4B1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,2EAA2E;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC;IACjE;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,+FAA+F;IAC/F,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC;;;;;OAKG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAIH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,WAAW,EAAE,CAAC;AAIjB;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,mBAgCX;AAhCD,WAAY,mBAAmB;IAC7B,2CAA2C;IAC3C,0DAAmC,CAAA;IACnC,uDAAuD;IACvD,4DAAqC,CAAA;IACrC,mEAAmE;IACnE,kEAA2C,CAAA;IAC3C,qEAAqE;IACrE,kEAA2C,CAAA;IAC3C,4EAA4E;IAC5E,kDAA2B,CAAA;IAC3B,8CAA8C;IAC9C,gEAAyC,CAAA;IACzC,qEAAqE;IACrE,8DAAuC,CAAA;IACvC;;;;;;OAMG;IACH,0FAAmE,CAAA;IACnE;;;;;;;OAOG;IACH,8FAAuE,CAAA;AACzE,CAAC,EAhCW,mBAAmB,KAAnB,mBAAmB,QAgC9B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,MAAM,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAsB,CAAC,iBAAiB,CAAC,CAAC;AAElG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC","sourcesContent":["import { z } from 'zod';\n\n/*\n OAuth Client ID Metadata Documents (CIMD) — the contract this provider accepts.\n \n CIMD lets a client identify itself with an HTTPS URL it controls instead of a `client_id` minted\n * by this authorization server. The URL resolves to a JSON document describing the client, so\n * impersonation requires taking over the domain rather than making a registration call.\n \n MCP made it the preferred mechanism in `2025-11-25` and DEPRECATED Dynamic Client Registration in\n * `2026-07-28` — but the market has not followed: Cursor supports DCR only, with no announced CIMD\n * timeline, while every Anthropic surface tested chose CIMD when offered both. Wildo therefore serves\n * BOTH; this file is the CIMD half.\n \n spec-cite: OAuth Client ID Metadata Document, draft-ietf-oauth-client-id-metadata-document-00\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents\n /\n\n/\n How much of the open internet this deployment will accept as a client identity.\n \n There is no single correct answer and the draft says so — the authorization server \"MAY choose to\n * have its own heuristics and policies around the trust of domain names used as client IDs\"\n * (§ 6.8) — so this is a per-application posture rather than a framework constant.\n \n semantic-literal-boundary: a closed Wildo vocabulary with one named runtime source. Every schema,\n * default and comparison derives from THIS enum.\n /\nexport enum CimdTrustPolicy {\n /\n URL-formatted `client_id` values are refused. The default.\n \n Nothing accepts a stranger's URL until an application opts in — the same fail-closed shape as\n * `mcp.exposed`, and how CIMD ships elsewhere (WorkOS ships it off by default). A framework that\n * defaulted to fetching arbitrary URLs would enable an SSRF surface on every deployment that never\n * asked for one.\n /\n DISABLED = 'disabled',\n /\n Accept a `client_id` that is on a configured allow-list.\n \n The draft's \"allowlists for trusted domains (for protected servers)\" — a B2B tenant that knows\n * which agent vendors it works with, and wants no others.\n \n An entry may be a FULL `client_id` URL (exact, and the stricter grain — this is how Clerk's CIMD\n * admission works) or a BARE HOST (every client on that domain). Prefer the URL form when the\n * domain might host more than one vendor's metadata.\n /\n ALLOWLIST = 'allowlist',\n /\n Accept any HTTPS `client_id` that passes the structural and SSRF checks.\n \n The draft's open-server posture, and what makes CIMD zero-configuration. Correct for a public\n * agent surface; a deliberate choice, never a default.\n /\n OPEN = 'open',\n}\n\n/\n The `auth.cimd` section an application authors to opt into CIMD.\n \n ## Why this schema has to exist, and what its absence cost\n \n The resolver read this posture out of `appConfigService.config.auth.cimd` before anything\n * DECLARED it, and the application-configuration schema is a plain Zod object — so Zod stripped the\n * whole section at load. Every deployment therefore read `undefined`, defaulted to `DISABLED`, and\n * CIMD was unreachable: the resolver could not run and the discovery flag could not be advertised,\n * no matter what an application authored.\n \n The unit tests could not see it because they hand the service a config OBJECT directly, which is\n * the right way to test a reader and the exact reason it cannot catch a missing declaration. It\n * surfaced while wiring the live lane — the first thing that had to author the section for real.\n /\nexport const CimdApplicationConfigSchema = z.object({\n /* The deployment's posture. Absent ⇒ {@link CimdTrustPolicy.DISABLED}. /\n policy: z.enum(CimdTrustPolicy).default(CimdTrustPolicy.DISABLED),\n /\n Entries admitted under {@link CimdTrustPolicy.ALLOWLIST}: a full `client_id` URL (exact, the\n * stricter grain) or a bare host (every client on that domain). Ignored under the other postures.\n /\n allowedClients: z.array(z.string().min(1)).default([]),\n});\n\nexport type CimdApplicationConfig = z.infer<typeof CimdApplicationConfigSchema>;\n\n/\n The `auth.dynamicClientRegistration` section — RFC 7591 `/register`.\n \n Declared HERE, beside CIMD, because the two are the same decision seen twice: how a client with no\n * prior relationship obtains an identity. An application picks one, both, or neither.\n \n Off by default, and the reasoning is stronger than CIMD's. An open `/register` lets any\n * anonymous caller create a durable row in this application's database — a write primitive, not just\n * a read. MCP `2026-07-28` additionally DEPRECATED dynamic registration in favour of CIMD, so an\n * application that turns this on is making a deliberate interoperability trade (today: Cursor\n * supports DCR only), not following the recommended path.\n * spec-cite: MCP 2025-11-25 — Authorization § Dynamic Client Registration: \"This option is included\n * for backwards compatibility with earlier versions of the MCP authorization spec.\"\n /\nexport const DynamicClientRegistrationConfigSchema = z.object({\n /* Absent or false ⇒ `/register` answers 404 and `registration_endpoint` is not advertised. /\n enabled: z.boolean().default(false),\n /\n Hard ceiling on how many clients one source IP may register per hour.\n \n `/register` is unauthenticated by design, so the only thing between it and unbounded row\n * creation is this. Deliberately low: a legitimate agent registers ONCE and stores the result.\n /\n maxRegistrationsPerHourPerIp: z.number().int().min(1).max(1000).default(10),\n});\n\nexport type DynamicClientRegistrationConfig = z.infer<typeof DynamicClientRegistrationConfigSchema>;\n\n/\n The client metadata document itself.\n \n Only the three REQUIRED members are enforced — \"The metadata document MUST include at least the\n * following properties: `client_id`, `client_name`, `redirect_uris`\". Everything else is optional\n * and passed through, because the document is authored by the CLIENT and this server has no standing\n * to reject fields it does not consume.\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n \n `.passthrough()` is deliberate: a strict object would reject a conformant document that carries a\n * member from a later revision, turning forward-compatibility into an outage.\n /\nexport const CimdClientMetadataSchema = z.object({\n client_id: z.string().min(1),\n client_name: z.string().min(1),\n redirect_uris: z.array(z.string().min(1)).min(1),\n client_uri: z.string().optional(),\n logo_uri: z.string().optional(),\n grant_types: z.array(z.string()).optional(),\n response_types: z.array(z.string()).optional(),\n token_endpoint_auth_method: z.string().optional(),\n jwks_uri: z.string().optional(),\n jwks: z.unknown().optional(),\n}).passthrough();\n\nexport type CimdClientMetadata = z.infer<typeof CimdClientMetadataSchema>;\n\n/\n Why a `client_id` URL was refused.\n \n A closed vocabulary rather than free text because these are BRANCHED on (the caller maps them to\n * an OAuth error) and COUNTED (an operator watching a spike in `SSRF_TARGET_REFUSED` is watching an\n * attack, not a misconfiguration).\n /\nexport enum CimdRejectionReason {\n /* The deployment has not enabled CIMD. /\n POLICY_DISABLED = 'policy_disabled',\n /* The host is not on this deployment's allow-list. /\n HOST_NOT_ALLOWED = 'host_not_allowed',\n /* Not `https`, or no path component — the draft requires both. /\n MALFORMED_CLIENT_ID = 'malformed_client_id',\n /* Resolves to a private, loopback or otherwise internal address. /\n SSRF_TARGET_REFUSED = 'ssrf_target_refused',\n /* The document could not be fetched (status, timeout, size, transport). /\n UNREACHABLE = 'unreachable',\n /* Not JSON, or missing a required member. /\n MALFORMED_DOCUMENT = 'malformed_document',\n /* The document's `client_id` is not the URL it was fetched from. /\n IDENTITY_MISMATCH = 'identity_mismatch',\n /\n The document declares a SHARED-SECRET client authentication method, which the draft forbids\n * outright — a CIMD identity is proved by domain control, and a symmetric secret would have to be\n * established out of band, defeating the mechanism. Distinct from\n * {@link UNSUPPORTED_CLIENT_AUTHENTICATION} because this is the CLIENT violating the specification,\n * not this server declining a capability.\n /\n FORBIDDEN_CLIENT_AUTHENTICATION = 'forbidden_client_authentication',\n /\n The document declares an asymmetric client authentication method (`private_key_jwt`) that the\n * draft permits but this provider does not implement.\n \n Refused rather than silently downgraded to a public client: a client that believes it\n * authenticates with a private key, served by a server that never checks one, is a downgrade the\n * client has no way to detect.\n /\n UNSUPPORTED_CLIENT_AUTHENTICATION = 'unsupported_client_authentication',\n}\n\n/\n The only `token_endpoint_auth_method` this provider accepts from a client metadata document.\n \n The draft's constraint is a MUST NOT on a whole FAMILY of methods: \"the `token_endpoint_auth_method`\n * property MUST NOT include `client_secret_post`, `client_secret_basic`, `client_secret_jwt`, or any\n * other method based around a shared symmetric secret.\"\n * spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1\n \n \"any other method\" is why this is an ACCEPT-list of one rather than a block-list of three: a\n * block-list would admit every symmetric method the registry gains after today, which is precisely\n * the open-ended case the MUST NOT names. `private_key_jwt` is permitted by § 6.2 and refused here\n * for a different reason — see {@link CimdRejectionReason.UNSUPPORTED_CLIENT_AUTHENTICATION}.\n /\nexport const CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD = 'none';\n\n/\n The asymmetric methods the draft permits, listed so the refusal can name the right reason.\n \n Anything NOT here and not {@link CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD} is treated as\n * symmetric — the fail-closed reading of \"any other method based around a shared symmetric secret\".\n /\nexport const CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS: readonly string[] = ['private_key_jwt'];\n\n/\n Bounds on the fetch, so a hostile URL cannot hold a request thread or exhaust memory.\n \n The draft says nothing about either — it is a generic \"do not trust a stranger's server\" concern —\n * but an unbounded fetch of an attacker-chosen URL is a denial-of-service primitive handed to anyone\n * who can send an authorize request.\n /\nexport const CIMD_FETCH_TIMEOUT_MS = 5_000;\nexport const CIMD_MAX_DOCUMENT_BYTES = 64 1024;\n\n/*\n Hard ceiling on cached documents, per pod.\n \n The cache is keyed on a URL an UNAUTHENTICATED caller supplies, so without a ceiling it is an\n * unbounded-growth primitive: under {@link CimdTrustPolicy.OPEN} anyone can mint one entry per\n * distinct URL they can serve a valid document from, and under `ALLOWLIST` with a bare-HOST entry\n * the allow-listed vendor can do the same across unlimited paths. Entries expire, but expiry alone\n * never RECLAIMS anything — a map that only skips stale entries on read still grows forever.\n \n Sized far above any real client population: a deployment talking to thousands of distinct agent\n * vendors is not a shape this mechanism serves. The point is that the number is FINITE, not that it\n * is tuned.\n /\nexport const CIMD_MAX_CACHE_ENTRIES = 512;\n\n/\n Cache bounds.\n \n \"The authorization server SHOULD respect HTTP cache headers when caching client metadata, but MAY\n * define its own upper and/or lower bounds on an acceptable cache lifetime as well.\"\n * spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.4\n \n The upper bound matters for revocation: a client that has been compromised and taken its document\n * down should stop being honoured in minutes, not days, however generous its own `Cache-Control` was.\n * The lower bound stops a client with `no-cache` from turning every authorize request into an\n * outbound fetch.\n /\nexport const CIMD_CACHE_MIN_TTL_MS = 60_000;\nexport const CIMD_CACHE_MAX_TTL_MS = 15 60_000;\n"]}
1	+ {"version":3,"file":"cimd.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/models/cimd.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,eA4BX;AA5BD,WAAY,eAAe;IACzB;;;;;;;OAOG;IACH,wCAAqB,CAAA;IACrB;;;;;;;;;OASG;IACH,0CAAuB,CAAA;IACvB;;;;;OAKG;IACH,gCAAa,CAAA;AACf,CAAC,EA5BW,eAAe,KAAf,eAAe,QA4B1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,2EAA2E;IAC3E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC;IACjE;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAIH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,+FAA+F;IAC/F,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC;;;;;OAKG;IACH,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAIH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC,WAAW,EAAE,CAAC;AAIjB;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,mBAgCX;AAhCD,WAAY,mBAAmB;IAC7B,2CAA2C;IAC3C,0DAAmC,CAAA;IACnC,uDAAuD;IACvD,4DAAqC,CAAA;IACrC,mEAAmE;IACnE,kEAA2C,CAAA;IAC3C,qEAAqE;IACrE,kEAA2C,CAAA;IAC3C,4EAA4E;IAC5E,kDAA2B,CAAA;IAC3B,8CAA8C;IAC9C,gEAAyC,CAAA;IACzC,qEAAqE;IACrE,8DAAuC,CAAA;IACvC;;;;;;OAMG;IACH,0FAAmE,CAAA;IACnE;;;;;;;OAOG;IACH,8FAAuE,CAAA;AACzE,CAAC,EAhCW,mBAAmB,KAAnB,mBAAmB,QAgC9B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,MAAM,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAsB,CAAC,iBAAiB,CAAC,CAAC;AAElG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC","sourcesContent":["import { z } from 'zod';\n\n/*\n OAuth Client ID Metadata Documents (CIMD) — the contract this provider accepts.\n \n CIMD lets a client identify itself with an HTTPS URL it controls instead of a `client_id` minted\n * by this authorization server. The URL resolves to a JSON document describing the client, so\n * impersonation requires taking over the domain rather than making a registration call.\n \n MCP made it the preferred mechanism in `2025-11-25` and DEPRECATED Dynamic Client Registration in\n * `2026-07-28` — but the market has not followed: Cursor supports DCR only, with no announced CIMD\n * timeline, while every Anthropic surface tested chose CIMD when offered both. Wildo therefore serves\n * BOTH; this file is the CIMD half.\n \n spec-cite: OAuth Client ID Metadata Document, draft-ietf-oauth-client-id-metadata-document-00\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents\n /\n\n/\n How much of the open internet this deployment will accept as a client identity.\n \n There is no single correct answer and the draft says so — the authorization server \"MAY choose to\n * have its own heuristics and policies around the trust of domain names used as client IDs\"\n * (§ 6.8) — so this is a per-application posture rather than a framework constant.\n \n semantic-literal-boundary: a closed Wildo vocabulary with one named runtime source. Every schema,\n * default and comparison derives from THIS enum.\n /\nexport enum CimdTrustPolicy {\n /\n URL-formatted `client_id` values are refused. The default.\n \n Nothing accepts a stranger's URL until an application opts in — the same fail-closed shape as\n * `mcp.exposed`, and how CIMD ships elsewhere (WorkOS ships it off by default). A framework that\n * defaulted to fetching arbitrary URLs would enable an SSRF surface on every deployment that never\n * asked for one.\n /\n DISABLED = 'disabled',\n /\n Accept a `client_id` that is on a configured allow-list.\n \n The draft's \"allowlists for trusted domains (for protected servers)\" — a B2B tenant that knows\n * which agent vendors it works with, and wants no others.\n \n An entry may be a FULL `client_id` URL (exact, and the stricter grain — this is how Clerk's CIMD\n * admission works) or a BARE HOST (every client on that domain). Prefer the URL form when the\n * domain might host more than one vendor's metadata.\n /\n ALLOWLIST = 'allowlist',\n /\n Accept any HTTPS `client_id` that passes the structural and SSRF checks.\n \n The draft's open-server posture, and what makes CIMD zero-configuration. Correct for a public\n * agent surface; a deliberate choice, never a default.\n /\n OPEN = 'open',\n}\n\n/\n The `auth.cimd` section an application authors to opt into CIMD.\n \n ## Why this schema has to exist, and what its absence cost\n \n The resolver read this posture out of `appConfigService.config.auth.cimd` before anything\n * DECLARED it, and the application-configuration schema is a plain Zod object — so Zod stripped the\n * whole section at load. Every deployment therefore read `undefined`, defaulted to `DISABLED`, and\n * CIMD was unreachable: the resolver could not run and the discovery flag could not be advertised,\n * no matter what an application authored.\n \n The unit tests could not see it because they hand the service a config OBJECT directly, which is\n * the right way to test a reader and the exact reason it cannot catch a missing declaration. It\n * surfaced while wiring the live lane — the first thing that had to author the section for real.\n /\nexport const CimdApplicationConfigSchema = z.object({\n /* The deployment's posture. Absent ⇒ {@link CimdTrustPolicy.DISABLED}. /\n policy: z.enum(CimdTrustPolicy).default(CimdTrustPolicy.DISABLED),\n /\n Entries admitted under {@link CimdTrustPolicy.ALLOWLIST}: a full `client_id` URL (exact, the\n * stricter grain) or a bare host (every client on that domain). Ignored under the other postures.\n /\n allowedClients: z.array(z.string().min(1)).default([]),\n});\n\nexport type CimdApplicationConfig = z.infer<typeof CimdApplicationConfigSchema>;\n\n/\n The `auth.dynamicClientRegistration` section — RFC 7591 `/register`.\n \n Declared HERE, beside CIMD, because the two are the same decision seen twice: how a client with no\n * prior relationship obtains an identity. An application picks one, both, or neither.\n \n Off by default, and the reasoning is stronger than CIMD's. An open `/register` lets any\n * anonymous caller create a durable row in this application's database — a write primitive, not just\n * a read. MCP `2026-07-28` additionally DEPRECATED dynamic registration in favour of CIMD, so an\n * application that turns this on is making a deliberate interoperability trade (today: Cursor\n * supports DCR only), not following the recommended path.\n * spec-cite: MCP 2025-11-25 — Authorization § Dynamic Client Registration: \"This option is included\n * for backwards compatibility with earlier versions of the MCP authorization spec.\"\n /\nexport const DynamicClientRegistrationConfigSchema = z.object({\n /* Absent or false ⇒ `/register` answers 404 and `registration_endpoint` is not advertised. /\n enabled: z.boolean().default(false),\n /\n Hard ceiling on how many clients one source IP may register per hour.\n \n `/register` is unauthenticated by design, so the only thing between it and unbounded row\n * creation is this. Deliberately low: a legitimate agent registers ONCE and stores the result.\n /\n maxRegistrationsPerHourPerIp: z.number().int().min(1).max(1000).default(10),\n});\n\nexport type DynamicClientRegistrationConfig = z.infer<typeof DynamicClientRegistrationConfigSchema>;\n\n/\n The client metadata document itself.\n \n Only the three REQUIRED members are enforced — \"The metadata document MUST include at least the\n * following properties: `client_id`, `client_name`, `redirect_uris`\". Everything else is optional\n * and passed through, because the document is authored by the CLIENT and this server has no standing\n * to reject fields it does not consume.\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n \n `.passthrough()` is deliberate: a strict object would reject a conformant document that carries a\n * member from a later revision, turning forward-compatibility into an outage.\n /\nexport const CimdClientMetadataSchema = z.object({\n client_id: z.string().min(1),\n client_name: z.string().min(1),\n redirect_uris: z.array(z.string().min(1)).min(1),\n client_uri: z.string().optional(),\n logo_uri: z.string().optional(),\n grant_types: z.array(z.string()).optional(),\n response_types: z.array(z.string()).optional(),\n token_endpoint_auth_method: z.string().optional(),\n jwks_uri: z.string().optional(),\n jwks: z.unknown().optional(),\n /\n * RP-Initiated Logout post-logout redirects, honoured since 2026-09-08 (#464).\n \n `post_logout_redirect_uris` is the member OpenID Connect RP-Initiated Logout §2 registers, and\n * it is the ONLY way an OP can admit a post-logout redirect: §3 requires an EXACT match against\n * previously registered values. Until this was declared, a CIMD client's logout landed on this\n * application's own page and the client simply found its redirect ignored — silently, which was\n * the defect rather than the absence.\n * spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (registration of `post_logout_redirect_uris`)\n * and §3 (the OP \"MUST NOT perform post-logout redirection if the `post_logout_redirect_uri`\n * value supplied does not exactly match one of the previously registered\n * `post_logout_redirect_uris` values\").\n \n Same trust model as `redirect_uris`, deliberately: both are authored by the client, in the same\n * document, fetched over HTTPS from the `client_id` URL through the same SSRF guard and host\n * allow-list, and both are matched EXACTLY at use — never by prefix or origin, which would turn\n * one claimed URI into authority over a whole subtree.\n \n Optional: a client that registers none admits none, and the resolver defaults to an empty set.\n * That is fail-closed and is what every CIMD client got before this member existed.\n /\n post_logout_redirect_uris: z.array(z.string().min(1)).optional(),\n}).passthrough();\n\nexport type CimdClientMetadata = z.infer<typeof CimdClientMetadataSchema>;\n\n/\n Why a `client_id` URL was refused.\n \n A closed vocabulary rather than free text because these are BRANCHED on (the caller maps them to\n * an OAuth error) and COUNTED (an operator watching a spike in `SSRF_TARGET_REFUSED` is watching an\n * attack, not a misconfiguration).\n /\nexport enum CimdRejectionReason {\n /* The deployment has not enabled CIMD. /\n POLICY_DISABLED = 'policy_disabled',\n /* The host is not on this deployment's allow-list. /\n HOST_NOT_ALLOWED = 'host_not_allowed',\n /* Not `https`, or no path component — the draft requires both. /\n MALFORMED_CLIENT_ID = 'malformed_client_id',\n /* Resolves to a private, loopback or otherwise internal address. /\n SSRF_TARGET_REFUSED = 'ssrf_target_refused',\n /* The document could not be fetched (status, timeout, size, transport). /\n UNREACHABLE = 'unreachable',\n /* Not JSON, or missing a required member. /\n MALFORMED_DOCUMENT = 'malformed_document',\n /* The document's `client_id` is not the URL it was fetched from. /\n IDENTITY_MISMATCH = 'identity_mismatch',\n /\n The document declares a SHARED-SECRET client authentication method, which the draft forbids\n * outright — a CIMD identity is proved by domain control, and a symmetric secret would have to be\n * established out of band, defeating the mechanism. Distinct from\n * {@link UNSUPPORTED_CLIENT_AUTHENTICATION} because this is the CLIENT violating the specification,\n * not this server declining a capability.\n /\n FORBIDDEN_CLIENT_AUTHENTICATION = 'forbidden_client_authentication',\n /\n The document declares an asymmetric client authentication method (`private_key_jwt`) that the\n * draft permits but this provider does not implement.\n \n Refused rather than silently downgraded to a public client: a client that believes it\n * authenticates with a private key, served by a server that never checks one, is a downgrade the\n * client has no way to detect.\n /\n UNSUPPORTED_CLIENT_AUTHENTICATION = 'unsupported_client_authentication',\n}\n\n/\n The only `token_endpoint_auth_method` this provider accepts from a client metadata document.\n \n The draft's constraint is a MUST NOT on a whole FAMILY of methods: \"the `token_endpoint_auth_method`\n * property MUST NOT include `client_secret_post`, `client_secret_basic`, `client_secret_jwt`, or any\n * other method based around a shared symmetric secret.\"\n * spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1\n \n \"any other method\" is why this is an ACCEPT-list of one rather than a block-list of three: a\n * block-list would admit every symmetric method the registry gains after today, which is precisely\n * the open-ended case the MUST NOT names. `private_key_jwt` is permitted by § 6.2 and refused here\n * for a different reason — see {@link CimdRejectionReason.UNSUPPORTED_CLIENT_AUTHENTICATION}.\n /\nexport const CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD = 'none';\n\n/\n The asymmetric methods the draft permits, listed so the refusal can name the right reason.\n \n Anything NOT here and not {@link CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD} is treated as\n * symmetric — the fail-closed reading of \"any other method based around a shared symmetric secret\".\n /\nexport const CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS: readonly string[] = ['private_key_jwt'];\n\n/\n Bounds on the fetch, so a hostile URL cannot hold a request thread or exhaust memory.\n \n The draft says nothing about either — it is a generic \"do not trust a stranger's server\" concern —\n * but an unbounded fetch of an attacker-chosen URL is a denial-of-service primitive handed to anyone\n * who can send an authorize request.\n /\nexport const CIMD_FETCH_TIMEOUT_MS = 5_000;\nexport const CIMD_MAX_DOCUMENT_BYTES = 64 1024;\n\n/*\n Hard ceiling on cached documents, per pod.\n \n The cache is keyed on a URL an UNAUTHENTICATED caller supplies, so without a ceiling it is an\n * unbounded-growth primitive: under {@link CimdTrustPolicy.OPEN} anyone can mint one entry per\n * distinct URL they can serve a valid document from, and under `ALLOWLIST` with a bare-HOST entry\n * the allow-listed vendor can do the same across unlimited paths. Entries expire, but expiry alone\n * never RECLAIMS anything — a map that only skips stale entries on read still grows forever.\n \n Sized far above any real client population: a deployment talking to thousands of distinct agent\n * vendors is not a shape this mechanism serves. The point is that the number is FINITE, not that it\n * is tuned.\n /\nexport const CIMD_MAX_CACHE_ENTRIES = 512;\n\n/\n Cache bounds.\n \n \"The authorization server SHOULD respect HTTP cache headers when caching client metadata, but MAY\n * define its own upper and/or lower bounds on an acceptable cache lifetime as well.\"\n * spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.4\n \n The upper bound matters for revocation: a client that has been compromised and taken its document\n * down should stop being honoured in minutes, not days, however generous its own `Cache-Control` was.\n * The lower bound stops a client with `no-cache` from turning every authorize request into an\n * outbound fetch.\n /\nexport const CIMD_CACHE_MIN_TTL_MS = 60_000;\nexport const CIMD_CACHE_MAX_TTL_MS = 15 60_000;\n"]}

package/dist/esm/security/authentications/models/federated-auth-transport.backend.definitions.d.ts ADDED Viewed

@@ -0,0 +1,37 @@
+/**
+ * Hard deadline for one engine-issued request to an EXTERNAL IDENTITY PROVIDER on an interactive
+ * leg — the OAuth2 token exchange, the userinfo read, a provider profile extension endpoint, the
+ * OIDC discovery document, and the connected-accounts token exchange.
+ *
+ * ## Why this class gets its own bound
+ *
+ * The bound is a statement about who is waiting. Every request this constant covers sits between a
+ * person who has just been redirected back from an identity provider and the session they are
+ * trying to obtain: the browser is parked on a callback URL and the engine is holding it open while
+ * it talks to the IdP. An unbounded request there is not a slow API call, it is a sign-in that
+ * never finishes, and Node's `fetch` imposes no deadline of its own.
+ *
+ * 10s is the value OIDC discovery already used inline before this constant existed, and it is the
+ * right size for the class: every payload here is a small JSON document (a token response, a
+ * userinfo claim set, a discovery document), so nothing legitimate in this class spends time moving
+ * bytes. It sits deliberately above `CIMD_FETCH_TIMEOUT_MS` (5s) — a CIMD document is fetched on
+ * behalf of an unauthenticated stranger and deserves less of the deployment's patience than a
+ * federated sign-in a tenant configured — and well below the 60s the email transport allows, which
+ * is sized for attachments behind a durable lease with nobody watching.
+ *
+ * ## The response body is covered, and by which mechanism
+ *
+ * The signal is handed to `fetch` itself, and an abort tears down the response stream along with
+ * the request — so a provider that returns headers and then stalls its body is bounded here too.
+ * That holds because these sites call the platform `fetch` directly.
+ *
+ * Where a transport is a SEAM that something else may substitute — `EmailBackendService` and
+ * `SMSBackendService`, whose `fetch` is stubbed by their own tests and could be replaced by a
+ * polyfill — that reasoning is not available, because honouring the signal on an in-flight body
+ * read is a property of the implementation rather than of the contract. Those two therefore race
+ * the body read against the signal explicitly (`readResponseTextWithAbort`). Prefer the explicit
+ * race whenever the transport is substitutable; `AbortSignal.timeout` is sufficient only where the
+ * platform `fetch` is reached directly, as it is throughout this class.
+ */
+export declare const FEDERATED_AUTH_PROVIDER_REQUEST_TIMEOUT_MS = 10000;
+//# sourceMappingURL=federated-auth-transport.backend.definitions.d.ts.map

package/dist/esm/security/authentications/models/federated-auth-transport.backend.definitions.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"federated-auth-transport.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/federated-auth-transport.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,0CAA0C,QAAS,CAAC"}

package/dist/esm/security/authentications/models/federated-auth-transport.backend.definitions.js ADDED Viewed

@@ -0,0 +1,37 @@
+/**
+ * Hard deadline for one engine-issued request to an EXTERNAL IDENTITY PROVIDER on an interactive
+ * leg — the OAuth2 token exchange, the userinfo read, a provider profile extension endpoint, the
+ * OIDC discovery document, and the connected-accounts token exchange.
+ *
+ * ## Why this class gets its own bound
+ *
+ * The bound is a statement about who is waiting. Every request this constant covers sits between a
+ * person who has just been redirected back from an identity provider and the session they are
+ * trying to obtain: the browser is parked on a callback URL and the engine is holding it open while
+ * it talks to the IdP. An unbounded request there is not a slow API call, it is a sign-in that
+ * never finishes, and Node's `fetch` imposes no deadline of its own.
+ *
+ * 10s is the value OIDC discovery already used inline before this constant existed, and it is the
+ * right size for the class: every payload here is a small JSON document (a token response, a
+ * userinfo claim set, a discovery document), so nothing legitimate in this class spends time moving
+ * bytes. It sits deliberately above `CIMD_FETCH_TIMEOUT_MS` (5s) — a CIMD document is fetched on
+ * behalf of an unauthenticated stranger and deserves less of the deployment's patience than a
+ * federated sign-in a tenant configured — and well below the 60s the email transport allows, which
+ * is sized for attachments behind a durable lease with nobody watching.
+ *
+ * ## The response body is covered, and by which mechanism
+ *
+ * The signal is handed to `fetch` itself, and an abort tears down the response stream along with
+ * the request — so a provider that returns headers and then stalls its body is bounded here too.
+ * That holds because these sites call the platform `fetch` directly.
+ *
+ * Where a transport is a SEAM that something else may substitute — `EmailBackendService` and
+ * `SMSBackendService`, whose `fetch` is stubbed by their own tests and could be replaced by a
+ * polyfill — that reasoning is not available, because honouring the signal on an in-flight body
+ * read is a property of the implementation rather than of the contract. Those two therefore race
+ * the body read against the signal explicitly (`readResponseTextWithAbort`). Prefer the explicit
+ * race whenever the transport is substitutable; `AbortSignal.timeout` is sufficient only where the
+ * platform `fetch` is reached directly, as it is throughout this class.
+ */
+export const FEDERATED_AUTH_PROVIDER_REQUEST_TIMEOUT_MS = 10_000;
+//# sourceMappingURL=federated-auth-transport.backend.definitions.js.map

package/dist/esm/security/authentications/models/federated-auth-transport.backend.definitions.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"federated-auth-transport.backend.definitions.js","sourceRoot":"","sources":["../../../../../src/security/authentications/models/federated-auth-transport.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,MAAM,CAAC","sourcesContent":["/**\n * Hard deadline for one engine-issued request to an EXTERNAL IDENTITY PROVIDER on an interactive\n * leg — the OAuth2 token exchange, the userinfo read, a provider profile extension endpoint, the\n * OIDC discovery document, and the connected-accounts token exchange.\n *\n * ## Why this class gets its own bound\n *\n * The bound is a statement about who is waiting. Every request this constant covers sits between a\n * person who has just been redirected back from an identity provider and the session they are\n * trying to obtain: the browser is parked on a callback URL and the engine is holding it open while\n * it talks to the IdP. An unbounded request there is not a slow API call, it is a sign-in that\n * never finishes, and Node's `fetch` imposes no deadline of its own.\n *\n * 10s is the value OIDC discovery already used inline before this constant existed, and it is the\n * right size for the class: every payload here is a small JSON document (a token response, a\n * userinfo claim set, a discovery document), so nothing legitimate in this class spends time moving\n * bytes. It sits deliberately above `CIMD_FETCH_TIMEOUT_MS` (5s) — a CIMD document is fetched on\n * behalf of an unauthenticated stranger and deserves less of the deployment's patience than a\n * federated sign-in a tenant configured — and well below the 60s the email transport allows, which\n * is sized for attachments behind a durable lease with nobody watching.\n *\n * ## The response body is covered, and by which mechanism\n *\n * The signal is handed to `fetch` itself, and an abort tears down the response stream along with\n * the request — so a provider that returns headers and then stalls its body is bounded here too.\n * That holds because these sites call the platform `fetch` directly.\n *\n * Where a transport is a SEAM that something else may substitute — `EmailBackendService` and\n * `SMSBackendService`, whose `fetch` is stubbed by their own tests and could be replaced by a\n * polyfill — that reasoning is not available, because honouring the signal on an in-flight body\n * read is a property of the implementation rather than of the contract. Those two therefore race\n * the body read against the signal explicitly (`readResponseTextWithAbort`). Prefer the explicit\n * race whenever the transport is substitutable; `AbortSignal.timeout` is sufficient only where the\n * platform `fetch` is reached directly, as it is throughout this class.\n */\nexport const FEDERATED_AUTH_PROVIDER_REQUEST_TIMEOUT_MS = 10_000;\n"]}

package/dist/esm/security/authentications/models/identity-persistence-boundaries.backend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"identity-persistence-boundaries.backend.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/identity-persistence-boundaries.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,yFAAyF,CAAC;AAGpJ;;;;;;GAMG;AACH,oBAAY,+BAA+B;IACzC,iBAAiB,qCAAqC;IACtD,gCAAgC,oDACmB;IACnD,4BAA4B,gDACmB;IAC/C,mCAAmC,uDACmB;CACvD;AAED,wBAAgB,wCAAwC,CAAC,OAAO,EAAE;IAChE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,sCAAsC,EAAE,OAAO,CAAC;CAC1D,GAAG,oCAAoC,CAcvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,sDAAsD,IACtE,oCAAoC,CAWnC;AAED;;;;;;;GAOG;AACH,wBAAgB,kDAAkD,CAAC,OAAO,EAAE;IAC1E,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC,GAAG,oCAAoC,CAcvC;AAED,wBAAgB,yDAAyD,IACzE,oCAAoC,CAUnC;AAED,oBAAY,yBAAyB;IACnC,yBAAyB,qCAAqC;IAC9D,oBAAoB,gCAAgC;IACpD,4BAA4B,wCAAwC;CACrE;AAED,eAAO,MAAM,sCAAsC;;;;;;CAMM,CAAC;AAE1D,eAAO,MAAM,iCAAiC;;;;;;CAMW,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;;;;CAQG,CAAC;AAE1D,oBAAY,yCAAyC;IACnD,yBAAyB,sDAC4B;IACrD,0BAA0B,uDAC4B;IACtD,8BAA8B,2DAC4B;IAC1D,+BAA+B,4DAC4B;CAC5D;AAED,eAAO,MAAM,sCAAsC;;;;;;CAOM,CAAC;AAE1D,eAAO,MAAM,uCAAuC;;;;;;;;CASK,CAAC;AAE1D,eAAO,MAAM,2CAA2C;;;;;;CAOC,CAAC;AAE1D,eAAO,MAAM,4CAA4C;;;;;;;;CAUA,CAAC"}
1	+ {"version":3,"file":"identity-persistence-boundaries.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/identity-persistence-boundaries.backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,yFAAyF,CAAC;AAGpJ;;;;;;GAMG;AACH,oBAAY,+BAA+B;IACzC,iBAAiB,qCAAqC;IACtD,gCAAgC,oDACmB;IACnD,4BAA4B,gDACmB;IAC/C,mCAAmC,uDACmB;CACvD;AAED,wBAAgB,wCAAwC,CAAC,OAAO,EAAE;IAChE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,sCAAsC,EAAE,OAAO,CAAC;CAC1D,GAAG,oCAAoC,CAcvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,sDAAsD,IACtE,oCAAoC,CAWnC;AAED;;;;;;;GAOG;AACH,wBAAgB,kDAAkD,CAAC,OAAO,EAAE;IAC1E,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC,GAAG,oCAAoC,CAcvC;AAED,wBAAgB,yDAAyD,IACzE,oCAAoC,CAUnC;AAED,oBAAY,yBAAyB;IACnC,yBAAyB,qCAAqC;IAC9D,oBAAoB,gCAAgC;IACpD,4BAA4B,wCAAwC;CACrE;AAED,eAAO,MAAM,sCAAsC;;;;;;CAMM,CAAC;AAE1D,eAAO,MAAM,iCAAiC;;;;;;CAMW,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,yCAAyC;;;;;;;;CAQG,CAAC;AAE1D,oBAAY,yCAAyC;IACnD,yBAAyB,sDAC4B;IACrD,0BAA0B,uDAC4B;IACtD,8BAA8B,2DAC4B;IAC1D,+BAA+B,4DAC4B;CAC5D;AAED,eAAO,MAAM,sCAAsC;;;;;;CAOM,CAAC;AAE1D,eAAO,MAAM,uCAAuC;;;;;;;;CASK,CAAC;AAE1D,eAAO,MAAM,2CAA2C;;;;;;CAOC,CAAC;AAE1D,eAAO,MAAM,4CAA4C;;;;;;;;CAUA,CAAC"}

package/dist/esm/security/authentications/models/jwt.backend.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jwt.backend.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/jwt.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA0B,cAAc,EAAE,aAAa,EAAiC,MAAM,uBAAuB,CAAC;AAE7H,6GAA6G;AAC7G,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAGzC;;;;;;;GAOG;AAGH,eAAO,MAAM,uBAAuB;;EAAwG,CAAC;AAC7I,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB,EAAE,GAAG,CAAC,WAGvC,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,GAAG,CAAC,aAGzC,CAAA;AAED,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAgC5E,CAAA;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAkCzE,CAAA"}
1	+ {"version":3,"file":"jwt.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/jwt.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA0B,cAAc,EAAE,aAAa,EAAiC,MAAM,uBAAuB,CAAC;AAE7H,6GAA6G;AAC7G,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAGzC;;;;;;;GAOG;AAGH,eAAO,MAAM,uBAAuB;;EAAwG,CAAC;AAC7I,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB,EAAE,GAAG,CAAC,WAGvC,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,GAAG,CAAC,aAGzC,CAAA;AAED,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAgC5E,CAAA;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAkCzE,CAAA"}

package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.d.ts CHANGED Viewed

@@ -33,6 +33,21 @@ export interface OAuth2ResolvedConnection extends SSOResolvedConnectionBase {
     issuer?: string;
     /** JWKS endpoint — for ID token signature verification */
     jwksUri?: string;
+    /**
+     * The upstream identity provider's RP-initiated logout endpoint, and whether this connection has
+     * OPTED IN to using it (issue #445).
+     *
+     * Both were resolved into local variables and DROPPED before reaching here — the endpoint was
+     * persisted, audit-marked and resolved from all three template modes into a value nothing
+     * downstream could see, so signing out of Wildo left the session at the provider alive and the
+     * next sign-in was silent.
+     *
+     * They travel as a PAIR because either alone is a half-answer: the endpoint records what the
+     * provider can do (in DISCOVERY mode it is read out of the provider's own document, so it says
+     * nothing about intent), and the flag records what the operator asked for.
+     */
+    endSessionEndpoint?: string;
+    federatedLogoutEnabled?: boolean;
     clientId: string;
     /**
      * Client secret — always a string. For Apple (dynamic JWT secret), the RESOLVER
@@ -69,6 +84,21 @@ export interface OAuth2ResolvedConnection extends SSOResolvedConnectionBase {
      * Works for both social `userProfileMapping` and enterprise `claimsMapping`.
      */
     profileMapping: OAuth2ProfileMapping;
+    /**
+     * OIDC `acr_values` — the authentication context class references this connection REQUIRES of the
+     * identity provider (step-up, MFA at the IdP, a named assurance level). Sent space-delimited.
+     */
+    acrValues?: string[];
+    /** OIDC `max_age` — maximum acceptable age, in seconds, of the end-user's IdP authentication. */
+    maxAge?: number;
+    /** OIDC `prompt` — whether the IdP must re-authenticate, re-consent, or must NOT prompt at all. */
+    prompt?: 'none' | 'login' | 'consent' | 'select_account';
+    /**
+     * OAuth2 `response_type`. The engine implements the authorization-CODE flow ONLY, so this is
+     * `'code'` in practice; the resolver refuses `id_token` / `token` rather than sending a value it
+     * cannot complete the callback for. Carried here so the refusal has something to refuse.
+     */
+    responseType: 'code';
     extraAuthParams?: Record<string, string>;
     extraTokenParams?: Record<string, string>;
     tokenRequestHeaders?: Record<string, string>;

package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2-connection.backend.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/oauth2-connection.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EACL,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAM9E;;;;GAIG;AACH,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE;;;OAGG;IACH,MAAM,EAAE,sBAAsB,CAAC,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAGpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;~~IAGjB~~,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,uBAAuB,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,MAAM,CAAC;IAG/E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAGpC;;;;;;OAMG;IACH,YAAY,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC;IAEjD;;;;;OAKG;IACH,cAAc,EAAE,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;IAG1D;;;OAGG;IACH,cAAc,EAAE,oBAAoB,CAAC;~~IAGrC~~,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAG7C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAEtC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,iBAAiB,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB;qEACiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;oFAEgF;IAChF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;CACpB"}
1	+ {"version":3,"file":"oauth2-connection.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/oauth2-connection.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EACL,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAM9E;;;;GAIG;AACH,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE;;;OAGG;IACH,MAAM,EAAE,sBAAsB,CAAC,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAGpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAGjC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,uBAAuB,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,MAAM,CAAC;IAG/E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAGpC;;;;;;OAMG;IACH,YAAY,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC;IAEjD;;;;;OAKG;IACH,cAAc,EAAE,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;IAG1D;;;OAGG;IACH,cAAc,EAAE,oBAAoB,CAAC;IAcrC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;IACzD;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IAGrB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAG7C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAEtC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,iBAAiB,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB;qEACiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;oFAEgF;IAChF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;CACpB"}

package/dist/esm/security/authentications/models/oauth2-connection.backend.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2-connection.backend.schemas.js","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/oauth2-connection.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG","sourcesContent":["/*\n OAuth2 Resolved Connection & State Types\n \n These are the canonical types shared between the OAuth2 engine and its resolvers.\n * Social resolver (Step 4) and Enterprise resolver (Step 15) both produce\n * `OAuth2ResolvedConnection`. The engine methods (`buildAuthorizationUrl`,\n * `handleCallback`, `provisionOrLinkUser`) consume it.\n \n `NormalizedUserProfile` is owned by `sso-connection.backend.schemas.ts` and\n * re-exported here because both OAuth2 and SAML consume the same normalized shape.\n /\n\nimport type { SSOResolvedConnectionBase } from './sso-connection.backend.schemas';\nimport {\n ExternalIdentitySource,\n type AuthScopeType,\n type SsoConnectionType,\n} from '@wildo-ai/saas-models';\n\nexport type { NormalizedUserProfile } from './sso-connection.backend.schemas';\n\n// ─────────────────────────────────────────────────────────────────\n// OAuth2ResolvedConnection\n// ─────────────────────────────────────────────────────────────────\n\n/\n Canonical resolved OAuth2 connection — the engine's only input.\n * Social resolver (Step 4) and Enterprise resolver (Step 15) both produce this.\n * Extends SSOResolvedConnectionBase with OAuth2-specific protocol fields.\n /\nexport interface OAuth2ResolvedConnection extends SSOResolvedConnectionBase {\n /\n Identity protocol, not merely the transport implementation. OAuth2-only\n * providers (for example GitHub) must not be recorded as OIDC.\n /\n source: ExternalIdentitySource.OAUTH2 \| ExternalIdentitySource.OIDC;\n\n // ─── OAuth2 Protocol Parameters ───\n authorizationUrl: string;\n tokenUrl: string;\n /* Optional — Apple has none (identity from ID token) /\n userInfoUrl?: string;\n /* Redirect URI — computed by resolver, stored for exact match on callback /\n redirectUri: string;\n /* Issuer URL — for ID token validation (Apple, enterprise OIDC) /\n issuer?: string;\n /* JWKS endpoint — for ID token signature verification /\n jwksUri?: string;\n\n // ─── Client Credentials ───\n clientId: string;\n /\n Client secret — always a string. For Apple (dynamic JWT secret), the RESOLVER\n * generates the signed JWT and places the result here. The engine never knows\n * how the secret was produced.\n /\n clientSecret: string;\n /\n How to send credentials to the token endpoint.\n * - 'client_secret_post': credentials in POST body (Google, Microsoft, GitHub, Apple)\n * - 'client_secret_basic': credentials in Authorization: Basic header (some enterprise IdPs)\n * - 'none': no client auth (public clients, rare)\n /\n tokenEndpointAuthMethod: 'client_secret_post' \| 'client_secret_basic' \| 'none';\n\n // ─── Scopes & Security ───\n scopes: string[];\n pkceMethod: 'S256' \| 'plain' \| null;\n\n // ─── Response Configuration ───\n /\n How the IdP delivers the authorization response.\n * - 'query': code & state in URL query params (default, most providers)\n * - 'fragment': code & state in URL fragment (rare)\n * - 'form_post': code & state in POST body (Apple REQUIRES this)\n * The callback handler MUST accept both GET and POST and extract params accordingly.\n /\n responseMode: 'query' \| 'fragment' \| 'form_post';\n\n /\n Where user identity comes from after code exchange:\n * - 'userinfo': fetch from userInfoUrl (Google, Microsoft, GitHub — default)\n * - 'id_token': decode from ID token JWT (Apple — no userinfo endpoint)\n * - 'callback_body': embedded in the callback POST body (Apple first-auth name)\n /\n identitySource: 'userinfo' \| 'id_token' \| 'callback_body';\n\n // ─── Profile Mapping (unified) ───\n /\n Maps provider claim field names to canonical user profile fields.\n * Works for both social `userProfileMapping` and enterprise `claimsMapping`.\n /\n profileMapping: OAuth2ProfileMapping;\n\n // ─── Extra Parameters ───\n extraAuthParams?: Record<string, string>;\n extraTokenParams?: Record<string, string>;\n tokenRequestHeaders?: Record<string, string>;\n\n // ─── Provider-Specific Extensions ───\n extensions?: Record<string, unknown>;\n\n}\n\n/\n Profile mapping — translates provider claim field names to canonical fields.\n /\nexport interface OAuth2ProfileMapping {\n id: string;\n email: string;\n firstName?: string;\n lastName?: string;\n name?: string;\n image?: string;\n emailVerified?: string;\n roles?: string;\n groups?: string;\n department?: string;\n employeeId?: string;\n}\n\n// ─────────────────────────────────────────────────────────────────\n// State Token Metadata\n// ─────────────────────────────────────────────────────────────────\n\n\n/\n Metadata stored in the OAUTH2_STATE consumable token.\n * Carries connection context through the OAuth2 redirect so the callback handler\n * can re-resolve the exact same connection configuration.\n \n Created by buildAuthorizationUrl() → consumed by resolveFromState().\n \n For social connections with per-scope credential overrides (P3), scopeType + scopeId\n * are stored so resolveFromState() can re-apply the override on callback — ensuring\n * the same clientId/clientSecret (and signed-JWT params) are used for the token exchange.\n /\nexport interface OAuth2StateTokenMetadata {\n connectionType: SsoConnectionType;\n providerRef: string;\n /* The clientId used at authorize time. Validated on callback to detect config drift. /\n clientId: string;\n responseMode: 'query' \| 'fragment' \| 'form_post';\n pkceVerifier?: string;\n redirectUri: string;\n initiatedAt: string; // ISO timestamp\n /* Config-defined frontend service identity for the surface that initiated the OAuth2 flow.\n * Used on callback to redirect back to the correct frontend. /\n frontendServiceName?: string;\n /* Scope context — set for enterprise connections AND social connections with\n * credential overrides (P3). Used by resolveFromState() to re-resolve the connection\n * with the correct org/app scope, including per-scope credential overrides. /\n scopeType?: AuthScopeType;\n /* The org or app ID. Combined with scopeType to load SsoConfig for credential overrides. /\n scopeId?: string;\n /* Post-auth frontend path to restore after the provider round-trip. /\n returnUrl?: string;\n /* Enterprise-only — identifies the specific SsoConnection resource. /\n connectionId?: string;\n}\n\n/\n Parameters passed to the callback handler from the route.\n * Extracted from query params (GET) or body (POST) based on responseMode.\n /\nexport interface OAuth2CallbackParams {\n code: string;\n state: string;\n /* Apple form_post: the full POST body including `user` JSON (first auth only) /\n body?: Record<string, unknown>;\n}\n\n/\n Result of provisionOrLinkUser — the user and whether it was newly created.\n /\nexport interface OAuth2ProvisionResult {\n /* The provisioned user ID — userId. /\n userId: string;\n /* Whether the user was newly created (JIT provisioning) vs linked to existing. */\n isNewUser: boolean;\n}\n"]}
1	+ {"version":3,"file":"oauth2-connection.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/models/oauth2-connection.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG","sourcesContent":["/*\n OAuth2 Resolved Connection & State Types\n \n These are the canonical types shared between the OAuth2 engine and its resolvers.\n * Social resolver (Step 4) and Enterprise resolver (Step 15) both produce\n * `OAuth2ResolvedConnection`. The engine methods (`buildAuthorizationUrl`,\n * `handleCallback`, `provisionOrLinkUser`) consume it.\n \n `NormalizedUserProfile` is owned by `sso-connection.backend.schemas.ts` and\n * re-exported here because both OAuth2 and SAML consume the same normalized shape.\n /\n\nimport type { SSOResolvedConnectionBase } from './sso-connection.backend.schemas';\nimport {\n ExternalIdentitySource,\n type AuthScopeType,\n type SsoConnectionType,\n} from '@wildo-ai/saas-models';\n\nexport type { NormalizedUserProfile } from './sso-connection.backend.schemas';\n\n// ─────────────────────────────────────────────────────────────────\n// OAuth2ResolvedConnection\n// ─────────────────────────────────────────────────────────────────\n\n/\n Canonical resolved OAuth2 connection — the engine's only input.\n * Social resolver (Step 4) and Enterprise resolver (Step 15) both produce this.\n * Extends SSOResolvedConnectionBase with OAuth2-specific protocol fields.\n /\nexport interface OAuth2ResolvedConnection extends SSOResolvedConnectionBase {\n /\n Identity protocol, not merely the transport implementation. OAuth2-only\n * providers (for example GitHub) must not be recorded as OIDC.\n /\n source: ExternalIdentitySource.OAUTH2 \| ExternalIdentitySource.OIDC;\n\n // ─── OAuth2 Protocol Parameters ───\n authorizationUrl: string;\n tokenUrl: string;\n /* Optional — Apple has none (identity from ID token) /\n userInfoUrl?: string;\n /* Redirect URI — computed by resolver, stored for exact match on callback /\n redirectUri: string;\n /* Issuer URL — for ID token validation (Apple, enterprise OIDC) /\n issuer?: string;\n /* JWKS endpoint — for ID token signature verification /\n jwksUri?: string;\n /\n The upstream identity provider's RP-initiated logout endpoint, and whether this connection has\n * OPTED IN to using it (issue #445).\n \n Both were resolved into local variables and DROPPED before reaching here — the endpoint was\n * persisted, audit-marked and resolved from all three template modes into a value nothing\n * downstream could see, so signing out of Wildo left the session at the provider alive and the\n * next sign-in was silent.\n \n They travel as a PAIR because either alone is a half-answer: the endpoint records what the\n * provider can do (in DISCOVERY mode it is read out of the provider's own document, so it says\n * nothing about intent), and the flag records what the operator asked for.\n /\n endSessionEndpoint?: string;\n federatedLogoutEnabled?: boolean;\n\n // ─── Client Credentials ───\n clientId: string;\n /\n Client secret — always a string. For Apple (dynamic JWT secret), the RESOLVER\n * generates the signed JWT and places the result here. The engine never knows\n * how the secret was produced.\n /\n clientSecret: string;\n /\n How to send credentials to the token endpoint.\n * - 'client_secret_post': credentials in POST body (Google, Microsoft, GitHub, Apple)\n * - 'client_secret_basic': credentials in Authorization: Basic header (some enterprise IdPs)\n * - 'none': no client auth (public clients, rare)\n /\n tokenEndpointAuthMethod: 'client_secret_post' \| 'client_secret_basic' \| 'none';\n\n // ─── Scopes & Security ───\n scopes: string[];\n pkceMethod: 'S256' \| 'plain' \| null;\n\n // ─── Response Configuration ───\n /\n How the IdP delivers the authorization response.\n * - 'query': code & state in URL query params (default, most providers)\n * - 'fragment': code & state in URL fragment (rare)\n * - 'form_post': code & state in POST body (Apple REQUIRES this)\n * The callback handler MUST accept both GET and POST and extract params accordingly.\n /\n responseMode: 'query' \| 'fragment' \| 'form_post';\n\n /\n Where user identity comes from after code exchange:\n * - 'userinfo': fetch from userInfoUrl (Google, Microsoft, GitHub — default)\n * - 'id_token': decode from ID token JWT (Apple — no userinfo endpoint)\n * - 'callback_body': embedded in the callback POST body (Apple first-auth name)\n /\n identitySource: 'userinfo' \| 'id_token' \| 'callback_body';\n\n // ─── Profile Mapping (unified) ───\n /\n Maps provider claim field names to canonical user profile fields.\n * Works for both social `userProfileMapping` and enterprise `claimsMapping`.\n /\n profileMapping: OAuth2ProfileMapping;\n\n // ─── Authorization-Request Shaping (OIDC) ───\n /\n * These four were declared on the enterprise OIDC connection, persisted, audit-marked and NEVER\n * SENT until 2026-09-08 (#419). That mattered most for `acrValues`: an operator who configured a\n * step-up authentication context requirement got no such demand at the identity provider and no\n * error — a security control the customer believed they had configured, silently absent.\n \n They are first-class fields rather than `extraAuthParams` entries on purpose. Three of the four\n * parameter names they produce are in `RESERVED_AUTH_PARAM_KEYS` or would collide with one, so\n * routing them through the opaque extras bag would either drop them or let an operator overwrite\n * a protocol parameter the engine owns.\n /\n /\n OIDC `acr_values` — the authentication context class references this connection REQUIRES of the\n * identity provider (step-up, MFA at the IdP, a named assurance level). Sent space-delimited.\n /\n acrValues?: string[];\n /* OIDC `max_age` — maximum acceptable age, in seconds, of the end-user's IdP authentication. /\n maxAge?: number;\n /* OIDC `prompt` — whether the IdP must re-authenticate, re-consent, or must NOT prompt at all. /\n prompt?: 'none' \| 'login' \| 'consent' \| 'select_account';\n /\n OAuth2 `response_type`. The engine implements the authorization-CODE flow ONLY, so this is\n * `'code'` in practice; the resolver refuses `id_token` / `token` rather than sending a value it\n * cannot complete the callback for. Carried here so the refusal has something to refuse.\n /\n responseType: 'code';\n\n // ─── Extra Parameters ───\n extraAuthParams?: Record<string, string>;\n extraTokenParams?: Record<string, string>;\n tokenRequestHeaders?: Record<string, string>;\n\n // ─── Provider-Specific Extensions ───\n extensions?: Record<string, unknown>;\n\n}\n\n/\n Profile mapping — translates provider claim field names to canonical fields.\n /\nexport interface OAuth2ProfileMapping {\n id: string;\n email: string;\n firstName?: string;\n lastName?: string;\n name?: string;\n image?: string;\n emailVerified?: string;\n roles?: string;\n groups?: string;\n department?: string;\n employeeId?: string;\n}\n\n// ─────────────────────────────────────────────────────────────────\n// State Token Metadata\n// ─────────────────────────────────────────────────────────────────\n\n\n/\n Metadata stored in the OAUTH2_STATE consumable token.\n * Carries connection context through the OAuth2 redirect so the callback handler\n * can re-resolve the exact same connection configuration.\n \n Created by buildAuthorizationUrl() → consumed by resolveFromState().\n \n For social connections with per-scope credential overrides (P3), scopeType + scopeId\n * are stored so resolveFromState() can re-apply the override on callback — ensuring\n * the same clientId/clientSecret (and signed-JWT params) are used for the token exchange.\n /\nexport interface OAuth2StateTokenMetadata {\n connectionType: SsoConnectionType;\n providerRef: string;\n /* The clientId used at authorize time. Validated on callback to detect config drift. /\n clientId: string;\n responseMode: 'query' \| 'fragment' \| 'form_post';\n pkceVerifier?: string;\n redirectUri: string;\n initiatedAt: string; // ISO timestamp\n /* Config-defined frontend service identity for the surface that initiated the OAuth2 flow.\n * Used on callback to redirect back to the correct frontend. /\n frontendServiceName?: string;\n /* Scope context — set for enterprise connections AND social connections with\n * credential overrides (P3). Used by resolveFromState() to re-resolve the connection\n * with the correct org/app scope, including per-scope credential overrides. /\n scopeType?: AuthScopeType;\n /* The org or app ID. Combined with scopeType to load SsoConfig for credential overrides. /\n scopeId?: string;\n /* Post-auth frontend path to restore after the provider round-trip. /\n returnUrl?: string;\n /* Enterprise-only — identifies the specific SsoConnection resource. /\n connectionId?: string;\n}\n\n/\n Parameters passed to the callback handler from the route.\n * Extracted from query params (GET) or body (POST) based on responseMode.\n /\nexport interface OAuth2CallbackParams {\n code: string;\n state: string;\n /* Apple form_post: the full POST body including `user` JSON (first auth only) /\n body?: Record<string, unknown>;\n}\n\n/\n Result of provisionOrLinkUser — the user and whether it was newly created.\n /\nexport interface OAuth2ProvisionResult {\n /* The provisioned user ID — userId. /\n userId: string;\n /* Whether the user was newly created (JIT provisioning) vs linked to existing. */\n isNewUser: boolean;\n}\n"]}

package/dist/esm/security/authentications/models/saml-authentication.backend.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"saml-authentication.backend.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/saml-authentication.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,aAAa,EACb,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAMlF;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,yBAAyB;IACvE,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC;IAEpC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAE3B,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,+DAA+D;IAC/D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6CAA6C;IAC7C,YAAY,EAAE,OAAO,CAAC;IACtB,wCAAwC;IACxC,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,SAAS,EAAE,aAAa,CAAC;IACzB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB"}
1	+ {"version":3,"file":"saml-authentication.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/saml-authentication.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,aAAa,EACb,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAMlF;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,yBAAyB;IACvE,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC;IAEpC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAE3B,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,+DAA+D;IAC/D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6CAA6C;IAC7C,YAAY,EAAE,OAAO,CAAC;IACtB,wCAAwC;IACxC,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,SAAS,EAAE,aAAa,CAAC;IACzB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB"}

package/dist/esm/security/authentications/models/sso-connection.backend.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-connection.backend.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/sso-connection.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAMlE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,4BAA4B;IAC3C,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAMD;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GACjC;IACA,SAAS,EAAE,aAAa,CAAC,YAAY,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB,GACC;IACA,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEJ;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,yBAAyB,CAiB3B;AAED,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,MAAM,GAAG,SAAS,CAIpB;AAED,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IAEpB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,yBAAyB,CAAC;IAElC,+HAA+H;IAC/H,kBAAkB,CAAC,EAAE,4BAA4B,CAAC;CACnD;AAMD;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,6BAA6B;IAC9E,MAAM,EACF,sBAAsB,CAAC,MAAM,GAC7B,sBAAsB,CAAC,IAAI,GAC3B,sBAAsB,CAAC,IAAI,CAAC;IAChC,cAAc,EAAE,iBAAiB,CAAC;CAEnC;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,aAAa,EAAE,OAAO,CAAC;IACvB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC"}
1	+ {"version":3,"file":"sso-connection.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/sso-connection.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAMlE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,4BAA4B;IAC3C,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAMD;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GACjC;IACA,SAAS,EAAE,aAAa,CAAC,YAAY,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB,GACC;IACA,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEJ;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,yBAAyB,CAiB3B;AAED,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,MAAM,GAAG,SAAS,CAIpB;AAED,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IAEpB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,yBAAyB,CAAC;IAElC,+HAA+H;IAC/H,kBAAkB,CAAC,EAAE,4BAA4B,CAAC;CACnD;AAMD;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,6BAA6B;IAC9E,MAAM,EACF,sBAAsB,CAAC,MAAM,GAC7B,sBAAsB,CAAC,IAAI,GAC3B,sBAAsB,CAAC,IAAI,CAAC;IAChC,cAAc,EAAE,iBAAiB,CAAC;CAEnC;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,aAAa,EAAE,OAAO,CAAC;IACvB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC"}

package/dist/esm/security/authentications/models/user-authorization-version.backend.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"user-authorization-version.backend.utils.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/models/user-authorization-version.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,GAAG;IAC9C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,0BAA0B,GAAG,IAAI,GAAG,SAAS,GAClD,MAAM,GAAG,IAAI,CAOf"}
1	+ {"version":3,"file":"user-authorization-version.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/models/user-authorization-version.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,GAAG;IAC9C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,0BAA0B,GAAG,IAAI,GAAG,SAAS,GAClD,MAAM,GAAG,IAAI,CAOf"}

package/dist/esm/security/authentications/seeds/enterprise-config-defaults.seeds.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"enterprise-config-defaults.seeds.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/seeds/enterprise-config-defaults.seeds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAGH,OAAO,EAEL,KAAK,kBAAkB,EAKxB,MAAM,uDAAuD,CAAC;AA6B/D,2FAA2F;AAC3F,eAAO,MAAM,gCAAgC,oBA6B3C,CAAC;AAEH,2KAA2K;AAC3K,eAAO,MAAM,6CAA6C,oBAoBxD,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,uCAAuC,oBAsBlD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,EAAE,kBAAkB,EAItE,CAAC;AAaF,0DAA0D;AAC1D,eAAO,MAAM,+BAA+B,oBAsB1C,CAAC;AAEH,2KAA2K;AAC3K,eAAO,MAAM,4CAA4C,oBASvD,CAAC;AAEH,kEAAkE;AAClE,eAAO,MAAM,sCAAsC,oBAiBjD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,8CAA8C,EAAE,kBAAkB,EAI9E,CAAC"}
1	+ {"version":3,"file":"enterprise-config-defaults.seeds.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/seeds/enterprise-config-defaults.seeds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAGH,OAAO,EAEL,KAAK,kBAAkB,EAKxB,MAAM,uDAAuD,CAAC;AA6B/D,2FAA2F;AAC3F,eAAO,MAAM,gCAAgC,oBA6B3C,CAAC;AAEH,2KAA2K;AAC3K,eAAO,MAAM,6CAA6C,oBAoBxD,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,uCAAuC,oBAsBlD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,EAAE,kBAAkB,EAItE,CAAC;AAaF,0DAA0D;AAC1D,eAAO,MAAM,+BAA+B,oBAsB1C,CAAC;AAEH,2KAA2K;AAC3K,eAAO,MAAM,4CAA4C,oBASvD,CAAC;AAEH,kEAAkE;AAClE,eAAO,MAAM,sCAAsC,oBAiBjD,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,8CAA8C,EAAE,kBAAkB,EAI9E,CAAC"}

package/dist/esm/security/authentications/services/__tests__/mock-auth-execution-context-factory.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mock-auth-execution-context-factory.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/__tests__/mock-auth-execution-context-factory.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAe1B,qBACa,sCAAsC;IACjD,OAAO,CAAC,uBAAuB,CAAuD;IACtF,OAAO,CAAC,6BAA6B,CAA6D;IAClG,OAAO,CAAC,sBAAsB,CAAsD;IACpF,OAAO,CAAC,sBAAsB,CAAuD;IACrF,OAAO,CAAC,wBAAwB,CAAyD;IAGzF,yBAAyB,8CAAmD;IAE5E,mCAAmC,8CAAyD;IAE5F,4BAA4B,8CAAkD;IAG9E,qBAAqB,8CAAyD;IAG9E,+BAA+B,0FAE7B;IAEF,yBAAyB,qCAA4C;IAErE,2BAA2B,qCAA8C;IAEzE,0BAA0B,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAI3D,gCAAgC,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAIjE,yBAAyB,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAI1D,yBAAyB,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI;IAIvD,2BAA2B,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI;IAIzD,KAAK,IAAI,IAAI;CAcd"}
1	+ {"version":3,"file":"mock-auth-execution-context-factory.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/__tests__/mock-auth-execution-context-factory.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAe1B,qBACa,sCAAsC;IACjD,OAAO,CAAC,uBAAuB,CAAuD;IACtF,OAAO,CAAC,6BAA6B,CAA6D;IAClG,OAAO,CAAC,sBAAsB,CAAsD;IACpF,OAAO,CAAC,sBAAsB,CAAuD;IACrF,OAAO,CAAC,wBAAwB,CAAyD;IAGzF,yBAAyB,8CAAmD;IAE5E,mCAAmC,8CAAyD;IAE5F,4BAA4B,8CAAkD;IAG9E,qBAAqB,8CAAyD;IAG9E,+BAA+B,0FAE7B;IAEF,yBAAyB,qCAA4C;IAErE,2BAA2B,qCAA8C;IAEzE,0BAA0B,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAI3D,gCAAgC,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAIjE,yBAAyB,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAI1D,yBAAyB,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI;IAIvD,2BAA2B,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI;IAIzD,KAAK,IAAI,IAAI;CAcd"}

package/dist/esm/security/authentications/services/__tests__/mock-auth-token-issuer.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mock-auth-token-issuer.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/__tests__/mock-auth-token-issuer.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAI1B,KAAK,oBAAoB,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAUF,qBACa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAA8C;IAG5D,WAAW;qBAlBE,MAAM;sBACL,MAAM;mBACT,MAAM;QAgBqC;IAEtD,kBAAkB;qBApBL,MAAM;sBACL,MAAM;mBACT,MAAM;QAkB4C;IAE7D,uHAAuH;IACvH,0BAA0B,0DAAuD;IAEjF,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI;IAOtD,KAAK,IAAI,IAAI;CAMd"}
1	+ {"version":3,"file":"mock-auth-token-issuer.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/__tests__/mock-auth-token-issuer.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAI1B,KAAK,oBAAoB,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAUF,qBACa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAA8C;IAG5D,WAAW;qBAlBE,MAAM;sBACL,MAAM;mBACT,MAAM;QAgBqC;IAEtD,kBAAkB;qBApBL,MAAM;sBACL,MAAM;mBACT,MAAM;QAkB4C;IAE7D,uHAAuH;IACvH,0BAA0B,0DAAuD;IAEjF,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI;IAOtD,KAAK,IAAI,IAAI;CAMd"}

package/dist/esm/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-provider-audit-spies.mock.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC;IAsB7C,wDAAwD;;;;;;;;;;;;;;;;EAK3D;AAED,MAAM,MAAM,2BAA2B,GAAG,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAC"}
1	+ {"version":3,"file":"oauth-provider-audit-spies.mock.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC;IAsB7C,wDAAwD;;;;;;;;;;;;;;;;EAK3D;AAED,MAAM,MAAM,2BAA2B,GAAG,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/esm/security/authentications/services/admin-config/__tests__/mock-domain-to-org-lookup.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mock-domain-to-org-lookup.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../../~~src/security/authentications/services/admin-config/__tests__/mock-domain-to-org-lookup.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAI1B,KAAK,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;AAE7D,qBACa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6C;IAC3E,OAAO,CAAC,cAAc,CAAgC;IAEtD,eAAe,wGAMZ;IAEH;;;;;OAKG;IACH,mBAAmB,8DAA4D;IAE/E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAIrE,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAIvD,KAAK,IAAI,IAAI;CAMd"}
1	+ {"version":3,"file":"mock-domain-to-org-lookup.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/__tests__/mock-domain-to-org-lookup.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAI1B,KAAK,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;AAE7D,qBACa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6C;IAC3E,OAAO,CAAC,cAAc,CAAgC;IAEtD,eAAe,wGAMZ;IAEH;;;;;OAKG;IACH,mBAAmB,8DAA4D;IAE/E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAIrE,iBAAiB,CAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI;IAIvD,KAAK,IAAI,IAAI;CAMd"}

package/dist/esm/security/authentications/services/admin-config/__tests__/mock-enterprise-user-provisioning.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mock-enterprise-user-provisioning.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../../~~src/security/authentications/services/admin-config/__tests__/mock-enterprise-user-provisioning.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAI1B,KAAK,mBAAmB,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,KAAK,gCAAgC,GAAG;IACtC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAeF,qBACa,qCAAqC;IAChD,OAAO,CAAC,MAAM,CAAsE;IAGpF,uBAAuB;;iBA9BlB,MAAM;oBACH,MAAM;qBACL,OAAO;;;eAKT,OAAO;0BACI,OAAO;QA0BrB;IAEJ,qBAAqB,CAAC,MAAM,EAAE,gCAAgC,GAAG,IAAI;IAQrE,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI;IAOnD,KAAK,IAAI,IAAI;CAId"}
1	+ {"version":3,"file":"mock-enterprise-user-provisioning.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/__tests__/mock-enterprise-user-provisioning.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,kBAAkB,CAAC;AAI1B,KAAK,mBAAmB,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,KAAK,gCAAgC,GAAG;IACtC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAeF,qBACa,qCAAqC;IAChD,OAAO,CAAC,MAAM,CAAsE;IAGpF,uBAAuB;;iBA9BlB,MAAM;oBACH,MAAM;qBACL,OAAO;;;eAKT,OAAO;0BACI,OAAO;QA0BrB;IAEJ,qBAAqB,CAAC,MAAM,EAAE,gCAAgC,GAAG,IAAI;IAQrE,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI;IAOnD,KAAK,IAAI,IAAI;CAId"}

package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.d.ts CHANGED Viewed

@@ -162,8 +162,6 @@ export declare class AuthOrganizationConfigurationService {
         ssoEnabled: string[];
         allowExternal: boolean;
     }>;
-    isEmergencyAccessEnabled(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<boolean>;
-    getEmergencyAccessAccounts(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<string[]>;
     validateSSOConfig(config: Partial<SsoConfigBase>): {
         isValid: boolean;
         errors: string[];

package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-organization-configuration.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/admin-config/auth-organization-configuration.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAsB,MAAM,WAAW,CAAC;AAC1D,OAAO,~~EAEL~~,aAAa,EAMb,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAM7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAiB5G,qBACa,oCAAoC;IAOV,OAAO,CAAC,MAAM;IACX,OAAO,CAAC,QAAQ,CAAC,SAAS;IAPlE,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,iBAAiB,CAAgD;IACzE,OAAO,CAAC,qBAAqB,CAAyF;IACtH,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAGpC,MAAM,EAAE,aAAa,EACT,SAAS,EAAE,SAAS;IAM7E;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;IAIlC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAI9B;qGACiG;IACjG,OAAO,CAAC,eAAe;IAIvB;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IActC,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;IAIpB;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IASlC;;;;;;;;;;;;;;;;OAgBG;YACW,0CAA0C;IA2BxD,OAAO,CAAC,uBAAuB;IAM/B,OAAO,CAAC,kCAAkC;IAM1C,OAAO,CAAC,wBAAwB;IAMhC,OAAO,CAAC,8BAA8B;IAMtC;;;OAGG;IACI,qBAAqB,IAAI,MAAM,EAAE;IAUxC;;;OAGG;IACI,oBAAoB,IAAI,MAAM,EAAE;IAcvC;;;;;;;;;;;;;;OAcG;IACU,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAqC/H;;;;;;;;;;OAUG;IACU,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAwB5G;;;;;;;;;;OAUG;IACU,yBAAyB,CACpC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASpC;;;;;;;;;;OAUG;IACU,6BAA6B,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAK7H;;;;;;;;;OASG;IACU,oCAAoC,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAU9G,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B/I,kEAAkE;IACrD,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAKzF,kEAAkE;IACrD,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAKlG,kEAAkE;IACrD,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAenG,kEAAkE;IACrD,sBAAsB,CACjC,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAqB7B,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKrG,yBAAyB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKjH,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QACrG,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;~~IASW~~,wBAAwB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhH,0BAA0B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAKzH,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAezF,cAAc,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,KAAK,IAAI,GAAG,IAAI;IAIjH,OAAO,CAAC,kBAAkB;IAcnB,sBAAsB,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAwDjG;;;;;;;;;;;OAWG;IACU,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAqChI,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBhJ,uBAAuB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS5H;;;;;;;;;;;;;;;;OAgBG;IACU,0BAA0B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAgCzJ;;;;;;;;;;;;;;;;;;;OAmBG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC;CAyBjB"}
1	+ {"version":3,"file":"auth-organization-configuration.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/auth-organization-configuration.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAsB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAGL,aAAa,EAMb,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAChC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAM7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAiB5G,qBACa,oCAAoC;IAOV,OAAO,CAAC,MAAM;IACX,OAAO,CAAC,QAAQ,CAAC,SAAS;IAPlE,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,iBAAiB,CAAgD;IACzE,OAAO,CAAC,qBAAqB,CAAyF;IACtH,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;gBAGpC,MAAM,EAAE,aAAa,EACT,SAAS,EAAE,SAAS;IAM7E;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;IAIlC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAI9B;qGACiG;IACjG,OAAO,CAAC,eAAe;IAIvB;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IActC,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;IAIpB;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IASlC;;;;;;;;;;;;;;;;OAgBG;YACW,0CAA0C;IA2BxD,OAAO,CAAC,uBAAuB;IAM/B,OAAO,CAAC,kCAAkC;IAM1C,OAAO,CAAC,wBAAwB;IAMhC,OAAO,CAAC,8BAA8B;IAMtC;;;OAGG;IACI,qBAAqB,IAAI,MAAM,EAAE;IAUxC;;;OAGG;IACI,oBAAoB,IAAI,MAAM,EAAE;IAcvC;;;;;;;;;;;;;;OAcG;IACU,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAqC/H;;;;;;;;;;OAUG;IACU,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAwB5G;;;;;;;;;;OAUG;IACU,yBAAyB,CACpC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASpC;;;;;;;;;;OAUG;IACU,6BAA6B,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAK7H;;;;;;;;;OASG;IACU,oCAAoC,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAU9G,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B/I,kEAAkE;IACrD,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAKzF,kEAAkE;IACrD,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAKlG,kEAAkE;IACrD,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAenG,kEAAkE;IACrD,sBAAsB,CACjC,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAqB7B,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKrG,yBAAyB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKjH,UAAU,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QACrG,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IA2BK,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IAezF,cAAc,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,KAAK,IAAI,GAAG,IAAI;IAIjH,OAAO,CAAC,kBAAkB;IAcnB,sBAAsB,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAwDjG;;;;;;;;;;;OAWG;IACU,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAqChI,oBAAoB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBhJ,uBAAuB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS5H;;;;;;;;;;;;;;;;OAgBG;IACU,0BAA0B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAgCzJ;;;;;;;;;;;;;;;;;;;OAmBG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC;CAyBjB"}

package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.js CHANGED Viewed

@@ -18,7 +18,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Container, injectable, inject } from 'inversify';
-import { CoreResourceType, AuthScopeType, SsoProtocol, SsoConfigBaseSchema, isWildoBackendError, ErrorType, CORE_ORG_ROLES, } from '@wildo-ai/saas-models';
+import { resolveVerifiedDomains, CoreResourceType, AuthScopeType, SsoProtocol, SsoConfigBaseSchema, isWildoBackendError, ErrorType, CORE_ORG_ROLES, } from '@wildo-ai/saas-models';
 import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
 import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
 import { describeCaughtError } from '../../../../errors/utils/error-log-level-classification.backend.utils.js';
@@ -396,19 +396,28 @@ let AuthOrganizationConfigurationService = class AuthOrganizationConfigurationSe
     async getDomains(ec, scopeType, scopeId) {
         const config = await this.loadSSOConfig(ec, scopeType, scopeId);
         return {
-            verified: config?.domains.verifiedDomains || [],
+            /*
+             * DERIVED, not the stored list (#457). `domains.verifiedDomains` holds every CLAIMED domain —
+             * `initiateDomainVerification` pushes one in at claim time with status `pending` — so
+             * returning it under the name `verified` handed a caller pending, failed and expired domains
+             * with no reason to suspect it. There is no such caller yet, which is the only reason this was
+             * contained rather than a disclosure.
+             */
+            verified: resolveVerifiedDomains(config?.domains),
             ssoEnabled: config?.domains.ssoEnabledDomains || [],
             allowExternal: config?.domains.allowExternalDomains || false,
         };
     }
-    async isEmergencyAccessEnabled(ec, scopeType, scopeId) {
-        const config = await this.loadSSOConfig(ec, scopeType, scopeId);
-        return config?.emergencyAccess.enabled || false;
-    }
-    async getEmergencyAccessAccounts(ec, scopeType, scopeId) {
-        const config = await this.loadSSOConfig(ec, scopeType, scopeId);
-        return config?.emergencyAccess.breakGlassAccounts || [];
-    }
+    /*
+     * `isEmergencyAccessEnabled` and `getEmergencyAccessAccounts` used to sit here, and both had ZERO
+     * callers for as long as they existed — two accessors onto a config block nothing read (#423).
+     *
+     * The break-glass decision is now taken by `isBreakGlassAccount` in
+     * `enterprise-sso-enforcement.backend.utils`, beside `requiresEnterpriseSsoOnly`, because the two
+     * must agree: one decides whether a password field is offered at all, the other decides who gets
+     * past the enforcement gate, and a tenant whose accounts cannot reach a password field has
+     * break-glass in name only. Splitting them across two modules is how they drift.
+     */
     validateSSOConfig(config) {
         const result = SsoConfigBaseSchema.safeParse(config);
         if (result.success) {
@@ -445,7 +454,6 @@ let AuthOrganizationConfigurationService = class AuthOrganizationConfigurationSe
             enforcement: {
                 requireSSO: false,
                 allowPasswordFallback: true,
-                enforceForAdmins: true,
                 graceLoginAttempts: 3,
             },
             domains: {
@@ -476,12 +484,13 @@ let AuthOrganizationConfigurationService = class AuthOrganizationConfigurationSe
                 complianceReporting: false,
                 retentionDays: 365,
             },
+            // `enabled: true` with an EMPTY list grants nothing — the list is what confers the bypass, so
+            // a default tenant has break-glass switched on and nobody named. `requireApproval`,
+            // `maxDurationHours` and `auditLevel` were removed from the schema (#481/#423); this builder
+            // returns `Record<string, unknown>`, so nothing would have caught them staying here.
             emergencyAccess: {
                 enabled: true,
                 breakGlassAccounts: [],
-                requireApproval: true,
-                maxDurationHours: 24,
-                auditLevel: 'verbose',
             },
             oauth2ProviderRestrictions: {
                 allowedProviders: [],