@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/security/scim/models/scim-protocol.backend.schemas.d.ts

@@ -151,42 +151,80 @@ export interface SCIMListResponse<T = SCIMUserResource> {
     itemsPerPage: number;
     Resources: T[];
 }
-export declare const SCIM_SERVICE_PROVIDER_CONFIG: {
-    readonly schemas: readonly ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"];
-    readonly documentationUri: "https://docs.wildo.ai/scim";
-    readonly patch: {
-        readonly supported: true;
+/**
+ * Where an application's SCIM discovery document sends a directory administrator for
+ * documentation. Authored per application (`auth.scimDocumentation`), because the RFC defines
+ * `documentationUri` as the SERVICE PROVIDER's documentation — and the service provider is the
+ * application, not the framework it was built with.
+ *
+ * spec-cite: RFC 7643 §5 — "An HTTP-addressable URL pointing to the service provider's
+ * human-consumable help documentation. OPTIONAL."
+ */
+export interface ScimDocumentationUris {
+    /** RFC 7643 §5 `documentationUri` on the ServiceProviderConfig itself. */
+    readonly serviceProviderUri?: string;
+    /** RFC 7643 §5 `documentationUri` on the OAuth bearer-token authentication scheme. */
+    readonly authenticationSchemeUri?: string;
+}
+/**
+ * Build the SCIM ServiceProviderConfig this application serves at
+ * `GET /scim/v2/ServiceProviderConfig` (RFC 7643 §5).
+ *
+ * Everything except the two documentation URLs is a statement about THIS implementation and is
+ * therefore fixed: patch and bulk are supported, filtering is capped, `changePassword`, `sort` and
+ * `etag` are not. Those are facts about the code, not choices an application makes.
+ *
+ * ## Why the two URLs are parameters, and why absence OMITS rather than empties
+ *
+ * They were frozen here, pointing at `docs.wildo.ai/scim` and `/scim/auth` — a host with no DNS
+ * record, so every application built on Wildo told its enterprise customers to go somewhere that
+ * does not resolve. Both are OPTIONAL in the RFC, so a discovery document without them is
+ * conformant; one carrying a URL that answers nothing is a false advertisement served to the exact
+ * reader who is trying to integrate.
+ *
+ * spec-cite: RFC 7643 §5 — both the top-level `documentationUri` and the `authenticationSchemes`
+ * sub-attribute of the same name are marked "OPTIONAL."
+ *
+ * An absent value therefore removes the KEY. Emitting `documentationUri: ''` or `null` would
+ * replace an unanswerable URL with a malformed one, and a directory-service client that reads the
+ * field before checking it would be worse off than if the framework had said nothing.
+ */
+export declare function buildScimServiceProviderConfig(documentation?: ScimDocumentationUris): {
+    patch: {
+        supported: boolean;
     };
-    readonly bulk: {
-        readonly supported: true;
-        readonly maxOperations: 100;
-        readonly maxPayloadSize: 1048576;
+    bulk: {
+        supported: boolean;
+        maxOperations: number;
+        maxPayloadSize: number;
     };
-    readonly filter: {
-        readonly supported: true;
-        readonly maxResults: 200;
+    filter: {
+        supported: boolean;
+        maxResults: number;
     };
-    readonly changePassword: {
-        readonly supported: false;
+    changePassword: {
+        supported: boolean;
     };
-    readonly sort: {
-        readonly supported: false;
+    sort: {
+        supported: boolean;
     };
-    readonly etag: {
-        readonly supported: false;
+    etag: {
+        supported: boolean;
     };
-    readonly authenticationSchemes: readonly [{
-        readonly type: "oauthbearertoken";
-        readonly name: "OAuth Bearer Token";
-        readonly description: "Authentication scheme using the OAuth Bearer Token Standard";
-        readonly specUri: "https://www.rfc-editor.org/info/rfc6750";
-        readonly documentationUri: "https://docs.wildo.ai/scim/auth";
-        readonly primary: true;
-    }];
-    readonly meta: {
-        readonly resourceType: "ServiceProviderConfig";
-        readonly location: "/scim/v2/ServiceProviderConfig";
+    authenticationSchemes: {
+        primary: boolean;
+        documentationUri?: string;
+        type: string;
+        name: string;
+        description: string;
+        specUri: string;
+    }[];
+    meta: {
+        resourceType: string;
+        location: string;
     };
+    documentationUri?: string;
+    schemas: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"[];
 };
 export declare const SCIM_USER_SCHEMA_DEFINITION: {
     readonly schemas: readonly ["urn:ietf:params:scim:schemas:core:2.0:Schema"];

package/dist/esm/security/scim/models/scim-protocol.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-protocol.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/models/scim-protocol.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;CAO1B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEhE,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AAMH,eAAO,MAAM,YAAY;;;;;;;;;;;CAWf,CAAC;AAEX,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAe/E;AAMD,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,SAAS,GACT,YAAY,GACZ,YAAY,GACZ,eAAe,GACf,aAAa,GACb,UAAU,GACV,cAAc,GACd,aAAa,GACb,WAAW,CAAC;AAEhB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAMD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAMD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,UAAU,EAAE,yBAAyB,EAAE,CAAC;CACzC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,EAAE;QACJ,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,gBAAgB;IACpD,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,CAAC,EAAE,CAAC;CAChB;AAMD,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqB/B,CAAC;AAMX,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyB9B,CAAC;AAMX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAerB,CAAC"}
+{"version":3,"file":"scim-protocol.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/scim/models/scim-protocol.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;CAO1B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEhE,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AAMH,eAAO,MAAM,YAAY;;;;;;;;;;;CAWf,CAAC;AAEX,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAe/E;AAMD,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,SAAS,GACT,YAAY,GACZ,YAAY,GACZ,eAAe,GACf,aAAa,GACb,UAAU,GACV,cAAc,GACd,aAAa,GACb,WAAW,CAAC;AAEhB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAMD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAMD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5C,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,UAAU,EAAE,yBAAyB,EAAE,CAAC;CACzC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,EAAE;QACJ,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,gBAAgB;IACpD,OAAO,EAAE,CAAC,OAAO,YAAY,CAAC,aAAa,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,CAAC,EAAE,CAAC;CAChB;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sFAAsF;IACtF,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,CAAC,EAAE,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBnF;AAMD,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyB9B,CAAC;AAMX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAerB,CAAC"}

package/dist/esm/security/scim/models/scim-protocol.backend.schemas.js

@@ -101,31 +101,53 @@ export function extractScimDirectoryUnitValue(body) {
     const department = rawDepartment.trim();
     return department.length > 0 ? department : undefined;
 }
-// ═══════════════════════════════════════════════════════════════
-// SCIM ServiceProviderConfig (RFC 7643 §5)
-// ═══════════════════════════════════════════════════════════════
-export const SCIM_SERVICE_PROVIDER_CONFIG = {
-    schemas: [SCIM_SCHEMAS.SERVICE_PROVIDER_CONFIG],
-    documentationUri: 'https://docs.wildo.ai/scim',
-    patch: { supported: true },
-    bulk: { supported: true, maxOperations: 100, maxPayloadSize: 1048576 },
-    filter: { supported: true, maxResults: 200 },
-    changePassword: { supported: false },
-    sort: { supported: false },
-    etag: { supported: false },
-    authenticationSchemes: [{
-            type: 'oauthbearertoken',
-            name: 'OAuth Bearer Token',
-            description: 'Authentication scheme using the OAuth Bearer Token Standard',
-            specUri: 'https://www.rfc-editor.org/info/rfc6750',
-            documentationUri: 'https://docs.wildo.ai/scim/auth',
-            primary: true,
-        }],
-    meta: {
-        resourceType: 'ServiceProviderConfig',
-        location: '/scim/v2/ServiceProviderConfig',
-    },
-};
+/**
+ * Build the SCIM ServiceProviderConfig this application serves at
+ * `GET /scim/v2/ServiceProviderConfig` (RFC 7643 §5).
+ *
+ * Everything except the two documentation URLs is a statement about THIS implementation and is
+ * therefore fixed: patch and bulk are supported, filtering is capped, `changePassword`, `sort` and
+ * `etag` are not. Those are facts about the code, not choices an application makes.
+ *
+ * ## Why the two URLs are parameters, and why absence OMITS rather than empties
+ *
+ * They were frozen here, pointing at `docs.wildo.ai/scim` and `/scim/auth` — a host with no DNS
+ * record, so every application built on Wildo told its enterprise customers to go somewhere that
+ * does not resolve. Both are OPTIONAL in the RFC, so a discovery document without them is
+ * conformant; one carrying a URL that answers nothing is a false advertisement served to the exact
+ * reader who is trying to integrate.
+ *
+ * spec-cite: RFC 7643 §5 — both the top-level `documentationUri` and the `authenticationSchemes`
+ * sub-attribute of the same name are marked "OPTIONAL."
+ *
+ * An absent value therefore removes the KEY. Emitting `documentationUri: ''` or `null` would
+ * replace an unanswerable URL with a malformed one, and a directory-service client that reads the
+ * field before checking it would be worse off than if the framework had said nothing.
+ */
+export function buildScimServiceProviderConfig(documentation) {
+    return {
+        schemas: [SCIM_SCHEMAS.SERVICE_PROVIDER_CONFIG],
+        ...(documentation?.serviceProviderUri ? { documentationUri: documentation.serviceProviderUri } : {}),
+        patch: { supported: true },
+        bulk: { supported: true, maxOperations: 100, maxPayloadSize: 1048576 },
+        filter: { supported: true, maxResults: 200 },
+        changePassword: { supported: false },
+        sort: { supported: false },
+        etag: { supported: false },
+        authenticationSchemes: [{
+                type: 'oauthbearertoken',
+                name: 'OAuth Bearer Token',
+                description: 'Authentication scheme using the OAuth Bearer Token Standard',
+                specUri: 'https://www.rfc-editor.org/info/rfc6750',
+                ...(documentation?.authenticationSchemeUri ? { documentationUri: documentation.authenticationSchemeUri } : {}),
+                primary: true,
+            }],
+        meta: {
+            resourceType: 'ServiceProviderConfig',
+            location: '/scim/v2/ServiceProviderConfig',
+        },
+    };
+}
 // ═══════════════════════════════════════════════════════════════
 // SCIM User Schema Definition (RFC 7643 §7)
 // ═══════════════════════════════════════════════════════════════

package/dist/esm/security/scim/models/scim-protocol.backend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-protocol.backend.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/scim/models/scim-protocol.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU,EAAS,OAAO;IAC1B,gBAAgB,EAAG,WAAW;IAC9B,iBAAiB,EAAE,UAAU;IAC7B,aAAa,EAAM,aAAa;IAChC,QAAQ,EAAW,SAAS,EAAS,kDAAkD;IACvF,YAAY,EAAO,gBAAgB;CAC3B,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA2B,MAAM,CAAC,WAAW,CACrF,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAClF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AAEH,kEAAkE;AAClE,0BAA0B;AAC1B,kEAAkE;AAElE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,4CAA4C;IAClD,eAAe,EAAE,4DAA4D;IAC7E,aAAa,EAAE,oDAAoD;IACnE,KAAK,EAAE,6CAA6C;IACpD,QAAQ,EAAE,+CAA+C;IACzD,YAAY,EAAE,mDAAmD;IACjE,aAAa,EAAE,oDAAoD;IACnE,uBAAuB,EAAE,6DAA6D;IACtF,aAAa,EAAE,oDAAoD;IACnE,MAAM,EAAE,8CAA8C;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhE,MAAM,QAAQ,GAAG,IAA+B,CAAC;IACjD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;IACnE,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,IAAI,IAAI,OAAO,mBAAmB,KAAK,QAAQ;QACrE,CAAC,CAAE,mBAA+C,CAAC,YAAY,CAAC;QAChE,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,oBAAoB,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAExD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AA2GD,kEAAkE;AAClE,2CAA2C;AAC3C,kEAAkE;AAElE,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,OAAO,EAAE,CAAC,YAAY,CAAC,uBAAuB,CAAC;IAC/C,gBAAgB,EAAE,4BAA4B;IAC9C,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;IAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE;IACtE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;IAC5C,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;IACpC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;IAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;IAC1B,qBAAqB,EAAE,CAAC;YACtB,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,6DAA6D;YAC1E,OAAO,EAAE,yCAAyC;YAClD,gBAAgB,EAAE,iCAAiC;YACnD,OAAO,EAAE,IAAI;SACd,CAAC;IACF,IAAI,EAAE;QACJ,YAAY,EAAE,uBAAuB;QACrC,QAAQ,EAAE,gCAAgC;KAC3C;CACO,CAAC;AAEX,kEAAkE;AAClE,4CAA4C;AAC5C,kEAAkE;AAElE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,YAAY,CAAC,IAAI;IACrB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;QAC9J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBACjI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACxH,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzH,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;aACzH,EAAC;QACF,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC1H,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QACtH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBAClI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACrE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACrE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC1E,EAAC;QACF,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;KAC1H;IACD,IAAI,EAAE;QACJ,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,oBAAoB,YAAY,CAAC,IAAI,EAAE;KAClD;CACO,CAAC;AAEX,kEAAkE;AAClE,+CAA+C;AAC/C,kEAAkE;AAElE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;QAClC,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;QACrC,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,cAAc;QAC3B,MAAM,EAAE,YAAY,CAAC,IAAI;QACzB,gBAAgB,EAAE,CAAC;gBACjB,MAAM,EAAE,YAAY,CAAC,eAAe;gBACpC,QAAQ,EAAE,KAAK;aAChB,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,cAAc;YAC5B,QAAQ,EAAE,6BAA6B;SACxC;KACF,CAAU,CAAC","sourcesContent":["/**\n * SCIM Protocol Schemas — Step 20\n * \n * SCIM 2.0 types, attribute mapping, and protocol constants for directory provisioning.\n * \n * Decision 13: Lean SCIM — Users only in v1, no Groups, no generic adapter.\n * SCIM_USER_ATTRIBUTE_MAP maps SCIM attributes → NormalizedUserProfile fields\n * (the same type used by SSO JIT provisioning in Step 4/15).\n *\n * Token schema has moved to @wildo-ai/saas-models (scimTokensPolymorphicDeclaration).\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Attribute Mapping\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Maps SCIM User resource attribute paths to NormalizedUserProfile fields.\n * Hardcoded for v1 — only the SCIM User resource is supported.\n * \n * FUTURE: If SCIM Groups or custom resources are needed, extract this into a\n * generic SCIMResourceMappingRegistry. See Decision 13 for the architecture.\n */\nexport const SCIM_USER_ATTRIBUTE_MAP = {\n  'userName':        'email',\n  'name.givenName':  'firstName',\n  'name.familyName': 'lastName',\n  'displayName':     'displayName',\n  'active':          '_active',        // computed: maps to user status (active/inactive)\n  'externalId':      'providerUserId',\n} as const;\n\n/**\n * Reverse map: NormalizedUserProfile field → SCIM attribute path.\n * Used by the response formatter to build SCIM User resources from internal data.\n */\nexport const PROFILE_TO_SCIM_ATTRIBUTE_MAP: Record<string, string> = Object.fromEntries(\n  Object.entries(SCIM_USER_ATTRIBUTE_MAP).map(([scim, profile]) => [profile, scim])\n);\n\n/**\n * FUTURE: SCIM Groups → Organization Roles\n * SCIM Groups map to role assignments, not departments.\n * Example: Okta group \"Wildo Admins\" → ADMIN role.\n * Implementation: add /scim/v2/Groups endpoints with:\n *   - POST/PUT/PATCH /Groups → create/update org roles\n *   - Group membership changes → OrganizationMember role updates\n *   - Group displayName → role identifier mapping (configurable per org)\n *\n * SCIM User department → OrganizationUnit: IMPLEMENTED (2026-08-01, WS-C). `department` from the\n * Enterprise User extension is bound to an organization unit through the EXPLICIT per-organization\n * `organizationUnitMapping` on the SCIM provisioning config — see\n * {@link extractScimDirectoryUnitValue} and `scim-organization-unit-mapping.shared.ts`. `division`\n * and `manager` remain unmapped: `division` would only be needed to disambiguate a search-based\n * match, and the declared mapping is unambiguous by construction, while `manager` is a reporting\n * relationship rather than a unit membership.\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Protocol Constants\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_SCHEMAS = {\n  USER: 'urn:ietf:params:scim:schemas:core:2.0:User',\n  ENTERPRISE_USER: 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User',\n  LIST_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:ListResponse',\n  ERROR: 'urn:ietf:params:scim:api:messages:2.0:Error',\n  PATCH_OP: 'urn:ietf:params:scim:api:messages:2.0:PatchOp',\n  BULK_REQUEST: 'urn:ietf:params:scim:api:messages:2.0:BulkRequest',\n  BULK_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:BulkResponse',\n  SERVICE_PROVIDER_CONFIG: 'urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig',\n  RESOURCE_TYPE: 'urn:ietf:params:scim:schemas:core:2.0:ResourceType',\n  SCHEMA: 'urn:ietf:params:scim:schemas:core:2.0:Schema',\n} as const;\n\nexport const SCIM_CONTENT_TYPE = 'application/scim+json';\n\n/**\n * Read the directory's `department` from an inbound SCIM User body.\n *\n * ## Why this is NOT an entry in `attributeMapping`\n *\n * Two independent reasons, and both matter:\n *\n * 1. **The path grammar cannot express it.** `resolveScimAttributePath` splits on `.`, and the\n *    extension key is literally `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User` — the\n *    `2.0` contains a dot, so any dotted path would traverse into a key that does not exist.\n * 2. **There is nothing tenant-specific to configure.** `attributeMapping` exists because directories\n *    disagree about where a value lives (`emails[0].value` vs `emails[type eq \"work\"].value`). The\n *    enterprise extension URN is fixed BY THE SCIM SPEC, so a configurable path here would offer a\n *    choice that has exactly one correct answer.\n *\n * The tenant-specific part — what a department VALUE means — is configured, in\n * `organizationUnitMapping`. This function only finds the value.\n *\n * Falls back to a top-level `department` because directories in the wild place it there when they do\n * not send the extension envelope. Returns `undefined` for anything non-string or blank, so an absent\n * department is unambiguous to the caller.\n */\nexport function extractScimDirectoryUnitValue(body: unknown): string | undefined {\n  if (body === null || typeof body !== 'object') return undefined;\n\n  const scimBody = body as Record<string, unknown>;\n  const enterpriseExtension = scimBody[SCIM_SCHEMAS.ENTERPRISE_USER];\n  const enterpriseDepartment =\n    enterpriseExtension !== null && typeof enterpriseExtension === 'object'\n      ? (enterpriseExtension as Record<string, unknown>)['department']\n      : undefined;\n\n  const rawDepartment = enterpriseDepartment ?? scimBody['department'];\n  if (typeof rawDepartment !== 'string') return undefined;\n\n  const department = rawDepartment.trim();\n  return department.length > 0 ? department : undefined;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Error Types (RFC 7644 §3.12)\n// ═══════════════════════════════════════════════════════════════\n\nexport type SCIMErrorType =\n  | 'invalidFilter'\n  | 'tooMany'\n  | 'uniqueness'\n  | 'mutability'\n  | 'invalidSyntax'\n  | 'invalidPath'\n  | 'noTarget'\n  | 'invalidValue'\n  | 'invalidVers'\n  | 'sensitive';\n\nexport interface SCIMErrorResponse {\n  schemas: [typeof SCIM_SCHEMAS.ERROR];\n  status: string;\n  detail: string;\n  scimType?: SCIMErrorType;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM PATCH Operation Types (RFC 7644 §3.5.2)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMPatchOperation {\n  op: 'add' | 'remove' | 'replace';\n  path?: string;\n  value?: unknown;\n}\n\nexport interface SCIMPatchRequest {\n  schemas: string[];\n  Operations: SCIMPatchOperation[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Bulk Operation Types (RFC 7644 §3.7)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMBulkOperation {\n  method: 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n  path: string;\n  bulkId?: string;\n  data?: Record<string, unknown>;\n}\n\nexport interface SCIMBulkRequest {\n  schemas: [typeof SCIM_SCHEMAS.BULK_REQUEST];\n  Operations: SCIMBulkOperation[];\n  failOnErrors?: number;\n}\n\nexport interface SCIMBulkOperationResponse {\n  method: string;\n  bulkId?: string;\n  location?: string;\n  status: string;\n  response?: SCIMErrorResponse;\n}\n\nexport interface SCIMBulkResponse {\n  schemas: [typeof SCIM_SCHEMAS.BULK_RESPONSE];\n  Operations: SCIMBulkOperationResponse[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Resource Type (RFC 7643 §4.1)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMUserResource {\n  schemas: string[];\n  id: string;\n  externalId?: string;\n  userName: string;\n  name?: {\n    formatted?: string;\n    familyName?: string;\n    givenName?: string;\n  };\n  displayName?: string;\n  active: boolean;\n  emails?: Array<{\n    value: string;\n    type?: string;\n    primary?: boolean;\n  }>;\n  meta: {\n    resourceType: 'User';\n    created: string;\n    lastModified: string;\n    location: string;\n  };\n}\n\nexport interface SCIMListResponse<T = SCIMUserResource> {\n  schemas: [typeof SCIM_SCHEMAS.LIST_RESPONSE];\n  totalResults: number;\n  startIndex: number;\n  itemsPerPage: number;\n  Resources: T[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM ServiceProviderConfig (RFC 7643 §5)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_SERVICE_PROVIDER_CONFIG = {\n  schemas: [SCIM_SCHEMAS.SERVICE_PROVIDER_CONFIG],\n  documentationUri: 'https://docs.wildo.ai/scim',\n  patch: { supported: true },\n  bulk: { supported: true, maxOperations: 100, maxPayloadSize: 1048576 },\n  filter: { supported: true, maxResults: 200 },\n  changePassword: { supported: false },\n  sort: { supported: false },\n  etag: { supported: false },\n  authenticationSchemes: [{\n    type: 'oauthbearertoken',\n    name: 'OAuth Bearer Token',\n    description: 'Authentication scheme using the OAuth Bearer Token Standard',\n    specUri: 'https://www.rfc-editor.org/info/rfc6750',\n    documentationUri: 'https://docs.wildo.ai/scim/auth',\n    primary: true,\n  }],\n  meta: {\n    resourceType: 'ServiceProviderConfig',\n    location: '/scim/v2/ServiceProviderConfig',\n  },\n} as const;\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Schema Definition (RFC 7643 §7)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_USER_SCHEMA_DEFINITION = {\n  schemas: [SCIM_SCHEMAS.SCHEMA],\n  id: SCIM_SCHEMAS.USER,\n  name: 'User',\n  description: 'User Account',\n  attributes: [\n    { name: 'userName', type: 'string', multiValued: false, required: true, caseExact: false, mutability: 'readWrite', returned: 'default', uniqueness: 'server' },\n    { name: 'name', type: 'complex', multiValued: false, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'givenName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'familyName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'formatted', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    ]},\n    { name: 'displayName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'active', type: 'boolean', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'emails', type: 'complex', multiValued: true, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'value', type: 'string', multiValued: false, required: true },\n      { name: 'type', type: 'string', multiValued: false, required: false },\n      { name: 'primary', type: 'boolean', multiValued: false, required: false },\n    ]},\n    { name: 'externalId', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n  ],\n  meta: {\n    resourceType: 'Schema',\n    location: `/scim/v2/Schemas/${SCIM_SCHEMAS.USER}`,\n  },\n} as const;\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Resource Types Definition (RFC 7644 §4)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_RESOURCE_TYPES = [{\n  schemas: [SCIM_SCHEMAS.RESOURCE_TYPE],\n  id: 'User',\n  name: 'User',\n  endpoint: '/Users',\n  description: 'User Account',\n  schema: SCIM_SCHEMAS.USER,\n  schemaExtensions: [{\n    schema: SCIM_SCHEMAS.ENTERPRISE_USER,\n    required: false,\n  }],\n  meta: {\n    resourceType: 'ResourceType',\n    location: '/scim/v2/ResourceTypes/User',\n  },\n}] as const;\n"]}
+{"version":3,"file":"scim-protocol.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/security/scim/models/scim-protocol.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU,EAAS,OAAO;IAC1B,gBAAgB,EAAG,WAAW;IAC9B,iBAAiB,EAAE,UAAU;IAC7B,aAAa,EAAM,aAAa;IAChC,QAAQ,EAAW,SAAS,EAAS,kDAAkD;IACvF,YAAY,EAAO,gBAAgB;CAC3B,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA2B,MAAM,CAAC,WAAW,CACrF,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAClF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AAEH,kEAAkE;AAClE,0BAA0B;AAC1B,kEAAkE;AAElE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,4CAA4C;IAClD,eAAe,EAAE,4DAA4D;IAC7E,aAAa,EAAE,oDAAoD;IACnE,KAAK,EAAE,6CAA6C;IACpD,QAAQ,EAAE,+CAA+C;IACzD,YAAY,EAAE,mDAAmD;IACjE,aAAa,EAAE,oDAAoD;IACnE,uBAAuB,EAAE,6DAA6D;IACtF,aAAa,EAAE,oDAAoD;IACnE,MAAM,EAAE,8CAA8C;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhE,MAAM,QAAQ,GAAG,IAA+B,CAAC;IACjD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;IACnE,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,IAAI,IAAI,OAAO,mBAAmB,KAAK,QAAQ;QACrE,CAAC,CAAE,mBAA+C,CAAC,YAAY,CAAC;QAChE,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,oBAAoB,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAExD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AA+HD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B,CAAC,aAAqC;IAClF,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,CAAC,uBAAuB,CAAC;QAC/C,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;QAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE;QACtE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;QAC5C,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QACpC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QAC1B,qBAAqB,EAAE,CAAC;gBACtB,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,oBAAoB;gBAC1B,WAAW,EAAE,6DAA6D;gBAC1E,OAAO,EAAE,yCAAyC;gBAClD,GAAG,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9G,OAAO,EAAE,IAAI;aACd,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,uBAAuB;YACrC,QAAQ,EAAE,gCAAgC;SAC3C;KACF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,4CAA4C;AAC5C,kEAAkE;AAElE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,YAAY,CAAC,IAAI;IACrB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;QAC9J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBACjI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACxH,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzH,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;aACzH,EAAC;QACF,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC1H,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QACtH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBAClI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACrE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACrE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC1E,EAAC;QACF,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;KAC1H;IACD,IAAI,EAAE;QACJ,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,oBAAoB,YAAY,CAAC,IAAI,EAAE;KAClD;CACO,CAAC;AAEX,kEAAkE;AAClE,+CAA+C;AAC/C,kEAAkE;AAElE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;QAClC,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;QACrC,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,cAAc;QAC3B,MAAM,EAAE,YAAY,CAAC,IAAI;QACzB,gBAAgB,EAAE,CAAC;gBACjB,MAAM,EAAE,YAAY,CAAC,eAAe;gBACpC,QAAQ,EAAE,KAAK;aAChB,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,cAAc;YAC5B,QAAQ,EAAE,6BAA6B;SACxC;KACF,CAAU,CAAC","sourcesContent":["/**\n * SCIM Protocol Schemas — Step 20\n * \n * SCIM 2.0 types, attribute mapping, and protocol constants for directory provisioning.\n * \n * Decision 13: Lean SCIM — Users only in v1, no Groups, no generic adapter.\n * SCIM_USER_ATTRIBUTE_MAP maps SCIM attributes → NormalizedUserProfile fields\n * (the same type used by SSO JIT provisioning in Step 4/15).\n *\n * Token schema has moved to @wildo-ai/saas-models (scimTokensPolymorphicDeclaration).\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Attribute Mapping\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Maps SCIM User resource attribute paths to NormalizedUserProfile fields.\n * Hardcoded for v1 — only the SCIM User resource is supported.\n * \n * FUTURE: If SCIM Groups or custom resources are needed, extract this into a\n * generic SCIMResourceMappingRegistry. See Decision 13 for the architecture.\n */\nexport const SCIM_USER_ATTRIBUTE_MAP = {\n  'userName':        'email',\n  'name.givenName':  'firstName',\n  'name.familyName': 'lastName',\n  'displayName':     'displayName',\n  'active':          '_active',        // computed: maps to user status (active/inactive)\n  'externalId':      'providerUserId',\n} as const;\n\n/**\n * Reverse map: NormalizedUserProfile field → SCIM attribute path.\n * Used by the response formatter to build SCIM User resources from internal data.\n */\nexport const PROFILE_TO_SCIM_ATTRIBUTE_MAP: Record<string, string> = Object.fromEntries(\n  Object.entries(SCIM_USER_ATTRIBUTE_MAP).map(([scim, profile]) => [profile, scim])\n);\n\n/**\n * FUTURE: SCIM Groups → Organization Roles\n * SCIM Groups map to role assignments, not departments.\n * Example: Okta group \"Wildo Admins\" → ADMIN role.\n * Implementation: add /scim/v2/Groups endpoints with:\n *   - POST/PUT/PATCH /Groups → create/update org roles\n *   - Group membership changes → OrganizationMember role updates\n *   - Group displayName → role identifier mapping (configurable per org)\n *\n * SCIM User department → OrganizationUnit: IMPLEMENTED (2026-08-01, WS-C). `department` from the\n * Enterprise User extension is bound to an organization unit through the EXPLICIT per-organization\n * `organizationUnitMapping` on the SCIM provisioning config — see\n * {@link extractScimDirectoryUnitValue} and `scim-organization-unit-mapping.shared.ts`. `division`\n * and `manager` remain unmapped: `division` would only be needed to disambiguate a search-based\n * match, and the declared mapping is unambiguous by construction, while `manager` is a reporting\n * relationship rather than a unit membership.\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Protocol Constants\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_SCHEMAS = {\n  USER: 'urn:ietf:params:scim:schemas:core:2.0:User',\n  ENTERPRISE_USER: 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User',\n  LIST_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:ListResponse',\n  ERROR: 'urn:ietf:params:scim:api:messages:2.0:Error',\n  PATCH_OP: 'urn:ietf:params:scim:api:messages:2.0:PatchOp',\n  BULK_REQUEST: 'urn:ietf:params:scim:api:messages:2.0:BulkRequest',\n  BULK_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:BulkResponse',\n  SERVICE_PROVIDER_CONFIG: 'urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig',\n  RESOURCE_TYPE: 'urn:ietf:params:scim:schemas:core:2.0:ResourceType',\n  SCHEMA: 'urn:ietf:params:scim:schemas:core:2.0:Schema',\n} as const;\n\nexport const SCIM_CONTENT_TYPE = 'application/scim+json';\n\n/**\n * Read the directory's `department` from an inbound SCIM User body.\n *\n * ## Why this is NOT an entry in `attributeMapping`\n *\n * Two independent reasons, and both matter:\n *\n * 1. **The path grammar cannot express it.** `resolveScimAttributePath` splits on `.`, and the\n *    extension key is literally `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User` — the\n *    `2.0` contains a dot, so any dotted path would traverse into a key that does not exist.\n * 2. **There is nothing tenant-specific to configure.** `attributeMapping` exists because directories\n *    disagree about where a value lives (`emails[0].value` vs `emails[type eq \"work\"].value`). The\n *    enterprise extension URN is fixed BY THE SCIM SPEC, so a configurable path here would offer a\n *    choice that has exactly one correct answer.\n *\n * The tenant-specific part — what a department VALUE means — is configured, in\n * `organizationUnitMapping`. This function only finds the value.\n *\n * Falls back to a top-level `department` because directories in the wild place it there when they do\n * not send the extension envelope. Returns `undefined` for anything non-string or blank, so an absent\n * department is unambiguous to the caller.\n */\nexport function extractScimDirectoryUnitValue(body: unknown): string | undefined {\n  if (body === null || typeof body !== 'object') return undefined;\n\n  const scimBody = body as Record<string, unknown>;\n  const enterpriseExtension = scimBody[SCIM_SCHEMAS.ENTERPRISE_USER];\n  const enterpriseDepartment =\n    enterpriseExtension !== null && typeof enterpriseExtension === 'object'\n      ? (enterpriseExtension as Record<string, unknown>)['department']\n      : undefined;\n\n  const rawDepartment = enterpriseDepartment ?? scimBody['department'];\n  if (typeof rawDepartment !== 'string') return undefined;\n\n  const department = rawDepartment.trim();\n  return department.length > 0 ? department : undefined;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Error Types (RFC 7644 §3.12)\n// ═══════════════════════════════════════════════════════════════\n\nexport type SCIMErrorType =\n  | 'invalidFilter'\n  | 'tooMany'\n  | 'uniqueness'\n  | 'mutability'\n  | 'invalidSyntax'\n  | 'invalidPath'\n  | 'noTarget'\n  | 'invalidValue'\n  | 'invalidVers'\n  | 'sensitive';\n\nexport interface SCIMErrorResponse {\n  schemas: [typeof SCIM_SCHEMAS.ERROR];\n  status: string;\n  detail: string;\n  scimType?: SCIMErrorType;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM PATCH Operation Types (RFC 7644 §3.5.2)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMPatchOperation {\n  op: 'add' | 'remove' | 'replace';\n  path?: string;\n  value?: unknown;\n}\n\nexport interface SCIMPatchRequest {\n  schemas: string[];\n  Operations: SCIMPatchOperation[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Bulk Operation Types (RFC 7644 §3.7)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMBulkOperation {\n  method: 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n  path: string;\n  bulkId?: string;\n  data?: Record<string, unknown>;\n}\n\nexport interface SCIMBulkRequest {\n  schemas: [typeof SCIM_SCHEMAS.BULK_REQUEST];\n  Operations: SCIMBulkOperation[];\n  failOnErrors?: number;\n}\n\nexport interface SCIMBulkOperationResponse {\n  method: string;\n  bulkId?: string;\n  location?: string;\n  status: string;\n  response?: SCIMErrorResponse;\n}\n\nexport interface SCIMBulkResponse {\n  schemas: [typeof SCIM_SCHEMAS.BULK_RESPONSE];\n  Operations: SCIMBulkOperationResponse[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Resource Type (RFC 7643 §4.1)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMUserResource {\n  schemas: string[];\n  id: string;\n  externalId?: string;\n  userName: string;\n  name?: {\n    formatted?: string;\n    familyName?: string;\n    givenName?: string;\n  };\n  displayName?: string;\n  active: boolean;\n  emails?: Array<{\n    value: string;\n    type?: string;\n    primary?: boolean;\n  }>;\n  meta: {\n    resourceType: 'User';\n    created: string;\n    lastModified: string;\n    location: string;\n  };\n}\n\nexport interface SCIMListResponse<T = SCIMUserResource> {\n  schemas: [typeof SCIM_SCHEMAS.LIST_RESPONSE];\n  totalResults: number;\n  startIndex: number;\n  itemsPerPage: number;\n  Resources: T[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM ServiceProviderConfig (RFC 7643 §5)\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Where an application's SCIM discovery document sends a directory administrator for\n * documentation. Authored per application (`auth.scimDocumentation`), because the RFC defines\n * `documentationUri` as the SERVICE PROVIDER's documentation — and the service provider is the\n * application, not the framework it was built with.\n *\n * spec-cite: RFC 7643 §5 — \"An HTTP-addressable URL pointing to the service provider's\n * human-consumable help documentation. OPTIONAL.\"\n */\nexport interface ScimDocumentationUris {\n  /** RFC 7643 §5 `documentationUri` on the ServiceProviderConfig itself. */\n  readonly serviceProviderUri?: string;\n  /** RFC 7643 §5 `documentationUri` on the OAuth bearer-token authentication scheme. */\n  readonly authenticationSchemeUri?: string;\n}\n\n/**\n * Build the SCIM ServiceProviderConfig this application serves at\n * `GET /scim/v2/ServiceProviderConfig` (RFC 7643 §5).\n *\n * Everything except the two documentation URLs is a statement about THIS implementation and is\n * therefore fixed: patch and bulk are supported, filtering is capped, `changePassword`, `sort` and\n * `etag` are not. Those are facts about the code, not choices an application makes.\n *\n * ## Why the two URLs are parameters, and why absence OMITS rather than empties\n *\n * They were frozen here, pointing at `docs.wildo.ai/scim` and `/scim/auth` — a host with no DNS\n * record, so every application built on Wildo told its enterprise customers to go somewhere that\n * does not resolve. Both are OPTIONAL in the RFC, so a discovery document without them is\n * conformant; one carrying a URL that answers nothing is a false advertisement served to the exact\n * reader who is trying to integrate.\n *\n * spec-cite: RFC 7643 §5 — both the top-level `documentationUri` and the `authenticationSchemes`\n * sub-attribute of the same name are marked \"OPTIONAL.\" \n *\n * An absent value therefore removes the KEY. Emitting `documentationUri: ''` or `null` would\n * replace an unanswerable URL with a malformed one, and a directory-service client that reads the\n * field before checking it would be worse off than if the framework had said nothing.\n */\nexport function buildScimServiceProviderConfig(documentation?: ScimDocumentationUris) {\n  return {\n    schemas: [SCIM_SCHEMAS.SERVICE_PROVIDER_CONFIG],\n    ...(documentation?.serviceProviderUri ? { documentationUri: documentation.serviceProviderUri } : {}),\n    patch: { supported: true },\n    bulk: { supported: true, maxOperations: 100, maxPayloadSize: 1048576 },\n    filter: { supported: true, maxResults: 200 },\n    changePassword: { supported: false },\n    sort: { supported: false },\n    etag: { supported: false },\n    authenticationSchemes: [{\n      type: 'oauthbearertoken',\n      name: 'OAuth Bearer Token',\n      description: 'Authentication scheme using the OAuth Bearer Token Standard',\n      specUri: 'https://www.rfc-editor.org/info/rfc6750',\n      ...(documentation?.authenticationSchemeUri ? { documentationUri: documentation.authenticationSchemeUri } : {}),\n      primary: true,\n    }],\n    meta: {\n      resourceType: 'ServiceProviderConfig',\n      location: '/scim/v2/ServiceProviderConfig',\n    },\n  };\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Schema Definition (RFC 7643 §7)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_USER_SCHEMA_DEFINITION = {\n  schemas: [SCIM_SCHEMAS.SCHEMA],\n  id: SCIM_SCHEMAS.USER,\n  name: 'User',\n  description: 'User Account',\n  attributes: [\n    { name: 'userName', type: 'string', multiValued: false, required: true, caseExact: false, mutability: 'readWrite', returned: 'default', uniqueness: 'server' },\n    { name: 'name', type: 'complex', multiValued: false, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'givenName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'familyName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'formatted', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    ]},\n    { name: 'displayName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'active', type: 'boolean', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'emails', type: 'complex', multiValued: true, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'value', type: 'string', multiValued: false, required: true },\n      { name: 'type', type: 'string', multiValued: false, required: false },\n      { name: 'primary', type: 'boolean', multiValued: false, required: false },\n    ]},\n    { name: 'externalId', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n  ],\n  meta: {\n    resourceType: 'Schema',\n    location: `/scim/v2/Schemas/${SCIM_SCHEMAS.USER}`,\n  },\n} as const;\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Resource Types Definition (RFC 7644 §4)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_RESOURCE_TYPES = [{\n  schemas: [SCIM_SCHEMAS.RESOURCE_TYPE],\n  id: 'User',\n  name: 'User',\n  endpoint: '/Users',\n  description: 'User Account',\n  schema: SCIM_SCHEMAS.USER,\n  schemaExtensions: [{\n    schema: SCIM_SCHEMAS.ENTERPRISE_USER,\n    required: false,\n  }],\n  meta: {\n    resourceType: 'ResourceType',\n    location: '/scim/v2/ResourceTypes/User',\n  },\n}] as const;\n"]}

package/dist/esm/security/scim/utils/scim-attribute-path-resolver.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-attribute-path-resolver.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/utils/scim-attribute-path-resolver.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAuDH;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc5F"}
+{"version":3,"file":"scim-attribute-path-resolver.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/scim/utils/scim-attribute-path-resolver.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAuDH;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc5F"}

package/dist/esm/security/scim/utils/scim-filter-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-filter-parser.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/utils/scim-filter-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IACjC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAgE,GAClG,gBAAgB,CAQlB"}
+{"version":3,"file":"scim-filter-parser.d.ts","sourceRoot":"","sources":["../../../../../src/security/scim/utils/scim-filter-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IACjC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAgE,GAClG,gBAAgB,CAQlB"}

package/dist/esm/security/scim/utils/scim-response-formatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-response-formatter.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/utils/scim-response-formatter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,IAAI,EAAc,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,uEAAuE,CAAC;AAE/E,UAAU,WAAW;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,WAAW,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GAClB,gBAAgB,CA6BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,gBAAgB,CAUlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,aAAa,GACvB,iBAAiB,CAOnB"}
+{"version":3,"file":"scim-response-formatter.d.ts","sourceRoot":"","sources":["../../../../../src/security/scim/utils/scim-response-formatter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,IAAI,EAAc,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,uEAAuE,CAAC;AAE/E,UAAU,WAAW;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,WAAW,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GAClB,gBAAgB,CA6BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,gBAAgB,CAUlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,aAAa,GACvB,iBAAiB,CAOnB"}

package/dist/esm/security/session-invalidation-fence.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-invalidation-fence.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/session-invalidation-fence.backend.utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAExF;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAEvE,2DAA2D;AAC3D,MAAM,WAAW,+BAA+B;IAC9C,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAsB,gCAAgC,CACpD,YAAY,EAAE,8BAA8B,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,+BAA+B,CAAC,CAY1C"}
+{"version":3,"file":"session-invalidation-fence.backend.utils.d.ts","sourceRoot":"","sources":["../../../src/security/session-invalidation-fence.backend.utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAExF;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAEvE,2DAA2D;AAC3D,MAAM,WAAW,+BAA+B;IAC9C,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAsB,gCAAgC,CACpD,YAAY,EAAE,8BAA8B,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,+BAA+B,CAAC,CAY1C"}

package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.d.ts

@@ -41,6 +41,12 @@
  * close it either — DNS can answer differently at connect time (rebinding) — so the complete defence
  * is enforcement in the egress path. Callers that want the intermediate strength
  * ({@link resolvesOnlyToPublicAddresses}) get an explicit check-then-connect with that residual named.
+ *
+ * **That egress-path enforcement now EXISTS**, in the sibling module
+ * `pinned-outbound-fetch.backend.utils.ts`: it classifies inside the connection's `lookup` hook, so
+ * the address validated and the address connected to are one value in one event. Every function here
+ * remains a pure classifier and keeps its stated residual — what changed is that a caller no longer
+ * has to live with it. A caller that makes the request itself, with its own `fetch`, still does.
  */
 /** Why an outbound target was refused. A closed vocabulary so caller messages stay stable. */
 export declare enum OutboundTargetRejection {
@@ -107,8 +113,10 @@ export declare enum OutboundTargetResolution {
  * client picking the other.
  *
  * ⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that changes
- * between the two (rebinding) is not covered. Closing it needs the request pinned to the validated
- * address, which Node's `fetch` does not expose.
+ * between the two (rebinding) is not covered by THIS function. Closing it needs the request pinned to
+ * the validated address — which Node's `fetch` does not expose, but `node:https`'s `lookup` hook
+ * does. `pinnedOutboundFetch` is built on that hook; a caller that issues its request through it has
+ * the residual closed, and a caller that does not, does not.
  *
  * `resolve` is injectable so callers can test the internal/public branches without a resolver.
  */

package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-target-guard.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,8FAA8F;AAC9F,oBAAY,uBAAuB;IACjC,8EAA8E;IAC9E,4BAA4B,iCAAiC;IAC7D,gGAAgG;IAChG,kBAAkB,uBAAuB;IACzC,kGAAkG;IAClG,2BAA2B,gCAAgC;IAC3D,mGAAmG;IACnG,6BAA6B,kCAAkC;CAChE;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlE;AAsCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAsB,GAAG,OAAO,CA6BxG;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,SAAS,CAsB3H;AAED,uGAAuG;AACvG,oBAAY,wBAAwB;IAClC,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GACpD,OAAO,CAAC,wBAAwB,CAAC,CAoBnC"}
+{"version":3,"file":"outbound-target-guard.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,8FAA8F;AAC9F,oBAAY,uBAAuB;IACjC,8EAA8E;IAC9E,4BAA4B,iCAAiC;IAC7D,gGAAgG;IAChG,kBAAkB,uBAAuB;IACzC,kGAAkG;IAClG,2BAA2B,gCAAgC;IAC3D,mGAAmG;IACnG,6BAA6B,kCAAkC;CAChE;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlE;AAsCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAsB,GAAG,OAAO,CA6BxG;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,SAAS,CAsB3H;AAED,uGAAuG;AACvG,oBAAY,wBAAwB;IAClC,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GACpD,OAAO,CAAC,wBAAwB,CAAC,CAoBnC"}

package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.js

@@ -41,6 +41,12 @@
  * close it either — DNS can answer differently at connect time (rebinding) — so the complete defence
  * is enforcement in the egress path. Callers that want the intermediate strength
  * ({@link resolvesOnlyToPublicAddresses}) get an explicit check-then-connect with that residual named.
+ *
+ * **That egress-path enforcement now EXISTS**, in the sibling module
+ * `pinned-outbound-fetch.backend.utils.ts`: it classifies inside the connection's `lookup` hook, so
+ * the address validated and the address connected to are one value in one event. Every function here
+ * remains a pure classifier and keeps its stated residual — what changed is that a caller no longer
+ * has to live with it. A caller that makes the request itself, with its own `fetch`, still does.
  */
 import { isIP } from 'node:net';
 /** Why an outbound target was refused. A closed vocabulary so caller messages stay stable. */
@@ -192,8 +198,10 @@ export var OutboundTargetResolution;
  * client picking the other.
  *
  * ⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that changes
- * between the two (rebinding) is not covered. Closing it needs the request pinned to the validated
- * address, which Node's `fetch` does not expose.
+ * between the two (rebinding) is not covered by THIS function. Closing it needs the request pinned to
+ * the validated address — which Node's `fetch` does not expose, but `node:https`'s `lookup` hook
+ * does. `pinnedOutboundFetch` is built on that hook; a caller that issues its request through it has
+ * the residual closed, and a caller that does not, does not.
  *
  * `resolve` is injectable so callers can test the internal/public branches without a resolver.
  */

package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-target-guard.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,8FAA8F;AAC9F,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,8EAA8E;IAC9E,wFAA6D,CAAA;IAC7D,gGAAgG;IAChG,oEAAyC,CAAA;IACzC,kGAAkG;IAClG,sFAA2D,CAAA;IAC3D,mGAAmG;IACnG,0FAA+D,CAAA;AACjE,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,4DAA4D;IAChH,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,OAAO,CACL,CAAC,KAAK,CAAC,CAAmC,4BAA4B;WACnE,CAAC,KAAK,EAAE,CAA+B,WAAW;WAClD,CAAC,KAAK,GAAG,CAA8B,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAK,6BAA6B;WACpE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,wDAAwD;WAC/F,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAM,WAAW;QACrD;;;;;;;;WAQG;WACA,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAE,wBAAwB;WAC/D,CAAC,IAAI,GAAG,CAA+B,6CAA6C;KACxF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,YAAoB,IAAI,CAAC,OAAO,CAAC;IAC7F,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAS,wBAAwB;IAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAoB,wBAAwB;IAC/E,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAiB,yCAAyC;IAChG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAuB,qBAAqB;IAE5E;;;;;;;OAOG;IACH,MAAM,YAAY,GAAG,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/D,IAAI,YAAY;QAAE,OAAO,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,MAA4B;IACpF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,uBAAuB,CAAC,kBAAkB,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,CAAC;IAED,OAAO,4BAA4B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC;AACzH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAN,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,yDAA6B,CAAA;AAC/B,CAAC,EAJW,wBAAwB,KAAxB,wBAAwB,QAInC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAgB,EAChB,OAAqD;IAErD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;IACrH,CAAC;IAED,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,mGAAmG;IACnG,6DAA6D;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC;IAErE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC,CAAC,wBAAwB,CAAC,QAAQ;QACnC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;AACtC,CAAC","sourcesContent":["/**\n * The ONE classification of \"is this address one the public internet cannot reach?\".\n *\n * ## Why this module exists\n *\n * Wildo makes server-side HTTP requests to destinations that come from application- or\n * tenant-authored configuration: M2M webhook endpoints, A2A push-notification targets, SIEM\n * collectors, SSO metadata documents, OAuth client-metadata documents. Every one of those is a\n * server-side request forgery primitive by construction, and the classic targets are the same in all\n * of them — `169.254.169.254` (cloud instance metadata), loopback admin ports, RFC 1918 space.\n *\n * Before this module the answer was written TWICE, privately, and the two copies disagreed:\n *\n * | Copy | Missing from it |\n * |---|---|\n * | `a2a-push-notification.backend.schemas.ts` (`isPrivateOrReservedAddress`) | IPv6 multicast `ff00::/8` |\n * | `cimd-client-metadata.backend.service.ts` (`isInternalAddress`) | `192.0.0.0/24` (IETF protocol assignments), `198.18.0.0/15` (benchmarking), the IPv4-mapped IPv6 HEX notation (`::ffff:a9fe:a9fe`), and the full `fe80::/10` link-local block (it matched only the literal `fe80:` prefix) |\n *\n * Both were written carefully, by authors who had read OWASP, eight months apart. Neither could see\n * the other because each was a module-private function — the exact shape\n * `.claude/rules/invariant-call-site-enumeration.md` #13 records, where the enumeration returns 1/1\n * and is *correct*, because the other site does not mention the symbol you searched for. The set\n * below is the UNION, so both call sites strictly improve.\n *\n * ## Block-list, not allow-list — and OWASP says why\n *\n * spec-cite: OWASP Server Side Request Forgery Prevention Cheat Sheet — *\"Case 2: application can\n * send request to ANY external IP address or domain name\"*, whose remedy is block-listing the\n * non-public ranges. An allow-list is unavailable here by construction: a tenant's webhook receiver,\n * an unknown OAuth client's metadata host and a customer's SIEM collector are all strangers.\n *\n * The ranges are an ALLOW-NOTHING list rather than a deny-list of known-bad addresses. A new reserved\n * block is far rarer than a new interesting internal service, so an unrecognised shape must not be\n * admitted merely because nobody enumerated it.\n *\n * ## What this CANNOT do, stated rather than hidden\n *\n * {@link isPrivateOrReservedIpAddress} classifies an ADDRESS. {@link classifyOutboundTargetUrl}\n * classifies a URL's SHAPE and, for a literal-IP host, its address. Neither resolves DNS, so\n * `evil.test` with an A record of `10.0.0.5` passes both. Resolving at validation time would not\n * close it either — DNS can answer differently at connect time (rebinding) — so the complete defence\n * is enforcement in the egress path. Callers that want the intermediate strength\n * ({@link resolvesOnlyToPublicAddresses}) get an explicit check-then-connect with that residual named.\n */\n\nimport { isIP } from 'node:net';\n\n/** Why an outbound target was refused. A closed vocabulary so caller messages stay stable. */\nexport enum OutboundTargetRejection {\n  /** Not parseable as an absolute URL, or not on a scheme the caller admits. */\n  NOT_ABSOLUTE_ADMITTED_SCHEME = 'not_absolute_admitted_scheme',\n  /** `https://user:pass@host` — the credentials would be replayed on every request and logged. */\n  CREDENTIALS_IN_URL = 'credentials_in_url',\n  /** A literal IP inside a private, loopback, link-local, multicast or otherwise reserved range. */\n  PRIVATE_OR_RESERVED_ADDRESS = 'private_or_reserved_address',\n  /** A hostname that resolves into the deployment's own network by DEFINITION rather than by DNS. */\n  RESERVED_SPECIAL_USE_HOSTNAME = 'reserved_special_use_hostname',\n}\n\n/**\n * Hostnames that reach the local machine by DEFINITION rather than by DNS answer.\n *\n * Deliberately grounded in special-use name registries instead of a list of cloud metadata\n * hostnames: a vendor list needs maintaining, names vendors in engine code, and is always one\n * provider behind.\n *\n * spec-cite: RFC 6761 §6.3 (`localhost` and any name ending in `.localhost` are special-use and\n * resolve to a loopback address) · RFC 6762 §3 (`.local` is reserved for link-local multicast DNS).\n */\nexport function isReservedSpecialUseHostname(host: string): boolean {\n  const name = host.toLowerCase().replace(/\\.$/, ''); // a trailing dot is a fully-qualified form of the same name\n  return name === 'localhost' || name.endsWith('.localhost') || name === 'local' || name.endsWith('.local');\n}\n\n/**\n * Is this literal IPv4 address one no externally-reachable service can live at?\n *\n * A MALFORMED address returns `true` — fail closed. A caller that cannot even parse the host it is\n * about to connect to has no basis for admitting it, and the alternative (admit what we could not\n * classify) is how notation tricks get through.\n */\nfunction isPrivateOrReservedIpv4(address: string): boolean {\n  const parts = address.split('.').map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {\n    return true;\n  }\n  const [a, b, c] = parts;\n  return (\n    a === 0                                   // \"this network\" — RFC 1122\n    || a === 10                               // RFC 1918\n    || a === 127                              // loopback\n    || (a === 100 && b >= 64 && b <= 127)     // RFC 6598 carrier-grade NAT\n    || (a === 169 && b === 254)               // link-local — INCLUDES 169.254.169.254, cloud metadata\n    || (a === 172 && b >= 16 && b <= 31)      // RFC 1918\n    /**\n     * RFC 6890 IETF protocol assignments — `192.0.0.0/**24**`, not `/16`.\n     *\n     * The A2A copy this list was merged from tested `a === 192 && b === 0`, which is a /16 and\n     * therefore over-blocked ~65,000 ORDINARY PUBLIC addresses (`192.0.1.x`, `192.0.3.x`, …) that are\n     * regular allocated space. Narrowed here to what the registry actually reserves, because an\n     * over-wide range is not \"extra safe\" — it silently refuses legitimate customer endpoints, and it\n     * is exactly the failure the adjacent-public controls in the test suite exist to catch.\n     */\n    || (a === 192 && b === 0 && c === 0)\n    || (a === 192 && b === 168)               // RFC 1918\n    || (a === 198 && (b === 18 || b === 19))  // RFC 2544 benchmarking\n    || a >= 224                               // multicast 224/4, reserved 240/4, broadcast\n  );\n}\n\n/**\n * Is this literal IP address (v4 or v6) one no externally-reachable service can live at?\n *\n * `ipVersion` may be supplied when the caller already computed it; otherwise it is derived. A value\n * that is not an IP at all returns `false` — this function answers a question about ADDRESSES, and a\n * hostname is the caller's job (see {@link isReservedSpecialUseHostname} and\n * {@link resolvesOnlyToPublicAddresses}).\n */\nexport function isPrivateOrReservedIpAddress(address: string, ipVersion: number = isIP(address)): boolean {\n  if (ipVersion === 4) return isPrivateOrReservedIpv4(address);\n  if (ipVersion !== 6) return false;\n\n  const v6 = address.toLowerCase();\n  if (v6 === '::' || v6 === '::1') return true;         // unspecified, loopback\n  if (/^f[cd]/.test(v6)) return true;                    // unique-local fc00::/7\n  if (/^fe[89ab]/.test(v6)) return true;                 // link-local fe80::/10 — the WHOLE block\n  if (/^ff/.test(v6)) return true;                       // multicast ff00::/8\n\n  /**\n   * IPv4-mapped — the same address wearing a different notation, and the notation that got past the\n   * first version of the A2A guard. `new URL()` NORMALISES `::ffff:169.254.169.254` to\n   * `::ffff:a9fe:a9fe`, so matching only the dotted form let the cloud metadata address through while\n   * every dotted-form pin stayed green. Both spellings are handled: the hex form is what arrives from\n   * a parsed URL, the dotted form is what arrives from a config read back out of storage or from a\n   * DNS answer.\n   */\n  const mappedDotted = v6.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (mappedDotted) return isPrivateOrReservedIpv4(mappedDotted[1]);\n\n  const mappedHex = v6.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n  if (mappedHex) {\n    const high = parseInt(mappedHex[1], 16);\n    const low = parseInt(mappedHex[2], 16);\n    return isPrivateOrReservedIpv4(`${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`);\n  }\n\n  return false;\n}\n\n/** Strip the brackets a parsed URL puts around an IPv6 literal, so `isIP` can read it. */\nexport function unwrapUrlHost(hostname: string): string {\n  return hostname.replace(/^\\[|\\]$/g, '');\n}\n\n/** What a caller admits, so one classifier can serve callers with different scheme policies. */\nexport interface OutboundTargetPolicy {\n  /**\n   * Schemes the caller will issue a request on. Pass `['https:']` where the value in transit is a\n   * credential; pass `['https:', 'http:']` where refusing plaintext would break existing authored\n   * configuration and that decision has not been taken.\n   */\n  admittedProtocols: readonly string[];\n}\n\n/**\n * Classify a target URL a caller is about to request, refusing the shapes that turn this server into\n * a request-forgery tool.\n *\n * Returns `undefined` for an admitted target. An ordinary hostname is admitted — see the module\n * header for why that is a stated residual rather than an oversight.\n */\nexport function classifyOutboundTargetUrl(rawUrl: string, policy: OutboundTargetPolicy): OutboundTargetRejection | undefined {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n\n  if (!policy.admittedProtocols.includes(url.protocol)) {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n  if (url.username || url.password) {\n    return OutboundTargetRejection.CREDENTIALS_IN_URL;\n  }\n\n  const host = unwrapUrlHost(url.hostname);\n  const ipVersion = isIP(host);\n  if (ipVersion === 0) {\n    return isReservedSpecialUseHostname(host) ? OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME : undefined;\n  }\n\n  return isPrivateOrReservedIpAddress(host, ipVersion) ? OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS : undefined;\n}\n\n/** Outcome of the DNS-resolving half, kept separate because \"did not resolve\" is not \"is internal\". */\nexport enum OutboundTargetResolution {\n  PUBLIC = 'public',\n  INTERNAL = 'internal',\n  UNRESOLVABLE = 'unresolvable',\n}\n\n/**\n * Resolve a hostname and check EVERY answer, not just the first.\n *\n * DNS is resolved rather than the hostname trusted, because `internal.example.com` may be a public\n * name with a private A record — the attack a shape check cannot see. Every resolved address is\n * checked because a hostile resolver can return one public and one private address and rely on the\n * client picking the other.\n *\n * ⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that changes\n * between the two (rebinding) is not covered. Closing it needs the request pinned to the validated\n * address, which Node's `fetch` does not expose.\n *\n * `resolve` is injectable so callers can test the internal/public branches without a resolver.\n */\nexport async function resolvesOnlyToPublicAddresses(\n  hostname: string,\n  resolve: (host: string) => Promise<readonly string[]>,\n): Promise<OutboundTargetResolution> {\n  const literal = unwrapUrlHost(hostname);\n  if (isIP(literal) !== 0) {\n    return isPrivateOrReservedIpAddress(literal) ? OutboundTargetResolution.INTERNAL : OutboundTargetResolution.PUBLIC;\n  }\n\n  let addresses: readonly string[];\n  try {\n    addresses = await resolve(hostname);\n  } catch {\n    return OutboundTargetResolution.UNRESOLVABLE;\n  }\n\n  // An empty answer is treated as INTERNAL rather than UNRESOLVABLE: the resolver succeeded and told\n  // us nothing usable, which is not evidence the name is safe.\n  if (addresses.length === 0) return OutboundTargetResolution.INTERNAL;\n\n  return addresses.some((address) => isPrivateOrReservedIpAddress(address))\n    ? OutboundTargetResolution.INTERNAL\n    : OutboundTargetResolution.PUBLIC;\n}\n"]}
+{"version":3,"file":"outbound-target-guard.backend.utils.js","sourceRoot":"","sources":["../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,8FAA8F;AAC9F,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,8EAA8E;IAC9E,wFAA6D,CAAA;IAC7D,gGAAgG;IAChG,oEAAyC,CAAA;IACzC,kGAAkG;IAClG,sFAA2D,CAAA;IAC3D,mGAAmG;IACnG,0FAA+D,CAAA;AACjE,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,4DAA4D;IAChH,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,OAAO,CACL,CAAC,KAAK,CAAC,CAAmC,4BAA4B;WACnE,CAAC,KAAK,EAAE,CAA+B,WAAW;WAClD,CAAC,KAAK,GAAG,CAA8B,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAK,6BAA6B;WACpE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,wDAAwD;WAC/F,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAM,WAAW;QACrD;;;;;;;;WAQG;WACA,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAE,wBAAwB;WAC/D,CAAC,IAAI,GAAG,CAA+B,6CAA6C;KACxF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,YAAoB,IAAI,CAAC,OAAO,CAAC;IAC7F,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAS,wBAAwB;IAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAoB,wBAAwB;IAC/E,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAiB,yCAAyC;IAChG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAuB,qBAAqB;IAE5E;;;;;;;OAOG;IACH,MAAM,YAAY,GAAG,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/D,IAAI,YAAY;QAAE,OAAO,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,MAA4B;IACpF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,uBAAuB,CAAC,kBAAkB,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,CAAC;IAED,OAAO,4BAA4B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC;AACzH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAN,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,yDAA6B,CAAA;AAC/B,CAAC,EAJW,wBAAwB,KAAxB,wBAAwB,QAInC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAgB,EAChB,OAAqD;IAErD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;IACrH,CAAC;IAED,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,mGAAmG;IACnG,6DAA6D;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC;IAErE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC,CAAC,wBAAwB,CAAC,QAAQ;QACnC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;AACtC,CAAC","sourcesContent":["/**\n * The ONE classification of \"is this address one the public internet cannot reach?\".\n *\n * ## Why this module exists\n *\n * Wildo makes server-side HTTP requests to destinations that come from application- or\n * tenant-authored configuration: M2M webhook endpoints, A2A push-notification targets, SIEM\n * collectors, SSO metadata documents, OAuth client-metadata documents. Every one of those is a\n * server-side request forgery primitive by construction, and the classic targets are the same in all\n * of them — `169.254.169.254` (cloud instance metadata), loopback admin ports, RFC 1918 space.\n *\n * Before this module the answer was written TWICE, privately, and the two copies disagreed:\n *\n * | Copy | Missing from it |\n * |---|---|\n * | `a2a-push-notification.backend.schemas.ts` (`isPrivateOrReservedAddress`) | IPv6 multicast `ff00::/8` |\n * | `cimd-client-metadata.backend.service.ts` (`isInternalAddress`) | `192.0.0.0/24` (IETF protocol assignments), `198.18.0.0/15` (benchmarking), the IPv4-mapped IPv6 HEX notation (`::ffff:a9fe:a9fe`), and the full `fe80::/10` link-local block (it matched only the literal `fe80:` prefix) |\n *\n * Both were written carefully, by authors who had read OWASP, eight months apart. Neither could see\n * the other because each was a module-private function — the exact shape\n * `.claude/rules/invariant-call-site-enumeration.md` #13 records, where the enumeration returns 1/1\n * and is *correct*, because the other site does not mention the symbol you searched for. The set\n * below is the UNION, so both call sites strictly improve.\n *\n * ## Block-list, not allow-list — and OWASP says why\n *\n * spec-cite: OWASP Server Side Request Forgery Prevention Cheat Sheet — *\"Case 2: application can\n * send request to ANY external IP address or domain name\"*, whose remedy is block-listing the\n * non-public ranges. An allow-list is unavailable here by construction: a tenant's webhook receiver,\n * an unknown OAuth client's metadata host and a customer's SIEM collector are all strangers.\n *\n * The ranges are an ALLOW-NOTHING list rather than a deny-list of known-bad addresses. A new reserved\n * block is far rarer than a new interesting internal service, so an unrecognised shape must not be\n * admitted merely because nobody enumerated it.\n *\n * ## What this CANNOT do, stated rather than hidden\n *\n * {@link isPrivateOrReservedIpAddress} classifies an ADDRESS. {@link classifyOutboundTargetUrl}\n * classifies a URL's SHAPE and, for a literal-IP host, its address. Neither resolves DNS, so\n * `evil.test` with an A record of `10.0.0.5` passes both. Resolving at validation time would not\n * close it either — DNS can answer differently at connect time (rebinding) — so the complete defence\n * is enforcement in the egress path. Callers that want the intermediate strength\n * ({@link resolvesOnlyToPublicAddresses}) get an explicit check-then-connect with that residual named.\n *\n * **That egress-path enforcement now EXISTS**, in the sibling module\n * `pinned-outbound-fetch.backend.utils.ts`: it classifies inside the connection's `lookup` hook, so\n * the address validated and the address connected to are one value in one event. Every function here\n * remains a pure classifier and keeps its stated residual — what changed is that a caller no longer\n * has to live with it. A caller that makes the request itself, with its own `fetch`, still does.\n */\n\nimport { isIP } from 'node:net';\n\n/** Why an outbound target was refused. A closed vocabulary so caller messages stay stable. */\nexport enum OutboundTargetRejection {\n  /** Not parseable as an absolute URL, or not on a scheme the caller admits. */\n  NOT_ABSOLUTE_ADMITTED_SCHEME = 'not_absolute_admitted_scheme',\n  /** `https://user:pass@host` — the credentials would be replayed on every request and logged. */\n  CREDENTIALS_IN_URL = 'credentials_in_url',\n  /** A literal IP inside a private, loopback, link-local, multicast or otherwise reserved range. */\n  PRIVATE_OR_RESERVED_ADDRESS = 'private_or_reserved_address',\n  /** A hostname that resolves into the deployment's own network by DEFINITION rather than by DNS. */\n  RESERVED_SPECIAL_USE_HOSTNAME = 'reserved_special_use_hostname',\n}\n\n/**\n * Hostnames that reach the local machine by DEFINITION rather than by DNS answer.\n *\n * Deliberately grounded in special-use name registries instead of a list of cloud metadata\n * hostnames: a vendor list needs maintaining, names vendors in engine code, and is always one\n * provider behind.\n *\n * spec-cite: RFC 6761 §6.3 (`localhost` and any name ending in `.localhost` are special-use and\n * resolve to a loopback address) · RFC 6762 §3 (`.local` is reserved for link-local multicast DNS).\n */\nexport function isReservedSpecialUseHostname(host: string): boolean {\n  const name = host.toLowerCase().replace(/\\.$/, ''); // a trailing dot is a fully-qualified form of the same name\n  return name === 'localhost' || name.endsWith('.localhost') || name === 'local' || name.endsWith('.local');\n}\n\n/**\n * Is this literal IPv4 address one no externally-reachable service can live at?\n *\n * A MALFORMED address returns `true` — fail closed. A caller that cannot even parse the host it is\n * about to connect to has no basis for admitting it, and the alternative (admit what we could not\n * classify) is how notation tricks get through.\n */\nfunction isPrivateOrReservedIpv4(address: string): boolean {\n  const parts = address.split('.').map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {\n    return true;\n  }\n  const [a, b, c] = parts;\n  return (\n    a === 0                                   // \"this network\" — RFC 1122\n    || a === 10                               // RFC 1918\n    || a === 127                              // loopback\n    || (a === 100 && b >= 64 && b <= 127)     // RFC 6598 carrier-grade NAT\n    || (a === 169 && b === 254)               // link-local — INCLUDES 169.254.169.254, cloud metadata\n    || (a === 172 && b >= 16 && b <= 31)      // RFC 1918\n    /**\n     * RFC 6890 IETF protocol assignments — `192.0.0.0/**24**`, not `/16`.\n     *\n     * The A2A copy this list was merged from tested `a === 192 && b === 0`, which is a /16 and\n     * therefore over-blocked ~65,000 ORDINARY PUBLIC addresses (`192.0.1.x`, `192.0.3.x`, …) that are\n     * regular allocated space. Narrowed here to what the registry actually reserves, because an\n     * over-wide range is not \"extra safe\" — it silently refuses legitimate customer endpoints, and it\n     * is exactly the failure the adjacent-public controls in the test suite exist to catch.\n     */\n    || (a === 192 && b === 0 && c === 0)\n    || (a === 192 && b === 168)               // RFC 1918\n    || (a === 198 && (b === 18 || b === 19))  // RFC 2544 benchmarking\n    || a >= 224                               // multicast 224/4, reserved 240/4, broadcast\n  );\n}\n\n/**\n * Is this literal IP address (v4 or v6) one no externally-reachable service can live at?\n *\n * `ipVersion` may be supplied when the caller already computed it; otherwise it is derived. A value\n * that is not an IP at all returns `false` — this function answers a question about ADDRESSES, and a\n * hostname is the caller's job (see {@link isReservedSpecialUseHostname} and\n * {@link resolvesOnlyToPublicAddresses}).\n */\nexport function isPrivateOrReservedIpAddress(address: string, ipVersion: number = isIP(address)): boolean {\n  if (ipVersion === 4) return isPrivateOrReservedIpv4(address);\n  if (ipVersion !== 6) return false;\n\n  const v6 = address.toLowerCase();\n  if (v6 === '::' || v6 === '::1') return true;         // unspecified, loopback\n  if (/^f[cd]/.test(v6)) return true;                    // unique-local fc00::/7\n  if (/^fe[89ab]/.test(v6)) return true;                 // link-local fe80::/10 — the WHOLE block\n  if (/^ff/.test(v6)) return true;                       // multicast ff00::/8\n\n  /**\n   * IPv4-mapped — the same address wearing a different notation, and the notation that got past the\n   * first version of the A2A guard. `new URL()` NORMALISES `::ffff:169.254.169.254` to\n   * `::ffff:a9fe:a9fe`, so matching only the dotted form let the cloud metadata address through while\n   * every dotted-form pin stayed green. Both spellings are handled: the hex form is what arrives from\n   * a parsed URL, the dotted form is what arrives from a config read back out of storage or from a\n   * DNS answer.\n   */\n  const mappedDotted = v6.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (mappedDotted) return isPrivateOrReservedIpv4(mappedDotted[1]);\n\n  const mappedHex = v6.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n  if (mappedHex) {\n    const high = parseInt(mappedHex[1], 16);\n    const low = parseInt(mappedHex[2], 16);\n    return isPrivateOrReservedIpv4(`${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`);\n  }\n\n  return false;\n}\n\n/** Strip the brackets a parsed URL puts around an IPv6 literal, so `isIP` can read it. */\nexport function unwrapUrlHost(hostname: string): string {\n  return hostname.replace(/^\\[|\\]$/g, '');\n}\n\n/** What a caller admits, so one classifier can serve callers with different scheme policies. */\nexport interface OutboundTargetPolicy {\n  /**\n   * Schemes the caller will issue a request on. Pass `['https:']` where the value in transit is a\n   * credential; pass `['https:', 'http:']` where refusing plaintext would break existing authored\n   * configuration and that decision has not been taken.\n   */\n  admittedProtocols: readonly string[];\n}\n\n/**\n * Classify a target URL a caller is about to request, refusing the shapes that turn this server into\n * a request-forgery tool.\n *\n * Returns `undefined` for an admitted target. An ordinary hostname is admitted — see the module\n * header for why that is a stated residual rather than an oversight.\n */\nexport function classifyOutboundTargetUrl(rawUrl: string, policy: OutboundTargetPolicy): OutboundTargetRejection | undefined {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n\n  if (!policy.admittedProtocols.includes(url.protocol)) {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n  if (url.username || url.password) {\n    return OutboundTargetRejection.CREDENTIALS_IN_URL;\n  }\n\n  const host = unwrapUrlHost(url.hostname);\n  const ipVersion = isIP(host);\n  if (ipVersion === 0) {\n    return isReservedSpecialUseHostname(host) ? OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME : undefined;\n  }\n\n  return isPrivateOrReservedIpAddress(host, ipVersion) ? OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS : undefined;\n}\n\n/** Outcome of the DNS-resolving half, kept separate because \"did not resolve\" is not \"is internal\". */\nexport enum OutboundTargetResolution {\n  PUBLIC = 'public',\n  INTERNAL = 'internal',\n  UNRESOLVABLE = 'unresolvable',\n}\n\n/**\n * Resolve a hostname and check EVERY answer, not just the first.\n *\n * DNS is resolved rather than the hostname trusted, because `internal.example.com` may be a public\n * name with a private A record — the attack a shape check cannot see. Every resolved address is\n * checked because a hostile resolver can return one public and one private address and rely on the\n * client picking the other.\n *\n * ⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that changes\n * between the two (rebinding) is not covered by THIS function. Closing it needs the request pinned to\n * the validated address — which Node's `fetch` does not expose, but `node:https`'s `lookup` hook\n * does. `pinnedOutboundFetch` is built on that hook; a caller that issues its request through it has\n * the residual closed, and a caller that does not, does not.\n *\n * `resolve` is injectable so callers can test the internal/public branches without a resolver.\n */\nexport async function resolvesOnlyToPublicAddresses(\n  hostname: string,\n  resolve: (host: string) => Promise<readonly string[]>,\n): Promise<OutboundTargetResolution> {\n  const literal = unwrapUrlHost(hostname);\n  if (isIP(literal) !== 0) {\n    return isPrivateOrReservedIpAddress(literal) ? OutboundTargetResolution.INTERNAL : OutboundTargetResolution.PUBLIC;\n  }\n\n  let addresses: readonly string[];\n  try {\n    addresses = await resolve(hostname);\n  } catch {\n    return OutboundTargetResolution.UNRESOLVABLE;\n  }\n\n  // An empty answer is treated as INTERNAL rather than UNRESOLVABLE: the resolver succeeded and told\n  // us nothing usable, which is not evidence the name is safe.\n  if (addresses.length === 0) return OutboundTargetResolution.INTERNAL;\n\n  return addresses.some((address) => isPrivateOrReservedIpAddress(address))\n    ? OutboundTargetResolution.INTERNAL\n    : OutboundTargetResolution.PUBLIC;\n}\n"]}