@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACL,WAAW,EASZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,EACzC,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAMpH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AAqDnH,wFAAwF;AACxF,MAAM,MAAM,uBAAuB,GAAG,UAAU,CAAC,OAAO,yCAAyC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AA4DlH,0IAA0I;AAC1I,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,GAAG,uBAAuB,CAyBtI;AA4FD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAc/F;AAED,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAK/F;AAED,2CAA2C;AAC3C,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAK/F;AAED,6CAA6C;AAC7C,wBAAgB,oCAAoC,IAAI,0CAA0C,EAAE,CAKnG"}
+{"version":3,"file":"oauth-clients.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-clients.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACL,WAAW,EASZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,EACzC,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAMpH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uEAAuE,CAAC;AAqDnH,wFAAwF;AACxF,MAAM,MAAM,uBAAuB,GAAG,UAAU,CAAC,OAAO,yCAAyC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AA4DlH,0IAA0I;AAC1I,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,qBAAqB,GAAG,uBAAuB,CAyBtI;AA4FD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAc/F;AAED,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAK/F;AAED,2CAA2C;AAC3C,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAK/F;AAED,6CAA6C;AAC7C,wBAAgB,oCAAoC,IAAI,0CAA0C,EAAE,CAKnG"}

package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACL,WAAW,EACX,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,OAAO,EAAE,iCAAiC,EAAE,MAAM,yCAAyC,CAAC;AAE5F,OAAO,EAAE,uCAAuC,EAAE,2BAA2B,EAAE,MAAM,uEAAuE,CAAC;AAG7J;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAiC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAA+F,CAAC;AAExI,mFAAmF;AACnF,IAAK,sBAGJ;AAHD,WAAK,sBAAsB;IACzB,2CAAiB,CAAA;IACjB,mDAAyB,CAAA;AAC3B,CAAC,EAHI,sBAAsB,KAAtB,sBAAsB,QAG1B;AAyBD;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAqC;IAC7D;QACE,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;QACzD,KAAK,EAAE,WAAW,CAAC,YAAY;QAC/B,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;YAC5B,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;SACnD;KACF;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;QACxD,KAAK,EAAE,WAAW,CAAC,WAAW;QAC9B,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;SAC7B;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,gCAAgC,CACvC,sBAAqF,EACrF,WAAyF;IAEzF,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;YACxC,aAAa,EAAE;gBACb,kBAAkB,EAAE,MAAM,CAAC,YAAY;gBACvC,6EAA6E;gBAC7E,6EAA6E;gBAC7E,+DAA+D;gBAC/D,mBAAmB,EAAE,sBAAsB,CAAC,MAAM,CAAC;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB;gBAClB,UAAU;aACX;YACD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;SACzC,CAAC,CAAC;QACL,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0IAA0I;AAC1I,MAAM,UAAU,4BAA4B,CAAC,KAAkB,EAAE,qBAA4C;IAC3G,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,8FAA8F;YAC9F,gGAAgG;YAChG,gGAAgG;YAChG,gFAAgF;YAChF,mGAAmG;YACnG,uCAAuC,CAAC,gBAAgB,EAAG,KAA8B,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YAC5I,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;YAC7F,+FAA+F;YAC/F,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAC1D,iFAAiF;YACjF,mFAAmF;YACnF,kEAAkE;YAClE,OAAO,EAAE,GAAI,KAAiC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;QAC/E,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YAC5F,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ;gBAAE,OAAO,aAAa,CAAC;YAC9E,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACjE,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAChD,IAAI,CAAC,WAAW;gBAAE,OAAO,aAAa,CAAC;YACvC,OAAO,EAAE,GAAI,aAAyC,EAAE,WAAW,EAAE,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,+BAA+B,CAAC,KAAkB,EAAE,IAA4B;IACvF,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,8EAA8E;YAC9E,2EAA2E;YAC3E,iBAAiB;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,aAAkD,CAAC;YAEzE,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBAC3D,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,qDAAqD,OAAO,CAAC,MAAM,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,MAAM,EAAE;iBAChI,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;YAC7F,MAAM,8BAA8B,GAAG,IAAI,KAAK,sBAAsB,CAAC,MAAM;gBAC3E,CAAC,CAAC,CAAE,KAA8C,CAAC,yBAAyB,IAAI,IAAI,IAAI,EAAE,CAAC;gBAC3F,CAAC,CAAC,IAAI,CAAC;YACT,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAE5F,OAAO;gBACL,GAAI,KAAiC;gBACrC,YAAY;gBACZ,YAAY;gBACZ,uEAAuE;gBACvE,yEAAyE;gBACzE,oBAAoB,EAAE,OAAO,EAAE,YAAY;gBAC3C,oBAAoB,EAAE,OAAO,EAAE,YAAY;gBAC3C,8BAA8B;aAC/B,CAAC;QACJ,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YACtF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAkC,CAAC;YAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC3D,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAE9C,MAAM,eAAe,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;YAC/G,IAAI,IAAI,KAAK,sBAAsB,CAAC,MAAM,EAAE,CAAC;gBAC3C,gFAAgF;gBAChF,+EAA+E;gBAC/E,OAAO,EAAE,GAAG,eAAe,EAAE,WAAW,EAAE,GAAG,EAAE,yBAAyB,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACtH,CAAC;YACD,4DAA4D;YAC5D,OAAO,eAAe,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D;;;;;;;;;;GAUG;AACH,SAAS,8BAA8B;IACrC,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YACnF,MAAM,OAAO,GAAG,KAAK,CAAC,aAA2D,CAAC;YAElF,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBAC3D,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,gCAAgC,iBAAiB,CAAC,OAAO,kBAAkB,OAAO,CAAC,MAAM,GAAG;wBACrG,iBAAiB,EAAE,OAAO,CAAC,MAAM;qBAClC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,UAAqB,EAAE,EAAE,CACpG,yCAAyC,CAAC;YACxC,aAAa,EAAE;gBACb,kBAAkB,EAAE,MAAM,CAAC,YAAY;gBACvC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM;gBACtC,WAAW,EAAE,4BAA4B,CAAC,aAAa;gBACvD,kBAAkB,EAAE,IAAI;aACzB;YACD,QAAQ,EAAE,8BAA8B,EAAE;SAC3C,CAAC,CAAC;QACL,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC9C,OAAO,gCAAgC,CACrC,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAClC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,KAAK,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAC1G,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,gCAAgC;IAC9C,OAAO,gCAAgC,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,CACzF,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,oCAAoC;IAClD,OAAO,gCAAgC,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EACjC,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAC7F,CAAC;AACJ,CAAC","sourcesContent":["/**\n * OAuth Clients Custom Implementations\n *\n * Implements the server-side behaviour for the organization + application OAuth-client\n * resources (`organizationOAuthClients`, `applicationOAuthClients`) that the schema\n * alone cannot express. FAITHFUL MIRROR of the api-keys mint pipeline\n * (`api-keys.custom-impl.backend.service.ts`), FOCUSED to the trunk operation set:\n *\n *   CREATE      → mint fresh secret material (the client must never supply it).\n *   ROTATE      → reissue the secret; retain the prior secret in a grace window that\n *                 stops authenticating at the caller-chosen `oldSecretInvalidationDate`.\n *   REGENERATE  → reissue the secret; keep the prior secret valid open-endedly (until\n *                 the next rotation) for a zero-downtime overlap.\n *\n * (api-keys' DEACTIVATE/REACTIVATE/EXTEND_EXPIRY/USAGE_STATS impls are deferred to the\n * OIDC branch alongside their resource-config ops.)\n *\n * WHY MINTING NEEDS AN IMPL: the schema requires `secretPrefix` + `hashedSecret`, but\n * both are `.excludeFromCreate().excludeFromUpdate()` (the client must never supply\n * them) and `plainSecret` is an ephemeral response-only field. Nothing generated them,\n * so a bare create/update persisted a row missing the required fields. These impls are\n * the single server-side choke point that mints secret material.\n *\n * PATTERN (CREATE / ROTATE / REGENERATE — all \"mint a secret\" ops):\n *   prefixCoreOperations  → mint material; inject the persisted `secretPrefix` +\n *                           `hashedSecret` (and, for rotate/regenerate, the previous-\n *                           secret grace-window fields) into the payload. Those fields\n *                           are `.excludeFrom{Create,Update}()`, so returning them from\n *                           the prefix is what carries them into the core write — the\n *                           orchestration diffs the prefix-added keys and forwards them\n *                           to the repository's `preserveServerInjectedFields` allowlist\n *                           so the final strict parse re-attaches (rather than strips)\n *                           them. Stash the one-time `plainSecret` for the postfix.\n *   postfixCoreOperations → attach the one-time `plainSecret` (+ rotate's `oldClientId` /\n *                           `oldSecretInvalidationDate`) to the response so the\n *                           operation's ephemeral `plainSecret` field surfaces it.\n * The core write still runs, so notifications / websocket events fire normally — which\n * is why this is prefix+postfix rather than `replaceCoreOperations`.\n *\n * VARIANT COVERAGE: a custom impl is matched to a running op by its FULL operation-path\n * identity — `isOperationDefault` (the `isDefault` sentinel) vs `variantKey` produce\n * DISTINCT keys (`createOperationPathKey`). So a single default registration only\n * intercepts the default variant; the cross-tenant app-super-admin `admin` variant\n * (org clients only) needs its own registration or it runs the bare core op and fails.\n * `OAUTH_CLIENT_TARGETS` enumerates every (resource × variant) each op exposes. Minting\n * is org-agnostic — the target `organizationId` rides in the payload / pre-fetched\n * record, never from these handlers — so the admin variant reuses the identical handlers\n * and (per the user security decision) also receives the tenant's one-time `plainSecret`.\n */\n\nimport {\n  ApiKeyScope,\n  AppOAuthClients_Operations,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  OAuthClientStatus,\n  OrgOAuthClients_Operations,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type { OAuthClientBase } from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { generateOAuthClientSecretMaterial } from './oauth-client-generation.backend.utils';\nimport type { Container } from 'inversify';\nimport { assertRequestedRolesWithinCallerCeiling, createRoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\nimport type { RoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\n\n/**\n * Bridge for the one-time plaintext secret between the CREATE prefix (which mints it)\n * and the postfix (which returns it), keyed by the per-operation `ExecutionContext`\n * INSTANCE. The orchestration threads the SAME `executionContext` through both handlers\n * (`services-registry-handler.backend.service.ts` prefix + postfix calls), so it is a\n * stable, per-invocation correlation key.\n *\n * A `WeakMap` keyed by the EC is deliberately chosen over a `Map` keyed by `hashedSecret`\n * / `_id`: (1) NO LEAK — the entry is reclaimed by GC when the request's EC becomes\n * unreachable, so a core-write failure between prefix and postfix cannot strand the\n * plaintext in memory; (2) NO RACE — concurrent operations run on DISTINCT EC instances,\n * so two simultaneous mints/reissues never collide on a shared key. `plainSecret` is\n * never persisted; the postfix also deletes the entry for promptness.\n */\nconst PLAINTEXT_SECRET_BY_EC = new WeakMap<ExecutionContext<any>, string>();\n\n/**\n * Bridge for ROTATE / REGENERATE, keyed by the same per-operation `ExecutionContext`\n * instance (see {@link PLAINTEXT_SECRET_BY_EC}). Carries the one-time `plainSecret` AND\n * the applied `previousSecretInvalidationDate`, so the postfix builds ROTATE's\n * `oldSecretInvalidationDate` from the value the prefix actually applied — independent of\n * whether the update result round-trips that field.\n */\nconst REISSUE_BRIDGE_BY_EC = new WeakMap<ExecutionContext<any>, { plainSecret: string; previousSecretInvalidationDate: Date | null }>();\n\n/** ROTATE keeps a bounded grace window; REGENERATE keeps an open-ended overlap. */\nenum OAuthClientReissueKind {\n  ROTATE = 'rotate',\n  REGENERATE = 'regenerate',\n}\n\n/**\n * The pre-fetched client fields the reissue prefix reads. `hashedSecret`/`secretPrefix`\n * are present on every persisted client of either scope.\n */\ntype ReissuableOAuthClient = Pick<OAuthClientBase, 'status'> & { hashedSecret: string; secretPrefix: string };\n\n/**\n * Structural view of a per-resource custom-operation enum — the members that have a\n * backend impl in this file. Both `OrgOAuthClients_Operations` and\n * `AppOAuthClients_Operations` satisfy it (identical string values).\n */\ntype OAuthClientCustomOps = { ROTATE: string; REGENERATE: string; EXPIRE: string };\n\ntype OAuthClientTarget = {\n  resourceType: CoreResourceType;\n  scope: ApiKeyScope;\n  ops: OAuthClientCustomOps;\n  variants: ReadonlyArray<{ isOperationDefault: boolean; variantKey?: string }>;\n};\n\n/** The handler-object shape accepted by `createResourceCustomServiceImplementation`. */\nexport type OAuthClientImplHandlers = Parameters<typeof createResourceCustomServiceImplementation>[0]['handlers'];\n\n/**\n * The OAuth-client resources, their scope (drives the `oc_org_` / `oc_app_` prefix), the\n * per-resource custom-op enum, and every op VARIANT each resource exposes.\n *\n * - ORG clients expose an org-admin DEFAULT + a cross-tenant app-super-admin `admin`\n *   variant → both registered.\n * - APP clients are single-variant (APP_ADMIN-scoped) → default only.\n */\nconst OAUTH_CLIENT_TARGETS: ReadonlyArray<OAuthClientTarget> = [\n  {\n    resourceType: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n    scope: ApiKeyScope.ORGANIZATION,\n    ops: OrgOAuthClients_Operations,\n    variants: [\n      { isOperationDefault: true },\n      { isOperationDefault: false, variantKey: 'admin' },\n    ],\n  },\n  {\n    resourceType: CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n    scope: ApiKeyScope.APPLICATION,\n    ops: AppOAuthClients_Operations,\n    variants: [\n      { isOperationDefault: true },\n    ],\n  },\n];\n\n/**\n * Register one custom-impl factory per (target × variant) for a single operation.\n * Every OAuth-client op is API_CALL and needs a distinct registration per variant\n * identity (see the module header) — this centralizes that fan-out.\n */\nfunction oauthClientFactoriesForOperation(\n  operationIdentifierFor: (target: OAuthClientTarget) => string | CoreResourceOperation,\n  handlersFor: (target: OAuthClientTarget, container: Container) => OAuthClientImplHandlers,\n): ResourceCustomServiceImplementationFactory[] {\n  return OAUTH_CLIENT_TARGETS.flatMap((target) =>\n    target.variants.map(({ isOperationDefault, variantKey }) => {\n      const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n        createResourceCustomServiceImplementation({\n          operationPath: {\n            resourceIdentifier: target.resourceType,\n            // API_CALL: the lookup key is built from the RUNNING operation's variantType\n            // (`extractOperationPath` passes it through unchanged), and OAuth-client ops\n            // are dispatched as direct HTTP API_CALLs. Must match exactly.\n            operationIdentifier: operationIdentifierFor(target),\n            variantType: ResourceOperationVariantType.API_CALL,\n            isOperationDefault,\n            variantKey,\n          },\n          handlers: handlersFor(target, container),\n        });\n      return factory as unknown as ResourceCustomServiceImplementationFactory;\n    }),\n  );\n}\n\n/** CREATE — enforce the role-ceiling, then mint material; surface `plainSecret` once. Exported for focused create-pipeline unit tests. */\nexport function buildOAuthClientMintHandlers(scope: ApiKeyScope, roleHierarchyResolver: RoleHierarchyResolver): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // Role-ceiling gate — a principal cannot mint a client carrying roles it does not itself hold\n      // (self-service privilege-escalation prevention; APPLICATION-scoped super-admin + system writes\n      // bypass). The ceiling is hierarchy-aware, so an ORG_ADMIN may mint a client carrying the roles\n      // its own role confers (ORG_MANAGER/ORG_MEMBER/…) but never ORG_OWNER above it.\n      // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on machine-credential minting.\n      assertRequestedRolesWithinCallerCeiling(executionContext, (input as { roles?: string[] }).roles, utils.errorBuilder, roleHierarchyResolver);\n      const { plainSecret, secretPrefix, hashedSecret } = generateOAuthClientSecretMaterial(scope);\n      // Bridge the one-time secret to the postfix, keyed by the per-op EC instance; never persisted.\n      PLAINTEXT_SECRET_BY_EC.set(executionContext, plainSecret);\n      // secretPrefix + hashedSecret are `.excludeFromCreate()`; returning them injects\n      // them into the create payload (preserveServerInjectedFields re-attaches them past\n      // the strict parse) so the row persists with the required fields.\n      return { ...(input as Record<string, unknown>), secretPrefix, hashedSecret };\n    },\n    postfixCoreOperations: async (_id, createdClient, executionContext, _operationPath, _utils) => {\n      if (!createdClient || typeof createdClient !== 'object') return createdClient;\n      const plainSecret = PLAINTEXT_SECRET_BY_EC.get(executionContext);\n      PLAINTEXT_SECRET_BY_EC.delete(executionContext);\n      if (!plainSecret) return createdClient;\n      return { ...(createdClient as Record<string, unknown>), plainSecret };\n    },\n  };\n}\n\n/**\n * ROTATE / REGENERATE — reissue the secret on the SAME record, moving the prior secret\n * into the grace-window slot. The client-credentials exchange keeps honoring the prior\n * secret until `previousSecretInvalidationDate` (ROTATE: the caller-chosen instant,\n * defaulting to now = immediate cutover; REGENERATE: `null` = open-ended overlap).\n */\nfunction buildOAuthClientReissueHandlers(scope: ApiKeyScope, kind: OAuthClientReissueKind): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // `currentObject` is the pre-fetched DB record for this UPDATE-borrow op — it\n      // includes the backend-only `hashedSecret`/`secretPrefix` we move into the\n      // previous slot.\n      const current = utils.currentObject as ReissuableOAuthClient | undefined;\n\n      // Only an ACTIVE client can be reissued (409 for a revoked/expired client —\n      // otherwise rotation would silently re-arm a deactivated credential).\n      if (current && current.status !== OAuthClientStatus.ACTIVE) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: { message: `OAuth client secret cannot be reissued in status '${current.status}'`, oauthClientStatus: current.status },\n        });\n      }\n\n      const { plainSecret, secretPrefix, hashedSecret } = generateOAuthClientSecretMaterial(scope);\n      const previousSecretInvalidationDate = kind === OAuthClientReissueKind.ROTATE\n        ? ((input as { oldSecretInvalidationDate?: Date }).oldSecretInvalidationDate ?? new Date())\n        : null;\n      REISSUE_BRIDGE_BY_EC.set(executionContext, { plainSecret, previousSecretInvalidationDate });\n\n      return {\n        ...(input as Record<string, unknown>),\n        hashedSecret,\n        secretPrefix,\n        // Move the outgoing secret into the grace-window slot (server-managed,\n        // excludeFrom{Create,Update} → carried by preserveServerInjectedFields).\n        previousHashedSecret: current?.hashedSecret,\n        previousSecretPrefix: current?.secretPrefix,\n        previousSecretInvalidationDate,\n      };\n    },\n    postfixCoreOperations: async (_id, updated, executionContext, _operationPath, _utils) => {\n      if (!updated || typeof updated !== 'object') return updated;\n      const record = updated as Record<string, unknown>;\n      const bridged = REISSUE_BRIDGE_BY_EC.get(executionContext);\n      REISSUE_BRIDGE_BY_EC.delete(executionContext);\n\n      const withPlainSecret = bridged?.plainSecret ? { ...record, plainSecret: bridged.plainSecret } : { ...record };\n      if (kind === OAuthClientReissueKind.ROTATE) {\n        // ROTATE's response DTO additionally carries the rotated record's id + when the\n        // prior secret is invalidated. Same record, so `oldClientId` is its own `_id`.\n        return { ...withPlainSecret, oldClientId: _id, oldSecretInvalidationDate: bridged?.previousSecretInvalidationDate };\n      }\n      // REGENERATE's response DTO is resource + plainSecret only.\n      return withPlainSecret;\n    },\n  };\n}\n\n/** CREATE impls — org default + org `admin` + app default. */\n/**\n * ACTIVE → EXPIRED, forced — the transition the credential-expiry sweep dispatches (#413).\n *\n * The FIRST status-transition handler on this resource: OAuth clients ship ROTATE and REGENERATE\n * and no deactivate/reactivate pair, so unlike api-keys there was no generic transition helper to\n * reuse. The 409 is the whole reason the sweep goes through a verb — an INACTIVE client was retired\n * by an administrator, and relabelling it EXPIRED would erase who ended it.\n *\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential state transitions are\n * explicit and validated, never inferred from a caller-supplied field.\n */\nfunction buildOAuthClientExpireHandlers(): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, _input, executionContext, _operationPath, utils) => {\n      const current = utils.currentObject as { status?: OAuthClientStatus } | undefined;\n\n      if (current && current.status !== OAuthClientStatus.ACTIVE) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: {\n            message: `OAuth client cannot move to '${OAuthClientStatus.EXPIRED}' from status '${current.status}'`,\n            oauthClientStatus: current.status,\n          },\n        });\n      }\n\n      return { status: OAuthClientStatus.EXPIRED };\n    },\n  };\n}\n\n/**\n * EXPIRE impls — registered separately from the other ops rather than through\n * `oauthClientFactoriesForOperation`, because that helper hardcodes `variantType: API_CALL` and\n * fans out over each resource's HTTP variants. EXPIRE is INTERNAL_CALL with a single default\n * variant, so it needs its own registration or the lookup key would never match and the guard above\n * would be silently unreachable.\n */\nexport function createOAuthClientExpireFactories(): ResourceCustomServiceImplementationFactory[] {\n  return OAUTH_CLIENT_TARGETS.map((target) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, _container: Container) =>\n      createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: target.resourceType,\n          operationIdentifier: target.ops.EXPIRE,\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: buildOAuthClientExpireHandlers(),\n      });\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\nexport function createOAuthClientCreateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    () => CoreResourceOperation.CREATE,\n    (target, container) => buildOAuthClientMintHandlers(target.scope, createRoleHierarchyResolver(container)),\n  );\n}\n\n/** ROTATE impls — bounded grace window. */\nexport function createOAuthClientRotateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    (target) => target.ops.ROTATE,\n    (target) => buildOAuthClientReissueHandlers(target.scope, OAuthClientReissueKind.ROTATE),\n  );\n}\n\n/** REGENERATE impls — open-ended overlap. */\nexport function createOAuthClientRegenerateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    (target) => target.ops.REGENERATE,\n    (target) => buildOAuthClientReissueHandlers(target.scope, OAuthClientReissueKind.REGENERATE),\n  );\n}\n"]}
+{"version":3,"file":"oauth-clients.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-clients.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACL,WAAW,EACX,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,OAAO,EAAE,iCAAiC,EAAE,MAAM,yCAAyC,CAAC;AAE5F,OAAO,EAAE,uCAAuC,EAAE,2BAA2B,EAAE,MAAM,uEAAuE,CAAC;AAG7J;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAiC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAA+F,CAAC;AAExI,mFAAmF;AACnF,IAAK,sBAGJ;AAHD,WAAK,sBAAsB;IACzB,2CAAiB,CAAA;IACjB,mDAAyB,CAAA;AAC3B,CAAC,EAHI,sBAAsB,KAAtB,sBAAsB,QAG1B;AAyBD;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAqC;IAC7D;QACE,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;QACzD,KAAK,EAAE,WAAW,CAAC,YAAY;QAC/B,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;YAC5B,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;SACnD;KACF;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;QACxD,KAAK,EAAE,WAAW,CAAC,WAAW;QAC9B,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;SAC7B;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,gCAAgC,CACvC,sBAAqF,EACrF,WAAyF;IAEzF,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;YACxC,aAAa,EAAE;gBACb,kBAAkB,EAAE,MAAM,CAAC,YAAY;gBACvC,6EAA6E;gBAC7E,6EAA6E;gBAC7E,+DAA+D;gBAC/D,mBAAmB,EAAE,sBAAsB,CAAC,MAAM,CAAC;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB;gBAClB,UAAU;aACX;YACD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;SACzC,CAAC,CAAC;QACL,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0IAA0I;AAC1I,MAAM,UAAU,4BAA4B,CAAC,KAAkB,EAAE,qBAA4C;IAC3G,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,8FAA8F;YAC9F,gGAAgG;YAChG,gGAAgG;YAChG,gFAAgF;YAChF,mGAAmG;YACnG,uCAAuC,CAAC,gBAAgB,EAAG,KAA8B,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YAC5I,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;YAC7F,+FAA+F;YAC/F,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAC1D,iFAAiF;YACjF,mFAAmF;YACnF,kEAAkE;YAClE,OAAO,EAAE,GAAI,KAAiC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;QAC/E,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YAC5F,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ;gBAAE,OAAO,aAAa,CAAC;YAC9E,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACjE,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAChD,IAAI,CAAC,WAAW;gBAAE,OAAO,aAAa,CAAC;YACvC,OAAO,EAAE,GAAI,aAAyC,EAAE,WAAW,EAAE,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,+BAA+B,CAAC,KAAkB,EAAE,IAA4B;IACvF,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,8EAA8E;YAC9E,2EAA2E;YAC3E,iBAAiB;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,aAAkD,CAAC;YAEzE,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBAC3D,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,qDAAqD,OAAO,CAAC,MAAM,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,MAAM,EAAE;iBAChI,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;YAC7F,MAAM,8BAA8B,GAAG,IAAI,KAAK,sBAAsB,CAAC,MAAM;gBAC3E,CAAC,CAAC,CAAE,KAA8C,CAAC,yBAAyB,IAAI,IAAI,IAAI,EAAE,CAAC;gBAC3F,CAAC,CAAC,IAAI,CAAC;YACT,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAE5F,OAAO;gBACL,GAAI,KAAiC;gBACrC,YAAY;gBACZ,YAAY;gBACZ,uEAAuE;gBACvE,yEAAyE;gBACzE,oBAAoB,EAAE,OAAO,EAAE,YAAY;gBAC3C,oBAAoB,EAAE,OAAO,EAAE,YAAY;gBAC3C,8BAA8B;aAC/B,CAAC;QACJ,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YACtF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAkC,CAAC;YAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC3D,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAE9C,MAAM,eAAe,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;YAC/G,IAAI,IAAI,KAAK,sBAAsB,CAAC,MAAM,EAAE,CAAC;gBAC3C,gFAAgF;gBAChF,+EAA+E;gBAC/E,OAAO,EAAE,GAAG,eAAe,EAAE,WAAW,EAAE,GAAG,EAAE,yBAAyB,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACtH,CAAC;YACD,4DAA4D;YAC5D,OAAO,eAAe,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D;;;;;;;;;;GAUG;AACH,SAAS,8BAA8B;IACrC,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YACnF,MAAM,OAAO,GAAG,KAAK,CAAC,aAA2D,CAAC;YAElF,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBAC3D,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,gCAAgC,iBAAiB,CAAC,OAAO,kBAAkB,OAAO,CAAC,MAAM,GAAG;wBACrG,iBAAiB,EAAE,OAAO,CAAC,MAAM;qBAClC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,UAAqB,EAAE,EAAE,CACpG,yCAAyC,CAAC;YACxC,aAAa,EAAE;gBACb,kBAAkB,EAAE,MAAM,CAAC,YAAY;gBACvC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM;gBACtC,WAAW,EAAE,4BAA4B,CAAC,aAAa;gBACvD,kBAAkB,EAAE,IAAI;aACzB;YACD,QAAQ,EAAE,8BAA8B,EAAE;SAC3C,CAAC,CAAC;QACL,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC9C,OAAO,gCAAgC,CACrC,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAClC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,KAAK,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAC1G,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,gCAAgC;IAC9C,OAAO,gCAAgC,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,CACzF,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,oCAAoC;IAClD,OAAO,gCAAgC,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EACjC,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAC7F,CAAC;AACJ,CAAC","sourcesContent":["/**\n * OAuth Clients Custom Implementations\n *\n * Implements the server-side behaviour for the organization + application OAuth-client\n * resources (`organizationOAuthClients`, `applicationOAuthClients`) that the schema\n * alone cannot express. FAITHFUL MIRROR of the api-keys mint pipeline\n * (`api-keys.custom-impl.backend.service.ts`), FOCUSED to the trunk operation set:\n *\n *   CREATE      → mint fresh secret material (the client must never supply it).\n *   ROTATE      → reissue the secret; retain the prior secret in a grace window that\n *                 stops authenticating at the caller-chosen `oldSecretInvalidationDate`.\n *   REGENERATE  → reissue the secret; keep the prior secret valid open-endedly (until\n *                 the next rotation) for a zero-downtime overlap.\n *\n * (api-keys' DEACTIVATE/REACTIVATE/EXTEND_EXPIRY/USAGE_STATS impls are deferred to the\n * OIDC branch alongside their resource-config ops.)\n *\n * WHY MINTING NEEDS AN IMPL: the schema requires `secretPrefix` + `hashedSecret`, but\n * both are `.excludeFromCreate().excludeFromUpdate()` (the client must never supply\n * them) and `plainSecret` is an ephemeral response-only field. Nothing generated them,\n * so a bare create/update persisted a row missing the required fields. These impls are\n * the single server-side choke point that mints secret material.\n *\n * PATTERN (CREATE / ROTATE / REGENERATE — all \"mint a secret\" ops):\n *   prefixCoreOperations  → mint material; inject the persisted `secretPrefix` +\n *                           `hashedSecret` (and, for rotate/regenerate, the previous-\n *                           secret grace-window fields) into the payload. Those fields\n *                           are `.excludeFrom{Create,Update}()`, so returning them from\n *                           the prefix is what carries them into the core write — the\n *                           orchestration diffs the prefix-added keys and forwards them\n *                           to the repository's `preserveServerInjectedFields` allowlist\n *                           so the final strict parse re-attaches (rather than strips)\n *                           them. Stash the one-time `plainSecret` for the postfix.\n *   postfixCoreOperations → attach the one-time `plainSecret` (+ rotate's `oldClientId` /\n *                           `oldSecretInvalidationDate`) to the response so the\n *                           operation's ephemeral `plainSecret` field surfaces it.\n * The core write still runs, so notifications / websocket events fire normally — which\n * is why this is prefix+postfix rather than `replaceCoreOperations`.\n *\n * VARIANT COVERAGE: a custom impl is matched to a running op by its FULL operation-path\n * identity — `isOperationDefault` (the `isDefault` sentinel) vs `variantKey` produce\n * DISTINCT keys (`createOperationPathKey`). So a single default registration only\n * intercepts the default variant; the cross-tenant app-super-admin `admin` variant\n * (org clients only) needs its own registration or it runs the bare core op and fails.\n * `OAUTH_CLIENT_TARGETS` enumerates every (resource × variant) each op exposes. Minting\n * is org-agnostic — the target `organizationId` rides in the payload / pre-fetched\n * record, never from these handlers — so the admin variant reuses the identical handlers\n * and (per the user security decision) also receives the tenant's one-time `plainSecret`.\n */\n\nimport {\n  ApiKeyScope,\n  AppOAuthClients_Operations,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  OAuthClientStatus,\n  OrgOAuthClients_Operations,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type { OAuthClientBase } from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { generateOAuthClientSecretMaterial } from './oauth-client-generation.backend.utils';\nimport type { Container } from 'inversify';\nimport { assertRequestedRolesWithinCallerCeiling, createRoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\nimport type { RoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\n\n/**\n * Bridge for the one-time plaintext secret between the CREATE prefix (which mints it)\n * and the postfix (which returns it), keyed by the per-operation `ExecutionContext`\n * INSTANCE. The orchestration threads the SAME `executionContext` through both handlers\n * (`services-registry-handler.backend.service.ts` prefix + postfix calls), so it is a\n * stable, per-invocation correlation key.\n *\n * A `WeakMap` keyed by the EC is deliberately chosen over a `Map` keyed by `hashedSecret`\n * / `_id`: (1) NO LEAK — the entry is reclaimed by GC when the request's EC becomes\n * unreachable, so a core-write failure between prefix and postfix cannot strand the\n * plaintext in memory; (2) NO RACE — concurrent operations run on DISTINCT EC instances,\n * so two simultaneous mints/reissues never collide on a shared key. `plainSecret` is\n * never persisted; the postfix also deletes the entry for promptness.\n */\nconst PLAINTEXT_SECRET_BY_EC = new WeakMap<ExecutionContext<any>, string>();\n\n/**\n * Bridge for ROTATE / REGENERATE, keyed by the same per-operation `ExecutionContext`\n * instance (see {@link PLAINTEXT_SECRET_BY_EC}). Carries the one-time `plainSecret` AND\n * the applied `previousSecretInvalidationDate`, so the postfix builds ROTATE's\n * `oldSecretInvalidationDate` from the value the prefix actually applied — independent of\n * whether the update result round-trips that field.\n */\nconst REISSUE_BRIDGE_BY_EC = new WeakMap<ExecutionContext<any>, { plainSecret: string; previousSecretInvalidationDate: Date | null }>();\n\n/** ROTATE keeps a bounded grace window; REGENERATE keeps an open-ended overlap. */\nenum OAuthClientReissueKind {\n  ROTATE = 'rotate',\n  REGENERATE = 'regenerate',\n}\n\n/**\n * The pre-fetched client fields the reissue prefix reads. `hashedSecret`/`secretPrefix`\n * are present on every persisted client of either scope.\n */\ntype ReissuableOAuthClient = Pick<OAuthClientBase, 'status'> & { hashedSecret: string; secretPrefix: string };\n\n/**\n * Structural view of a per-resource custom-operation enum — the members that have a\n * backend impl in this file. Both `OrgOAuthClients_Operations` and\n * `AppOAuthClients_Operations` satisfy it (identical string values).\n */\ntype OAuthClientCustomOps = { ROTATE: string; REGENERATE: string; EXPIRE: string };\n\ntype OAuthClientTarget = {\n  resourceType: CoreResourceType;\n  scope: ApiKeyScope;\n  ops: OAuthClientCustomOps;\n  variants: ReadonlyArray<{ isOperationDefault: boolean; variantKey?: string }>;\n};\n\n/** The handler-object shape accepted by `createResourceCustomServiceImplementation`. */\nexport type OAuthClientImplHandlers = Parameters<typeof createResourceCustomServiceImplementation>[0]['handlers'];\n\n/**\n * The OAuth-client resources, their scope (drives the `oc_org_` / `oc_app_` prefix), the\n * per-resource custom-op enum, and every op VARIANT each resource exposes.\n *\n * - ORG clients expose an org-admin DEFAULT + a cross-tenant app-super-admin `admin`\n *   variant → both registered.\n * - APP clients are single-variant (APP_ADMIN-scoped) → default only.\n */\nconst OAUTH_CLIENT_TARGETS: ReadonlyArray<OAuthClientTarget> = [\n  {\n    resourceType: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n    scope: ApiKeyScope.ORGANIZATION,\n    ops: OrgOAuthClients_Operations,\n    variants: [\n      { isOperationDefault: true },\n      { isOperationDefault: false, variantKey: 'admin' },\n    ],\n  },\n  {\n    resourceType: CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n    scope: ApiKeyScope.APPLICATION,\n    ops: AppOAuthClients_Operations,\n    variants: [\n      { isOperationDefault: true },\n    ],\n  },\n];\n\n/**\n * Register one custom-impl factory per (target × variant) for a single operation.\n * Every OAuth-client op is API_CALL and needs a distinct registration per variant\n * identity (see the module header) — this centralizes that fan-out.\n */\nfunction oauthClientFactoriesForOperation(\n  operationIdentifierFor: (target: OAuthClientTarget) => string | CoreResourceOperation,\n  handlersFor: (target: OAuthClientTarget, container: Container) => OAuthClientImplHandlers,\n): ResourceCustomServiceImplementationFactory[] {\n  return OAUTH_CLIENT_TARGETS.flatMap((target) =>\n    target.variants.map(({ isOperationDefault, variantKey }) => {\n      const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n        createResourceCustomServiceImplementation({\n          operationPath: {\n            resourceIdentifier: target.resourceType,\n            // API_CALL: the lookup key is built from the RUNNING operation's variantType\n            // (`extractOperationPath` passes it through unchanged), and OAuth-client ops\n            // are dispatched as direct HTTP API_CALLs. Must match exactly.\n            operationIdentifier: operationIdentifierFor(target),\n            variantType: ResourceOperationVariantType.API_CALL,\n            isOperationDefault,\n            variantKey,\n          },\n          handlers: handlersFor(target, container),\n        });\n      return factory as unknown as ResourceCustomServiceImplementationFactory;\n    }),\n  );\n}\n\n/** CREATE — enforce the role-ceiling, then mint material; surface `plainSecret` once. Exported for focused create-pipeline unit tests. */\nexport function buildOAuthClientMintHandlers(scope: ApiKeyScope, roleHierarchyResolver: RoleHierarchyResolver): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // Role-ceiling gate — a principal cannot mint a client carrying roles it does not itself hold\n      // (self-service privilege-escalation prevention; APPLICATION-scoped super-admin + system writes\n      // bypass). The ceiling is hierarchy-aware, so an ORG_ADMIN may mint a client carrying the roles\n      // its own role confers (ORG_MANAGER/ORG_MEMBER/…) but never ORG_OWNER above it.\n      // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on machine-credential minting.\n      assertRequestedRolesWithinCallerCeiling(executionContext, (input as { roles?: string[] }).roles, utils.errorBuilder, roleHierarchyResolver);\n      const { plainSecret, secretPrefix, hashedSecret } = generateOAuthClientSecretMaterial(scope);\n      // Bridge the one-time secret to the postfix, keyed by the per-op EC instance; never persisted.\n      PLAINTEXT_SECRET_BY_EC.set(executionContext, plainSecret);\n      // secretPrefix + hashedSecret are `.excludeFromCreate()`; returning them injects\n      // them into the create payload (preserveServerInjectedFields re-attaches them past\n      // the strict parse) so the row persists with the required fields.\n      return { ...(input as Record<string, unknown>), secretPrefix, hashedSecret };\n    },\n    postfixCoreOperations: async (_id, createdClient, executionContext, _operationPath, _utils) => {\n      if (!createdClient || typeof createdClient !== 'object') return createdClient;\n      const plainSecret = PLAINTEXT_SECRET_BY_EC.get(executionContext);\n      PLAINTEXT_SECRET_BY_EC.delete(executionContext);\n      if (!plainSecret) return createdClient;\n      return { ...(createdClient as Record<string, unknown>), plainSecret };\n    },\n  };\n}\n\n/**\n * ROTATE / REGENERATE — reissue the secret on the SAME record, moving the prior secret\n * into the grace-window slot. The client-credentials exchange keeps honoring the prior\n * secret until `previousSecretInvalidationDate` (ROTATE: the caller-chosen instant,\n * defaulting to now = immediate cutover; REGENERATE: `null` = open-ended overlap).\n */\nfunction buildOAuthClientReissueHandlers(scope: ApiKeyScope, kind: OAuthClientReissueKind): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // `currentObject` is the pre-fetched DB record for this UPDATE-borrow op — it\n      // includes the backend-only `hashedSecret`/`secretPrefix` we move into the\n      // previous slot.\n      const current = utils.currentObject as ReissuableOAuthClient | undefined;\n\n      // Only an ACTIVE client can be reissued (409 for a revoked/expired client —\n      // otherwise rotation would silently re-arm a deactivated credential).\n      if (current && current.status !== OAuthClientStatus.ACTIVE) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: { message: `OAuth client secret cannot be reissued in status '${current.status}'`, oauthClientStatus: current.status },\n        });\n      }\n\n      const { plainSecret, secretPrefix, hashedSecret } = generateOAuthClientSecretMaterial(scope);\n      const previousSecretInvalidationDate = kind === OAuthClientReissueKind.ROTATE\n        ? ((input as { oldSecretInvalidationDate?: Date }).oldSecretInvalidationDate ?? new Date())\n        : null;\n      REISSUE_BRIDGE_BY_EC.set(executionContext, { plainSecret, previousSecretInvalidationDate });\n\n      return {\n        ...(input as Record<string, unknown>),\n        hashedSecret,\n        secretPrefix,\n        // Move the outgoing secret into the grace-window slot (server-managed,\n        // excludeFrom{Create,Update} → carried by preserveServerInjectedFields).\n        previousHashedSecret: current?.hashedSecret,\n        previousSecretPrefix: current?.secretPrefix,\n        previousSecretInvalidationDate,\n      };\n    },\n    postfixCoreOperations: async (_id, updated, executionContext, _operationPath, _utils) => {\n      if (!updated || typeof updated !== 'object') return updated;\n      const record = updated as Record<string, unknown>;\n      const bridged = REISSUE_BRIDGE_BY_EC.get(executionContext);\n      REISSUE_BRIDGE_BY_EC.delete(executionContext);\n\n      const withPlainSecret = bridged?.plainSecret ? { ...record, plainSecret: bridged.plainSecret } : { ...record };\n      if (kind === OAuthClientReissueKind.ROTATE) {\n        // ROTATE's response DTO additionally carries the rotated record's id + when the\n        // prior secret is invalidated. Same record, so `oldClientId` is its own `_id`.\n        return { ...withPlainSecret, oldClientId: _id, oldSecretInvalidationDate: bridged?.previousSecretInvalidationDate };\n      }\n      // REGENERATE's response DTO is resource + plainSecret only.\n      return withPlainSecret;\n    },\n  };\n}\n\n/** CREATE impls — org default + org `admin` + app default. */\n/**\n * ACTIVE → EXPIRED, forced — the transition the credential-expiry sweep dispatches (#413).\n *\n * The FIRST status-transition handler on this resource: OAuth clients ship ROTATE and REGENERATE\n * and no deactivate/reactivate pair, so unlike api-keys there was no generic transition helper to\n * reuse. The 409 is the whole reason the sweep goes through a verb — an INACTIVE client was retired\n * by an administrator, and relabelling it EXPIRED would erase who ended it.\n *\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential state transitions are\n * explicit and validated, never inferred from a caller-supplied field.\n */\nfunction buildOAuthClientExpireHandlers(): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, _input, executionContext, _operationPath, utils) => {\n      const current = utils.currentObject as { status?: OAuthClientStatus } | undefined;\n\n      if (current && current.status !== OAuthClientStatus.ACTIVE) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: {\n            message: `OAuth client cannot move to '${OAuthClientStatus.EXPIRED}' from status '${current.status}'`,\n            oauthClientStatus: current.status,\n          },\n        });\n      }\n\n      return { status: OAuthClientStatus.EXPIRED };\n    },\n  };\n}\n\n/**\n * EXPIRE impls — registered separately from the other ops rather than through\n * `oauthClientFactoriesForOperation`, because that helper hardcodes `variantType: API_CALL` and\n * fans out over each resource's HTTP variants. EXPIRE is INTERNAL_CALL with a single default\n * variant, so it needs its own registration or the lookup key would never match and the guard above\n * would be silently unreachable.\n */\nexport function createOAuthClientExpireFactories(): ResourceCustomServiceImplementationFactory[] {\n  return OAUTH_CLIENT_TARGETS.map((target) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, _container: Container) =>\n      createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: target.resourceType,\n          operationIdentifier: target.ops.EXPIRE,\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: buildOAuthClientExpireHandlers(),\n      });\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\nexport function createOAuthClientCreateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    () => CoreResourceOperation.CREATE,\n    (target, container) => buildOAuthClientMintHandlers(target.scope, createRoleHierarchyResolver(container)),\n  );\n}\n\n/** ROTATE impls — bounded grace window. */\nexport function createOAuthClientRotateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    (target) => target.ops.ROTATE,\n    (target) => buildOAuthClientReissueHandlers(target.scope, OAuthClientReissueKind.ROTATE),\n  );\n}\n\n/** REGENERATE impls — open-ended overlap. */\nexport function createOAuthClientRegenerateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    (target) => target.ops.REGENERATE,\n    (target) => buildOAuthClientReissueHandlers(target.scope, OAuthClientReissueKind.REGENERATE),\n  );\n}\n"]}

package/dist/esm/security/outbound/outbound-request-deadline.backend.utils.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The half of an outbound deadline that is easy to lose: response-BODY consumption.
+ *
+ * ## Why a bound on the request alone is not a bound
+ *
+ * A deadline usually gets written as "abort the fetch after N ms", and that reads complete. It is
+ * not: a provider that returns response headers promptly and then stalls its body retains the
+ * request exactly as effectively as one that never answers at all. The socket stays open, the
+ * caller stays parked, and the timer that was supposed to cap it has already been cleared because
+ * `fetch` resolved.
+ *
+ * ## Why the abort has to be raced rather than assumed
+ *
+ * A conforming `fetch` tears down the response stream when the request's signal aborts, so where
+ * the platform `fetch` is reached DIRECTLY the signal alone covers the body. That reasoning stops
+ * being available the moment the transport is a SEAM something else can substitute — an injected
+ * `fetchImpl`, a stubbed global, a polyfill — because honouring the signal on an in-flight body
+ * read is a property of the implementation and not of the contract. Racing the read against the
+ * signal makes the deadline a property of THIS code rather than of whichever transport happens to
+ * be bound.
+ *
+ * Use this wherever the transport is substitutable. Where the platform `fetch` is called directly
+ * and cannot be replaced, passing the signal to `fetch` is sufficient and this is unnecessary.
+ */
+/**
+ * Read a response body as text, failing at the moment `signal` aborts rather than whenever the
+ * body decides to finish.
+ *
+ * Rejects with the signal's own `reason` when that reason is an `Error`, so the caller's error
+ * message names the deadline that was exceeded rather than a generic abort.
+ */
+export declare function readResponseTextWithinDeadline(response: Pick<Response, 'text'>, signal: AbortSignal): Promise<string>;
+/**
+ * An abort `reason` is `unknown` by contract: `AbortController.abort()` may be handed anything, and
+ * `AbortSignal.timeout` supplies a `TimeoutError` `DOMException`. Normalise it so a caller can
+ * always read a `message`.
+ */
+export declare function abortReasonToError(reason: unknown, fallbackMessage?: string): Error;
+//# sourceMappingURL=outbound-request-deadline.backend.utils.d.ts.map

package/dist/esm/security/outbound/outbound-request-deadline.backend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-request-deadline.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/outbound/outbound-request-deadline.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;GAMG;AACH,wBAAsB,8BAA8B,CAClD,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAChC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,SAAiC,GAAG,KAAK,CAG3G"}

package/dist/esm/security/outbound/outbound-request-deadline.backend.utils.js

@@ -0,0 +1,60 @@
+/**
+ * The half of an outbound deadline that is easy to lose: response-BODY consumption.
+ *
+ * ## Why a bound on the request alone is not a bound
+ *
+ * A deadline usually gets written as "abort the fetch after N ms", and that reads complete. It is
+ * not: a provider that returns response headers promptly and then stalls its body retains the
+ * request exactly as effectively as one that never answers at all. The socket stays open, the
+ * caller stays parked, and the timer that was supposed to cap it has already been cleared because
+ * `fetch` resolved.
+ *
+ * ## Why the abort has to be raced rather than assumed
+ *
+ * A conforming `fetch` tears down the response stream when the request's signal aborts, so where
+ * the platform `fetch` is reached DIRECTLY the signal alone covers the body. That reasoning stops
+ * being available the moment the transport is a SEAM something else can substitute — an injected
+ * `fetchImpl`, a stubbed global, a polyfill — because honouring the signal on an in-flight body
+ * read is a property of the implementation and not of the contract. Racing the read against the
+ * signal makes the deadline a property of THIS code rather than of whichever transport happens to
+ * be bound.
+ *
+ * Use this wherever the transport is substitutable. Where the platform `fetch` is called directly
+ * and cannot be replaced, passing the signal to `fetch` is sufficient and this is unnecessary.
+ */
+/**
+ * Read a response body as text, failing at the moment `signal` aborts rather than whenever the
+ * body decides to finish.
+ *
+ * Rejects with the signal's own `reason` when that reason is an `Error`, so the caller's error
+ * message names the deadline that was exceeded rather than a generic abort.
+ */
+export async function readResponseTextWithinDeadline(response, signal) {
+    if (signal.aborted) {
+        throw abortReasonToError(signal.reason);
+    }
+    let abortListener;
+    const aborted = new Promise((_resolve, reject) => {
+        abortListener = () => reject(abortReasonToError(signal.reason));
+        signal.addEventListener('abort', abortListener, { once: true });
+    });
+    try {
+        return await Promise.race([response.text(), aborted]);
+    }
+    finally {
+        if (abortListener) {
+            signal.removeEventListener('abort', abortListener);
+        }
+    }
+}
+/**
+ * An abort `reason` is `unknown` by contract: `AbortController.abort()` may be handed anything, and
+ * `AbortSignal.timeout` supplies a `TimeoutError` `DOMException`. Normalise it so a caller can
+ * always read a `message`.
+ */
+export function abortReasonToError(reason, fallbackMessage = 'Outbound request was aborted') {
+    if (reason instanceof Error)
+        return reason;
+    return new Error(typeof reason === 'string' ? reason : fallbackMessage);
+}
+//# sourceMappingURL=outbound-request-deadline.backend.utils.js.map

package/dist/esm/security/outbound/outbound-request-deadline.backend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-request-deadline.backend.utils.js","sourceRoot":"","sources":["../../../../src/security/outbound/outbound-request-deadline.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAAgC,EAChC,MAAmB;IAEnB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,aAAuC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACtD,aAAa,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe,EAAE,eAAe,GAAG,8BAA8B;IAClG,IAAI,MAAM,YAAY,KAAK;QAAE,OAAO,MAAM,CAAC;IAC3C,OAAO,IAAI,KAAK,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;AAC1E,CAAC","sourcesContent":["/**\n * The half of an outbound deadline that is easy to lose: response-BODY consumption.\n *\n * ## Why a bound on the request alone is not a bound\n *\n * A deadline usually gets written as \"abort the fetch after N ms\", and that reads complete. It is\n * not: a provider that returns response headers promptly and then stalls its body retains the\n * request exactly as effectively as one that never answers at all. The socket stays open, the\n * caller stays parked, and the timer that was supposed to cap it has already been cleared because\n * `fetch` resolved.\n *\n * ## Why the abort has to be raced rather than assumed\n *\n * A conforming `fetch` tears down the response stream when the request's signal aborts, so where\n * the platform `fetch` is reached DIRECTLY the signal alone covers the body. That reasoning stops\n * being available the moment the transport is a SEAM something else can substitute — an injected\n * `fetchImpl`, a stubbed global, a polyfill — because honouring the signal on an in-flight body\n * read is a property of the implementation and not of the contract. Racing the read against the\n * signal makes the deadline a property of THIS code rather than of whichever transport happens to\n * be bound.\n *\n * Use this wherever the transport is substitutable. Where the platform `fetch` is called directly\n * and cannot be replaced, passing the signal to `fetch` is sufficient and this is unnecessary.\n */\n\n/**\n * Read a response body as text, failing at the moment `signal` aborts rather than whenever the\n * body decides to finish.\n *\n * Rejects with the signal's own `reason` when that reason is an `Error`, so the caller's error\n * message names the deadline that was exceeded rather than a generic abort.\n */\nexport async function readResponseTextWithinDeadline(\n  response: Pick<Response, 'text'>,\n  signal: AbortSignal,\n): Promise<string> {\n  if (signal.aborted) {\n    throw abortReasonToError(signal.reason);\n  }\n\n  let abortListener: (() => void) | undefined;\n  const aborted = new Promise<never>((_resolve, reject) => {\n    abortListener = () => reject(abortReasonToError(signal.reason));\n    signal.addEventListener('abort', abortListener, { once: true });\n  });\n\n  try {\n    return await Promise.race([response.text(), aborted]);\n  } finally {\n    if (abortListener) {\n      signal.removeEventListener('abort', abortListener);\n    }\n  }\n}\n\n/**\n * An abort `reason` is `unknown` by contract: `AbortController.abort()` may be handed anything, and\n * `AbortSignal.timeout` supplies a `TimeoutError` `DOMException`. Normalise it so a caller can\n * always read a `message`.\n */\nexport function abortReasonToError(reason: unknown, fallbackMessage = 'Outbound request was aborted'): Error {\n  if (reason instanceof Error) return reason;\n  return new Error(typeof reason === 'string' ? reason : fallbackMessage);\n}\n"]}

package/dist/esm/security/outbound/outbound-request-headers.backend.utils.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Merging engine-owned headers over a header set the engine does not control.
+ *
+ * ## The defect this exists to remove
+ *
+ * Every outbound arm in the engine composes its request headers the same way: take a set the
+ * PROVIDER supplied (transport headers off a runtime contract, a harvested REST catalogue's
+ * `defaultHeaders`) and apply the engine's own credential over the top. Written as an object
+ * literal that reads as safe, and four arms carried a JSDoc saying so — a variant of *"it is
+ * applied AFTER the provider's headers, so a provider cannot take authentication over by naming
+ * that header"*.
+ *
+ * **That reasoning holds only for an IDENTICAL spelling.** HTTP header names are case-insensitive;
+ * a JavaScript object's keys are not. A provider naming `Authorization` while the engine writes
+ * `authorization` produces TWO DISTINCT KEYS, and neither `fetch` nor `Headers` treats the later
+ * one as a replacement — they are COMBINED into a single comma-joined field value:
+ *
+ * ```
+ * authorization: Bearer provider-chosen, Basic QUMtYWNjb3VudDpzM2NyM3Q=
+ * ```
+ *
+ * That is strictly worse than the takeover the ordering was defending against. A takeover
+ * authenticates as the provider; a combination authenticates as NOBODY, so the arm fails closed
+ * against its vendor with a credential error that names neither cause. It is a provider-caused
+ * outage the arm's own promise says cannot happen.
+ *
+ * ## Why the collision is likely rather than theoretical
+ *
+ * The two spellings are not equally probable. `WildoHeaderKeys.AUTHORIZATION` is `authorization`,
+ * lower-case, while `Authorization` is the conventional spelling throughout vendor documentation —
+ * so the colliding case is the one a provider author writes BY DEFAULT, and the safe one is the
+ * one they would have to be told to write.
+ *
+ * ## Why a shared function rather than a filter per arm
+ *
+ * Five sites merge these two sources, and the defect had already been fixed at one of them by hand
+ * before anyone counted the rest. A predicate applied N times is a predicate that will be applied
+ * N-1 times; the invariant belongs somewhere a new arm reaches by calling rather than by
+ * remembering. See `.claude/rules/invariant-call-site-enumeration.md` — "prefer making the
+ * invariant unbypassable over applying it N times".
+ *
+ * ## Why DROP rather than REFUSE
+ *
+ * A provider that names the engine's credential header has made a mistake, not an attack. Refusing
+ * the request would turn a harmless declaration into a dead capability — on the SMS arm, one that
+ * carries phone verification and the second factor. The engine's value is authoritative either
+ * way, so dropping the provider's key restores exactly the promise the JSDoc always made.
+ */
+/**
+ * The provider's headers, with every case-insensitive spelling of an engine-owned header removed,
+ * and the engine's own values applied over the result.
+ *
+ * The returned record is safe to hand to `fetch`: no two of its keys name the same HTTP header, so
+ * the `Headers` layer has nothing to combine.
+ *
+ * `engineOwned` wins unconditionally — that is what makes it engine-owned. Keys of `engineOwned`
+ * whose value is `undefined` are omitted rather than sent empty, so a caller may build its set
+ * conditionally without an intermediate spread.
+ *
+ * @param providerSupplied Headers the engine did not author: a provider contract's transport
+ *   headers, a harvested catalogue's `defaultHeaders`, or any set crossing a trust boundary.
+ * @param engineOwned Headers the engine owns and that must reach the wire exactly once — the
+ *   credential, and anything else whose value a provider must not influence.
+ */
+export declare function withEngineOwnedHeaders(providerSupplied: Readonly<Record<string, string>> | undefined, engineOwned: Readonly<Record<string, string | undefined>>): Record<string, string>;
+//# sourceMappingURL=outbound-request-headers.backend.utils.d.ts.map

package/dist/esm/security/outbound/outbound-request-headers.backend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-request-headers.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/outbound/outbound-request-headers.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,EAC9D,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GACxD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB"}

package/dist/esm/security/outbound/outbound-request-headers.backend.utils.js

@@ -0,0 +1,75 @@
+/**
+ * Merging engine-owned headers over a header set the engine does not control.
+ *
+ * ## The defect this exists to remove
+ *
+ * Every outbound arm in the engine composes its request headers the same way: take a set the
+ * PROVIDER supplied (transport headers off a runtime contract, a harvested REST catalogue's
+ * `defaultHeaders`) and apply the engine's own credential over the top. Written as an object
+ * literal that reads as safe, and four arms carried a JSDoc saying so — a variant of *"it is
+ * applied AFTER the provider's headers, so a provider cannot take authentication over by naming
+ * that header"*.
+ *
+ * **That reasoning holds only for an IDENTICAL spelling.** HTTP header names are case-insensitive;
+ * a JavaScript object's keys are not. A provider naming `Authorization` while the engine writes
+ * `authorization` produces TWO DISTINCT KEYS, and neither `fetch` nor `Headers` treats the later
+ * one as a replacement — they are COMBINED into a single comma-joined field value:
+ *
+ * ```
+ * authorization: Bearer provider-chosen, Basic QUMtYWNjb3VudDpzM2NyM3Q=
+ * ```
+ *
+ * That is strictly worse than the takeover the ordering was defending against. A takeover
+ * authenticates as the provider; a combination authenticates as NOBODY, so the arm fails closed
+ * against its vendor with a credential error that names neither cause. It is a provider-caused
+ * outage the arm's own promise says cannot happen.
+ *
+ * ## Why the collision is likely rather than theoretical
+ *
+ * The two spellings are not equally probable. `WildoHeaderKeys.AUTHORIZATION` is `authorization`,
+ * lower-case, while `Authorization` is the conventional spelling throughout vendor documentation —
+ * so the colliding case is the one a provider author writes BY DEFAULT, and the safe one is the
+ * one they would have to be told to write.
+ *
+ * ## Why a shared function rather than a filter per arm
+ *
+ * Five sites merge these two sources, and the defect had already been fixed at one of them by hand
+ * before anyone counted the rest. A predicate applied N times is a predicate that will be applied
+ * N-1 times; the invariant belongs somewhere a new arm reaches by calling rather than by
+ * remembering. See `.claude/rules/invariant-call-site-enumeration.md` — "prefer making the
+ * invariant unbypassable over applying it N times".
+ *
+ * ## Why DROP rather than REFUSE
+ *
+ * A provider that names the engine's credential header has made a mistake, not an attack. Refusing
+ * the request would turn a harmless declaration into a dead capability — on the SMS arm, one that
+ * carries phone verification and the second factor. The engine's value is authoritative either
+ * way, so dropping the provider's key restores exactly the promise the JSDoc always made.
+ */
+/**
+ * The provider's headers, with every case-insensitive spelling of an engine-owned header removed,
+ * and the engine's own values applied over the result.
+ *
+ * The returned record is safe to hand to `fetch`: no two of its keys name the same HTTP header, so
+ * the `Headers` layer has nothing to combine.
+ *
+ * `engineOwned` wins unconditionally — that is what makes it engine-owned. Keys of `engineOwned`
+ * whose value is `undefined` are omitted rather than sent empty, so a caller may build its set
+ * conditionally without an intermediate spread.
+ *
+ * @param providerSupplied Headers the engine did not author: a provider contract's transport
+ *   headers, a harvested catalogue's `defaultHeaders`, or any set crossing a trust boundary.
+ * @param engineOwned Headers the engine owns and that must reach the wire exactly once — the
+ *   credential, and anything else whose value a provider must not influence.
+ */
+export function withEngineOwnedHeaders(providerSupplied, engineOwned) {
+    const reserved = new Set(Object.keys(engineOwned).map((name) => name.toLowerCase()));
+    const merged = Object.fromEntries(Object.entries(providerSupplied ?? {}).filter(([name]) => !reserved.has(name.toLowerCase())));
+    for (const [name, value] of Object.entries(engineOwned)) {
+        if (value !== undefined) {
+            merged[name] = value;
+        }
+    }
+    return merged;
+}
+//# sourceMappingURL=outbound-request-headers.backend.utils.js.map

package/dist/esm/security/outbound/outbound-request-headers.backend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-request-headers.backend.utils.js","sourceRoot":"","sources":["../../../../src/security/outbound/outbound-request-headers.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,gBAA8D,EAC9D,WAAyD;IAEzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAErF,MAAM,MAAM,GAA2B,MAAM,CAAC,WAAW,CACvD,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAC7F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Merging engine-owned headers over a header set the engine does not control.\n *\n * ## The defect this exists to remove\n *\n * Every outbound arm in the engine composes its request headers the same way: take a set the\n * PROVIDER supplied (transport headers off a runtime contract, a harvested REST catalogue's\n * `defaultHeaders`) and apply the engine's own credential over the top. Written as an object\n * literal that reads as safe, and four arms carried a JSDoc saying so — a variant of *\"it is\n * applied AFTER the provider's headers, so a provider cannot take authentication over by naming\n * that header\"*.\n *\n * **That reasoning holds only for an IDENTICAL spelling.** HTTP header names are case-insensitive;\n * a JavaScript object's keys are not. A provider naming `Authorization` while the engine writes\n * `authorization` produces TWO DISTINCT KEYS, and neither `fetch` nor `Headers` treats the later\n * one as a replacement — they are COMBINED into a single comma-joined field value:\n *\n * ```\n * authorization: Bearer provider-chosen, Basic QUMtYWNjb3VudDpzM2NyM3Q=\n * ```\n *\n * That is strictly worse than the takeover the ordering was defending against. A takeover\n * authenticates as the provider; a combination authenticates as NOBODY, so the arm fails closed\n * against its vendor with a credential error that names neither cause. It is a provider-caused\n * outage the arm's own promise says cannot happen.\n *\n * ## Why the collision is likely rather than theoretical\n *\n * The two spellings are not equally probable. `WildoHeaderKeys.AUTHORIZATION` is `authorization`,\n * lower-case, while `Authorization` is the conventional spelling throughout vendor documentation —\n * so the colliding case is the one a provider author writes BY DEFAULT, and the safe one is the\n * one they would have to be told to write.\n *\n * ## Why a shared function rather than a filter per arm\n *\n * Five sites merge these two sources, and the defect had already been fixed at one of them by hand\n * before anyone counted the rest. A predicate applied N times is a predicate that will be applied\n * N-1 times; the invariant belongs somewhere a new arm reaches by calling rather than by\n * remembering. See `.claude/rules/invariant-call-site-enumeration.md` — \"prefer making the\n * invariant unbypassable over applying it N times\".\n *\n * ## Why DROP rather than REFUSE\n *\n * A provider that names the engine's credential header has made a mistake, not an attack. Refusing\n * the request would turn a harmless declaration into a dead capability — on the SMS arm, one that\n * carries phone verification and the second factor. The engine's value is authoritative either\n * way, so dropping the provider's key restores exactly the promise the JSDoc always made.\n */\n\n/**\n * The provider's headers, with every case-insensitive spelling of an engine-owned header removed,\n * and the engine's own values applied over the result.\n *\n * The returned record is safe to hand to `fetch`: no two of its keys name the same HTTP header, so\n * the `Headers` layer has nothing to combine.\n *\n * `engineOwned` wins unconditionally — that is what makes it engine-owned. Keys of `engineOwned`\n * whose value is `undefined` are omitted rather than sent empty, so a caller may build its set\n * conditionally without an intermediate spread.\n *\n * @param providerSupplied Headers the engine did not author: a provider contract's transport\n *   headers, a harvested catalogue's `defaultHeaders`, or any set crossing a trust boundary.\n * @param engineOwned Headers the engine owns and that must reach the wire exactly once — the\n *   credential, and anything else whose value a provider must not influence.\n */\nexport function withEngineOwnedHeaders(\n  providerSupplied: Readonly<Record<string, string>> | undefined,\n  engineOwned: Readonly<Record<string, string | undefined>>,\n): Record<string, string> {\n  const reserved = new Set(Object.keys(engineOwned).map((name) => name.toLowerCase()));\n\n  const merged: Record<string, string> = Object.fromEntries(\n    Object.entries(providerSupplied ?? {}).filter(([name]) => !reserved.has(name.toLowerCase())),\n  );\n\n  for (const [name, value] of Object.entries(engineOwned)) {\n    if (value !== undefined) {\n      merged[name] = value;\n    }\n  }\n\n  return merged;\n}\n"]}

package/dist/esm/security/scim/controllers/scim.backend.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim.backend.controller.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/controllers/scim.backend.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AAEzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAI1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAuC5I,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,qBACa,4BAA6B,SAAQ,gCAAgC;IAWnB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAI9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBAbjD,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACL,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAClD,mBAAmB,EAAE,wCAAwC,EAC9E,gBAAgB,EAAE,uBAAuB,EACrB,gBAAgB,EAAE,oCAAoC,EACnE,gBAAgB,EAAE,uBAAuB,EAChD,gBAAgB,EAAE,uBAAuB,EAItC,mBAAmB,EAAE,0BAA0B;IASlH,SAAS,CAAC,WAAW,IAAI,IAAI;YAyCf,yBAAyB;YAkIzB,4BAA4B;YAgB5B,cAAc;YAUd,oBAAoB;YAcpB,iBAAiB;YA4DjB,cAAc;YA8Bd,gBAAgB;YA6DhB,kBAAkB;YAqElB,gBAAgB;YAsGhB,iBAAiB;YAuCjB,WAAW;YAyEX,qBAAqB;IA8InC,OAAO,CAAC,oBAAoB;IAwB5B,OAAO,CAAC,qBAAqB;IAiD7B,OAAO,CAAC,oBAAoB;YAqBd,cAAc;YAed,eAAe;YASf,oBAAoB;IAalC;;;;;;;;;;;;;OAaG;IACH;;;;;;;OAOG;YACW,sBAAsB;IAuCpC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gCAAgC;IA0D9C,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;IAoCxB,OAAO,CAAC,UAAU;YAIJ,gCAAgC;IAiB9C,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,WAAW;YAQL,4BAA4B;CAG3C"}
+{"version":3,"file":"scim.backend.controller.d.ts","sourceRoot":"","sources":["../../../../../src/security/scim/controllers/scim.backend.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AAEzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAI1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAuC5I,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,qBACa,4BAA6B,SAAQ,gCAAgC;IAWnB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAI9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBAbjD,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACL,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAClD,mBAAmB,EAAE,wCAAwC,EAC9E,gBAAgB,EAAE,uBAAuB,EACrB,gBAAgB,EAAE,oCAAoC,EACnE,gBAAgB,EAAE,uBAAuB,EAChD,gBAAgB,EAAE,uBAAuB,EAItC,mBAAmB,EAAE,0BAA0B;IASlH,SAAS,CAAC,WAAW,IAAI,IAAI;YAyCf,yBAAyB;YAkIzB,4BAA4B;YAgB5B,cAAc;YAUd,oBAAoB;YAcpB,iBAAiB;YA4DjB,cAAc;YA8Bd,gBAAgB;YA6DhB,kBAAkB;YAqElB,gBAAgB;YAsGhB,iBAAiB;YAuCjB,WAAW;YAyEX,qBAAqB;IA8InC,OAAO,CAAC,oBAAoB;IAwB5B,OAAO,CAAC,qBAAqB;IAiD7B,OAAO,CAAC,oBAAoB;YAqBd,cAAc;YAed,eAAe;YASf,oBAAoB;IAalC;;;;;;;;;;;;;OAaG;IACH;;;;;;;OAOG;YACW,sBAAsB;IAuCpC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gCAAgC;IA0D9C,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;IAoCxB,OAAO,CAAC,UAAU;YAIJ,gCAAgC;IAiB9C,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,WAAW;YAQL,4BAA4B;CAG3C"}