@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/security/scim/models/scim-protocol.backend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-protocol.backend.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/scim/models/scim-protocol.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU,EAAS,OAAO;IAC1B,gBAAgB,EAAG,WAAW;IAC9B,iBAAiB,EAAE,UAAU;IAC7B,aAAa,EAAM,aAAa;IAChC,QAAQ,EAAW,SAAS,EAAS,kDAAkD;IACvF,YAAY,EAAO,gBAAgB;CAC3B,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA2B,MAAM,CAAC,WAAW,CACrF,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAClF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AAEH,kEAAkE;AAClE,0BAA0B;AAC1B,kEAAkE;AAElE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,4CAA4C;IAClD,eAAe,EAAE,4DAA4D;IAC7E,aAAa,EAAE,oDAAoD;IACnE,KAAK,EAAE,6CAA6C;IACpD,QAAQ,EAAE,+CAA+C;IACzD,YAAY,EAAE,mDAAmD;IACjE,aAAa,EAAE,oDAAoD;IACnE,uBAAuB,EAAE,6DAA6D;IACtF,aAAa,EAAE,oDAAoD;IACnE,MAAM,EAAE,8CAA8C;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhE,MAAM,QAAQ,GAAG,IAA+B,CAAC;IACjD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;IACnE,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,IAAI,IAAI,OAAO,mBAAmB,KAAK,QAAQ;QACrE,CAAC,CAAE,mBAA+C,CAAC,YAAY,CAAC;QAChE,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,oBAAoB,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAExD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AA+HD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B,CAAC,aAAqC;IAClF,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,CAAC,uBAAuB,CAAC;QAC/C,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;QAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE;QACtE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;QAC5C,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QACpC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QAC1B,qBAAqB,EAAE,CAAC;gBACtB,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,oBAAoB;gBAC1B,WAAW,EAAE,6DAA6D;gBAC1E,OAAO,EAAE,yCAAyC;gBAClD,GAAG,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9G,OAAO,EAAE,IAAI;aACd,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,uBAAuB;YACrC,QAAQ,EAAE,gCAAgC;SAC3C;KACF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,4CAA4C;AAC5C,kEAAkE;AAElE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,YAAY,CAAC,IAAI;IACrB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;QAC9J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBACjI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACxH,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzH,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;aACzH,EAAC;QACF,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC1H,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QACtH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBAClI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACrE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACrE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC1E,EAAC;QACF,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;KAC1H;IACD,IAAI,EAAE;QACJ,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,oBAAoB,YAAY,CAAC,IAAI,EAAE;KAClD;CACO,CAAC;AAEX,kEAAkE;AAClE,+CAA+C;AAC/C,kEAAkE;AAElE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;QAClC,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;QACrC,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,cAAc;QAC3B,MAAM,EAAE,YAAY,CAAC,IAAI;QACzB,gBAAgB,EAAE,CAAC;gBACjB,MAAM,EAAE,YAAY,CAAC,eAAe;gBACpC,QAAQ,EAAE,KAAK;aAChB,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,cAAc;YAC5B,QAAQ,EAAE,6BAA6B;SACxC;KACF,CAAU,CAAC","sourcesContent":["/**\n * SCIM Protocol Schemas — Step 20\n * \n * SCIM 2.0 types, attribute mapping, and protocol constants for directory provisioning.\n * \n * Decision 13: Lean SCIM — Users only in v1, no Groups, no generic adapter.\n * SCIM_USER_ATTRIBUTE_MAP maps SCIM attributes → NormalizedUserProfile fields\n * (the same type used by SSO JIT provisioning in Step 4/15).\n *\n * Token schema has moved to @wildo-ai/saas-models (scimTokensPolymorphicDeclaration).\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Attribute Mapping\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Maps SCIM User resource attribute paths to NormalizedUserProfile fields.\n * Hardcoded for v1 — only the SCIM User resource is supported.\n * \n * FUTURE: If SCIM Groups or custom resources are needed, extract this into a\n * generic SCIMResourceMappingRegistry. See Decision 13 for the architecture.\n */\nexport const SCIM_USER_ATTRIBUTE_MAP = {\n  'userName':        'email',\n  'name.givenName':  'firstName',\n  'name.familyName': 'lastName',\n  'displayName':     'displayName',\n  'active':          '_active',        // computed: maps to user status (active/inactive)\n  'externalId':      'providerUserId',\n} as const;\n\n/**\n * Reverse map: NormalizedUserProfile field → SCIM attribute path.\n * Used by the response formatter to build SCIM User resources from internal data.\n */\nexport const PROFILE_TO_SCIM_ATTRIBUTE_MAP: Record<string, string> = Object.fromEntries(\n  Object.entries(SCIM_USER_ATTRIBUTE_MAP).map(([scim, profile]) => [profile, scim])\n);\n\n/**\n * FUTURE: SCIM Groups → Organization Roles\n * SCIM Groups map to role assignments, not departments.\n * Example: Okta group \"Wildo Admins\" → ADMIN role.\n * Implementation: add /scim/v2/Groups endpoints with:\n *   - POST/PUT/PATCH /Groups → create/update org roles\n *   - Group membership changes → OrganizationMember role updates\n *   - Group displayName → role identifier mapping (configurable per org)\n *\n * SCIM User department → OrganizationUnit: IMPLEMENTED (2026-08-01, WS-C). `department` from the\n * Enterprise User extension is bound to an organization unit through the EXPLICIT per-organization\n * `organizationUnitMapping` on the SCIM provisioning config — see\n * {@link extractScimDirectoryUnitValue} and `scim-organization-unit-mapping.shared.ts`. `division`\n * and `manager` remain unmapped: `division` would only be needed to disambiguate a search-based\n * match, and the declared mapping is unambiguous by construction, while `manager` is a reporting\n * relationship rather than a unit membership.\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Protocol Constants\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_SCHEMAS = {\n  USER: 'urn:ietf:params:scim:schemas:core:2.0:User',\n  ENTERPRISE_USER: 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User',\n  LIST_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:ListResponse',\n  ERROR: 'urn:ietf:params:scim:api:messages:2.0:Error',\n  PATCH_OP: 'urn:ietf:params:scim:api:messages:2.0:PatchOp',\n  BULK_REQUEST: 'urn:ietf:params:scim:api:messages:2.0:BulkRequest',\n  BULK_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:BulkResponse',\n  SERVICE_PROVIDER_CONFIG: 'urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig',\n  RESOURCE_TYPE: 'urn:ietf:params:scim:schemas:core:2.0:ResourceType',\n  SCHEMA: 'urn:ietf:params:scim:schemas:core:2.0:Schema',\n} as const;\n\nexport const SCIM_CONTENT_TYPE = 'application/scim+json';\n\n/**\n * Read the directory's `department` from an inbound SCIM User body.\n *\n * ## Why this is NOT an entry in `attributeMapping`\n *\n * Two independent reasons, and both matter:\n *\n * 1. **The path grammar cannot express it.** `resolveScimAttributePath` splits on `.`, and the\n *    extension key is literally `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User` — the\n *    `2.0` contains a dot, so any dotted path would traverse into a key that does not exist.\n * 2. **There is nothing tenant-specific to configure.** `attributeMapping` exists because directories\n *    disagree about where a value lives (`emails[0].value` vs `emails[type eq \"work\"].value`). The\n *    enterprise extension URN is fixed BY THE SCIM SPEC, so a configurable path here would offer a\n *    choice that has exactly one correct answer.\n *\n * The tenant-specific part — what a department VALUE means — is configured, in\n * `organizationUnitMapping`. This function only finds the value.\n *\n * Falls back to a top-level `department` because directories in the wild place it there when they do\n * not send the extension envelope. Returns `undefined` for anything non-string or blank, so an absent\n * department is unambiguous to the caller.\n */\nexport function extractScimDirectoryUnitValue(body: unknown): string | undefined {\n  if (body === null || typeof body !== 'object') return undefined;\n\n  const scimBody = body as Record<string, unknown>;\n  const enterpriseExtension = scimBody[SCIM_SCHEMAS.ENTERPRISE_USER];\n  const enterpriseDepartment =\n    enterpriseExtension !== null && typeof enterpriseExtension === 'object'\n      ? (enterpriseExtension as Record<string, unknown>)['department']\n      : undefined;\n\n  const rawDepartment = enterpriseDepartment ?? scimBody['department'];\n  if (typeof rawDepartment !== 'string') return undefined;\n\n  const department = rawDepartment.trim();\n  return department.length > 0 ? department : undefined;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Error Types (RFC 7644 §3.12)\n// ═══════════════════════════════════════════════════════════════\n\nexport type SCIMErrorType =\n  | 'invalidFilter'\n  | 'tooMany'\n  | 'uniqueness'\n  | 'mutability'\n  | 'invalidSyntax'\n  | 'invalidPath'\n  | 'noTarget'\n  | 'invalidValue'\n  | 'invalidVers'\n  | 'sensitive';\n\nexport interface SCIMErrorResponse {\n  schemas: [typeof SCIM_SCHEMAS.ERROR];\n  status: string;\n  detail: string;\n  scimType?: SCIMErrorType;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM PATCH Operation Types (RFC 7644 §3.5.2)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMPatchOperation {\n  op: 'add' | 'remove' | 'replace';\n  path?: string;\n  value?: unknown;\n}\n\nexport interface SCIMPatchRequest {\n  schemas: string[];\n  Operations: SCIMPatchOperation[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Bulk Operation Types (RFC 7644 §3.7)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMBulkOperation {\n  method: 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n  path: string;\n  bulkId?: string;\n  data?: Record<string, unknown>;\n}\n\nexport interface SCIMBulkRequest {\n  schemas: [typeof SCIM_SCHEMAS.BULK_REQUEST];\n  Operations: SCIMBulkOperation[];\n  failOnErrors?: number;\n}\n\nexport interface SCIMBulkOperationResponse {\n  method: string;\n  bulkId?: string;\n  location?: string;\n  status: string;\n  response?: SCIMErrorResponse;\n}\n\nexport interface SCIMBulkResponse {\n  schemas: [typeof SCIM_SCHEMAS.BULK_RESPONSE];\n  Operations: SCIMBulkOperationResponse[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Resource Type (RFC 7643 §4.1)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMUserResource {\n  schemas: string[];\n  id: string;\n  externalId?: string;\n  userName: string;\n  name?: {\n    formatted?: string;\n    familyName?: string;\n    givenName?: string;\n  };\n  displayName?: string;\n  active: boolean;\n  emails?: Array<{\n    value: string;\n    type?: string;\n    primary?: boolean;\n  }>;\n  meta: {\n    resourceType: 'User';\n    created: string;\n    lastModified: string;\n    location: string;\n  };\n}\n\nexport interface SCIMListResponse<T = SCIMUserResource> {\n  schemas: [typeof SCIM_SCHEMAS.LIST_RESPONSE];\n  totalResults: number;\n  startIndex: number;\n  itemsPerPage: number;\n  Resources: T[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM ServiceProviderConfig (RFC 7643 §5)\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Where an application's SCIM discovery document sends a directory administrator for\n * documentation. Authored per application (`auth.scimDocumentation`), because the RFC defines\n * `documentationUri` as the SERVICE PROVIDER's documentation — and the service provider is the\n * application, not the framework it was built with.\n *\n * spec-cite: RFC 7643 §5 — \"An HTTP-addressable URL pointing to the service provider's\n * human-consumable help documentation. OPTIONAL.\"\n */\nexport interface ScimDocumentationUris {\n  /** RFC 7643 §5 `documentationUri` on the ServiceProviderConfig itself. */\n  readonly serviceProviderUri?: string;\n  /** RFC 7643 §5 `documentationUri` on the OAuth bearer-token authentication scheme. */\n  readonly authenticationSchemeUri?: string;\n}\n\n/**\n * Build the SCIM ServiceProviderConfig this application serves at\n * `GET /scim/v2/ServiceProviderConfig` (RFC 7643 §5).\n *\n * Everything except the two documentation URLs is a statement about THIS implementation and is\n * therefore fixed: patch and bulk are supported, filtering is capped, `changePassword`, `sort` and\n * `etag` are not. Those are facts about the code, not choices an application makes.\n *\n * ## Why the two URLs are parameters, and why absence OMITS rather than empties\n *\n * They were frozen here, pointing at `docs.wildo.ai/scim` and `/scim/auth` — a host with no DNS\n * record, so every application built on Wildo told its enterprise customers to go somewhere that\n * does not resolve. Both are OPTIONAL in the RFC, so a discovery document without them is\n * conformant; one carrying a URL that answers nothing is a false advertisement served to the exact\n * reader who is trying to integrate.\n *\n * spec-cite: RFC 7643 §5 — both the top-level `documentationUri` and the `authenticationSchemes`\n * sub-attribute of the same name are marked \"OPTIONAL.\" \n *\n * An absent value therefore removes the KEY. Emitting `documentationUri: ''` or `null` would\n * replace an unanswerable URL with a malformed one, and a directory-service client that reads the\n * field before checking it would be worse off than if the framework had said nothing.\n */\nexport function buildScimServiceProviderConfig(documentation?: ScimDocumentationUris) {\n  return {\n    schemas: [SCIM_SCHEMAS.SERVICE_PROVIDER_CONFIG],\n    ...(documentation?.serviceProviderUri ? { documentationUri: documentation.serviceProviderUri } : {}),\n    patch: { supported: true },\n    bulk: { supported: true, maxOperations: 100, maxPayloadSize: 1048576 },\n    filter: { supported: true, maxResults: 200 },\n    changePassword: { supported: false },\n    sort: { supported: false },\n    etag: { supported: false },\n    authenticationSchemes: [{\n      type: 'oauthbearertoken',\n      name: 'OAuth Bearer Token',\n      description: 'Authentication scheme using the OAuth Bearer Token Standard',\n      specUri: 'https://www.rfc-editor.org/info/rfc6750',\n      ...(documentation?.authenticationSchemeUri ? { documentationUri: documentation.authenticationSchemeUri } : {}),\n      primary: true,\n    }],\n    meta: {\n      resourceType: 'ServiceProviderConfig',\n      location: '/scim/v2/ServiceProviderConfig',\n    },\n  };\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Schema Definition (RFC 7643 §7)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_USER_SCHEMA_DEFINITION = {\n  schemas: [SCIM_SCHEMAS.SCHEMA],\n  id: SCIM_SCHEMAS.USER,\n  name: 'User',\n  description: 'User Account',\n  attributes: [\n    { name: 'userName', type: 'string', multiValued: false, required: true, caseExact: false, mutability: 'readWrite', returned: 'default', uniqueness: 'server' },\n    { name: 'name', type: 'complex', multiValued: false, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'givenName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'familyName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'formatted', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    ]},\n    { name: 'displayName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'active', type: 'boolean', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'emails', type: 'complex', multiValued: true, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'value', type: 'string', multiValued: false, required: true },\n      { name: 'type', type: 'string', multiValued: false, required: false },\n      { name: 'primary', type: 'boolean', multiValued: false, required: false },\n    ]},\n    { name: 'externalId', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n  ],\n  meta: {\n    resourceType: 'Schema',\n    location: `/scim/v2/Schemas/${SCIM_SCHEMAS.USER}`,\n  },\n} as const;\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Resource Types Definition (RFC 7644 §4)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_RESOURCE_TYPES = [{\n  schemas: [SCIM_SCHEMAS.RESOURCE_TYPE],\n  id: 'User',\n  name: 'User',\n  endpoint: '/Users',\n  description: 'User Account',\n  schema: SCIM_SCHEMAS.USER,\n  schemaExtensions: [{\n    schema: SCIM_SCHEMAS.ENTERPRISE_USER,\n    required: false,\n  }],\n  meta: {\n    resourceType: 'ResourceType',\n    location: '/scim/v2/ResourceTypes/User',\n  },\n}] as const;\n"]}
+{"version":3,"file":"scim-protocol.backend.schemas.js","sourceRoot":"","sources":["../../../../../src/security/scim/models/scim-protocol.backend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU,EAAS,OAAO;IAC1B,gBAAgB,EAAG,WAAW;IAC9B,iBAAiB,EAAE,UAAU;IAC7B,aAAa,EAAM,aAAa;IAChC,QAAQ,EAAW,SAAS,EAAS,kDAAkD;IACvF,YAAY,EAAO,gBAAgB;CAC3B,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA2B,MAAM,CAAC,WAAW,CACrF,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAClF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AAEH,kEAAkE;AAClE,0BAA0B;AAC1B,kEAAkE;AAElE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,4CAA4C;IAClD,eAAe,EAAE,4DAA4D;IAC7E,aAAa,EAAE,oDAAoD;IACnE,KAAK,EAAE,6CAA6C;IACpD,QAAQ,EAAE,+CAA+C;IACzD,YAAY,EAAE,mDAAmD;IACjE,aAAa,EAAE,oDAAoD;IACnE,uBAAuB,EAAE,6DAA6D;IACtF,aAAa,EAAE,oDAAoD;IACnE,MAAM,EAAE,8CAA8C;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhE,MAAM,QAAQ,GAAG,IAA+B,CAAC;IACjD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;IACnE,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,IAAI,IAAI,OAAO,mBAAmB,KAAK,QAAQ;QACrE,CAAC,CAAE,mBAA+C,CAAC,YAAY,CAAC;QAChE,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,oBAAoB,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAExD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AA+HD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B,CAAC,aAAqC;IAClF,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,CAAC,uBAAuB,CAAC;QAC/C,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;QAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE;QACtE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE;QAC5C,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QACpC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QAC1B,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QAC1B,qBAAqB,EAAE,CAAC;gBACtB,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,oBAAoB;gBAC1B,WAAW,EAAE,6DAA6D;gBAC1E,OAAO,EAAE,yCAAyC;gBAClD,GAAG,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9G,OAAO,EAAE,IAAI;aACd,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,uBAAuB;YACrC,QAAQ,EAAE,gCAAgC;SAC3C;KACF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,4CAA4C;AAC5C,kEAAkE;AAElE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,YAAY,CAAC,IAAI;IACrB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;QAC9J,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBACjI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACxH,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzH,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;aACzH,EAAC;QACF,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC1H,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QACtH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE;gBAClI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACrE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACrE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC1E,EAAC;QACF,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;KAC1H;IACD,IAAI,EAAE;QACJ,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,oBAAoB,YAAY,CAAC,IAAI,EAAE;KAClD;CACO,CAAC;AAEX,kEAAkE;AAClE,+CAA+C;AAC/C,kEAAkE;AAElE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;QAClC,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC;QACrC,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,cAAc;QAC3B,MAAM,EAAE,YAAY,CAAC,IAAI;QACzB,gBAAgB,EAAE,CAAC;gBACjB,MAAM,EAAE,YAAY,CAAC,eAAe;gBACpC,QAAQ,EAAE,KAAK;aAChB,CAAC;QACF,IAAI,EAAE;YACJ,YAAY,EAAE,cAAc;YAC5B,QAAQ,EAAE,6BAA6B;SACxC;KACF,CAAU,CAAC","sourcesContent":["/**\n * SCIM Protocol Schemas — Step 20\n * \n * SCIM 2.0 types, attribute mapping, and protocol constants for directory provisioning.\n * \n * Decision 13: Lean SCIM — Users only in v1, no Groups, no generic adapter.\n * SCIM_USER_ATTRIBUTE_MAP maps SCIM attributes → NormalizedUserProfile fields\n * (the same type used by SSO JIT provisioning in Step 4/15).\n *\n * Token schema has moved to @wildo-ai/saas-models (scimTokensPolymorphicDeclaration).\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Attribute Mapping\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Maps SCIM User resource attribute paths to NormalizedUserProfile fields.\n * Hardcoded for v1 — only the SCIM User resource is supported.\n * \n * FUTURE: If SCIM Groups or custom resources are needed, extract this into a\n * generic SCIMResourceMappingRegistry. See Decision 13 for the architecture.\n */\nexport const SCIM_USER_ATTRIBUTE_MAP = {\n  'userName':        'email',\n  'name.givenName':  'firstName',\n  'name.familyName': 'lastName',\n  'displayName':     'displayName',\n  'active':          '_active',        // computed: maps to user status (active/inactive)\n  'externalId':      'providerUserId',\n} as const;\n\n/**\n * Reverse map: NormalizedUserProfile field → SCIM attribute path.\n * Used by the response formatter to build SCIM User resources from internal data.\n */\nexport const PROFILE_TO_SCIM_ATTRIBUTE_MAP: Record<string, string> = Object.fromEntries(\n  Object.entries(SCIM_USER_ATTRIBUTE_MAP).map(([scim, profile]) => [profile, scim])\n);\n\n/**\n * FUTURE: SCIM Groups → Organization Roles\n * SCIM Groups map to role assignments, not departments.\n * Example: Okta group \"Wildo Admins\" → ADMIN role.\n * Implementation: add /scim/v2/Groups endpoints with:\n *   - POST/PUT/PATCH /Groups → create/update org roles\n *   - Group membership changes → OrganizationMember role updates\n *   - Group displayName → role identifier mapping (configurable per org)\n *\n * SCIM User department → OrganizationUnit: IMPLEMENTED (2026-08-01, WS-C). `department` from the\n * Enterprise User extension is bound to an organization unit through the EXPLICIT per-organization\n * `organizationUnitMapping` on the SCIM provisioning config — see\n * {@link extractScimDirectoryUnitValue} and `scim-organization-unit-mapping.shared.ts`. `division`\n * and `manager` remain unmapped: `division` would only be needed to disambiguate a search-based\n * match, and the declared mapping is unambiguous by construction, while `manager` is a reporting\n * relationship rather than a unit membership.\n */\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Protocol Constants\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_SCHEMAS = {\n  USER: 'urn:ietf:params:scim:schemas:core:2.0:User',\n  ENTERPRISE_USER: 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User',\n  LIST_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:ListResponse',\n  ERROR: 'urn:ietf:params:scim:api:messages:2.0:Error',\n  PATCH_OP: 'urn:ietf:params:scim:api:messages:2.0:PatchOp',\n  BULK_REQUEST: 'urn:ietf:params:scim:api:messages:2.0:BulkRequest',\n  BULK_RESPONSE: 'urn:ietf:params:scim:api:messages:2.0:BulkResponse',\n  SERVICE_PROVIDER_CONFIG: 'urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig',\n  RESOURCE_TYPE: 'urn:ietf:params:scim:schemas:core:2.0:ResourceType',\n  SCHEMA: 'urn:ietf:params:scim:schemas:core:2.0:Schema',\n} as const;\n\nexport const SCIM_CONTENT_TYPE = 'application/scim+json';\n\n/**\n * Read the directory's `department` from an inbound SCIM User body.\n *\n * ## Why this is NOT an entry in `attributeMapping`\n *\n * Two independent reasons, and both matter:\n *\n * 1. **The path grammar cannot express it.** `resolveScimAttributePath` splits on `.`, and the\n *    extension key is literally `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User` — the\n *    `2.0` contains a dot, so any dotted path would traverse into a key that does not exist.\n * 2. **There is nothing tenant-specific to configure.** `attributeMapping` exists because directories\n *    disagree about where a value lives (`emails[0].value` vs `emails[type eq \"work\"].value`). The\n *    enterprise extension URN is fixed BY THE SCIM SPEC, so a configurable path here would offer a\n *    choice that has exactly one correct answer.\n *\n * The tenant-specific part — what a department VALUE means — is configured, in\n * `organizationUnitMapping`. This function only finds the value.\n *\n * Falls back to a top-level `department` because directories in the wild place it there when they do\n * not send the extension envelope. Returns `undefined` for anything non-string or blank, so an absent\n * department is unambiguous to the caller.\n */\nexport function extractScimDirectoryUnitValue(body: unknown): string | undefined {\n  if (body === null || typeof body !== 'object') return undefined;\n\n  const scimBody = body as Record<string, unknown>;\n  const enterpriseExtension = scimBody[SCIM_SCHEMAS.ENTERPRISE_USER];\n  const enterpriseDepartment =\n    enterpriseExtension !== null && typeof enterpriseExtension === 'object'\n      ? (enterpriseExtension as Record<string, unknown>)['department']\n      : undefined;\n\n  const rawDepartment = enterpriseDepartment ?? scimBody['department'];\n  if (typeof rawDepartment !== 'string') return undefined;\n\n  const department = rawDepartment.trim();\n  return department.length > 0 ? department : undefined;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Error Types (RFC 7644 §3.12)\n// ═══════════════════════════════════════════════════════════════\n\nexport type SCIMErrorType =\n  | 'invalidFilter'\n  | 'tooMany'\n  | 'uniqueness'\n  | 'mutability'\n  | 'invalidSyntax'\n  | 'invalidPath'\n  | 'noTarget'\n  | 'invalidValue'\n  | 'invalidVers'\n  | 'sensitive';\n\nexport interface SCIMErrorResponse {\n  schemas: [typeof SCIM_SCHEMAS.ERROR];\n  status: string;\n  detail: string;\n  scimType?: SCIMErrorType;\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM PATCH Operation Types (RFC 7644 §3.5.2)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMPatchOperation {\n  op: 'add' | 'remove' | 'replace';\n  path?: string;\n  value?: unknown;\n}\n\nexport interface SCIMPatchRequest {\n  schemas: string[];\n  Operations: SCIMPatchOperation[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Bulk Operation Types (RFC 7644 §3.7)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMBulkOperation {\n  method: 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n  path: string;\n  bulkId?: string;\n  data?: Record<string, unknown>;\n}\n\nexport interface SCIMBulkRequest {\n  schemas: [typeof SCIM_SCHEMAS.BULK_REQUEST];\n  Operations: SCIMBulkOperation[];\n  failOnErrors?: number;\n}\n\nexport interface SCIMBulkOperationResponse {\n  method: string;\n  bulkId?: string;\n  location?: string;\n  status: string;\n  response?: SCIMErrorResponse;\n}\n\nexport interface SCIMBulkResponse {\n  schemas: [typeof SCIM_SCHEMAS.BULK_RESPONSE];\n  Operations: SCIMBulkOperationResponse[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Resource Type (RFC 7643 §4.1)\n// ═══════════════════════════════════════════════════════════════\n\nexport interface SCIMUserResource {\n  schemas: string[];\n  id: string;\n  externalId?: string;\n  userName: string;\n  name?: {\n    formatted?: string;\n    familyName?: string;\n    givenName?: string;\n  };\n  displayName?: string;\n  active: boolean;\n  emails?: Array<{\n    value: string;\n    type?: string;\n    primary?: boolean;\n  }>;\n  meta: {\n    resourceType: 'User';\n    created: string;\n    lastModified: string;\n    location: string;\n  };\n}\n\nexport interface SCIMListResponse<T = SCIMUserResource> {\n  schemas: [typeof SCIM_SCHEMAS.LIST_RESPONSE];\n  totalResults: number;\n  startIndex: number;\n  itemsPerPage: number;\n  Resources: T[];\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM ServiceProviderConfig (RFC 7643 §5)\n// ═══════════════════════════════════════════════════════════════\n\n/**\n * Where an application's SCIM discovery document sends a directory administrator for\n * documentation. Authored per application (`auth.scimDocumentation`), because the RFC defines\n * `documentationUri` as the SERVICE PROVIDER's documentation — and the service provider is the\n * application, not the framework it was built with.\n *\n * spec-cite: RFC 7643 §5 — \"An HTTP-addressable URL pointing to the service provider's\n * human-consumable help documentation. OPTIONAL.\"\n */\nexport interface ScimDocumentationUris {\n  /** RFC 7643 §5 `documentationUri` on the ServiceProviderConfig itself. */\n  readonly serviceProviderUri?: string;\n  /** RFC 7643 §5 `documentationUri` on the OAuth bearer-token authentication scheme. */\n  readonly authenticationSchemeUri?: string;\n}\n\n/**\n * Build the SCIM ServiceProviderConfig this application serves at\n * `GET /scim/v2/ServiceProviderConfig` (RFC 7643 §5).\n *\n * Everything except the two documentation URLs is a statement about THIS implementation and is\n * therefore fixed: patch and bulk are supported, filtering is capped, `changePassword`, `sort` and\n * `etag` are not. Those are facts about the code, not choices an application makes.\n *\n * ## Why the two URLs are parameters, and why absence OMITS rather than empties\n *\n * They were frozen here, pointing at `docs.wildo.ai/scim` and `/scim/auth` — a host with no DNS\n * record, so every application built on Wildo told its enterprise customers to go somewhere that\n * does not resolve. Both are OPTIONAL in the RFC, so a discovery document without them is\n * conformant; one carrying a URL that answers nothing is a false advertisement served to the exact\n * reader who is trying to integrate.\n *\n * spec-cite: RFC 7643 §5 — both the top-level `documentationUri` and the `authenticationSchemes`\n * sub-attribute of the same name are marked \"OPTIONAL.\" \n *\n * An absent value therefore removes the KEY. Emitting `documentationUri: ''` or `null` would\n * replace an unanswerable URL with a malformed one, and a directory-service client that reads the\n * field before checking it would be worse off than if the framework had said nothing.\n */\nexport function buildScimServiceProviderConfig(documentation?: ScimDocumentationUris) {\n  return {\n    schemas: [SCIM_SCHEMAS.SERVICE_PROVIDER_CONFIG],\n    ...(documentation?.serviceProviderUri ? { documentationUri: documentation.serviceProviderUri } : {}),\n    patch: { supported: true },\n    bulk: { supported: true, maxOperations: 100, maxPayloadSize: 1048576 },\n    filter: { supported: true, maxResults: 200 },\n    changePassword: { supported: false },\n    sort: { supported: false },\n    etag: { supported: false },\n    authenticationSchemes: [{\n      type: 'oauthbearertoken',\n      name: 'OAuth Bearer Token',\n      description: 'Authentication scheme using the OAuth Bearer Token Standard',\n      specUri: 'https://www.rfc-editor.org/info/rfc6750',\n      ...(documentation?.authenticationSchemeUri ? { documentationUri: documentation.authenticationSchemeUri } : {}),\n      primary: true,\n    }],\n    meta: {\n      resourceType: 'ServiceProviderConfig',\n      location: '/scim/v2/ServiceProviderConfig',\n    },\n  };\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM User Schema Definition (RFC 7643 §7)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_USER_SCHEMA_DEFINITION = {\n  schemas: [SCIM_SCHEMAS.SCHEMA],\n  id: SCIM_SCHEMAS.USER,\n  name: 'User',\n  description: 'User Account',\n  attributes: [\n    { name: 'userName', type: 'string', multiValued: false, required: true, caseExact: false, mutability: 'readWrite', returned: 'default', uniqueness: 'server' },\n    { name: 'name', type: 'complex', multiValued: false, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'givenName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'familyName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n      { name: 'formatted', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    ]},\n    { name: 'displayName', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'active', type: 'boolean', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n    { name: 'emails', type: 'complex', multiValued: true, required: false, mutability: 'readWrite', returned: 'default', subAttributes: [\n      { name: 'value', type: 'string', multiValued: false, required: true },\n      { name: 'type', type: 'string', multiValued: false, required: false },\n      { name: 'primary', type: 'boolean', multiValued: false, required: false },\n    ]},\n    { name: 'externalId', type: 'string', multiValued: false, required: false, mutability: 'readWrite', returned: 'default' },\n  ],\n  meta: {\n    resourceType: 'Schema',\n    location: `/scim/v2/Schemas/${SCIM_SCHEMAS.USER}`,\n  },\n} as const;\n\n// ═══════════════════════════════════════════════════════════════\n// SCIM Resource Types Definition (RFC 7644 §4)\n// ═══════════════════════════════════════════════════════════════\n\nexport const SCIM_RESOURCE_TYPES = [{\n  schemas: [SCIM_SCHEMAS.RESOURCE_TYPE],\n  id: 'User',\n  name: 'User',\n  endpoint: '/Users',\n  description: 'User Account',\n  schema: SCIM_SCHEMAS.USER,\n  schemaExtensions: [{\n    schema: SCIM_SCHEMAS.ENTERPRISE_USER,\n    required: false,\n  }],\n  meta: {\n    resourceType: 'ResourceType',\n    location: '/scim/v2/ResourceTypes/User',\n  },\n}] as const;\n"]}

package/dist/esm/security/scim/utils/scim-attribute-path-resolver.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-attribute-path-resolver.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/utils/scim-attribute-path-resolver.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAuDH;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc5F"}
+{"version":3,"file":"scim-attribute-path-resolver.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/scim/utils/scim-attribute-path-resolver.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAuDH;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc5F"}

package/dist/esm/security/scim/utils/scim-filter-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-filter-parser.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/utils/scim-filter-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IACjC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAgE,GAClG,gBAAgB,CAQlB"}
+{"version":3,"file":"scim-filter-parser.d.ts","sourceRoot":"","sources":["../../../../../src/security/scim/utils/scim-filter-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IACjC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAgE,GAClG,gBAAgB,CAQlB"}

package/dist/esm/security/scim/utils/scim-response-formatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-response-formatter.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/utils/scim-response-formatter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,IAAI,EAAc,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,uEAAuE,CAAC;AAE/E,UAAU,WAAW;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,WAAW,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GAClB,gBAAgB,CA6BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,gBAAgB,CAUlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,aAAa,GACvB,iBAAiB,CAOnB"}
+{"version":3,"file":"scim-response-formatter.d.ts","sourceRoot":"","sources":["../../../../../src/security/scim/utils/scim-response-formatter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,IAAI,EAAc,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,uEAAuE,CAAC;AAE/E,UAAU,WAAW;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,WAAW,GAAG,IAAI,EAC3B,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GAClB,gBAAgB,CA6BlB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,gBAAgB,CAUlB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,aAAa,GACvB,iBAAiB,CAOnB"}

package/dist/esm/security/session-invalidation-fence.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-invalidation-fence.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/session-invalidation-fence.backend.utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAExF;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAEvE,2DAA2D;AAC3D,MAAM,WAAW,+BAA+B;IAC9C,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAsB,gCAAgC,CACpD,YAAY,EAAE,8BAA8B,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,+BAA+B,CAAC,CAY1C"}
+{"version":3,"file":"session-invalidation-fence.backend.utils.d.ts","sourceRoot":"","sources":["../../../src/security/session-invalidation-fence.backend.utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAExF;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAEvE,2DAA2D;AAC3D,MAAM,WAAW,+BAA+B;IAC9C,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAsB,gCAAgC,CACpD,YAAY,EAAE,8BAA8B,EAC5C,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,+BAA+B,CAAC,CAY1C"}

package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-target-guard.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,8FAA8F;AAC9F,oBAAY,uBAAuB;IACjC,8EAA8E;IAC9E,4BAA4B,iCAAiC;IAC7D,gGAAgG;IAChG,kBAAkB,uBAAuB;IACzC,kGAAkG;IAClG,2BAA2B,gCAAgC;IAC3D,mGAAmG;IACnG,6BAA6B,kCAAkC;CAChE;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlE;AAsCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAsB,GAAG,OAAO,CA6BxG;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,SAAS,CAsB3H;AAED,uGAAuG;AACvG,oBAAY,wBAAwB;IAClC,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GACpD,OAAO,CAAC,wBAAwB,CAAC,CAoBnC"}
+{"version":3,"file":"outbound-target-guard.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAIH,8FAA8F;AAC9F,oBAAY,uBAAuB;IACjC,8EAA8E;IAC9E,4BAA4B,iCAAiC;IAC7D,gGAAgG;IAChG,kBAAkB,uBAAuB;IACzC,kGAAkG;IAClG,2BAA2B,gCAAgC;IAC3D,mGAAmG;IACnG,6BAA6B,kCAAkC;CAChE;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlE;AAsCD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAsB,GAAG,OAAO,CA6BxG;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,SAAS,CAsB3H;AAED,uGAAuG;AACvG,oBAAY,wBAAwB;IAClC,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GACpD,OAAO,CAAC,wBAAwB,CAAC,CAoBnC"}

package/dist/esm/security/ssrf/outbound-target-guard.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"outbound-target-guard.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,8FAA8F;AAC9F,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,8EAA8E;IAC9E,wFAA6D,CAAA;IAC7D,gGAAgG;IAChG,oEAAyC,CAAA;IACzC,kGAAkG;IAClG,sFAA2D,CAAA;IAC3D,mGAAmG;IACnG,0FAA+D,CAAA;AACjE,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,4DAA4D;IAChH,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,OAAO,CACL,CAAC,KAAK,CAAC,CAAmC,4BAA4B;WACnE,CAAC,KAAK,EAAE,CAA+B,WAAW;WAClD,CAAC,KAAK,GAAG,CAA8B,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAK,6BAA6B;WACpE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,wDAAwD;WAC/F,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAM,WAAW;QACrD;;;;;;;;WAQG;WACA,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAE,wBAAwB;WAC/D,CAAC,IAAI,GAAG,CAA+B,6CAA6C;KACxF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,YAAoB,IAAI,CAAC,OAAO,CAAC;IAC7F,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAS,wBAAwB;IAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAoB,wBAAwB;IAC/E,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAiB,yCAAyC;IAChG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAuB,qBAAqB;IAE5E;;;;;;;OAOG;IACH,MAAM,YAAY,GAAG,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/D,IAAI,YAAY;QAAE,OAAO,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,MAA4B;IACpF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,uBAAuB,CAAC,kBAAkB,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,CAAC;IAED,OAAO,4BAA4B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC;AACzH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAN,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,yDAA6B,CAAA;AAC/B,CAAC,EAJW,wBAAwB,KAAxB,wBAAwB,QAInC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAgB,EAChB,OAAqD;IAErD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;IACrH,CAAC;IAED,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,mGAAmG;IACnG,6DAA6D;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC;IAErE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC,CAAC,wBAAwB,CAAC,QAAQ;QACnC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;AACtC,CAAC","sourcesContent":["/**\n * The ONE classification of \"is this address one the public internet cannot reach?\".\n *\n * ## Why this module exists\n *\n * Wildo makes server-side HTTP requests to destinations that come from application- or\n * tenant-authored configuration: M2M webhook endpoints, A2A push-notification targets, SIEM\n * collectors, SSO metadata documents, OAuth client-metadata documents. Every one of those is a\n * server-side request forgery primitive by construction, and the classic targets are the same in all\n * of them — `169.254.169.254` (cloud instance metadata), loopback admin ports, RFC 1918 space.\n *\n * Before this module the answer was written TWICE, privately, and the two copies disagreed:\n *\n * | Copy | Missing from it |\n * |---|---|\n * | `a2a-push-notification.backend.schemas.ts` (`isPrivateOrReservedAddress`) | IPv6 multicast `ff00::/8` |\n * | `cimd-client-metadata.backend.service.ts` (`isInternalAddress`) | `192.0.0.0/24` (IETF protocol assignments), `198.18.0.0/15` (benchmarking), the IPv4-mapped IPv6 HEX notation (`::ffff:a9fe:a9fe`), and the full `fe80::/10` link-local block (it matched only the literal `fe80:` prefix) |\n *\n * Both were written carefully, by authors who had read OWASP, eight months apart. Neither could see\n * the other because each was a module-private function — the exact shape\n * `.claude/rules/invariant-call-site-enumeration.md` #13 records, where the enumeration returns 1/1\n * and is *correct*, because the other site does not mention the symbol you searched for. The set\n * below is the UNION, so both call sites strictly improve.\n *\n * ## Block-list, not allow-list — and OWASP says why\n *\n * spec-cite: OWASP Server Side Request Forgery Prevention Cheat Sheet — *\"Case 2: application can\n * send request to ANY external IP address or domain name\"*, whose remedy is block-listing the\n * non-public ranges. An allow-list is unavailable here by construction: a tenant's webhook receiver,\n * an unknown OAuth client's metadata host and a customer's SIEM collector are all strangers.\n *\n * The ranges are an ALLOW-NOTHING list rather than a deny-list of known-bad addresses. A new reserved\n * block is far rarer than a new interesting internal service, so an unrecognised shape must not be\n * admitted merely because nobody enumerated it.\n *\n * ## What this CANNOT do, stated rather than hidden\n *\n * {@link isPrivateOrReservedIpAddress} classifies an ADDRESS. {@link classifyOutboundTargetUrl}\n * classifies a URL's SHAPE and, for a literal-IP host, its address. Neither resolves DNS, so\n * `evil.test` with an A record of `10.0.0.5` passes both. Resolving at validation time would not\n * close it either — DNS can answer differently at connect time (rebinding) — so the complete defence\n * is enforcement in the egress path. Callers that want the intermediate strength\n * ({@link resolvesOnlyToPublicAddresses}) get an explicit check-then-connect with that residual named.\n *\n * **That egress-path enforcement now EXISTS**, in the sibling module\n * `pinned-outbound-fetch.backend.utils.ts`: it classifies inside the connection's `lookup` hook, so\n * the address validated and the address connected to are one value in one event. Every function here\n * remains a pure classifier and keeps its stated residual — what changed is that a caller no longer\n * has to live with it. A caller that makes the request itself, with its own `fetch`, still does.\n */\n\nimport { isIP } from 'node:net';\n\n/** Why an outbound target was refused. A closed vocabulary so caller messages stay stable. */\nexport enum OutboundTargetRejection {\n  /** Not parseable as an absolute URL, or not on a scheme the caller admits. */\n  NOT_ABSOLUTE_ADMITTED_SCHEME = 'not_absolute_admitted_scheme',\n  /** `https://user:pass@host` — the credentials would be replayed on every request and logged. */\n  CREDENTIALS_IN_URL = 'credentials_in_url',\n  /** A literal IP inside a private, loopback, link-local, multicast or otherwise reserved range. */\n  PRIVATE_OR_RESERVED_ADDRESS = 'private_or_reserved_address',\n  /** A hostname that resolves into the deployment's own network by DEFINITION rather than by DNS. */\n  RESERVED_SPECIAL_USE_HOSTNAME = 'reserved_special_use_hostname',\n}\n\n/**\n * Hostnames that reach the local machine by DEFINITION rather than by DNS answer.\n *\n * Deliberately grounded in special-use name registries instead of a list of cloud metadata\n * hostnames: a vendor list needs maintaining, names vendors in engine code, and is always one\n * provider behind.\n *\n * spec-cite: RFC 6761 §6.3 (`localhost` and any name ending in `.localhost` are special-use and\n * resolve to a loopback address) · RFC 6762 §3 (`.local` is reserved for link-local multicast DNS).\n */\nexport function isReservedSpecialUseHostname(host: string): boolean {\n  const name = host.toLowerCase().replace(/\\.$/, ''); // a trailing dot is a fully-qualified form of the same name\n  return name === 'localhost' || name.endsWith('.localhost') || name === 'local' || name.endsWith('.local');\n}\n\n/**\n * Is this literal IPv4 address one no externally-reachable service can live at?\n *\n * A MALFORMED address returns `true` — fail closed. A caller that cannot even parse the host it is\n * about to connect to has no basis for admitting it, and the alternative (admit what we could not\n * classify) is how notation tricks get through.\n */\nfunction isPrivateOrReservedIpv4(address: string): boolean {\n  const parts = address.split('.').map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {\n    return true;\n  }\n  const [a, b, c] = parts;\n  return (\n    a === 0                                   // \"this network\" — RFC 1122\n    || a === 10                               // RFC 1918\n    || a === 127                              // loopback\n    || (a === 100 && b >= 64 && b <= 127)     // RFC 6598 carrier-grade NAT\n    || (a === 169 && b === 254)               // link-local — INCLUDES 169.254.169.254, cloud metadata\n    || (a === 172 && b >= 16 && b <= 31)      // RFC 1918\n    /**\n     * RFC 6890 IETF protocol assignments — `192.0.0.0/**24**`, not `/16`.\n     *\n     * The A2A copy this list was merged from tested `a === 192 && b === 0`, which is a /16 and\n     * therefore over-blocked ~65,000 ORDINARY PUBLIC addresses (`192.0.1.x`, `192.0.3.x`, …) that are\n     * regular allocated space. Narrowed here to what the registry actually reserves, because an\n     * over-wide range is not \"extra safe\" — it silently refuses legitimate customer endpoints, and it\n     * is exactly the failure the adjacent-public controls in the test suite exist to catch.\n     */\n    || (a === 192 && b === 0 && c === 0)\n    || (a === 192 && b === 168)               // RFC 1918\n    || (a === 198 && (b === 18 || b === 19))  // RFC 2544 benchmarking\n    || a >= 224                               // multicast 224/4, reserved 240/4, broadcast\n  );\n}\n\n/**\n * Is this literal IP address (v4 or v6) one no externally-reachable service can live at?\n *\n * `ipVersion` may be supplied when the caller already computed it; otherwise it is derived. A value\n * that is not an IP at all returns `false` — this function answers a question about ADDRESSES, and a\n * hostname is the caller's job (see {@link isReservedSpecialUseHostname} and\n * {@link resolvesOnlyToPublicAddresses}).\n */\nexport function isPrivateOrReservedIpAddress(address: string, ipVersion: number = isIP(address)): boolean {\n  if (ipVersion === 4) return isPrivateOrReservedIpv4(address);\n  if (ipVersion !== 6) return false;\n\n  const v6 = address.toLowerCase();\n  if (v6 === '::' || v6 === '::1') return true;         // unspecified, loopback\n  if (/^f[cd]/.test(v6)) return true;                    // unique-local fc00::/7\n  if (/^fe[89ab]/.test(v6)) return true;                 // link-local fe80::/10 — the WHOLE block\n  if (/^ff/.test(v6)) return true;                       // multicast ff00::/8\n\n  /**\n   * IPv4-mapped — the same address wearing a different notation, and the notation that got past the\n   * first version of the A2A guard. `new URL()` NORMALISES `::ffff:169.254.169.254` to\n   * `::ffff:a9fe:a9fe`, so matching only the dotted form let the cloud metadata address through while\n   * every dotted-form pin stayed green. Both spellings are handled: the hex form is what arrives from\n   * a parsed URL, the dotted form is what arrives from a config read back out of storage or from a\n   * DNS answer.\n   */\n  const mappedDotted = v6.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (mappedDotted) return isPrivateOrReservedIpv4(mappedDotted[1]);\n\n  const mappedHex = v6.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n  if (mappedHex) {\n    const high = parseInt(mappedHex[1], 16);\n    const low = parseInt(mappedHex[2], 16);\n    return isPrivateOrReservedIpv4(`${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`);\n  }\n\n  return false;\n}\n\n/** Strip the brackets a parsed URL puts around an IPv6 literal, so `isIP` can read it. */\nexport function unwrapUrlHost(hostname: string): string {\n  return hostname.replace(/^\\[|\\]$/g, '');\n}\n\n/** What a caller admits, so one classifier can serve callers with different scheme policies. */\nexport interface OutboundTargetPolicy {\n  /**\n   * Schemes the caller will issue a request on. Pass `['https:']` where the value in transit is a\n   * credential; pass `['https:', 'http:']` where refusing plaintext would break existing authored\n   * configuration and that decision has not been taken.\n   */\n  admittedProtocols: readonly string[];\n}\n\n/**\n * Classify a target URL a caller is about to request, refusing the shapes that turn this server into\n * a request-forgery tool.\n *\n * Returns `undefined` for an admitted target. An ordinary hostname is admitted — see the module\n * header for why that is a stated residual rather than an oversight.\n */\nexport function classifyOutboundTargetUrl(rawUrl: string, policy: OutboundTargetPolicy): OutboundTargetRejection | undefined {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n\n  if (!policy.admittedProtocols.includes(url.protocol)) {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n  if (url.username || url.password) {\n    return OutboundTargetRejection.CREDENTIALS_IN_URL;\n  }\n\n  const host = unwrapUrlHost(url.hostname);\n  const ipVersion = isIP(host);\n  if (ipVersion === 0) {\n    return isReservedSpecialUseHostname(host) ? OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME : undefined;\n  }\n\n  return isPrivateOrReservedIpAddress(host, ipVersion) ? OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS : undefined;\n}\n\n/** Outcome of the DNS-resolving half, kept separate because \"did not resolve\" is not \"is internal\". */\nexport enum OutboundTargetResolution {\n  PUBLIC = 'public',\n  INTERNAL = 'internal',\n  UNRESOLVABLE = 'unresolvable',\n}\n\n/**\n * Resolve a hostname and check EVERY answer, not just the first.\n *\n * DNS is resolved rather than the hostname trusted, because `internal.example.com` may be a public\n * name with a private A record — the attack a shape check cannot see. Every resolved address is\n * checked because a hostile resolver can return one public and one private address and rely on the\n * client picking the other.\n *\n * ⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that changes\n * between the two (rebinding) is not covered by THIS function. Closing it needs the request pinned to\n * the validated address — which Node's `fetch` does not expose, but `node:https`'s `lookup` hook\n * does. `pinnedOutboundFetch` is built on that hook; a caller that issues its request through it has\n * the residual closed, and a caller that does not, does not.\n *\n * `resolve` is injectable so callers can test the internal/public branches without a resolver.\n */\nexport async function resolvesOnlyToPublicAddresses(\n  hostname: string,\n  resolve: (host: string) => Promise<readonly string[]>,\n): Promise<OutboundTargetResolution> {\n  const literal = unwrapUrlHost(hostname);\n  if (isIP(literal) !== 0) {\n    return isPrivateOrReservedIpAddress(literal) ? OutboundTargetResolution.INTERNAL : OutboundTargetResolution.PUBLIC;\n  }\n\n  let addresses: readonly string[];\n  try {\n    addresses = await resolve(hostname);\n  } catch {\n    return OutboundTargetResolution.UNRESOLVABLE;\n  }\n\n  // An empty answer is treated as INTERNAL rather than UNRESOLVABLE: the resolver succeeded and told\n  // us nothing usable, which is not evidence the name is safe.\n  if (addresses.length === 0) return OutboundTargetResolution.INTERNAL;\n\n  return addresses.some((address) => isPrivateOrReservedIpAddress(address))\n    ? OutboundTargetResolution.INTERNAL\n    : OutboundTargetResolution.PUBLIC;\n}\n"]}
+{"version":3,"file":"outbound-target-guard.backend.utils.js","sourceRoot":"","sources":["../../../../src/security/ssrf/outbound-target-guard.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,8FAA8F;AAC9F,MAAM,CAAN,IAAY,uBASX;AATD,WAAY,uBAAuB;IACjC,8EAA8E;IAC9E,wFAA6D,CAAA;IAC7D,gGAAgG;IAChG,oEAAyC,CAAA;IACzC,kGAAkG;IAClG,sFAA2D,CAAA;IAC3D,mGAAmG;IACnG,0FAA+D,CAAA;AACjE,CAAC,EATW,uBAAuB,KAAvB,uBAAuB,QASlC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,4DAA4D;IAChH,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,OAAO,CACL,CAAC,KAAK,CAAC,CAAmC,4BAA4B;WACnE,CAAC,KAAK,EAAE,CAA+B,WAAW;WAClD,CAAC,KAAK,GAAG,CAA8B,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAK,6BAA6B;WACpE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,wDAAwD;WAC/F,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAM,WAAW;QACrD;;;;;;;;WAQG;WACA,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAe,WAAW;WAClD,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAE,wBAAwB;WAC/D,CAAC,IAAI,GAAG,CAA+B,6CAA6C;KACxF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,YAAoB,IAAI,CAAC,OAAO,CAAC;IAC7F,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAS,wBAAwB;IAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAoB,wBAAwB;IAC/E,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAiB,yCAAyC;IAChG,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAuB,qBAAqB;IAE5E;;;;;;;OAOG;IACH,MAAM,YAAY,GAAG,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/D,IAAI,YAAY;QAAE,OAAO,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,MAA4B;IACpF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,uBAAuB,CAAC,4BAA4B,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,uBAAuB,CAAC,kBAAkB,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,CAAC;IAED,OAAO,4BAA4B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC;AACzH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAN,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,6CAAiB,CAAA;IACjB,iDAAqB,CAAA;IACrB,yDAA6B,CAAA;AAC/B,CAAC,EAJW,wBAAwB,KAAxB,wBAAwB,QAInC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAgB,EAChB,OAAqD;IAErD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;IACrH,CAAC;IAED,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,mGAAmG;IACnG,6DAA6D;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC,QAAQ,CAAC;IAErE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC,CAAC,wBAAwB,CAAC,QAAQ;QACnC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;AACtC,CAAC","sourcesContent":["/**\n * The ONE classification of \"is this address one the public internet cannot reach?\".\n *\n * ## Why this module exists\n *\n * Wildo makes server-side HTTP requests to destinations that come from application- or\n * tenant-authored configuration: M2M webhook endpoints, A2A push-notification targets, SIEM\n * collectors, SSO metadata documents, OAuth client-metadata documents. Every one of those is a\n * server-side request forgery primitive by construction, and the classic targets are the same in all\n * of them — `169.254.169.254` (cloud instance metadata), loopback admin ports, RFC 1918 space.\n *\n * Before this module the answer was written TWICE, privately, and the two copies disagreed:\n *\n * | Copy | Missing from it |\n * |---|---|\n * | `a2a-push-notification.backend.schemas.ts` (`isPrivateOrReservedAddress`) | IPv6 multicast `ff00::/8` |\n * | `cimd-client-metadata.backend.service.ts` (`isInternalAddress`) | `192.0.0.0/24` (IETF protocol assignments), `198.18.0.0/15` (benchmarking), the IPv4-mapped IPv6 HEX notation (`::ffff:a9fe:a9fe`), and the full `fe80::/10` link-local block (it matched only the literal `fe80:` prefix) |\n *\n * Both were written carefully, by authors who had read OWASP, eight months apart. Neither could see\n * the other because each was a module-private function — the exact shape\n * `.claude/rules/invariant-call-site-enumeration.md` #13 records, where the enumeration returns 1/1\n * and is *correct*, because the other site does not mention the symbol you searched for. The set\n * below is the UNION, so both call sites strictly improve.\n *\n * ## Block-list, not allow-list — and OWASP says why\n *\n * spec-cite: OWASP Server Side Request Forgery Prevention Cheat Sheet — *\"Case 2: application can\n * send request to ANY external IP address or domain name\"*, whose remedy is block-listing the\n * non-public ranges. An allow-list is unavailable here by construction: a tenant's webhook receiver,\n * an unknown OAuth client's metadata host and a customer's SIEM collector are all strangers.\n *\n * The ranges are an ALLOW-NOTHING list rather than a deny-list of known-bad addresses. A new reserved\n * block is far rarer than a new interesting internal service, so an unrecognised shape must not be\n * admitted merely because nobody enumerated it.\n *\n * ## What this CANNOT do, stated rather than hidden\n *\n * {@link isPrivateOrReservedIpAddress} classifies an ADDRESS. {@link classifyOutboundTargetUrl}\n * classifies a URL's SHAPE and, for a literal-IP host, its address. Neither resolves DNS, so\n * `evil.test` with an A record of `10.0.0.5` passes both. Resolving at validation time would not\n * close it either — DNS can answer differently at connect time (rebinding) — so the complete defence\n * is enforcement in the egress path. Callers that want the intermediate strength\n * ({@link resolvesOnlyToPublicAddresses}) get an explicit check-then-connect with that residual named.\n *\n * **That egress-path enforcement now EXISTS**, in the sibling module\n * `pinned-outbound-fetch.backend.utils.ts`: it classifies inside the connection's `lookup` hook, so\n * the address validated and the address connected to are one value in one event. Every function here\n * remains a pure classifier and keeps its stated residual — what changed is that a caller no longer\n * has to live with it. A caller that makes the request itself, with its own `fetch`, still does.\n */\n\nimport { isIP } from 'node:net';\n\n/** Why an outbound target was refused. A closed vocabulary so caller messages stay stable. */\nexport enum OutboundTargetRejection {\n  /** Not parseable as an absolute URL, or not on a scheme the caller admits. */\n  NOT_ABSOLUTE_ADMITTED_SCHEME = 'not_absolute_admitted_scheme',\n  /** `https://user:pass@host` — the credentials would be replayed on every request and logged. */\n  CREDENTIALS_IN_URL = 'credentials_in_url',\n  /** A literal IP inside a private, loopback, link-local, multicast or otherwise reserved range. */\n  PRIVATE_OR_RESERVED_ADDRESS = 'private_or_reserved_address',\n  /** A hostname that resolves into the deployment's own network by DEFINITION rather than by DNS. */\n  RESERVED_SPECIAL_USE_HOSTNAME = 'reserved_special_use_hostname',\n}\n\n/**\n * Hostnames that reach the local machine by DEFINITION rather than by DNS answer.\n *\n * Deliberately grounded in special-use name registries instead of a list of cloud metadata\n * hostnames: a vendor list needs maintaining, names vendors in engine code, and is always one\n * provider behind.\n *\n * spec-cite: RFC 6761 §6.3 (`localhost` and any name ending in `.localhost` are special-use and\n * resolve to a loopback address) · RFC 6762 §3 (`.local` is reserved for link-local multicast DNS).\n */\nexport function isReservedSpecialUseHostname(host: string): boolean {\n  const name = host.toLowerCase().replace(/\\.$/, ''); // a trailing dot is a fully-qualified form of the same name\n  return name === 'localhost' || name.endsWith('.localhost') || name === 'local' || name.endsWith('.local');\n}\n\n/**\n * Is this literal IPv4 address one no externally-reachable service can live at?\n *\n * A MALFORMED address returns `true` — fail closed. A caller that cannot even parse the host it is\n * about to connect to has no basis for admitting it, and the alternative (admit what we could not\n * classify) is how notation tricks get through.\n */\nfunction isPrivateOrReservedIpv4(address: string): boolean {\n  const parts = address.split('.').map((part) => Number(part));\n  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {\n    return true;\n  }\n  const [a, b, c] = parts;\n  return (\n    a === 0                                   // \"this network\" — RFC 1122\n    || a === 10                               // RFC 1918\n    || a === 127                              // loopback\n    || (a === 100 && b >= 64 && b <= 127)     // RFC 6598 carrier-grade NAT\n    || (a === 169 && b === 254)               // link-local — INCLUDES 169.254.169.254, cloud metadata\n    || (a === 172 && b >= 16 && b <= 31)      // RFC 1918\n    /**\n     * RFC 6890 IETF protocol assignments — `192.0.0.0/**24**`, not `/16`.\n     *\n     * The A2A copy this list was merged from tested `a === 192 && b === 0`, which is a /16 and\n     * therefore over-blocked ~65,000 ORDINARY PUBLIC addresses (`192.0.1.x`, `192.0.3.x`, …) that are\n     * regular allocated space. Narrowed here to what the registry actually reserves, because an\n     * over-wide range is not \"extra safe\" — it silently refuses legitimate customer endpoints, and it\n     * is exactly the failure the adjacent-public controls in the test suite exist to catch.\n     */\n    || (a === 192 && b === 0 && c === 0)\n    || (a === 192 && b === 168)               // RFC 1918\n    || (a === 198 && (b === 18 || b === 19))  // RFC 2544 benchmarking\n    || a >= 224                               // multicast 224/4, reserved 240/4, broadcast\n  );\n}\n\n/**\n * Is this literal IP address (v4 or v6) one no externally-reachable service can live at?\n *\n * `ipVersion` may be supplied when the caller already computed it; otherwise it is derived. A value\n * that is not an IP at all returns `false` — this function answers a question about ADDRESSES, and a\n * hostname is the caller's job (see {@link isReservedSpecialUseHostname} and\n * {@link resolvesOnlyToPublicAddresses}).\n */\nexport function isPrivateOrReservedIpAddress(address: string, ipVersion: number = isIP(address)): boolean {\n  if (ipVersion === 4) return isPrivateOrReservedIpv4(address);\n  if (ipVersion !== 6) return false;\n\n  const v6 = address.toLowerCase();\n  if (v6 === '::' || v6 === '::1') return true;         // unspecified, loopback\n  if (/^f[cd]/.test(v6)) return true;                    // unique-local fc00::/7\n  if (/^fe[89ab]/.test(v6)) return true;                 // link-local fe80::/10 — the WHOLE block\n  if (/^ff/.test(v6)) return true;                       // multicast ff00::/8\n\n  /**\n   * IPv4-mapped — the same address wearing a different notation, and the notation that got past the\n   * first version of the A2A guard. `new URL()` NORMALISES `::ffff:169.254.169.254` to\n   * `::ffff:a9fe:a9fe`, so matching only the dotted form let the cloud metadata address through while\n   * every dotted-form pin stayed green. Both spellings are handled: the hex form is what arrives from\n   * a parsed URL, the dotted form is what arrives from a config read back out of storage or from a\n   * DNS answer.\n   */\n  const mappedDotted = v6.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (mappedDotted) return isPrivateOrReservedIpv4(mappedDotted[1]);\n\n  const mappedHex = v6.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);\n  if (mappedHex) {\n    const high = parseInt(mappedHex[1], 16);\n    const low = parseInt(mappedHex[2], 16);\n    return isPrivateOrReservedIpv4(`${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`);\n  }\n\n  return false;\n}\n\n/** Strip the brackets a parsed URL puts around an IPv6 literal, so `isIP` can read it. */\nexport function unwrapUrlHost(hostname: string): string {\n  return hostname.replace(/^\\[|\\]$/g, '');\n}\n\n/** What a caller admits, so one classifier can serve callers with different scheme policies. */\nexport interface OutboundTargetPolicy {\n  /**\n   * Schemes the caller will issue a request on. Pass `['https:']` where the value in transit is a\n   * credential; pass `['https:', 'http:']` where refusing plaintext would break existing authored\n   * configuration and that decision has not been taken.\n   */\n  admittedProtocols: readonly string[];\n}\n\n/**\n * Classify a target URL a caller is about to request, refusing the shapes that turn this server into\n * a request-forgery tool.\n *\n * Returns `undefined` for an admitted target. An ordinary hostname is admitted — see the module\n * header for why that is a stated residual rather than an oversight.\n */\nexport function classifyOutboundTargetUrl(rawUrl: string, policy: OutboundTargetPolicy): OutboundTargetRejection | undefined {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n\n  if (!policy.admittedProtocols.includes(url.protocol)) {\n    return OutboundTargetRejection.NOT_ABSOLUTE_ADMITTED_SCHEME;\n  }\n  if (url.username || url.password) {\n    return OutboundTargetRejection.CREDENTIALS_IN_URL;\n  }\n\n  const host = unwrapUrlHost(url.hostname);\n  const ipVersion = isIP(host);\n  if (ipVersion === 0) {\n    return isReservedSpecialUseHostname(host) ? OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME : undefined;\n  }\n\n  return isPrivateOrReservedIpAddress(host, ipVersion) ? OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS : undefined;\n}\n\n/** Outcome of the DNS-resolving half, kept separate because \"did not resolve\" is not \"is internal\". */\nexport enum OutboundTargetResolution {\n  PUBLIC = 'public',\n  INTERNAL = 'internal',\n  UNRESOLVABLE = 'unresolvable',\n}\n\n/**\n * Resolve a hostname and check EVERY answer, not just the first.\n *\n * DNS is resolved rather than the hostname trusted, because `internal.example.com` may be a public\n * name with a private A record — the attack a shape check cannot see. Every resolved address is\n * checked because a hostile resolver can return one public and one private address and rely on the\n * client picking the other.\n *\n * ⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that changes\n * between the two (rebinding) is not covered by THIS function. Closing it needs the request pinned to\n * the validated address — which Node's `fetch` does not expose, but `node:https`'s `lookup` hook\n * does. `pinnedOutboundFetch` is built on that hook; a caller that issues its request through it has\n * the residual closed, and a caller that does not, does not.\n *\n * `resolve` is injectable so callers can test the internal/public branches without a resolver.\n */\nexport async function resolvesOnlyToPublicAddresses(\n  hostname: string,\n  resolve: (host: string) => Promise<readonly string[]>,\n): Promise<OutboundTargetResolution> {\n  const literal = unwrapUrlHost(hostname);\n  if (isIP(literal) !== 0) {\n    return isPrivateOrReservedIpAddress(literal) ? OutboundTargetResolution.INTERNAL : OutboundTargetResolution.PUBLIC;\n  }\n\n  let addresses: readonly string[];\n  try {\n    addresses = await resolve(hostname);\n  } catch {\n    return OutboundTargetResolution.UNRESOLVABLE;\n  }\n\n  // An empty answer is treated as INTERNAL rather than UNRESOLVABLE: the resolver succeeded and told\n  // us nothing usable, which is not evidence the name is safe.\n  if (addresses.length === 0) return OutboundTargetResolution.INTERNAL;\n\n  return addresses.some((address) => isPrivateOrReservedIpAddress(address))\n    ? OutboundTargetResolution.INTERNAL\n    : OutboundTargetResolution.PUBLIC;\n}\n"]}

package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-outbound-fetch.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/ssrf/pinned-outbound-fetch.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAMnE,OAAO,EACL,uBAAuB,EAGvB,KAAK,oBAAoB,EAC1B,MAAM,sEAAsE,CAAC;AAE9E;;;;;;;GAOG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;aASjC,SAAS,EAAE,uBAAuB;aAClC,cAAc,CAAC,EAAE,MAAM;IATzC;;;;OAIG;IACH,SAAgB,IAAI,mCAAmC;gBAGrC,SAAS,EAAE,uBAAuB,EAClC,cAAc,CAAC,EAAE,MAAM;CAK1C;AAED,sGAAsG;AACtG,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;AAE5F,MAAM,WAAW,yBAA0B,SAAQ,oBAAoB;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AA8CD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoH5G"}
+{"version":3,"file":"pinned-outbound-fetch.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/ssrf/pinned-outbound-fetch.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAMnE,OAAO,EACL,uBAAuB,EAGvB,KAAK,oBAAoB,EAC1B,MAAM,sEAAsE,CAAC;AAE9E;;;;;;;GAOG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;aASjC,SAAS,EAAE,uBAAuB;aAClC,cAAc,CAAC,EAAE,MAAM;IATzC;;;;OAIG;IACH,SAAgB,IAAI,mCAAmC;gBAGrC,SAAS,EAAE,uBAAuB,EAClC,cAAc,CAAC,EAAE,MAAM;CAK1C;AAED,sGAAsG;AACtG,MAAM,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;AAE5F,MAAM,WAAW,yBAA0B,SAAQ,oBAAoB;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AA8CD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoH5G"}

package/dist/esm/security/ssrf/pinned-outbound-fetch.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-outbound-fetch.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/ssrf/pinned-outbound-fetch.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAsB,MAAM,UAAU,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,KAAK,IAAI,SAAS,EAA4C,MAAM,WAAW,CAAC;AAEjH,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,GAE7B,MAAM,sEAAsE,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IASjC;IACA;IATlB;;;;OAIG;IACa,IAAI,GAAG,+BAA+B,CAAC;IAEvD,YACkB,SAAkC,EAClC,cAAuB;QAEvC,KAAK,CAAC,4BAA4B,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAH9E,cAAS,GAAT,SAAS,CAAyB;QAClC,mBAAc,GAAd,cAAc,CAAS;QAGvC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAgDD;;;;;;;;;;;;;;GAcG;AACH,MAAM,iBAAiB,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9D,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,MAAc,EAAE,IAA+B;IACpE,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACnG,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,IAAI,IAAI,CAAC,qBAAqB;WACzB,CAAC,SAAS,KAAK,uBAAuB,CAAC,2BAA2B;eAChE,SAAS,KAAK,uBAAuB,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAC5E,oFAAoF;QACpF,2FAA2F;QAC3F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAA0B,CAAC,QAAQ,EAAE,EAAE,CAC1D,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACzG,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAA+B;IACvF,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,cAAc,KAAK,SAAS;QAAE,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAEvF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,IAAI,eAAe,CAAC;IAEzD;;;;;OAKG;IACH,IAAI,cAAsD,CAAC;IAE3D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IACzE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAEjF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,OAAO,GAA2B,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC5D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAW,CAAC,eAAe,EAAE,cAAc,EAAE,EAAE;YAC/E,MAAM,OAAO,GAAkB,SAAS,CACtC;gBACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,+CAA+C;gBAC/F,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS;gBAC3B,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;gBAC5B,OAAO;gBACP,KAAK;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;gBAEnB;;;;;;;;;;;mBAWG;gBACH,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;oBACvC;;;;;uBAKG;oBACH,MAAM,MAAM,GAAG,CAAC,OAAmC,EAAQ,EAAE;wBAC3D,cAAc,GAAG,OAAO,CAAC;wBACzB,QAAQ,CAAC,OAAgC,EAAE,EAAE,CAAC,CAAC;oBACjD,CAAC,CAAC;oBACF,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,CAAC,QAAQ,EAAE,EAAE;wBACX,MAAM,SAAS,GAAoB,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;wBAC/G,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;4BAC3B,MAAM,CAAC,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC;4BAC5F,OAAO;wBACT,CAAC;wBACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;4BAChC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;4BACvF,IAAI,OAAO,EAAE,CAAC;gCACZ,MAAM,CAAC,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,2BAA2B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gCAC7G,OAAO;4BACT,CAAC;wBACH,CAAC;wBACD,mFAAmF;wBACnF,8EAA8E;wBAC9E,0EAA0E;wBAC1E,IAAK,OAA6B,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;;4BAC7D,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;oBACjE,CAAC,EACD,CAAC,KAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CACtD,CAAC;gBACJ,CAAC,CAA0B;aAC5B,EACD,CAAC,QAAyB,EAAE,EAAE;gBAC5B,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;gBACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;yBAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;wBAAE,KAAK,MAAM,GAAG,IAAI,KAAK;4BAAE,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5F,CAAC;gBACD,eAAe,CACb,IAAI,QAAQ;gBACV,iFAAiF;gBACjF,kDAAkD;gBAClD,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG;oBACxD,CAAC,CAAC,IAAI;oBACN,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAgC,EAC5D;oBACE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,GAAG;oBAClC,UAAU,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;oBACxC,OAAO,EAAE,eAAe;iBACzB,CACF,CACF,CAAC;YACJ,CAAC,CACF,CAAC;YAEF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACpC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+FAA+F;QAC/F,wFAAwF;QACxF,IAAI,cAAc;YAAE,MAAM,cAAc,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["/**\n * An outbound HTTP request that CONNECTS to the address it VALIDATED — the half\n * {@link classifyOutboundTargetUrl} and {@link resolvesOnlyToPublicAddresses} structurally cannot do.\n *\n * ## The hole this closes, and why the classifier alone could never close it\n *\n * Every guard in the sibling module answers a question and then hands the answer to somebody else,\n * who makes a SEPARATE connection. That is a check-then-connect, and the guard's own header says so:\n *\n *   \"⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that\n *    changes between the two (rebinding) is not covered. Closing it needs the request pinned to the\n *    validated address, which Node's `fetch` does not expose.\"\n *\n * So a name whose A record answers `93.184.216.34` to the validating resolver and `169.254.169.254`\n * to the connecting one passes every check in this directory and still reaches cloud instance\n * metadata. The window is small and entirely attacker-controlled: the attacker owns the zone, so the\n * attacker chooses the TTL and therefore the width of the window.\n *\n * The classifier cannot fix this at any level of effort, because the defect is not in the answer —\n * the answer was correct when it was given. The defect is that the answer is thrown away before the\n * socket is opened.\n *\n * ## The mechanism, chosen after measuring the alternatives\n *\n * `net.Socket.connect` accepts a **`lookup` hook**, and `http.request` / `https.request` pass it\n * straight through. Node calls it at CONNECT time, and the address it returns is the address the\n * socket is opened to — there is no second resolution and therefore no window. Classifying inside\n * the hook makes validation and connection the SAME event rather than two events with a gap.\n *\n * Measured on this Node (2026-09-08) rather than assumed, because each of these decided the design:\n *\n * | probe | result |\n * |---|---|\n * | is `lookup` called for a hostname? | yes, as `lookup(host, { hints, all: true }, cb)` — note `all` |\n * | is `lookup` called for an IP LITERAL? | **no** — `net` short-circuits, so literals need the shape check |\n * | does an error raised inside the hook reach the caller? | yes, same error object, `message` and `code` intact |\n * | does TLS still verify against the NAME while connected to the pinned IP? | **yes** — a cert for `pinned.test` validated over a socket to `127.0.0.1` |\n *\n * That last row is what makes the whole approach viable. Pinning by rewriting the URL's host to the\n * validated IP — the obvious alternative — breaks SNI and certificate verification, i.e. it trades an\n * SSRF hole for a transport-security hole. Pinning through `lookup` keeps the hostname everywhere it\n * is a security input (SNI, certificate subject, the `Host` header) and replaces it only where it is\n * a routing input.\n *\n * ## Why this is not `fetch` with a dispatcher\n *\n * Node's `fetch` exposes no `lookup` hook. The undici route (`new Agent({ connect: { lookup } })`)\n * would work, but undici is not a declared dependency of this package — it is present in the store\n * only transitively — so taking it would add a second HTTP stack beside the one Node already embeds,\n * for a hook `node:https` exposes natively. Rejected on that basis, not on preference.\n *\n * `node:https` also gives one property for free that `fetch` needs an option for: **it does not\n * follow redirects at all.** A 302 arrives as a 302 the caller can see. `redirect: 'error'` is\n * therefore not something this module has to remember to pass — following a redirect to a target the\n * guard never saw is unrepresentable here.\n *\n * ## What this still does NOT do\n *\n * It does not defend a target that is public at connect time and hostile at the application layer,\n * and it does not stop a public host from being an open proxy into somebody else's private network.\n * Those are different problems with different answers. What it removes is the specific gap between\n * \"we checked this name\" and \"we opened this socket\".\n *\n * assurance-control: WILDO.NETWORK.OUTBOUND_TARGET_CONTROL — a server-side request initiated from\n * application- or tenant-authored configuration reaches only an address the deployment admits\n */\n\nimport { lookup as dnsLookup, type LookupAddress } from 'node:dns';\nimport { request as httpRequest, Agent as HttpAgent, type ClientRequest, type IncomingMessage } from 'node:http';\nimport type { LookupFunction } from 'node:net';\nimport { request as httpsRequest, Agent as HttpsAgent } from 'node:https';\nimport { Readable } from 'node:stream';\n\nimport {\n  OutboundTargetRejection,\n  classifyOutboundTargetUrl,\n  isPrivateOrReservedIpAddress,\n  type OutboundTargetPolicy,\n} from '~wildo-backend-lib/security/ssrf/outbound-target-guard.backend.utils';\n\n/**\n * Raised when the target was refused. Carries the closed-vocabulary reason so a caller can map it\n * onto its OWN rejection vocabulary rather than pattern-matching a message.\n *\n * `refusedAddress` is present only for a connect-time refusal — it is the address the resolver\n * returned at the moment of connection, which is the evidence that a rebinding attempt happened\n * rather than a merely mis-authored URL.\n */\nexport class OutboundTargetRefusedError extends Error {\n  /**\n   * A stable `code` alongside the class, because the error crosses `net`'s internals on its way out\n   * of the `lookup` hook. The class identity survives on this Node (measured), but a `code` is what\n   * every other error in that path carries and it costs nothing to be robust to a future wrap.\n   */\n  public readonly code = 'WILDO_OUTBOUND_TARGET_REFUSED';\n\n  constructor(\n    public readonly rejection: OutboundTargetRejection,\n    public readonly refusedAddress?: string,\n  ) {\n    super(`Outbound target refused: ${rejection}${refusedAddress ? ` (${refusedAddress})` : ''}`);\n    this.name = 'OutboundTargetRefusedError';\n  }\n}\n\n/** The `dns.lookup` shape the connection hook needs, injectable so a test can drive both branches. */\nexport type PinnedAddressResolver = (hostname: string) => Promise<readonly LookupAddress[]>;\n\nexport interface PinnedOutboundRequestInit extends OutboundTargetPolicy {\n  method?: string;\n  headers?: Readonly<Record<string, string>>;\n  /** Already-serialized request body. `content-length` is computed here; do not pass one. */\n  body?: string;\n  signal?: AbortSignal;\n\n  /**\n   * OPERATOR-authored escape: admit an address the public internet cannot reach.\n   *\n   * It exists because one legitimate outbound target class genuinely lives on a private network — a\n   * self-hosted SIEM collector on the same VPC as the application. Refusing that unconditionally\n   * would not be \"safe\", it would break a supported deployment shape.\n   *\n   * Three properties keep it from being an SSRF bypass with a checkbox, and all three are the\n   * caller's obligation rather than this module's:\n   *\n   * 1. **It is never the default.** Absent means refuse.\n   * 2. **It must be authored by the DEPLOYMENT OPERATOR, never by the tenant whose row supplies the\n   *    URL.** A tenant-settable \"allow private addresses\" flag hands the attacker the switch that\n   *    disarms the guard aimed at them. This is why the SIEM escape lives on the application\n   *    configuration and not on `siemExportConfig`, which an organization administrator authors.\n   * 3. **It must never reach a target class whose URL comes from an UNAUTHENTICATED stranger.** CIMD\n   *    resolves a `client_id` supplied by anyone who can reach the authorization endpoint; there is\n   *    no operator on earth who means \"let strangers address my metadata service\".\n   *\n   * Note what it does NOT relax: the scheme policy and the credentials-in-URL refusal still apply,\n   * and the connection is still pinned. It widens WHICH addresses are admitted, never whether the\n   * address that was admitted is the one connected to.\n   */\n  admitPrivateAddresses?: boolean;\n\n  /**\n   * Resolver used by the connection hook. Defaults to the system resolver.\n   *\n   * Injectable for the same reason `resolvesOnlyToPublicAddresses` takes one: the two branches that\n   * matter (a name that answers public, a name that answers private) cannot be exercised against a\n   * real resolver without owning a zone, and a rebinding pin needs a resolver that answers\n   * DIFFERENTLY on its second call — which is exactly what no real resolver will do on demand.\n   */\n  resolveAddresses?: PinnedAddressResolver;\n}\n\n/**\n * Connections are NOT pooled, deliberately.\n *\n * Two reasons, in order of weight. First, a pooled socket skips the `lookup` hook on reuse, so the\n * connect-time classification would run on the first request to a host and not on later ones — the\n * guard would hold or not hold depending on pool state, which is the least auditable property a\n * security control can have. (Reuse would in fact be SAFE, because a pooled socket is already\n * connected to an address this module validated — but \"safe because of a subtlety in another\n * module's cache\" is not a property to rest a control on.) Second, these targets are strangers:\n * pooling keeps an idle socket open per tenant-authored host, which is an unbounded resource keyed\n * on attacker-supplied strings.\n *\n * The cost is one TCP+TLS handshake per request, on a path that runs at webhook cadence rather than\n * per user request.\n */\nconst PINNED_HTTP_AGENT = new HttpAgent({ keepAlive: false });\nconst PINNED_HTTPS_AGENT = new HttpsAgent({ keepAlive: false });\n\n/**\n * Classify the URL's SHAPE before anything leaves the process.\n *\n * This is not redundant with the connection hook, and the reason is measured: `net` short-circuits\n * DNS for an IP LITERAL, so `https://169.254.169.254/latest/meta-data` never calls `lookup` and the\n * hook would never see it. The shape check is the ONLY thing standing in front of a literal target.\n */\nfunction classifyShape(rawUrl: string, init: PinnedOutboundRequestInit): OutboundTargetRejection | undefined {\n  const rejection = classifyOutboundTargetUrl(rawUrl, { admittedProtocols: init.admittedProtocols });\n  if (rejection === undefined) return undefined;\n\n  if (init.admitPrivateAddresses\n    && (rejection === OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS\n      || rejection === OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME)) {\n    // The operator declared this deployment reaches internal collectors. The scheme and\n    // credentials-in-URL refusals are NOT part of that declaration and fall through unchanged.\n    return undefined;\n  }\n  return rejection;\n}\n\nconst defaultResolver: PinnedAddressResolver = (hostname) =>\n  new Promise((resolve, reject) => {\n    dnsLookup(hostname, { all: true }, (error, addresses) => (error ? reject(error) : resolve(addresses)));\n  });\n\n/**\n * Make the request, connecting only to an address classified at the moment of connection.\n *\n * Returns a real {@link Response} built over the incoming message, so callers keep `ok`, `status`,\n * `headers.get()`, `body.getReader()` and `text()` — every surface the `fetch` this replaces gave\n * them. It is a genuine `Response`, not a look-alike: streaming size enforcement (CIMD reads the body\n * with a running byte counter and cancels the reader) works unchanged.\n *\n * Throws {@link OutboundTargetRefusedError} for a refusal, and whatever `node:http` throws for a\n * transport failure — callers already distinguish those, and conflating them would turn \"your\n * collector is down\" into \"your collector is an SSRF attempt\".\n */\nexport async function pinnedOutboundFetch(rawUrl: string, init: PinnedOutboundRequestInit): Promise<Response> {\n  const shapeRejection = classifyShape(rawUrl, init);\n  if (shapeRejection !== undefined) throw new OutboundTargetRefusedError(shapeRejection);\n\n  const url = new URL(rawUrl);\n  const resolve = init.resolveAddresses ?? defaultResolver;\n\n  /**\n   * The refusal is recorded here as well as thrown, because the throw happens INSIDE a `net`\n   * callback. The error object does survive that path on this Node — measured — but a caught error\n   * on the outside is only usefully classified if we can answer \"was it ours?\" without depending on\n   * that. The box answers it from our own frame.\n   */\n  let connectRefusal: OutboundTargetRefusedError | undefined;\n\n  const requestFn = url.protocol === 'https:' ? httpsRequest : httpRequest;\n  const agent = url.protocol === 'https:' ? PINNED_HTTPS_AGENT : PINNED_HTTP_AGENT;\n\n  const body = init.body;\n  const headers: Record<string, string> = { ...init.headers };\n  if (body !== undefined) headers['content-length'] = String(Buffer.byteLength(body, 'utf8'));\n\n  try {\n    const response = await new Promise<Response>((resolveResponse, rejectResponse) => {\n      const request: ClientRequest = requestFn(\n        {\n          protocol: url.protocol,\n          hostname: url.hostname.replace(/^\\[|\\]$/g, ''), // an IPv6 literal arrives bracketed from `URL`\n          port: url.port || undefined,\n          path: `${url.pathname}${url.search}`,\n          method: init.method ?? 'GET',\n          headers,\n          agent,\n          signal: init.signal,\n\n          /**\n           * THE PIN. Every address the resolver returns is classified here, and the connection is\n           * made to one of the addresses that passed — the same values, in the same event.\n           *\n           * ALL answers are checked rather than the one we hand back, because a hostile resolver can\n           * return one public and one private address and rely on the client picking the other. That\n           * is the same reasoning `resolvesOnlyToPublicAddresses` states; keeping it here means the\n           * property does not depend on which resolver the caller pre-checked with.\n           *\n           * An empty answer is a refusal rather than a fall-through: the resolver succeeded and told\n           * us nothing usable, which is not evidence the name is safe.\n           */\n          lookup: ((hostname, options, callback) => {\n            /**\n             * `callback` is typed as requiring an address even on the error path, so every refusal\n             * hands back an empty list beside the error. Node's `lookupAndConnect` tests the error\n             * FIRST and destroys the socket, so the list is never read — this is a type obligation,\n             * not a fallback the connection could take.\n             */\n            const refuse = (refusal: OutboundTargetRefusedError): void => {\n              connectRefusal = refusal;\n              callback(refusal as NodeJS.ErrnoException, []);\n            };\n            resolve(hostname).then(\n              (resolved) => {\n                const addresses: LookupAddress[] = resolved.map((entry) => ({ address: entry.address, family: entry.family }));\n                if (addresses.length === 0) {\n                  refuse(new OutboundTargetRefusedError(OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS));\n                  return;\n                }\n                if (!init.admitPrivateAddresses) {\n                  const refused = addresses.find((entry) => isPrivateOrReservedIpAddress(entry.address));\n                  if (refused) {\n                    refuse(new OutboundTargetRefusedError(OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS, refused.address));\n                    return;\n                  }\n                }\n                // `all` is what Node passes today; the single-address form is honoured so a future\n                // Node calling the hook the other way does not silently reach the `Invalid IP\n                // address: undefined` failure that the first draft of this hook produced.\n                if ((options as { all?: boolean }).all) callback(null, addresses);\n                else callback(null, addresses[0].address, addresses[0].family);\n              },\n              (error: NodeJS.ErrnoException) => callback(error, []),\n            );\n          }) satisfies LookupFunction,\n        },\n        (incoming: IncomingMessage) => {\n          const responseHeaders = new Headers();\n          for (const [name, value] of Object.entries(incoming.headers)) {\n            if (typeof value === 'string') responseHeaders.set(name, value);\n            else if (Array.isArray(value)) for (const one of value) responseHeaders.append(name, one);\n          }\n          resolveResponse(\n            new Response(\n              // A 204/304 carries no body; `Response` refuses a body on those statuses, so the\n              // stream is only attached where one is permitted.\n              incoming.statusCode === 204 || incoming.statusCode === 304\n                ? null\n                : (Readable.toWeb(incoming) as ReadableStream<Uint8Array>),\n              {\n                status: incoming.statusCode ?? 502,\n                statusText: incoming.statusMessage ?? '',\n                headers: responseHeaders,\n              },\n            ),\n          );\n        },\n      );\n\n      request.on('error', rejectResponse);\n      if (body !== undefined) request.write(body);\n      request.end();\n    });\n    return response;\n  } catch (error) {\n    // A refusal raised inside the hook surfaces here wrapped in whatever `net` did with it. Prefer\n    // our own record of it, so the caller's classification never depends on error identity.\n    if (connectRefusal) throw connectRefusal;\n    throw error;\n  }\n}\n"]}
+{"version":3,"file":"pinned-outbound-fetch.backend.utils.js","sourceRoot":"","sources":["../../../../src/security/ssrf/pinned-outbound-fetch.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAsB,MAAM,UAAU,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,KAAK,IAAI,SAAS,EAA4C,MAAM,WAAW,CAAC;AAEjH,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,GAE7B,MAAM,sEAAsE,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IASjC;IACA;IATlB;;;;OAIG;IACa,IAAI,GAAG,+BAA+B,CAAC;IAEvD,YACkB,SAAkC,EAClC,cAAuB;QAEvC,KAAK,CAAC,4BAA4B,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAH9E,cAAS,GAAT,SAAS,CAAyB;QAClC,mBAAc,GAAd,cAAc,CAAS;QAGvC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAgDD;;;;;;;;;;;;;;GAcG;AACH,MAAM,iBAAiB,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9D,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,MAAc,EAAE,IAA+B;IACpE,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACnG,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,IAAI,IAAI,CAAC,qBAAqB;WACzB,CAAC,SAAS,KAAK,uBAAuB,CAAC,2BAA2B;eAChE,SAAS,KAAK,uBAAuB,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAC5E,oFAAoF;QACpF,2FAA2F;QAC3F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAA0B,CAAC,QAAQ,EAAE,EAAE,CAC1D,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACzG,CAAC,CAAC,CAAC;AAEL;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAA+B;IACvF,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,cAAc,KAAK,SAAS;QAAE,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAEvF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,IAAI,eAAe,CAAC;IAEzD;;;;;OAKG;IACH,IAAI,cAAsD,CAAC;IAE3D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IACzE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAEjF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,OAAO,GAA2B,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC5D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAW,CAAC,eAAe,EAAE,cAAc,EAAE,EAAE;YAC/E,MAAM,OAAO,GAAkB,SAAS,CACtC;gBACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,+CAA+C;gBAC/F,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS;gBAC3B,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;gBAC5B,OAAO;gBACP,KAAK;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;gBAEnB;;;;;;;;;;;mBAWG;gBACH,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;oBACvC;;;;;uBAKG;oBACH,MAAM,MAAM,GAAG,CAAC,OAAmC,EAAQ,EAAE;wBAC3D,cAAc,GAAG,OAAO,CAAC;wBACzB,QAAQ,CAAC,OAAgC,EAAE,EAAE,CAAC,CAAC;oBACjD,CAAC,CAAC;oBACF,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,CAAC,QAAQ,EAAE,EAAE;wBACX,MAAM,SAAS,GAAoB,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;wBAC/G,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;4BAC3B,MAAM,CAAC,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC;4BAC5F,OAAO;wBACT,CAAC;wBACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;4BAChC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;4BACvF,IAAI,OAAO,EAAE,CAAC;gCACZ,MAAM,CAAC,IAAI,0BAA0B,CAAC,uBAAuB,CAAC,2BAA2B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gCAC7G,OAAO;4BACT,CAAC;wBACH,CAAC;wBACD,mFAAmF;wBACnF,8EAA8E;wBAC9E,0EAA0E;wBAC1E,IAAK,OAA6B,CAAC,GAAG;4BAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;;4BAC7D,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;oBACjE,CAAC,EACD,CAAC,KAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CACtD,CAAC;gBACJ,CAAC,CAA0B;aAC5B,EACD,CAAC,QAAyB,EAAE,EAAE;gBAC5B,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;gBACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;yBAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;wBAAE,KAAK,MAAM,GAAG,IAAI,KAAK;4BAAE,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5F,CAAC;gBACD,eAAe,CACb,IAAI,QAAQ;gBACV,iFAAiF;gBACjF,kDAAkD;gBAClD,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG;oBACxD,CAAC,CAAC,IAAI;oBACN,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAgC,EAC5D;oBACE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,GAAG;oBAClC,UAAU,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;oBACxC,OAAO,EAAE,eAAe;iBACzB,CACF,CACF,CAAC;YACJ,CAAC,CACF,CAAC;YAEF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACpC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+FAA+F;QAC/F,wFAAwF;QACxF,IAAI,cAAc;YAAE,MAAM,cAAc,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["/**\n * An outbound HTTP request that CONNECTS to the address it VALIDATED — the half\n * {@link classifyOutboundTargetUrl} and {@link resolvesOnlyToPublicAddresses} structurally cannot do.\n *\n * ## The hole this closes, and why the classifier alone could never close it\n *\n * Every guard in the sibling module answers a question and then hands the answer to somebody else,\n * who makes a SEPARATE connection. That is a check-then-connect, and the guard's own header says so:\n *\n *   \"⚠️ Residual, stated rather than hidden: this is a check-then-connect, so a DNS entry that\n *    changes between the two (rebinding) is not covered. Closing it needs the request pinned to the\n *    validated address, which Node's `fetch` does not expose.\"\n *\n * So a name whose A record answers `93.184.216.34` to the validating resolver and `169.254.169.254`\n * to the connecting one passes every check in this directory and still reaches cloud instance\n * metadata. The window is small and entirely attacker-controlled: the attacker owns the zone, so the\n * attacker chooses the TTL and therefore the width of the window.\n *\n * The classifier cannot fix this at any level of effort, because the defect is not in the answer —\n * the answer was correct when it was given. The defect is that the answer is thrown away before the\n * socket is opened.\n *\n * ## The mechanism, chosen after measuring the alternatives\n *\n * `net.Socket.connect` accepts a **`lookup` hook**, and `http.request` / `https.request` pass it\n * straight through. Node calls it at CONNECT time, and the address it returns is the address the\n * socket is opened to — there is no second resolution and therefore no window. Classifying inside\n * the hook makes validation and connection the SAME event rather than two events with a gap.\n *\n * Measured on this Node (2026-09-08) rather than assumed, because each of these decided the design:\n *\n * | probe | result |\n * |---|---|\n * | is `lookup` called for a hostname? | yes, as `lookup(host, { hints, all: true }, cb)` — note `all` |\n * | is `lookup` called for an IP LITERAL? | **no** — `net` short-circuits, so literals need the shape check |\n * | does an error raised inside the hook reach the caller? | yes, same error object, `message` and `code` intact |\n * | does TLS still verify against the NAME while connected to the pinned IP? | **yes** — a cert for `pinned.test` validated over a socket to `127.0.0.1` |\n *\n * That last row is what makes the whole approach viable. Pinning by rewriting the URL's host to the\n * validated IP — the obvious alternative — breaks SNI and certificate verification, i.e. it trades an\n * SSRF hole for a transport-security hole. Pinning through `lookup` keeps the hostname everywhere it\n * is a security input (SNI, certificate subject, the `Host` header) and replaces it only where it is\n * a routing input.\n *\n * ## Why this is not `fetch` with a dispatcher\n *\n * Node's `fetch` exposes no `lookup` hook. The undici route (`new Agent({ connect: { lookup } })`)\n * would work, but undici is not a declared dependency of this package — it is present in the store\n * only transitively — so taking it would add a second HTTP stack beside the one Node already embeds,\n * for a hook `node:https` exposes natively. Rejected on that basis, not on preference.\n *\n * `node:https` also gives one property for free that `fetch` needs an option for: **it does not\n * follow redirects at all.** A 302 arrives as a 302 the caller can see. `redirect: 'error'` is\n * therefore not something this module has to remember to pass — following a redirect to a target the\n * guard never saw is unrepresentable here.\n *\n * ## What this still does NOT do\n *\n * It does not defend a target that is public at connect time and hostile at the application layer,\n * and it does not stop a public host from being an open proxy into somebody else's private network.\n * Those are different problems with different answers. What it removes is the specific gap between\n * \"we checked this name\" and \"we opened this socket\".\n *\n * assurance-control: WILDO.NETWORK.OUTBOUND_TARGET_CONTROL — a server-side request initiated from\n * application- or tenant-authored configuration reaches only an address the deployment admits\n */\n\nimport { lookup as dnsLookup, type LookupAddress } from 'node:dns';\nimport { request as httpRequest, Agent as HttpAgent, type ClientRequest, type IncomingMessage } from 'node:http';\nimport type { LookupFunction } from 'node:net';\nimport { request as httpsRequest, Agent as HttpsAgent } from 'node:https';\nimport { Readable } from 'node:stream';\n\nimport {\n  OutboundTargetRejection,\n  classifyOutboundTargetUrl,\n  isPrivateOrReservedIpAddress,\n  type OutboundTargetPolicy,\n} from '~wildo-backend-lib/security/ssrf/outbound-target-guard.backend.utils';\n\n/**\n * Raised when the target was refused. Carries the closed-vocabulary reason so a caller can map it\n * onto its OWN rejection vocabulary rather than pattern-matching a message.\n *\n * `refusedAddress` is present only for a connect-time refusal — it is the address the resolver\n * returned at the moment of connection, which is the evidence that a rebinding attempt happened\n * rather than a merely mis-authored URL.\n */\nexport class OutboundTargetRefusedError extends Error {\n  /**\n   * A stable `code` alongside the class, because the error crosses `net`'s internals on its way out\n   * of the `lookup` hook. The class identity survives on this Node (measured), but a `code` is what\n   * every other error in that path carries and it costs nothing to be robust to a future wrap.\n   */\n  public readonly code = 'WILDO_OUTBOUND_TARGET_REFUSED';\n\n  constructor(\n    public readonly rejection: OutboundTargetRejection,\n    public readonly refusedAddress?: string,\n  ) {\n    super(`Outbound target refused: ${rejection}${refusedAddress ? ` (${refusedAddress})` : ''}`);\n    this.name = 'OutboundTargetRefusedError';\n  }\n}\n\n/** The `dns.lookup` shape the connection hook needs, injectable so a test can drive both branches. */\nexport type PinnedAddressResolver = (hostname: string) => Promise<readonly LookupAddress[]>;\n\nexport interface PinnedOutboundRequestInit extends OutboundTargetPolicy {\n  method?: string;\n  headers?: Readonly<Record<string, string>>;\n  /** Already-serialized request body. `content-length` is computed here; do not pass one. */\n  body?: string;\n  signal?: AbortSignal;\n\n  /**\n   * OPERATOR-authored escape: admit an address the public internet cannot reach.\n   *\n   * It exists because one legitimate outbound target class genuinely lives on a private network — a\n   * self-hosted SIEM collector on the same VPC as the application. Refusing that unconditionally\n   * would not be \"safe\", it would break a supported deployment shape.\n   *\n   * Three properties keep it from being an SSRF bypass with a checkbox, and all three are the\n   * caller's obligation rather than this module's:\n   *\n   * 1. **It is never the default.** Absent means refuse.\n   * 2. **It must be authored by the DEPLOYMENT OPERATOR, never by the tenant whose row supplies the\n   *    URL.** A tenant-settable \"allow private addresses\" flag hands the attacker the switch that\n   *    disarms the guard aimed at them. This is why the SIEM escape lives on the application\n   *    configuration and not on `siemExportConfig`, which an organization administrator authors.\n   * 3. **It must never reach a target class whose URL comes from an UNAUTHENTICATED stranger.** CIMD\n   *    resolves a `client_id` supplied by anyone who can reach the authorization endpoint; there is\n   *    no operator on earth who means \"let strangers address my metadata service\".\n   *\n   * Note what it does NOT relax: the scheme policy and the credentials-in-URL refusal still apply,\n   * and the connection is still pinned. It widens WHICH addresses are admitted, never whether the\n   * address that was admitted is the one connected to.\n   */\n  admitPrivateAddresses?: boolean;\n\n  /**\n   * Resolver used by the connection hook. Defaults to the system resolver.\n   *\n   * Injectable for the same reason `resolvesOnlyToPublicAddresses` takes one: the two branches that\n   * matter (a name that answers public, a name that answers private) cannot be exercised against a\n   * real resolver without owning a zone, and a rebinding pin needs a resolver that answers\n   * DIFFERENTLY on its second call — which is exactly what no real resolver will do on demand.\n   */\n  resolveAddresses?: PinnedAddressResolver;\n}\n\n/**\n * Connections are NOT pooled, deliberately.\n *\n * Two reasons, in order of weight. First, a pooled socket skips the `lookup` hook on reuse, so the\n * connect-time classification would run on the first request to a host and not on later ones — the\n * guard would hold or not hold depending on pool state, which is the least auditable property a\n * security control can have. (Reuse would in fact be SAFE, because a pooled socket is already\n * connected to an address this module validated — but \"safe because of a subtlety in another\n * module's cache\" is not a property to rest a control on.) Second, these targets are strangers:\n * pooling keeps an idle socket open per tenant-authored host, which is an unbounded resource keyed\n * on attacker-supplied strings.\n *\n * The cost is one TCP+TLS handshake per request, on a path that runs at webhook cadence rather than\n * per user request.\n */\nconst PINNED_HTTP_AGENT = new HttpAgent({ keepAlive: false });\nconst PINNED_HTTPS_AGENT = new HttpsAgent({ keepAlive: false });\n\n/**\n * Classify the URL's SHAPE before anything leaves the process.\n *\n * This is not redundant with the connection hook, and the reason is measured: `net` short-circuits\n * DNS for an IP LITERAL, so `https://169.254.169.254/latest/meta-data` never calls `lookup` and the\n * hook would never see it. The shape check is the ONLY thing standing in front of a literal target.\n */\nfunction classifyShape(rawUrl: string, init: PinnedOutboundRequestInit): OutboundTargetRejection | undefined {\n  const rejection = classifyOutboundTargetUrl(rawUrl, { admittedProtocols: init.admittedProtocols });\n  if (rejection === undefined) return undefined;\n\n  if (init.admitPrivateAddresses\n    && (rejection === OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS\n      || rejection === OutboundTargetRejection.RESERVED_SPECIAL_USE_HOSTNAME)) {\n    // The operator declared this deployment reaches internal collectors. The scheme and\n    // credentials-in-URL refusals are NOT part of that declaration and fall through unchanged.\n    return undefined;\n  }\n  return rejection;\n}\n\nconst defaultResolver: PinnedAddressResolver = (hostname) =>\n  new Promise((resolve, reject) => {\n    dnsLookup(hostname, { all: true }, (error, addresses) => (error ? reject(error) : resolve(addresses)));\n  });\n\n/**\n * Make the request, connecting only to an address classified at the moment of connection.\n *\n * Returns a real {@link Response} built over the incoming message, so callers keep `ok`, `status`,\n * `headers.get()`, `body.getReader()` and `text()` — every surface the `fetch` this replaces gave\n * them. It is a genuine `Response`, not a look-alike: streaming size enforcement (CIMD reads the body\n * with a running byte counter and cancels the reader) works unchanged.\n *\n * Throws {@link OutboundTargetRefusedError} for a refusal, and whatever `node:http` throws for a\n * transport failure — callers already distinguish those, and conflating them would turn \"your\n * collector is down\" into \"your collector is an SSRF attempt\".\n */\nexport async function pinnedOutboundFetch(rawUrl: string, init: PinnedOutboundRequestInit): Promise<Response> {\n  const shapeRejection = classifyShape(rawUrl, init);\n  if (shapeRejection !== undefined) throw new OutboundTargetRefusedError(shapeRejection);\n\n  const url = new URL(rawUrl);\n  const resolve = init.resolveAddresses ?? defaultResolver;\n\n  /**\n   * The refusal is recorded here as well as thrown, because the throw happens INSIDE a `net`\n   * callback. The error object does survive that path on this Node — measured — but a caught error\n   * on the outside is only usefully classified if we can answer \"was it ours?\" without depending on\n   * that. The box answers it from our own frame.\n   */\n  let connectRefusal: OutboundTargetRefusedError | undefined;\n\n  const requestFn = url.protocol === 'https:' ? httpsRequest : httpRequest;\n  const agent = url.protocol === 'https:' ? PINNED_HTTPS_AGENT : PINNED_HTTP_AGENT;\n\n  const body = init.body;\n  const headers: Record<string, string> = { ...init.headers };\n  if (body !== undefined) headers['content-length'] = String(Buffer.byteLength(body, 'utf8'));\n\n  try {\n    const response = await new Promise<Response>((resolveResponse, rejectResponse) => {\n      const request: ClientRequest = requestFn(\n        {\n          protocol: url.protocol,\n          hostname: url.hostname.replace(/^\\[|\\]$/g, ''), // an IPv6 literal arrives bracketed from `URL`\n          port: url.port || undefined,\n          path: `${url.pathname}${url.search}`,\n          method: init.method ?? 'GET',\n          headers,\n          agent,\n          signal: init.signal,\n\n          /**\n           * THE PIN. Every address the resolver returns is classified here, and the connection is\n           * made to one of the addresses that passed — the same values, in the same event.\n           *\n           * ALL answers are checked rather than the one we hand back, because a hostile resolver can\n           * return one public and one private address and rely on the client picking the other. That\n           * is the same reasoning `resolvesOnlyToPublicAddresses` states; keeping it here means the\n           * property does not depend on which resolver the caller pre-checked with.\n           *\n           * An empty answer is a refusal rather than a fall-through: the resolver succeeded and told\n           * us nothing usable, which is not evidence the name is safe.\n           */\n          lookup: ((hostname, options, callback) => {\n            /**\n             * `callback` is typed as requiring an address even on the error path, so every refusal\n             * hands back an empty list beside the error. Node's `lookupAndConnect` tests the error\n             * FIRST and destroys the socket, so the list is never read — this is a type obligation,\n             * not a fallback the connection could take.\n             */\n            const refuse = (refusal: OutboundTargetRefusedError): void => {\n              connectRefusal = refusal;\n              callback(refusal as NodeJS.ErrnoException, []);\n            };\n            resolve(hostname).then(\n              (resolved) => {\n                const addresses: LookupAddress[] = resolved.map((entry) => ({ address: entry.address, family: entry.family }));\n                if (addresses.length === 0) {\n                  refuse(new OutboundTargetRefusedError(OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS));\n                  return;\n                }\n                if (!init.admitPrivateAddresses) {\n                  const refused = addresses.find((entry) => isPrivateOrReservedIpAddress(entry.address));\n                  if (refused) {\n                    refuse(new OutboundTargetRefusedError(OutboundTargetRejection.PRIVATE_OR_RESERVED_ADDRESS, refused.address));\n                    return;\n                  }\n                }\n                // `all` is what Node passes today; the single-address form is honoured so a future\n                // Node calling the hook the other way does not silently reach the `Invalid IP\n                // address: undefined` failure that the first draft of this hook produced.\n                if ((options as { all?: boolean }).all) callback(null, addresses);\n                else callback(null, addresses[0].address, addresses[0].family);\n              },\n              (error: NodeJS.ErrnoException) => callback(error, []),\n            );\n          }) satisfies LookupFunction,\n        },\n        (incoming: IncomingMessage) => {\n          const responseHeaders = new Headers();\n          for (const [name, value] of Object.entries(incoming.headers)) {\n            if (typeof value === 'string') responseHeaders.set(name, value);\n            else if (Array.isArray(value)) for (const one of value) responseHeaders.append(name, one);\n          }\n          resolveResponse(\n            new Response(\n              // A 204/304 carries no body; `Response` refuses a body on those statuses, so the\n              // stream is only attached where one is permitted.\n              incoming.statusCode === 204 || incoming.statusCode === 304\n                ? null\n                : (Readable.toWeb(incoming) as ReadableStream<Uint8Array>),\n              {\n                status: incoming.statusCode ?? 502,\n                statusText: incoming.statusMessage ?? '',\n                headers: responseHeaders,\n              },\n            ),\n          );\n        },\n      );\n\n      request.on('error', rejectResponse);\n      if (body !== undefined) request.write(body);\n      request.end();\n    });\n    return response;\n  } catch (error) {\n    // A refusal raised inside the hook surfaces here wrapped in whatever `net` did with it. Prefer\n    // our own record of it, so the caller's classification never depends on error identity.\n    if (connectRefusal) throw connectRefusal;\n    throw error;\n  }\n}\n"]}

package/dist/esm/security/token-invalidation-fence.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-invalidation-fence.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/token-invalidation-fence.backend.utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAExF;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAEzE,6DAA6D;AAC7D,MAAM,WAAW,iCAAiC;IAChD,iGAAiG;IACjG,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8FG;AACH,wBAAsB,kCAAkC,CACtD,YAAY,EAAE,gCAAgC,EAC9C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,iCAAiC,CAAC,CAY5C"}
+{"version":3,"file":"token-invalidation-fence.backend.utils.d.ts","sourceRoot":"","sources":["../../../src/security/token-invalidation-fence.backend.utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAExF;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAEzE,6DAA6D;AAC7D,MAAM,WAAW,iCAAiC;IAChD,iGAAiG;IACjG,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8FG;AACH,wBAAsB,kCAAkC,CACtD,YAAY,EAAE,gCAAgC,EAC9C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,iCAAiC,CAAC,CAY5C"}

package/dist/esm/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,sEAAsE,CAAC;AACrF,cAAc,2FAA2F,CAAC;AAC1G,cAAc,mFAAmF,CAAC;AAClG,cAAc,uEAAuE,CAAC;AACtF,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,wDAAwD,CAAC;AACvE,cAAc,kFAAkF,CAAC;AACjG,cAAc,wEAAwE,CAAC;AACvF,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uCAAuC,CAAC;AACtD,cAAc,8DAA8D,CAAC;AAC7E,cAAc,gEAAgE,CAAC;AAC/E,cAAc,yDAAyD,CAAC;AACxE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mDAAmD,CAAC;AAClE,cAAc,0DAA0D,CAAC;AACzE,cAAc,2FAA2F,CAAC;AAC1G,cAAc,8EAA8E,CAAC;AAC7F,cAAc,8FAA8F,CAAC;AAC7G,cAAc,sGAAsG,CAAC;AACrH,cAAc,mFAAmF,CAAC;AAClG,cAAc,+EAA+E,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/testing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,yCAAyC,CAAC;AACxD,cAAc,yCAAyC,CAAC;AACxD,cAAc,sEAAsE,CAAC;AACrF,cAAc,2FAA2F,CAAC;AAC1G,cAAc,mFAAmF,CAAC;AAClG,cAAc,uEAAuE,CAAC;AACtF,cAAc,qDAAqD,CAAC;AACpE,cAAc,mDAAmD,CAAC;AAClE,cAAc,wDAAwD,CAAC;AACvE,cAAc,kFAAkF,CAAC;AACjG,cAAc,wEAAwE,CAAC;AACvF,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uCAAuC,CAAC;AACtD,cAAc,8DAA8D,CAAC;AAC7E,cAAc,gEAAgE,CAAC;AAC/E,cAAc,yDAAyD,CAAC;AACxE,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mDAAmD,CAAC;AAClE,cAAc,0DAA0D,CAAC;AACzE,cAAc,2FAA2F,CAAC;AAC1G,cAAc,8EAA8E,CAAC;AAC7F,cAAc,8FAA8F,CAAC;AAC7G,cAAc,sGAAsG,CAAC;AACrH,cAAc,mFAAmF,CAAC;AAClG,cAAc,+EAA+E,CAAC"}

package/dist/esm/users/services/inbound-contact-custom-implementation.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-contact-custom-implementation.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/users/services/inbound-contact-custom-implementation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAGL,4BAA4B,EAG7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AACpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAGlI;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,4BAA4B,CAKjG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CACzC,mBAAmB,EAAE,0BAA0B,EAC/C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,4BAA4B,CAAC,CAcvC;AAED,wBAAgB,mCAAmC,IAAI,0CAA0C,EAAE,CAuDlG"}
+{"version":3,"file":"inbound-contact-custom-implementation.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/users/services/inbound-contact-custom-implementation.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAGL,4BAA4B,EAG7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AACpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAGlI;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,4BAA4B,CAKjG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CACzC,mBAAmB,EAAE,0BAA0B,EAC/C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,4BAA4B,CAAC,CAcvC;AAED,wBAAgB,mCAAmC,IAAI,0CAA0C,EAAE,CAuDlG"}

package/dist/esm/users/services/user-deletion-audit.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-deletion-audit.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/users/services/user-deletion-audit.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAUH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAsEpH;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAmB/F"}
+{"version":3,"file":"user-deletion-audit.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/users/services/user-deletion-audit.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAUH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAsEpH;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CAmB/F"}

package/dist/esm/users/services/user-force-password-reset.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-force-password-reset.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/users/services/user-force-password-reset.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAUH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA2GpH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,qCAAqC,IAAI,0CAA0C,EAAE,CAwDpG"}
+{"version":3,"file":"user-force-password-reset.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/users/services/user-force-password-reset.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAUH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA2GpH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,qCAAqC,IAAI,0CAA0C,EAAE,CAwDpG"}

package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-read-retained.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/users/services/user-read-retained.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAWH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA0GpH,wBAAgB,+BAA+B,IAAI,0CAA0C,EAAE,CA4D9F"}
+{"version":3,"file":"user-read-retained.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/users/services/user-read-retained.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAWH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA0GpH,wBAAgB,+BAA+B,IAAI,0CAA0C,EAAE,CA4D9F"}

package/dist/esm/users/services/user-read-retained.custom-impl.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-read-retained.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../src/users/services/user-read-retained.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AACpH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,+EAA+E,CAAC;AAEvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAsBpF;;;;;;GAMG;AACH,SAAS,mCAAmC,CAC1C,EAAW,EACX,KAAc,EACd,gBAAuC,EACvC,KAAyB;IAEzB,kGAAkG;IAClG,4FAA4F;IAC5F,qCAAqC;IACrC,MAAM,aAAa,GAAG,sBAAsB,CAAC,EAAW,CAAC,CAAC;IAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;YACtF,OAAO,EAAE;gBACP,MAAM,EAAE,mDAAmD;gBAC3D,kBAAkB,EAAE,0BAA0B,CAAC,EAAW,CAAC;aAC5D;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,eAAe,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YAC7E,OAAO,EAAE;gBACP,MAAM,EAAE,wCAAwC;gBAChD,OAAO,EACL,4FAA4F;sBAC1F,qEAAqE;aAC1E;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAE9G,MAAM,MAAM,GAAG,OAAQ,KAA8B,EAAE,MAAM,KAAK,QAAQ;QACxE,CAAC,CAAC,CAAE,KAA4B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QAC/C,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,4FAA4F;QAC5F,iGAAiG;QACjG,2FAA2F;QAC3F,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;YACtF,OAAO,EAAE;gBACP,MAAM,EAAE,kDAAkD;gBAC1D,OAAO,EAAE,oGAAoG;aAC9G;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,mBAAmB,EAAE,gBAAgB,CAAC,aAAa;YACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,wCAAwC;QACpD,QAAQ,EAAE;YACR,uFAAuF;YACvF,6EAA6E;YAC7E,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBACjF,mCAAmC,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACxE,OAAO,KAAK,CAAC;YACf,CAAC;YACD;;;;;;;;;eASG;YACH,qBAAqB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAClE,mCAAmC,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAE1E,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;gBAEvG;;;;;;;;mBAQG;gBACH,OAAO,MAAM,YAAY,CAAC,oBAAoB,CAC5C,gBAAgB,CAAC,KAAK,EACtB,aAAa,EACb,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAC/C;oBACE,uFAAuF;oBACvF,oFAAoF;oBACpF,iEAAiE;oBACjE,YAAY,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc;wBACzD,CAAC,CAAC,EAAE,cAAc,EAAE,gBAAgB,CAAC,YAAY,CAAC,cAAc,EAAE;wBAClE,CAAC,CAAC,SAAS;iBACd,CACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEL,OAAO,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC","sourcesContent":["/**\n * `users | read_retained` — the operator surface for the audited see-through read (#490).\n *\n * # What this replaced: a capability nothing could reach\n *\n * `SystemAccessBackendService.readRetainedAsSystem` is the sanctioned way to reveal a RETAINED\n * (erased-and-impersonalized) user row. It has been complete and correct since retention landed —\n * it asserts the `seeRetained` policy verb, demands a privileged role, refuses a blank attribution,\n * sets the see-through flag for that read only, and emits a human-attributed `RETAINED_DATA_ACCESS`\n * audit row.\n *\n * And it had **no caller**. Measured: the only references were the factory that derives its grant\n * and the schema prose describing it as LIVE. So the capability existed, was audited by\n * construction, and the only route an operator actually had to a retained record was a database\n * console — which is precisely the unaudited path the primitive was built to replace.\n *\n * # Why an authenticated resource operation, and not an admin controller\n *\n * The engine already has an operator-facing admin controller pattern (`data-seeding-admin`), and it\n * is the wrong shape here: it authenticates with a shared `X-Admin-Secret`, which yields no user id\n * and no roles. The primitive requires BOTH — it fail-closes on a blank `accessingUserId`, and the\n * audit row's entire purpose is to say WHO looked. A shared secret answers \"someone who holds the\n * secret\", which is the question the record exists to improve on.\n *\n * A resource operation runs inside the application's own authentication and authorization, so the\n * caller's identity and roles arrive already established and cannot be self-asserted.\n *\n * # Application tier, deliberately — not platform tier\n *\n * A retention policy is an application's decision about its own data, the role gate the primitive\n * enforces (`APP_ADMIN_SUPER_ADMIN`) is an application role, and the system context the primitive\n * builds is APPLICATION-scoped. A platform-tier version would cross tenants, and would therefore\n * come under the declared cross-tenant admission rules and the `PLATFORM_ACCESS_GRANTS` requirement\n * rather than an ordinary role check. That is a bigger, different door; it is not this one, and it\n * should not be added by widening this one.\n */\n\nimport {\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ResourceOperationVariantType,\n  Users_Operations,\n} from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\n\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport {\n  describeUnaddressableShape,\n  resolveSingleSubjectId,\n} from '~wildo-backend-lib/base-classes/utils/single-subject-addressing.backend.utils';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\ninterface ErrorBuildingUtils {\n  errorBuilder: {\n    buildError: (\n      type: ErrorType,\n      executionContext?: unknown,\n      options?: { customMessageReference?: ErrorCustomMessageReference; context?: Record<string, unknown> },\n    ) => unknown;\n  };\n}\n\n/** Everything the reveal needs, resolved from the request and the established session. */\ninterface ValidatedRetainedReadRequest {\n  subjectUserId: string;\n  accessingUserId: string;\n  accessingUserRoles: string[];\n  reason: string;\n}\n\n/**\n * Resolve and validate the whole request, or throw.\n *\n * PURE and idempotent, so the PREFIX phase can run it to refuse before anything happens and the\n * REPLACE phase can re-derive the same values without state threaded between them — the shape the\n * sibling `force_password_reset` implementation records.\n */\nfunction resolveValidatedRetainedReadRequest(\n  id: unknown,\n  input: unknown,\n  executionContext: ExecutionContext<any>,\n  utils: ErrorBuildingUtils,\n): ValidatedRetainedReadRequest {\n  // Exactly one subject. A population-addressed reveal would disclose every retained row matching a\n  // filter on one operator's single stated reason, and the audit row would record that reason\n  // against a disclosure nobody sized.\n  const subjectUserId = resolveSingleSubjectId(id as never);\n  if (subjectUserId === undefined) {\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n      context: {\n        reason: 'read_retained requires a single addressed user id',\n        receivedAddressing: describeUnaddressableShape(id as never),\n      },\n    });\n  }\n\n  /*\n   * A HUMAN, and only a human.\n   *\n   * The sibling `force_password_reset` accepts a machine credential as attribution, and that is\n   * right there: a forced reset is an administrative ACT whose provenance is the strongest\n   * attribution available for a machine caller. This is different. The record being written says a\n   * named person chose to look at data an erasure removed, for a reason they wrote down — and an\n   * API key can supply neither half. `machineCredential` would answer \"which credential\", never\n   * \"who\", and the audit row is the whole reason this read is permitted at all.\n   */\n  const accessingUserId = executionContext.initiatorIds?.userId;\n  if (!accessingUserId) {\n    throw utils.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n      context: {\n        reason: 'read_retained_requires_human_principal',\n        message:\n          'Revealing a retained (erased) record requires an authenticated human principal. A machine '\n          + 'credential cannot supply the attribution this reveal is audited on.',\n      },\n    });\n  }\n\n  /*\n   * Roles from the ESTABLISHED session, never from the request body.\n   *\n   * The primitive re-asserts the privileged role itself, and it can only assert what it is handed —\n   * so handing it a request-supplied list would let a caller name their own authorization. The\n   * execution context's roles were established by authentication and cannot be written by the\n   * caller. Flattened across scopes because the primitive tests for one member, not for a scope.\n   */\n  const accessingUserRoles = (executionContext.initiatorRoles ?? []).flatMap((roleInfo) => [...roleInfo.roles]);\n\n  const reason = typeof (input as { reason?: unknown })?.reason === 'string'\n    ? ((input as { reason: string }).reason).trim()\n    : '';\n  if (!reason) {\n    // Also enforced by the request DTO and again inside the primitive. Three sites, because the\n    // audit store persists `eventData` unparsed: a blank reason that reached the row would produce a\n    // reveal recorded with no justification, which is indistinguishable from an unaudited one.\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n      context: {\n        reason: 'read_retained requires a non-empty justification',\n        message: 'Provide `reason`: why this retained record is being revealed (legal hold, dispute, investigation).',\n      },\n    });\n  }\n\n  return { subjectUserId, accessingUserId, accessingUserRoles, reason };\n}\n\nexport function createUserReadRetainedFactories(): ResourceCustomServiceImplementationFactory[] {\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n    createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier: CoreResourceType.USERS,\n        operationIdentifier: Users_Operations.READ_RETAINED,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      },\n      debugLabel: 'users.read_retained.see-through-reveal',\n      handlers: {\n        // Every refusal lives in PREFIX, the only phase that runs before the core write — so a\n        // rejected request cannot have touched the row on its way to being rejected.\n        prefixCoreOperations: async (id, input, executionContext, _operationPath, utils) => {\n          resolveValidatedRetainedReadRequest(id, input, executionContext, utils);\n          return input;\n        },\n        /*\n         * REPLACE, because the operation is UPDATE-like and must WRITE NOTHING.\n         *\n         * `resourceOperationLike: UPDATE` is how the operation gets a PUT with a body — the request\n         * carries a free-text justification, and a GET would put it in the URL and therefore in\n         * every access log between the operator and the server. Left to the generic core path, that\n         * declaration would make this a real update: a retained row is frozen, so it would fail, and\n         * on a resource that did not freeze it, it would silently write. Replacing the core\n         * operation is what makes an UPDATE-shaped route a read.\n         */\n        replaceCoreOperations: async (id, input, executionContext, _operationPath, utils) => {\n          const { subjectUserId, accessingUserId, accessingUserRoles, reason } =\n            resolveValidatedRetainedReadRequest(id, input, executionContext, utils);\n\n          const systemAccess = container.get<SystemAccessBackendService>(SAAS_SERVICE_TYPES.SystemAccessService);\n\n          /*\n           * Through the PRIMITIVE, never through the repository.\n           *\n           * This is the line the whole issue turns on. The same row is reachable by building a\n           * super-admin context and reading it directly — and that path asserts no `seeRetained`\n           * grant, sets no see-through flag, and writes no audit row. Reaching the repository here\n           * would reveal exactly the same personal data with no record of it, which is the outcome\n           * the audited pair exists to prevent.\n           */\n          return await systemAccess.readRetainedAsSystem(\n            CoreResourceType.USERS,\n            subjectUserId,\n            { accessingUserId, accessingUserRoles, reason },\n            {\n              // Scoped to the organization the caller is acting in, when there is one. The primitive\n              // suppresses the RETENTION predicate only — never the scope filter — so this cannot\n              // widen the read beyond what the caller could otherwise address.\n              scopeContext: executionContext.initiatorIds?.organizationId\n                ? { organizationId: executionContext.initiatorIds.organizationId }\n                : undefined,\n            },\n          );\n        },\n      },\n    });\n\n  return [factory];\n}\n"]}
+{"version":3,"file":"user-read-retained.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../src/users/services/user-read-retained.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EACL,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AACpH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,+EAA+E,CAAC;AAEvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAsBpF;;;;;;GAMG;AACH,SAAS,mCAAmC,CAC1C,EAAW,EACX,KAAc,EACd,gBAAuC,EACvC,KAAyB;IAEzB,kGAAkG;IAClG,4FAA4F;IAC5F,qCAAqC;IACrC,MAAM,aAAa,GAAG,sBAAsB,CAAC,EAAW,CAAC,CAAC;IAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;YACtF,OAAO,EAAE;gBACP,MAAM,EAAE,mDAAmD;gBAC3D,kBAAkB,EAAE,0BAA0B,CAAC,EAAW,CAAC;aAC5D;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,eAAe,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YAC7E,OAAO,EAAE;gBACP,MAAM,EAAE,wCAAwC;gBAChD,OAAO,EACL,4FAA4F;sBAC1F,qEAAqE;aAC1E;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,kBAAkB,GAAG,CAAC,gBAAgB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAE9G,MAAM,MAAM,GAAG,OAAQ,KAA8B,EAAE,MAAM,KAAK,QAAQ;QACxE,CAAC,CAAC,CAAE,KAA4B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QAC/C,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,4FAA4F;QAC5F,iGAAiG;QACjG,2FAA2F;QAC3F,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,sBAAsB,EAAE,2BAA2B,CAAC,kCAAkC;YACtF,OAAO,EAAE;gBACP,MAAM,EAAE,kDAAkD;gBAC1D,OAAO,EAAE,oGAAoG;aAC9G;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;YAC1C,mBAAmB,EAAE,gBAAgB,CAAC,aAAa;YACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,wCAAwC;QACpD,QAAQ,EAAE;YACR,uFAAuF;YACvF,6EAA6E;YAC7E,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBACjF,mCAAmC,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACxE,OAAO,KAAK,CAAC;YACf,CAAC;YACD;;;;;;;;;eASG;YACH,qBAAqB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAClE,mCAAmC,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAE1E,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;gBAEvG;;;;;;;;mBAQG;gBACH,OAAO,MAAM,YAAY,CAAC,oBAAoB,CAC5C,gBAAgB,CAAC,KAAK,EACtB,aAAa,EACb,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAC/C;oBACE,uFAAuF;oBACvF,oFAAoF;oBACpF,iEAAiE;oBACjE,YAAY,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc;wBACzD,CAAC,CAAC,EAAE,cAAc,EAAE,gBAAgB,CAAC,YAAY,CAAC,cAAc,EAAE;wBAClE,CAAC,CAAC,SAAS;iBACd,CACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;IAEL,OAAO,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC","sourcesContent":["/**\n * `users | read_retained` — the operator surface for the audited see-through read (#490).\n *\n * # What this replaced: a capability nothing could reach\n *\n * `SystemAccessBackendService.readRetainedAsSystem` is the sanctioned way to reveal a RETAINED\n * (erased-and-impersonalized) user row. It has been complete and correct since retention landed —\n * it asserts the `seeRetained` policy verb, demands a privileged role, refuses a blank attribution,\n * sets the see-through flag for that read only, and emits a human-attributed `RETAINED_DATA_ACCESS`\n * audit row.\n *\n * And it had **no caller**. Measured: the only references were the factory that derives its grant\n * and the schema prose describing it as LIVE. So the capability existed, was audited by\n * construction, and the only route an operator actually had to a retained record was a database\n * console — which is precisely the unaudited path the primitive was built to replace.\n *\n * # Why an authenticated resource operation, and not an admin controller\n *\n * The engine already has an operator-facing admin controller pattern (`data-seeding-admin`), and it\n * is the wrong shape here: it authenticates with a shared `X-Admin-Secret`, which yields no user id\n * and no roles. The primitive requires BOTH — it fail-closes on a blank `accessingUserId`, and the\n * audit row's entire purpose is to say WHO looked. A shared secret answers \"someone who holds the\n * secret\", which is the question the record exists to improve on.\n *\n * A resource operation runs inside the application's own authentication and authorization, so the\n * caller's identity and roles arrive already established and cannot be self-asserted.\n *\n * # Application tier, deliberately — not platform tier\n *\n * A retention policy is an application's decision about its own data, the role gate the primitive\n * enforces (`APP_ADMIN_SUPER_ADMIN`) is an application role, and the system context the primitive\n * builds is APPLICATION-scoped. A platform-tier version would cross tenants, and would therefore\n * come under the declared cross-tenant admission rules and the `PLATFORM_ACCESS_GRANTS` requirement\n * rather than an ordinary role check. That is a bigger, different door; it is not this one, and it\n * should not be added by widening this one.\n */\n\nimport {\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ResourceOperationVariantType,\n  Users_Operations,\n} from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\n\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport {\n  describeUnaddressableShape,\n  resolveSingleSubjectId,\n} from '~wildo-backend-lib/base-classes/utils/single-subject-addressing.backend.utils';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\ninterface ErrorBuildingUtils {\n  errorBuilder: {\n    buildError: (\n      type: ErrorType,\n      executionContext?: unknown,\n      options?: { customMessageReference?: ErrorCustomMessageReference; context?: Record<string, unknown> },\n    ) => unknown;\n  };\n}\n\n/** Everything the reveal needs, resolved from the request and the established session. */\ninterface ValidatedRetainedReadRequest {\n  subjectUserId: string;\n  accessingUserId: string;\n  accessingUserRoles: string[];\n  reason: string;\n}\n\n/**\n * Resolve and validate the whole request, or throw.\n *\n * PURE and idempotent, so the PREFIX phase can run it to refuse before anything happens and the\n * REPLACE phase can re-derive the same values without state threaded between them — the shape the\n * sibling `force_password_reset` implementation records.\n */\nfunction resolveValidatedRetainedReadRequest(\n  id: unknown,\n  input: unknown,\n  executionContext: ExecutionContext<any>,\n  utils: ErrorBuildingUtils,\n): ValidatedRetainedReadRequest {\n  // Exactly one subject. A population-addressed reveal would disclose every retained row matching a\n  // filter on one operator's single stated reason, and the audit row would record that reason\n  // against a disclosure nobody sized.\n  const subjectUserId = resolveSingleSubjectId(id as never);\n  if (subjectUserId === undefined) {\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n      context: {\n        reason: 'read_retained requires a single addressed user id',\n        receivedAddressing: describeUnaddressableShape(id as never),\n      },\n    });\n  }\n\n  /*\n   * A HUMAN, and only a human.\n   *\n   * The sibling `force_password_reset` accepts a machine credential as attribution, and that is\n   * right there: a forced reset is an administrative ACT whose provenance is the strongest\n   * attribution available for a machine caller. This is different. The record being written says a\n   * named person chose to look at data an erasure removed, for a reason they wrote down — and an\n   * API key can supply neither half. `machineCredential` would answer \"which credential\", never\n   * \"who\", and the audit row is the whole reason this read is permitted at all.\n   */\n  const accessingUserId = executionContext.initiatorIds?.userId;\n  if (!accessingUserId) {\n    throw utils.errorBuilder.buildError(ErrorType.AUTHORIZATION, executionContext, {\n      context: {\n        reason: 'read_retained_requires_human_principal',\n        message:\n          'Revealing a retained (erased) record requires an authenticated human principal. A machine '\n          + 'credential cannot supply the attribution this reveal is audited on.',\n      },\n    });\n  }\n\n  /*\n   * Roles from the ESTABLISHED session, never from the request body.\n   *\n   * The primitive re-asserts the privileged role itself, and it can only assert what it is handed —\n   * so handing it a request-supplied list would let a caller name their own authorization. The\n   * execution context's roles were established by authentication and cannot be written by the\n   * caller. Flattened across scopes because the primitive tests for one member, not for a scope.\n   */\n  const accessingUserRoles = (executionContext.initiatorRoles ?? []).flatMap((roleInfo) => [...roleInfo.roles]);\n\n  const reason = typeof (input as { reason?: unknown })?.reason === 'string'\n    ? ((input as { reason: string }).reason).trim()\n    : '';\n  if (!reason) {\n    // Also enforced by the request DTO and again inside the primitive. Three sites, because the\n    // audit store persists `eventData` unparsed: a blank reason that reached the row would produce a\n    // reveal recorded with no justification, which is indistinguishable from an unaudited one.\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      customMessageReference: ErrorCustomMessageReference.SERVICE_RESOURCE_VALIDATION_FAILED,\n      context: {\n        reason: 'read_retained requires a non-empty justification',\n        message: 'Provide `reason`: why this retained record is being revealed (legal hold, dispute, investigation).',\n      },\n    });\n  }\n\n  return { subjectUserId, accessingUserId, accessingUserRoles, reason };\n}\n\nexport function createUserReadRetainedFactories(): ResourceCustomServiceImplementationFactory[] {\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n    createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier: CoreResourceType.USERS,\n        operationIdentifier: Users_Operations.READ_RETAINED,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      },\n      debugLabel: 'users.read_retained.see-through-reveal',\n      handlers: {\n        // Every refusal lives in PREFIX, the only phase that runs before the core write — so a\n        // rejected request cannot have touched the row on its way to being rejected.\n        prefixCoreOperations: async (id, input, executionContext, _operationPath, utils) => {\n          resolveValidatedRetainedReadRequest(id, input, executionContext, utils);\n          return input;\n        },\n        /*\n         * REPLACE, because the operation is UPDATE-like and must WRITE NOTHING.\n         *\n         * `resourceOperationLike: UPDATE` is how the operation gets a PUT with a body — the request\n         * carries a free-text justification, and a GET would put it in the URL and therefore in\n         * every access log between the operator and the server. Left to the generic core path, that\n         * declaration would make this a real update: a retained row is frozen, so it would fail, and\n         * on a resource that did not freeze it, it would silently write. Replacing the core\n         * operation is what makes an UPDATE-shaped route a read.\n         */\n        replaceCoreOperations: async (id, input, executionContext, _operationPath, utils) => {\n          const { subjectUserId, accessingUserId, accessingUserRoles, reason } =\n            resolveValidatedRetainedReadRequest(id, input, executionContext, utils);\n\n          const systemAccess = container.get<SystemAccessBackendService>(SAAS_SERVICE_TYPES.SystemAccessService);\n\n          /*\n           * Through the PRIMITIVE, never through the repository.\n           *\n           * This is the line the whole issue turns on. The same row is reachable by building a\n           * super-admin context and reading it directly — and that path asserts no `seeRetained`\n           * grant, sets no see-through flag, and writes no audit row. Reaching the repository here\n           * would reveal exactly the same personal data with no record of it, which is the outcome\n           * the audited pair exists to prevent.\n           */\n          return await systemAccess.readRetainedAsSystem(\n            CoreResourceType.USERS,\n            subjectUserId,\n            { accessingUserId, accessingUserRoles, reason },\n            {\n              // Scoped to the organization the caller is acting in, when there is one. The primitive\n              // suppresses the RETENTION predicate only — never the scope filter — so this cannot\n              // widen the read beyond what the caller could otherwise address.\n              scopeContext: executionContext.initiatorIds?.organizationId\n                ? { organizationId: executionContext.initiatorIds.organizationId }\n                : undefined,\n            },\n          );\n        },\n      },\n    });\n\n  return [factory];\n}\n"]}

package/dist/esm/users/services/user-role-administration.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-role-administration.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/users/services/user-role-administration.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAsYpH,uCAAuC;AACvC,wBAAgB,mCAAmC,IAAI,0CAA0C,EAAE,CAKlG;AAiJD,mDAAmD;AACnD,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAKjG"}
+{"version":3,"file":"user-role-administration.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/users/services/user-role-administration.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAsYpH,uCAAuC;AACvC,wBAAgB,mCAAmC,IAAI,0CAA0C,EAAE,CAKlG;AAiJD,mDAAmD;AACnD,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAKjG"}

package/dist/esm/users/services/user-self-custom-implementations.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-self-custom-implementations.backend.d.ts","sourceRoot":"","sources":["../../../../../src/users/services/user-self-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA0IpH,eAAO,MAAM,6BAA6B,EAAE,0CAA0C,EAGrF,CAAC"}
+{"version":3,"file":"user-self-custom-implementations.backend.d.ts","sourceRoot":"","sources":["../../../../src/users/services/user-self-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA0IpH,eAAO,MAAM,6BAA6B,EAAE,0CAA0C,EAGrF,CAAC"}

package/dist/esm/users/services/user-super-admin-floor.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-super-admin-floor.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/users/services/user-super-admin-floor.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAUH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA8CpH;;GAEG;AACH,wBAAgB,sCAAsC,IAAI,0CAA0C,CAiEnG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,sCAAsC,IAAI,0CAA0C,CA+DnG;AAED,yDAAyD;AACzD,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAEjG"}
+{"version":3,"file":"user-super-admin-floor.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/users/services/user-super-admin-floor.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAUH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA8CpH;;GAEG;AACH,wBAAgB,sCAAsC,IAAI,0CAA0C,CAiEnG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,sCAAsC,IAAI,0CAA0C,CA+DnG;AAED,yDAAyD;AACzD,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAEjG"}