@wildo-ai/saas-backend-lib 1.1.8 → 1.1.9

package/dist/esm/security/authentications/__tests__/registration-onboarding.harness.js

@@ -1,140 +0,0 @@
-import { vi } from 'vitest';
-import { AuthMethod, ErrorType } from '@wildo-ai/saas-models';
-import { AuthenticationOrchestratorBackendService } from '../../../security/authentications/services/authentication-orchestrator.backend.service.js';
-/**
- * A REAL `AuthenticationOrchestratorBackendService` for the registration → onboarding journey (#1011,
- * #1008), with only its collaborators replaced.
- *
- * The pins that use it exist because the defect lived INSIDE the orchestrator's own session handling —
- * `processEmailVerification` created a fresh session that no pending organization type reached, and
- * `completeOrgOnboarding` wrote `COMPLETED` for any number of concurrent callers. A unit double of the
- * orchestrator answers whatever the test tells it to, so it can only ever reproduce the drop that the
- * test author already knows about. So the orchestrator's real `createSession` / `getSession` /
- * `updateSession` / `consumeSession`, its real registration pipeline, its real enrollment settlement and
- * its real `completeOrgOnboarding` (including the real durable-onboarding ledger code) run here against:
- *
- * - an in-memory session store with the production store's contracts: `atomicUpdate` lands only on the
- *   version the caller read, and `consume` reports `true` to exactly the caller whose delete removed the
- *   key (Redis `DEL`'s count) — the same double `login-completion-single-mint.test.ts` uses;
- * - an in-memory `organizationOnboardingOperations` ledger behind the three repository doors the
- *   production ledger uses (#1131): a filtered read, an insert whose `_id` is unique (a second insert is
- *   refused with the classified CONFLICT both adapters raise), and a compare-and-set update.
- *
- * What is stubbed is policy RESOLUTION (which MFA posture a user type has) and credential storage —
- * inputs to the journey, not the journey.
- */
-/** The onboarding ledger's repository doors, in memory, with the store contracts the ledger relies on (#1131). */
-export function createInMemoryOnboardingLedger() {
-    const rows = new Map();
-    const matches = (row, filter) => Object.entries(filter).every(([key, value]) => row[key] === value);
-    const repositoriesRegistry = {
-        readUnscopedByKey: vi.fn(async (_resourceType, filter) => {
-            const row = rows.get(filter._id);
-            return row && matches(row, filter) ? { ...row } : null;
-        }),
-        insertDocumentForInfrastructure: vi.fn(async (_resourceType, doc) => {
-            if (rows.has(doc._id)) {
-                // The classified refusal `insertRawDocument` raises on either adapter for a duplicate primary key.
-                throw { type: ErrorType.CONFLICT, customMessageReference: 'conflict', context: { duplicateKey: doc._id } };
-            }
-            rows.set(doc._id, { ...doc });
-            return { ...doc };
-        }),
-        atomicGuardedMutation: vi.fn(async (_resourceType, filter, mutation) => {
-            const row = rows.get(filter._id);
-            if (!row || !matches(row, filter))
-                return null;
-            Object.assign(row, mutation.set);
-            return { ...row };
-        }),
-    };
-    return { rows, repositoriesRegistry };
-}
-/** The production session store's contracts, in memory. Session ids are `S-1`, `S-2`, … in creation order. */
-export function createInMemoryAuthSessionStore() {
-    const sessions = new Map();
-    let sequence = 0;
-    const store = {
-        generateSessionId: vi.fn(() => `S-${++sequence}`),
-        set: vi.fn(async (id, session) => { sessions.set(id, { ...session }); }),
-        get: vi.fn(async (id) => {
-            const session = sessions.get(id);
-            return session ? { ...session } : null;
-        }),
-        atomicUpdate: vi.fn(async (id, updated, expectedVersion) => {
-            const current = sessions.get(id);
-            if (!current || (current.version ?? 0) !== expectedVersion)
-                return null;
-            sessions.set(id, { ...updated });
-            return { ...updated };
-        }),
-        delete: vi.fn(async (id) => { sessions.delete(id); }),
-        consume: vi.fn(async (id) => sessions.delete(id)),
-    };
-    return { sessions, store };
-}
-export function buildRealRegistrationOrchestrator(deps) {
-    const service = Object.create(AuthenticationOrchestratorBackendService.prototype);
-    const { sessions, store } = createInMemoryAuthSessionStore();
-    const ledger = createInMemoryOnboardingLedger();
-    const posture = {};
-    service.sessionStore = store;
-    service.logDebug = vi.fn();
-    service.logger = { warn: vi.fn(), error: vi.fn(), debug: vi.fn(), info: vi.fn() };
-    service.errorBuilder = deps.errorBuilder;
-    service.appConfigService = deps.appConfigService;
-    service.servicesRegistryHandler = deps.servicesRegistryHandler;
-    service.systemAccessService = deps.systemAccessService;
-    service.resourcePersistenceUnitOfWork = deps.resourcePersistenceUnitOfWork;
-    service.repositoriesRegistry = ledger.repositoriesRegistry;
-    const policy = () => ({
-        authMethodsEnabled: { [AuthMethod.PASSWORD]: true, [AuthMethod.TOTP]: true },
-        mfaPolicy: { requireMFA: posture.requireMFA ?? false, enrollmentGracePeriodDays: posture.enrollmentGracePeriodDays ?? 0 },
-        lockoutPolicy: { maxLoginAttempts: 5, progressiveLockout: false },
-        sessionDurationMinutes: 30,
-    });
-    service._resolveAuthPolicy = vi.fn(() => policy());
-    service._resolveAuthPolicyWithOrgOverrides = vi.fn(async () => policy());
-    service._shouldRequireMFA = vi.fn(async () => ({ required: posture.requireMFA ?? false, enrolledMethods: [], presentableMethods: [] }));
-    service.credentialOps = {
-        readByUserId: vi.fn(async () => ({ _id: 'cred-1', mfaEnrollmentState: undefined })),
-        updateById: vi.fn(async () => undefined),
-    };
-    // The factor the registrant just enrolled is enrolled and accepted: the enrollment ceremony is not the subject.
-    service._resolveEnrolledAcceptedSecondFactors = vi.fn(async () => ({ policy: policy(), cred: null, enrolledAndAccepted: [AuthMethod.TOTP] }));
-    service.userLookup = {
-        findUserById: vi.fn(async (_ec, userId) => deps.findUserById?.(userId) ?? null),
-        /*
-         * Read by `completeOrgOnboarding` since #1215: the method that proved a PARKED federated sign-in
-         * must still be enabled when the tokens are finally minted, which happens here rather than at the
-         * callback. A resolved policy always carries `authMethodsEnabled` in production — the schema
-         * defaults it — so the double supplies it too.
-         */
-        resolveEffectiveAuthPolicy: vi.fn(async () => ({
-            authMethodsEnabled: {
-                [AuthMethod.PASSWORD]: true,
-                [AuthMethod.MAGIC_LINK]: true,
-                [AuthMethod.PASSKEY]: true,
-                [AuthMethod.EXTERNAL_OAUTH2]: true,
-                [AuthMethod.ORG_OPENID_CONNECT]: true,
-                [AuthMethod.ORG_SAML]: true,
-            },
-        })),
-    };
-    service.tokenIssuer = { issueTokens: vi.fn(async () => ({ accessToken: 'enrollment-access', refreshToken: 'enrollment-refresh', expiresIn: 900 })) };
-    service.auditLogsService = { logUserLogin: vi.fn(async () => undefined) };
-    return {
-        /*
-         * Typed as a plain record, not `AuthenticationOrchestratorBackendService & Record<…>`: the class has
-         * `private` members, TypeScript matches those by declaration site, and the intersection refuses every
-         * read of one — which the pins need (`createSession`, `tokenIssuer`, `auditLogsService`).
-         */
-        orchestrator: service,
-        sessions,
-        store,
-        ledger,
-        /** Set the user type's MFA posture before driving the pipeline. */
-        setPosture: (next) => Object.assign(posture, next),
-    };
-}
-//# sourceMappingURL=registration-onboarding.harness.js.map

package/dist/esm/security/authentications/__tests__/registration-onboarding.harness.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"registration-onboarding.harness.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/__tests__/registration-onboarding.harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,wCAAwC,EAAE,MAAM,kGAAkG,CAAC;AAE5J;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,kHAAkH;AAClH,MAAM,UAAU,8BAA8B;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,GAA4B,EAAE,MAA+B,EAAE,EAAE,CAChF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;IAErE,MAAM,oBAAoB,GAAG;QAC3B,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,aAAsB,EAAE,MAA+B,EAAE,EAAE;YACzF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAa,CAAC,CAAC;YAC3C,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,CAAC,CAAC;QACF,+BAA+B,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,aAAsB,EAAE,GAA4B,EAAE,EAAE;YACpG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAa,CAAC,EAAE,CAAC;gBAChC,mGAAmG;gBACnG,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,sBAAsB,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7G,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAa,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YACxC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC;QACF,qBAAqB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,aAAsB,EAAE,MAA+B,EAAE,QAA2C,EAAE,EAAE;YAC1I,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAa,CAAC,CAAC;YAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC;KACH,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;AACxC,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,8BAA8B;IAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC5D,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG;QACZ,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;QACjD,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,OAAgC,EAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;YAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC;QACF,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,OAAgC,EAAE,eAAuB,EAAE,EAAE;YAClG,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,eAAe;gBAAE,OAAO,IAAI,CAAC;YACxE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YACjC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACxB,CAAC,CAAC;QACF,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;KAC1D,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAmBD,MAAM,UAAU,iCAAiC,CAAC,IAAiD;IACjG,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,wCAAwC,CAAC,SAAS,CAAQ,CAAC;IACzF,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,8BAA8B,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,8BAA8B,EAAE,CAAC;IAChD,MAAM,OAAO,GAA8B,EAAE,CAAC;IAE9C,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC;IAC7B,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IAC3B,OAAO,CAAC,MAAM,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;IAClF,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACzC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACjD,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,uBAAuB,CAAC;IAC/D,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACvD,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,6BAA6B,CAAC;IAC3E,OAAO,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAE3D,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;QACpB,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE;QAC5E,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK,EAAE,yBAAyB,EAAE,OAAO,CAAC,yBAAyB,IAAI,CAAC,EAAE;QACzH,aAAa,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE;QACjE,sBAAsB,EAAE,EAAE;KAC3B,CAAC,CAAC;IACH,OAAO,CAAC,kBAAkB,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,kCAAkC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,iBAAiB,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxI,OAAO,CAAC,aAAa,GAAG;QACtB,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;KACzC,CAAC;IACF,gHAAgH;IAChH,OAAO,CAAC,qCAAqC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9I,OAAO,CAAC,UAAU,GAAG;QACnB,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAY,EAAE,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QAChG;;;;;WAKG;QACH,0BAA0B,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC7C,kBAAkB,EAAE;gBAClB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI;gBAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI;gBAC7B,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI;gBAC1B,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,IAAI;gBAClC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,IAAI;gBACrC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI;aAC5B;SACF,CAAC,CAAC;KACJ,CAAC;IACF,OAAO,CAAC,WAAW,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACrJ,OAAO,CAAC,gBAAgB,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;IAE1E,OAAO;QACL;;;;WAIG;QACH,YAAY,EAAE,OAA8B;QAC5C,QAAQ;QACR,KAAK;QACL,MAAM;QACN,mEAAmE;QACnE,UAAU,EAAE,CAAC,IAA+B,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;KAC9E,CAAC;AACJ,CAAC","sourcesContent":["import { vi } from 'vitest';\nimport { AuthMethod, ErrorType } from '@wildo-ai/saas-models';\n\nimport { AuthenticationOrchestratorBackendService } from '~wildo-backend-lib/security/authentications/services/authentication-orchestrator.backend.service';\n\n/**\n * A REAL `AuthenticationOrchestratorBackendService` for the registration → onboarding journey (#1011,\n * #1008), with only its collaborators replaced.\n *\n * The pins that use it exist because the defect lived INSIDE the orchestrator's own session handling —\n * `processEmailVerification` created a fresh session that no pending organization type reached, and\n * `completeOrgOnboarding` wrote `COMPLETED` for any number of concurrent callers. A unit double of the\n * orchestrator answers whatever the test tells it to, so it can only ever reproduce the drop that the\n * test author already knows about. So the orchestrator's real `createSession` / `getSession` /\n * `updateSession` / `consumeSession`, its real registration pipeline, its real enrollment settlement and\n * its real `completeOrgOnboarding` (including the real durable-onboarding ledger code) run here against:\n *\n * - an in-memory session store with the production store's contracts: `atomicUpdate` lands only on the\n *   version the caller read, and `consume` reports `true` to exactly the caller whose delete removed the\n *   key (Redis `DEL`'s count) — the same double `login-completion-single-mint.test.ts` uses;\n * - an in-memory `organizationOnboardingOperations` ledger behind the three repository doors the\n *   production ledger uses (#1131): a filtered read, an insert whose `_id` is unique (a second insert is\n *   refused with the classified CONFLICT both adapters raise), and a compare-and-set update.\n *\n * What is stubbed is policy RESOLUTION (which MFA posture a user type has) and credential storage —\n * inputs to the journey, not the journey.\n */\n\n/** The onboarding ledger's repository doors, in memory, with the store contracts the ledger relies on (#1131). */\nexport function createInMemoryOnboardingLedger() {\n  const rows = new Map<string, Record<string, unknown>>();\n  const matches = (row: Record<string, unknown>, filter: Record<string, unknown>) =>\n    Object.entries(filter).every(([key, value]) => row[key] === value);\n\n  const repositoriesRegistry = {\n    readUnscopedByKey: vi.fn(async (_resourceType: unknown, filter: Record<string, unknown>) => {\n      const row = rows.get(filter._id as string);\n      return row && matches(row, filter) ? { ...row } : null;\n    }),\n    insertDocumentForInfrastructure: vi.fn(async (_resourceType: unknown, doc: Record<string, unknown>) => {\n      if (rows.has(doc._id as string)) {\n        // The classified refusal `insertRawDocument` raises on either adapter for a duplicate primary key.\n        throw { type: ErrorType.CONFLICT, customMessageReference: 'conflict', context: { duplicateKey: doc._id } };\n      }\n      rows.set(doc._id as string, { ...doc });\n      return { ...doc };\n    }),\n    atomicGuardedMutation: vi.fn(async (_resourceType: unknown, filter: Record<string, unknown>, mutation: { set?: Record<string, unknown> }) => {\n      const row = rows.get(filter._id as string);\n      if (!row || !matches(row, filter)) return null;\n      Object.assign(row, mutation.set);\n      return { ...row };\n    }),\n  };\n\n  return { rows, repositoriesRegistry };\n}\n\n/** The production session store's contracts, in memory. Session ids are `S-1`, `S-2`, … in creation order. */\nexport function createInMemoryAuthSessionStore() {\n  const sessions = new Map<string, Record<string, unknown>>();\n  let sequence = 0;\n  const store = {\n    generateSessionId: vi.fn(() => `S-${++sequence}`),\n    set: vi.fn(async (id: string, session: Record<string, unknown>) => { sessions.set(id, { ...session }); }),\n    get: vi.fn(async (id: string) => {\n      const session = sessions.get(id);\n      return session ? { ...session } : null;\n    }),\n    atomicUpdate: vi.fn(async (id: string, updated: Record<string, unknown>, expectedVersion: number) => {\n      const current = sessions.get(id);\n      if (!current || (current.version ?? 0) !== expectedVersion) return null;\n      sessions.set(id, { ...updated });\n      return { ...updated };\n    }),\n    delete: vi.fn(async (id: string) => { sessions.delete(id); }),\n    consume: vi.fn(async (id: string) => sessions.delete(id)),\n  };\n  return { sessions, store };\n}\n\nexport interface RegistrationOrchestratorHarnessDependencies {\n  appConfigService: unknown;\n  servicesRegistryHandler: unknown;\n  systemAccessService: unknown;\n  resourcePersistenceUnitOfWork: unknown;\n  errorBuilder: unknown;\n  /** The account the enrollment settlement re-checks before completing a registration. */\n  findUserById?: (userId: string) => Promise<unknown>;\n}\n\nexport interface RegistrationPolicyPosture {\n  /** The user type requires a second factor. */\n  requireMFA?: boolean;\n  /** Days a registrant may defer the enrollment `requireMFA` demands. */\n  enrollmentGracePeriodDays?: number;\n}\n\nexport function buildRealRegistrationOrchestrator(deps: RegistrationOrchestratorHarnessDependencies) {\n  const service = Object.create(AuthenticationOrchestratorBackendService.prototype) as any;\n  const { sessions, store } = createInMemoryAuthSessionStore();\n  const ledger = createInMemoryOnboardingLedger();\n  const posture: RegistrationPolicyPosture = {};\n\n  service.sessionStore = store;\n  service.logDebug = vi.fn();\n  service.logger = { warn: vi.fn(), error: vi.fn(), debug: vi.fn(), info: vi.fn() };\n  service.errorBuilder = deps.errorBuilder;\n  service.appConfigService = deps.appConfigService;\n  service.servicesRegistryHandler = deps.servicesRegistryHandler;\n  service.systemAccessService = deps.systemAccessService;\n  service.resourcePersistenceUnitOfWork = deps.resourcePersistenceUnitOfWork;\n  service.repositoriesRegistry = ledger.repositoriesRegistry;\n\n  const policy = () => ({\n    authMethodsEnabled: { [AuthMethod.PASSWORD]: true, [AuthMethod.TOTP]: true },\n    mfaPolicy: { requireMFA: posture.requireMFA ?? false, enrollmentGracePeriodDays: posture.enrollmentGracePeriodDays ?? 0 },\n    lockoutPolicy: { maxLoginAttempts: 5, progressiveLockout: false },\n    sessionDurationMinutes: 30,\n  });\n  service._resolveAuthPolicy = vi.fn(() => policy());\n  service._resolveAuthPolicyWithOrgOverrides = vi.fn(async () => policy());\n  service._shouldRequireMFA = vi.fn(async () => ({ required: posture.requireMFA ?? false, enrolledMethods: [], presentableMethods: [] }));\n  service.credentialOps = {\n    readByUserId: vi.fn(async () => ({ _id: 'cred-1', mfaEnrollmentState: undefined })),\n    updateById: vi.fn(async () => undefined),\n  };\n  // The factor the registrant just enrolled is enrolled and accepted: the enrollment ceremony is not the subject.\n  service._resolveEnrolledAcceptedSecondFactors = vi.fn(async () => ({ policy: policy(), cred: null, enrolledAndAccepted: [AuthMethod.TOTP] }));\n  service.userLookup = {\n    findUserById: vi.fn(async (_ec: unknown, userId: string) => deps.findUserById?.(userId) ?? null),\n    /*\n     * Read by `completeOrgOnboarding` since #1215: the method that proved a PARKED federated sign-in\n     * must still be enabled when the tokens are finally minted, which happens here rather than at the\n     * callback. A resolved policy always carries `authMethodsEnabled` in production — the schema\n     * defaults it — so the double supplies it too.\n     */\n    resolveEffectiveAuthPolicy: vi.fn(async () => ({\n      authMethodsEnabled: {\n        [AuthMethod.PASSWORD]: true,\n        [AuthMethod.MAGIC_LINK]: true,\n        [AuthMethod.PASSKEY]: true,\n        [AuthMethod.EXTERNAL_OAUTH2]: true,\n        [AuthMethod.ORG_OPENID_CONNECT]: true,\n        [AuthMethod.ORG_SAML]: true,\n      },\n    })),\n  };\n  service.tokenIssuer = { issueTokens: vi.fn(async () => ({ accessToken: 'enrollment-access', refreshToken: 'enrollment-refresh', expiresIn: 900 })) };\n  service.auditLogsService = { logUserLogin: vi.fn(async () => undefined) };\n\n  return {\n    /*\n     * Typed as a plain record, not `AuthenticationOrchestratorBackendService & Record<…>`: the class has\n     * `private` members, TypeScript matches those by declaration site, and the intersection refuses every\n     * read of one — which the pins need (`createSession`, `tokenIssuer`, `auditLogsService`).\n     */\n    orchestrator: service as Record<string, any>,\n    sessions,\n    store,\n    ledger,\n    /** Set the user type's MFA posture before driving the pipeline. */\n    setPosture: (next: RegistrationPolicyPosture) => Object.assign(posture, next),\n  };\n}\n"]}

package/dist/esm/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.d.ts

@@ -1,35 +0,0 @@
-/**
- * A COMPLETE `AuditLogsBackendService` test double for the OAuth2/OIDC-provider suites — every audit
- * method the provider flows emit, as a stable `vi.fn()` spy. Two reasons this exists as ONE shared
- * factory rather than an inline literal per test:
- *
- * 1. **Assertability** — a test can assert an emit fired (e.g. `spies.logOAuthConsentGranted` was called
- *    with the right event args). Callers must reuse ONE instance per service/container so `.mock.calls`
- *    stays stable across `container.get(AuditLogsService)`.
- * 2. **Future-proofing** — a NEW audit method added to the provider flow will not re-break every OAuth
- *    suite with `<method> is not a function`; it is added HERE, once. (This is exactly the breakage the
- *    2026-07-31 audit-tier work hit when the mocks only stubbed `logMachineAuth*`.)
- *
- * Every spy resolves (`async () => {}`) to mirror the fire-and-forget `void log*(…).catch(warn)` shape at
- * the emit sites. `clear()` resets call history between tests.
- */
-export declare function createOAuthProviderAuditLogsSpies(): {
-    /** Reset all spy call history (use in `beforeEach`). */
-    clear(): void;
-    logMachineAuthSuccess: import("vitest").Mock<[], Promise<void>>;
-    logMachineAuthFailed: import("vitest").Mock<[], Promise<void>>;
-    logOAuthDelegatedTokenIssued: import("vitest").Mock<[], Promise<void>>;
-    logOAuthConsentGranted: import("vitest").Mock<[], Promise<void>>;
-    logOAuthConsentDenied: import("vitest").Mock<[], Promise<void>>;
-    logOAuthConsentGrantPersisted: import("vitest").Mock<[], Promise<void>>;
-    logOAuthTokenRefreshed: import("vitest").Mock<[], Promise<void>>;
-    logOAuthTokenRevoked: import("vitest").Mock<[], Promise<void>>;
-    logOAuthRpInitiatedLogout: import("vitest").Mock<[], Promise<void>>;
-    logOAuthCodeExchangeFailed: import("vitest").Mock<[], Promise<void>>;
-    logOAuthConsentBindingViolation: import("vitest").Mock<[], Promise<void>>;
-    logUserRefreshTokenReuseDetected: import("vitest").Mock<[], Promise<void>>;
-    logCimdClientRefused: import("vitest").Mock<[], Promise<void>>;
-    logDynamicClientRegistered: import("vitest").Mock<[], Promise<void>>;
-};
-export type OAuthProviderAuditLogsSpies = ReturnType<typeof createOAuthProviderAuditLogsSpies>;
-//# sourceMappingURL=oauth-provider-audit-spies.mock.d.ts.map

package/dist/esm/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-provider-audit-spies.mock.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC;IAsB7C,wDAAwD;;;;;;;;;;;;;;;;EAK3D;AAED,MAAM,MAAM,2BAA2B,GAAG,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/esm/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.js

@@ -1,46 +0,0 @@
-import { vi } from 'vitest';
-/**
- * A COMPLETE `AuditLogsBackendService` test double for the OAuth2/OIDC-provider suites — every audit
- * method the provider flows emit, as a stable `vi.fn()` spy. Two reasons this exists as ONE shared
- * factory rather than an inline literal per test:
- *
- * 1. **Assertability** — a test can assert an emit fired (e.g. `spies.logOAuthConsentGranted` was called
- *    with the right event args). Callers must reuse ONE instance per service/container so `.mock.calls`
- *    stays stable across `container.get(AuditLogsService)`.
- * 2. **Future-proofing** — a NEW audit method added to the provider flow will not re-break every OAuth
- *    suite with `<method> is not a function`; it is added HERE, once. (This is exactly the breakage the
- *    2026-07-31 audit-tier work hit when the mocks only stubbed `logMachineAuth*`.)
- *
- * Every spy resolves (`async () => {}`) to mirror the fire-and-forget `void log*(…).catch(warn)` shape at
- * the emit sites. `clear()` resets call history between tests.
- */
-export function createOAuthProviderAuditLogsSpies() {
-    const spies = {
-        // Pre-existing machine-auth events (client_credentials front + the A-7 code-flow twins).
-        logMachineAuthSuccess: vi.fn(async () => { }),
-        logMachineAuthFailed: vi.fn(async () => { }),
-        // OAuth2/OIDC provider events (audit-tier A-1..A-9).
-        logOAuthDelegatedTokenIssued: vi.fn(async () => { }),
-        logOAuthConsentGranted: vi.fn(async () => { }),
-        logOAuthConsentDenied: vi.fn(async () => { }),
-        logOAuthConsentGrantPersisted: vi.fn(async () => { }),
-        logOAuthTokenRefreshed: vi.fn(async () => { }),
-        logOAuthTokenRevoked: vi.fn(async () => { }),
-        logOAuthRpInitiatedLogout: vi.fn(async () => { }),
-        logOAuthCodeExchangeFailed: vi.fn(async () => { }),
-        logOAuthConsentBindingViolation: vi.fn(async () => { }),
-        logUserRefreshTokenReuseDetected: vi.fn(async () => { }),
-        // Client-identity events: a refused CIMD assertion, and an anonymous RFC 7591 registration.
-        logCimdClientRefused: vi.fn(async () => { }),
-        logDynamicClientRegistered: vi.fn(async () => { }),
-    };
-    return {
-        ...spies,
-        /** Reset all spy call history (use in `beforeEach`). */
-        clear() {
-            for (const fn of Object.values(spies))
-                fn.mockClear();
-        },
-    };
-}
-//# sourceMappingURL=oauth-provider-audit-spies.mock.js.map

package/dist/esm/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-provider-audit-spies.mock.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/__tests__/oauth-provider-audit-spies.mock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iCAAiC;IAC/C,MAAM,KAAK,GAAG;QACZ,yFAAyF;QACzF,qBAAqB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QAC5C,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QAC3C,qDAAqD;QACrD,4BAA4B,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QACnD,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QAC7C,qBAAqB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QAC5C,6BAA6B,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QACpD,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QAC7C,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QAC3C,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QAChD,0BAA0B,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QACjD,+BAA+B,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QACtD,gCAAgC,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QACvD,4FAA4F;QAC5F,oBAAoB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;QAC3C,0BAA0B,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;KAClD,CAAC;IACF,OAAO;QACL,GAAG,KAAK;QACR,wDAAwD;QACxD,KAAK;YACH,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { vi } from 'vitest';\n\n/**\n * A COMPLETE `AuditLogsBackendService` test double for the OAuth2/OIDC-provider suites — every audit\n * method the provider flows emit, as a stable `vi.fn()` spy. Two reasons this exists as ONE shared\n * factory rather than an inline literal per test:\n *\n * 1. **Assertability** — a test can assert an emit fired (e.g. `spies.logOAuthConsentGranted` was called\n *    with the right event args). Callers must reuse ONE instance per service/container so `.mock.calls`\n *    stays stable across `container.get(AuditLogsService)`.\n * 2. **Future-proofing** — a NEW audit method added to the provider flow will not re-break every OAuth\n *    suite with `<method> is not a function`; it is added HERE, once. (This is exactly the breakage the\n *    2026-07-31 audit-tier work hit when the mocks only stubbed `logMachineAuth*`.)\n *\n * Every spy resolves (`async () => {}`) to mirror the fire-and-forget `void log*(…).catch(warn)` shape at\n * the emit sites. `clear()` resets call history between tests.\n */\nexport function createOAuthProviderAuditLogsSpies() {\n  const spies = {\n    // Pre-existing machine-auth events (client_credentials front + the A-7 code-flow twins).\n    logMachineAuthSuccess: vi.fn(async () => {}),\n    logMachineAuthFailed: vi.fn(async () => {}),\n    // OAuth2/OIDC provider events (audit-tier A-1..A-9).\n    logOAuthDelegatedTokenIssued: vi.fn(async () => {}),\n    logOAuthConsentGranted: vi.fn(async () => {}),\n    logOAuthConsentDenied: vi.fn(async () => {}),\n    logOAuthConsentGrantPersisted: vi.fn(async () => {}),\n    logOAuthTokenRefreshed: vi.fn(async () => {}),\n    logOAuthTokenRevoked: vi.fn(async () => {}),\n    logOAuthRpInitiatedLogout: vi.fn(async () => {}),\n    logOAuthCodeExchangeFailed: vi.fn(async () => {}),\n    logOAuthConsentBindingViolation: vi.fn(async () => {}),\n    logUserRefreshTokenReuseDetected: vi.fn(async () => {}),\n    // Client-identity events: a refused CIMD assertion, and an anonymous RFC 7591 registration.\n    logCimdClientRefused: vi.fn(async () => {}),\n    logDynamicClientRegistered: vi.fn(async () => {}),\n  };\n  return {\n    ...spies,\n    /** Reset all spy call history (use in `beforeEach`). */\n    clear() {\n      for (const fn of Object.values(spies)) fn.mockClear();\n    },\n  };\n}\n\nexport type OAuthProviderAuditLogsSpies = ReturnType<typeof createOAuthProviderAuditLogsSpies>;\n"]}

package/dist/esm/security/connected-accounts/__tests__/support/real-connection-client-methods.d.ts

@@ -1,2 +0,0 @@
-export declare const REAL_CONNECTION_CLIENT_METHODS: Record<string, never>;
-//# sourceMappingURL=real-connection-client-methods.d.ts.map

package/dist/esm/security/connected-accounts/__tests__/support/real-connection-client-methods.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"real-connection-client-methods.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/connected-accounts/__tests__/support/real-connection-client-methods.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,8BAA8B,EAK3B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC"}

package/dist/esm/security/connected-accounts/__tests__/support/real-connection-client-methods.js

@@ -1,18 +0,0 @@
-import { ExternalProvidersRegistryBackendService } from '../../../../external-providers/services/external-providers-registry.backend.service.js';
-/**
- * The REAL registry methods that choose a connection's OAuth client (#1725), to spread into a registry double.
- *
- * A double that supplied its own `getConnectionOAuth2Client` would pin that the caller ASKS for a client and never
- * which client it gets — a pin satisfied by the fixture (`invariant-call-site-enumeration.md`). These are the
- * shipped bodies; called on the double they read the double's own `getProviderRuntimeContract` and
- * `getProviderSecret`, and a double with no `configService` declares no shared connection, so every ref is its own
- * connection exactly as an undeclared application's is.
- */
-const prototype = ExternalProvidersRegistryBackendService.prototype;
-export const REAL_CONNECTION_CLIENT_METHODS = {
-    getProviderSharedConnection: prototype.getProviderSharedConnection,
-    declaredSharedConnections: prototype.declaredSharedConnections,
-    getConnectionOAuth2Client: prototype.getConnectionOAuth2Client,
-    resolveConnectionOAuth2ClientCredentials: prototype.resolveConnectionOAuth2ClientCredentials,
-};
-//# sourceMappingURL=real-connection-client-methods.js.map

package/dist/esm/security/connected-accounts/__tests__/support/real-connection-client-methods.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"real-connection-client-methods.js","sourceRoot":"","sources":["../../../../../../../src/security/connected-accounts/__tests__/support/real-connection-client-methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AAErJ;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG,uCAAuC,CAAC,SAA+C,CAAC;AAE1G,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,2BAA2B,EAAE,SAAS,CAAC,2BAA2B;IAClE,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;IAC9D,yBAAyB,EAAE,SAAS,CAAC,yBAAyB;IAC9D,wCAAwC,EAAE,SAAS,CAAC,wCAAwC;CACzD,CAAC","sourcesContent":["import { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\n\n/**\n * The REAL registry methods that choose a connection's OAuth client (#1725), to spread into a registry double.\n *\n * A double that supplied its own `getConnectionOAuth2Client` would pin that the caller ASKS for a client and never\n * which client it gets — a pin satisfied by the fixture (`invariant-call-site-enumeration.md`). These are the\n * shipped bodies; called on the double they read the double's own `getProviderRuntimeContract` and\n * `getProviderSecret`, and a double with no `configService` declares no shared connection, so every ref is its own\n * connection exactly as an undeclared application's is.\n */\nconst prototype = ExternalProvidersRegistryBackendService.prototype as unknown as Record<string, unknown>;\n\nexport const REAL_CONNECTION_CLIENT_METHODS = {\n  getProviderSharedConnection: prototype.getProviderSharedConnection,\n  declaredSharedConnections: prototype.declaredSharedConnections,\n  getConnectionOAuth2Client: prototype.getConnectionOAuth2Client,\n  resolveConnectionOAuth2ClientCredentials: prototype.resolveConnectionOAuth2ClientCredentials,\n} as unknown as Record<string, never>;\n"]}

package/dist/esm/systems-of-record/credentials/__tests__/certificate-fixtures.d.ts

@@ -1,20 +0,0 @@
-/**
- * Fixed X.509 fixtures for the credential pins (#1056).
- *
- * Self-signed, generated once, and checked in rather than minted per run: Node cannot mint a
- * certificate, and a fixture produced by shelling out to `openssl` would make these tests depend on a
- * binary the repository does not otherwise require.
- *
- * Both are PUBLIC material — a certificate is the half you publish — so nothing here is a secret. The
- * private keys they were generated with were discarded to `/dev/null` and no signature is ever made
- * with them: the valid one is used for its BYTES (the `x5t` thumbprint) and its validity window, the
- * expired one for its window alone.
- */
-/**
- * `notAfter` in 2126. Long-lived deliberately: a fixture that expires turns a passing suite red on a
- * date nobody chose, which is the failure mode this file's own subject is about.
- */
-export declare const VALID_CERTIFICATE_PEM = "-----BEGIN CERTIFICATE-----\nMIIDFTCCAf2gAwIBAgIUGJ5PE1NHgDMro6tyd/sxqF/L9lgwDQYJKoZIhvcNAQEL\nBQAwGTEXMBUGA1UEAwwOd2lsZG8tc29yLXRlc3QwIBcNMjYwOTE3MTkyNDUwWhgP\nMjEyNjA4MjQxOTI0NTBaMBkxFzAVBgNVBAMMDndpbGRvLXNvci10ZXN0MIIBIjAN\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAocaBdD7ZeyY/JNsjBs6Lq1do7BYN\ngfH1HtQh6MBsN3vVdrqg8XgF65kYyXbQx+qCPOoxKazw9iQ9ko26vqDJwBk/TBT8\nAP6NwGIvbWGutQb6PXveeo6uvuD8rL4Mm044UH9Rj3lFmIXfcVFrXEx2TXt2Q+s9\n4xFvaRyjVSXioaHOpLOujN2vIvTAijXwPpbrN/LFGdukyLMkSRX7Ttf56Km4uwta\nINQyJt9qWO7NcmjjgogK2PrPmc4PuqFRimyEQBzi3QiNW01uAniR4DUEmcFJuPO6\nZ/ykWTmSP6yrMgurnCkB0eLub1fD59D4FgsGTJl+kbxVoFzrVTusqg7EgQIDAQAB\no1MwUTAdBgNVHQ4EFgQUCH+FpIKDm+79TGPw+JdQOrXiZOswHwYDVR0jBBgwFoAU\nCH+FpIKDm+79TGPw+JdQOrXiZOswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B\nAQsFAAOCAQEALX1Ev86gubCsesJLBDf/1yDnqBOx+uOWm7JJAJBxya8I3Gr3O+9c\nSpIuuBZK8OTHU19pmTRbAttFxA58VOl4nN7jTLsGVp1iAGuTjAgM+Rm9M+ilhm16\nV9Tu1Rv0r3q1SbwcFs5Ov9tCQhcOU0b6P1zRGsFaomuBJzESpmHnLEV2f2xZpi9t\nbcQoUtdzig9W2OnBj5HJKKYVdwMmoCssP6xRzmkRjkN/KIfdMPcLtdLnAqRAhC5B\ncdaaYq7fYgy3/MUmk0p9HF03Qk2//aMWPmFesEwgpaU+WUl0Hc8Y2RpkyS3SRjQz\nlwP83tAU/6GI4J8cFi+Pp0HfIPS/3PowLg==\n-----END CERTIFICATE-----";
-/** `notAfter` 2020-02-01 — already in the past, and permanently so. The E7 fixture. */
-export declare const EXPIRED_CERTIFICATE_PEM = "-----BEGIN CERTIFICATE-----\nMIIDGTCCAgGgAwIBAgIUbiRDk/GIFk+ZblQI5xF5KVsplAEwDQYJKoZIhvcNAQEL\nBQAwHDEaMBgGA1UEAwwRd2lsZG8tc29yLWV4cGlyZWQwHhcNMjAwMTAxMDAwMDAw\nWhcNMjAwMjAxMDAwMDAwWjAcMRowGAYDVQQDDBF3aWxkby1zb3ItZXhwaXJlZDCC\nASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMP3wfQXT4DNyYVPaOmNtHkQ\nXgGXC31rCoUnk7Q6ZL7wuXpg/eoHQEDpNuZ955aPxjg0Q8lsydohmxbi9SwrR88f\nE25HIIKNxoxoNi67nlrAe0YV0ngNKEDPWORlwvOE+Aw52F4JOgJn35E2SkjAZcqM\nX3WoIK/K3YdfaMrgR3yMzE9t/G10Kxy1SIG6Kn1MhPJNyxslVkAIyZhnqWUxBdjG\nKQTwjZfE30UJwh4zK3mRY+22l2/O7WLAdD0LawmvmDQXxuc/Jc3bzF2Ipm5REAnT\nAcic8uwcAuHfVqe1E9OUnURRSQdTNoP20nfO0rLrFYTjWpXmZOOQGNJkzDheV2EC\nAwEAAaNTMFEwHQYDVR0OBBYEFI1Zu+OGcOq8kGX7/2qn0jQT5CvhMB8GA1UdIwQY\nMBaAFI1Zu+OGcOq8kGX7/2qn0jQT5CvhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI\nhvcNAQELBQADggEBAJhjUFH17YnhMilq5oKeXp/87U85M8YvzmoV5pJ1Qs+Co+oO\ntCqR790W0j7HccS8YM927omZ4Gggt1VnsGK9N6NdSGNNAu1WQS6AD4d7wQ8UDhon\nTlcstIdzxjJZE59a08saaH84ymKtc2didVeHEwvtYtWbpmVy3FWP4YGHqIiXASIR\nJs5PifpiMqHVPfNT2/Wc16J1hIa1Cd6XqJdnoyhKV067So2uqQmJ/4Ea5di+/PxM\n0pB1AaNX0tvEWvlw5FBXucSw4sJ/J4QExSn4BFCMYqsJktoiPd4ehepcvFBW0e1r\nF1ZmEj1+AMgAIfpenIKizDbWMXJkkukfeDr32hA=\n-----END CERTIFICATE-----";
-//# sourceMappingURL=certificate-fixtures.d.ts.map

package/dist/esm/systems-of-record/credentials/__tests__/certificate-fixtures.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"certificate-fixtures.d.ts","sourceRoot":"","sources":["../../../../../../src/systems-of-record/credentials/__tests__/certificate-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;GAGG;AACH,eAAO,MAAM,qBAAqB,ioCAkBR,CAAC;AAE3B,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,qoCAkBV,CAAC"}

package/dist/esm/systems-of-record/credentials/__tests__/certificate-fixtures.js

@@ -1,56 +0,0 @@
-/**
- * Fixed X.509 fixtures for the credential pins (#1056).
- *
- * Self-signed, generated once, and checked in rather than minted per run: Node cannot mint a
- * certificate, and a fixture produced by shelling out to `openssl` would make these tests depend on a
- * binary the repository does not otherwise require.
- *
- * Both are PUBLIC material — a certificate is the half you publish — so nothing here is a secret. The
- * private keys they were generated with were discarded to `/dev/null` and no signature is ever made
- * with them: the valid one is used for its BYTES (the `x5t` thumbprint) and its validity window, the
- * expired one for its window alone.
- */
-/**
- * `notAfter` in 2126. Long-lived deliberately: a fixture that expires turns a passing suite red on a
- * date nobody chose, which is the failure mode this file's own subject is about.
- */
-export const VALID_CERTIFICATE_PEM = `-----BEGIN CERTIFICATE-----
-MIIDFTCCAf2gAwIBAgIUGJ5PE1NHgDMro6tyd/sxqF/L9lgwDQYJKoZIhvcNAQEL
-BQAwGTEXMBUGA1UEAwwOd2lsZG8tc29yLXRlc3QwIBcNMjYwOTE3MTkyNDUwWhgP
-MjEyNjA4MjQxOTI0NTBaMBkxFzAVBgNVBAMMDndpbGRvLXNvci10ZXN0MIIBIjAN
-BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAocaBdD7ZeyY/JNsjBs6Lq1do7BYN
-gfH1HtQh6MBsN3vVdrqg8XgF65kYyXbQx+qCPOoxKazw9iQ9ko26vqDJwBk/TBT8
-AP6NwGIvbWGutQb6PXveeo6uvuD8rL4Mm044UH9Rj3lFmIXfcVFrXEx2TXt2Q+s9
-4xFvaRyjVSXioaHOpLOujN2vIvTAijXwPpbrN/LFGdukyLMkSRX7Ttf56Km4uwta
-INQyJt9qWO7NcmjjgogK2PrPmc4PuqFRimyEQBzi3QiNW01uAniR4DUEmcFJuPO6
-Z/ykWTmSP6yrMgurnCkB0eLub1fD59D4FgsGTJl+kbxVoFzrVTusqg7EgQIDAQAB
-o1MwUTAdBgNVHQ4EFgQUCH+FpIKDm+79TGPw+JdQOrXiZOswHwYDVR0jBBgwFoAU
-CH+FpIKDm+79TGPw+JdQOrXiZOswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
-AQsFAAOCAQEALX1Ev86gubCsesJLBDf/1yDnqBOx+uOWm7JJAJBxya8I3Gr3O+9c
-SpIuuBZK8OTHU19pmTRbAttFxA58VOl4nN7jTLsGVp1iAGuTjAgM+Rm9M+ilhm16
-V9Tu1Rv0r3q1SbwcFs5Ov9tCQhcOU0b6P1zRGsFaomuBJzESpmHnLEV2f2xZpi9t
-bcQoUtdzig9W2OnBj5HJKKYVdwMmoCssP6xRzmkRjkN/KIfdMPcLtdLnAqRAhC5B
-cdaaYq7fYgy3/MUmk0p9HF03Qk2//aMWPmFesEwgpaU+WUl0Hc8Y2RpkyS3SRjQz
-lwP83tAU/6GI4J8cFi+Pp0HfIPS/3PowLg==
------END CERTIFICATE-----`;
-/** `notAfter` 2020-02-01 — already in the past, and permanently so. The E7 fixture. */
-export const EXPIRED_CERTIFICATE_PEM = `-----BEGIN CERTIFICATE-----
-MIIDGTCCAgGgAwIBAgIUbiRDk/GIFk+ZblQI5xF5KVsplAEwDQYJKoZIhvcNAQEL
-BQAwHDEaMBgGA1UEAwwRd2lsZG8tc29yLWV4cGlyZWQwHhcNMjAwMTAxMDAwMDAw
-WhcNMjAwMjAxMDAwMDAwWjAcMRowGAYDVQQDDBF3aWxkby1zb3ItZXhwaXJlZDCC
-ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMP3wfQXT4DNyYVPaOmNtHkQ
-XgGXC31rCoUnk7Q6ZL7wuXpg/eoHQEDpNuZ955aPxjg0Q8lsydohmxbi9SwrR88f
-E25HIIKNxoxoNi67nlrAe0YV0ngNKEDPWORlwvOE+Aw52F4JOgJn35E2SkjAZcqM
-X3WoIK/K3YdfaMrgR3yMzE9t/G10Kxy1SIG6Kn1MhPJNyxslVkAIyZhnqWUxBdjG
-KQTwjZfE30UJwh4zK3mRY+22l2/O7WLAdD0LawmvmDQXxuc/Jc3bzF2Ipm5REAnT
-Acic8uwcAuHfVqe1E9OUnURRSQdTNoP20nfO0rLrFYTjWpXmZOOQGNJkzDheV2EC
-AwEAAaNTMFEwHQYDVR0OBBYEFI1Zu+OGcOq8kGX7/2qn0jQT5CvhMB8GA1UdIwQY
-MBaAFI1Zu+OGcOq8kGX7/2qn0jQT5CvhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
-hvcNAQELBQADggEBAJhjUFH17YnhMilq5oKeXp/87U85M8YvzmoV5pJ1Qs+Co+oO
-tCqR790W0j7HccS8YM927omZ4Gggt1VnsGK9N6NdSGNNAu1WQS6AD4d7wQ8UDhon
-TlcstIdzxjJZE59a08saaH84ymKtc2didVeHEwvtYtWbpmVy3FWP4YGHqIiXASIR
-Js5PifpiMqHVPfNT2/Wc16J1hIa1Cd6XqJdnoyhKV067So2uqQmJ/4Ea5di+/PxM
-0pB1AaNX0tvEWvlw5FBXucSw4sJ/J4QExSn4BFCMYqsJktoiPd4ehepcvFBW0e1r
-F1ZmEj1+AMgAIfpenIKizDbWMXJkkukfeDr32hA=
------END CERTIFICATE-----`;
-//# sourceMappingURL=certificate-fixtures.js.map

package/dist/esm/systems-of-record/credentials/__tests__/certificate-fixtures.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"certificate-fixtures.js","sourceRoot":"","sources":["../../../../../../src/systems-of-record/credentials/__tests__/certificate-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;0BAkBX,CAAC;AAE3B,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;0BAkBb,CAAC","sourcesContent":["/**\n * Fixed X.509 fixtures for the credential pins (#1056).\n *\n * Self-signed, generated once, and checked in rather than minted per run: Node cannot mint a\n * certificate, and a fixture produced by shelling out to `openssl` would make these tests depend on a\n * binary the repository does not otherwise require.\n *\n * Both are PUBLIC material — a certificate is the half you publish — so nothing here is a secret. The\n * private keys they were generated with were discarded to `/dev/null` and no signature is ever made\n * with them: the valid one is used for its BYTES (the `x5t` thumbprint) and its validity window, the\n * expired one for its window alone.\n */\n\n/**\n * `notAfter` in 2126. Long-lived deliberately: a fixture that expires turns a passing suite red on a\n * date nobody chose, which is the failure mode this file's own subject is about.\n */\nexport const VALID_CERTIFICATE_PEM = `-----BEGIN CERTIFICATE-----\nMIIDFTCCAf2gAwIBAgIUGJ5PE1NHgDMro6tyd/sxqF/L9lgwDQYJKoZIhvcNAQEL\nBQAwGTEXMBUGA1UEAwwOd2lsZG8tc29yLXRlc3QwIBcNMjYwOTE3MTkyNDUwWhgP\nMjEyNjA4MjQxOTI0NTBaMBkxFzAVBgNVBAMMDndpbGRvLXNvci10ZXN0MIIBIjAN\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAocaBdD7ZeyY/JNsjBs6Lq1do7BYN\ngfH1HtQh6MBsN3vVdrqg8XgF65kYyXbQx+qCPOoxKazw9iQ9ko26vqDJwBk/TBT8\nAP6NwGIvbWGutQb6PXveeo6uvuD8rL4Mm044UH9Rj3lFmIXfcVFrXEx2TXt2Q+s9\n4xFvaRyjVSXioaHOpLOujN2vIvTAijXwPpbrN/LFGdukyLMkSRX7Ttf56Km4uwta\nINQyJt9qWO7NcmjjgogK2PrPmc4PuqFRimyEQBzi3QiNW01uAniR4DUEmcFJuPO6\nZ/ykWTmSP6yrMgurnCkB0eLub1fD59D4FgsGTJl+kbxVoFzrVTusqg7EgQIDAQAB\no1MwUTAdBgNVHQ4EFgQUCH+FpIKDm+79TGPw+JdQOrXiZOswHwYDVR0jBBgwFoAU\nCH+FpIKDm+79TGPw+JdQOrXiZOswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B\nAQsFAAOCAQEALX1Ev86gubCsesJLBDf/1yDnqBOx+uOWm7JJAJBxya8I3Gr3O+9c\nSpIuuBZK8OTHU19pmTRbAttFxA58VOl4nN7jTLsGVp1iAGuTjAgM+Rm9M+ilhm16\nV9Tu1Rv0r3q1SbwcFs5Ov9tCQhcOU0b6P1zRGsFaomuBJzESpmHnLEV2f2xZpi9t\nbcQoUtdzig9W2OnBj5HJKKYVdwMmoCssP6xRzmkRjkN/KIfdMPcLtdLnAqRAhC5B\ncdaaYq7fYgy3/MUmk0p9HF03Qk2//aMWPmFesEwgpaU+WUl0Hc8Y2RpkyS3SRjQz\nlwP83tAU/6GI4J8cFi+Pp0HfIPS/3PowLg==\n-----END CERTIFICATE-----`;\n\n/** `notAfter` 2020-02-01 — already in the past, and permanently so. The E7 fixture. */\nexport const EXPIRED_CERTIFICATE_PEM = `-----BEGIN CERTIFICATE-----\nMIIDGTCCAgGgAwIBAgIUbiRDk/GIFk+ZblQI5xF5KVsplAEwDQYJKoZIhvcNAQEL\nBQAwHDEaMBgGA1UEAwwRd2lsZG8tc29yLWV4cGlyZWQwHhcNMjAwMTAxMDAwMDAw\nWhcNMjAwMjAxMDAwMDAwWjAcMRowGAYDVQQDDBF3aWxkby1zb3ItZXhwaXJlZDCC\nASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMP3wfQXT4DNyYVPaOmNtHkQ\nXgGXC31rCoUnk7Q6ZL7wuXpg/eoHQEDpNuZ955aPxjg0Q8lsydohmxbi9SwrR88f\nE25HIIKNxoxoNi67nlrAe0YV0ngNKEDPWORlwvOE+Aw52F4JOgJn35E2SkjAZcqM\nX3WoIK/K3YdfaMrgR3yMzE9t/G10Kxy1SIG6Kn1MhPJNyxslVkAIyZhnqWUxBdjG\nKQTwjZfE30UJwh4zK3mRY+22l2/O7WLAdD0LawmvmDQXxuc/Jc3bzF2Ipm5REAnT\nAcic8uwcAuHfVqe1E9OUnURRSQdTNoP20nfO0rLrFYTjWpXmZOOQGNJkzDheV2EC\nAwEAAaNTMFEwHQYDVR0OBBYEFI1Zu+OGcOq8kGX7/2qn0jQT5CvhMB8GA1UdIwQY\nMBaAFI1Zu+OGcOq8kGX7/2qn0jQT5CvhMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI\nhvcNAQELBQADggEBAJhjUFH17YnhMilq5oKeXp/87U85M8YvzmoV5pJ1Qs+Co+oO\ntCqR790W0j7HccS8YM927omZ4Gggt1VnsGK9N6NdSGNNAu1WQS6AD4d7wQ8UDhon\nTlcstIdzxjJZE59a08saaH84ymKtc2didVeHEwvtYtWbpmVy3FWP4YGHqIiXASIR\nJs5PifpiMqHVPfNT2/Wc16J1hIa1Cd6XqJdnoyhKV067So2uqQmJ/4Ea5di+/PxM\n0pB1AaNX0tvEWvlw5FBXucSw4sJ/J4QExSn4BFCMYqsJktoiPd4ehepcvFBW0e1r\nF1ZmEj1+AMgAIfpenIKizDbWMXJkkukfeDr32hA=\n-----END CERTIFICATE-----`;\n"]}