npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.6 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1399) hide show

package/dist/esm/security/oauth-clients/oauth-clients.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-clients.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/oauth-clients/oauth-clients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAElE,kCAAkC;AAClC,qBAAqB;AACrB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,0CAAqB,CAAA;IACrB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,KAAjB,iBAAiB,QAI5B;AAED;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,6BAcX;AAdD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,sDAAqB,CAAA;IACrB;;;;;OAKG;IACH,oDAAmB,CAAA;AACrB,CAAC,EAdW,6BAA6B,KAA7B,6BAA6B,QAcxC;AAED,MAAM,CAAN,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,2DAAyC,CAAA;IACzC,2DAAyC,CAAA;IACzC,iDAA+B,CAAA;AACjC,CAAC,EAJW,cAAc,KAAd,cAAc,QAIzB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,4BAIX;AAJD,WAAY,4BAA4B;IACtC,6CAAa,CAAA;IACb,2EAA2C,CAAA;IAC3C,yEAAyC,CAAA;AAC3C,CAAC,EAJW,4BAA4B,KAA5B,4BAA4B,QAIvC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAAoC;IACxF,OAAO,MAAM,KAAK,4BAA4B,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,mGAAmG;IACnG,YAAY;IACZ,aAAa;IACb,WAAW;IACX,kFAAkF;IAClF,OAAO;IACP,OAAO;IACP,oEAAoE;IACpE,OAAO;IACP,aAAa;IACb,4DAA4D;IAC5D,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpG,wGAAwG;AACxG,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AAEtD,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;IAC5F,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,4BAA4B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,kCAAkC;AAClC,4BAA4B;AAC5B,kCAAkC;AAElC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,EAAE,cAAc;IACtE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACzD,4FAA4F;IAC5F,yFAAyF;IACzF,+DAA+D;IAC/D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACzD,8FAA8F;IAC9F,4FAA4F;IAC5F,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAC3F,kFAAkF;IAClF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,kGAAkG;IAClG,iGAAiG;IACjG,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE;QACxC,OAAO,EAAE,+GAA+G;KACzH,CAAC,CACH;QACD,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,iGAAiG;QACjG,qFAAqF;QACrF,kFAAkF;SACjF,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,EAAE,CAAC;IACd,wGAAwG;IACxG,yGAAyG;IACzG,qGAAqG;IACrG,0GAA0G;IAC1G,kGAAkG;IAClG,2FAA2F;IAC3F,yGAAyG;IACzG,2GAA2G;IAC3G,kGAAkG;IAClG,2BAA2B;IAC3B,sBAAsB,EAAE,CAAC;SACtB,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE;QACxC,OAAO,EAAE,2HAA2H;KACrI,CAAC,CACH;SACA,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,EAAE,CAAC;IACd,+FAA+F;IAC/F,oGAAoG;IACpG,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,mGAAmG;IACnG,2FAA2F;IAC3F,6FAA6F;IAC7F,mCAAmC;IACnC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,qGAAqG;IACrG,qGAAqG;IACrG,qGAAqG;IACrG,8EAA8E;IAC9E,qDAAqD;IACrD,mGAAmG;IACnG,uEAAuE;IACvE,kFAAkF;IAClF,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;IACzH,yEAAyE;IACzE,qDAAqD;IACrD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6EAA6E;IAC7E,6EAA6E;IAC7E,gFAAgF;IAChF,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,gFAAgF;IAChF,0EAA0E;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC9I,qEAAqE;IACrE,gFAAgF;IAChF,0BAA0B;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAE3F,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,4EAA4E;IAC5E,yEAAyE;IACzE,oFAAoF;IACpF,mFAAmF;IACnF,8DAA8D;IAC9D,gDAAgD;IAChD,EAAE;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,iEAAiE;IACjE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACxH,+EAA+E;IAC/E,iFAAiF;IACjF,qBAAqB;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC7F,8EAA8E;IAC9E,iFAAiF;IACjF,gFAAgF;IAChF,6EAA6E;IAC7E,0DAA0D;IAC1D,8BAA8B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAE3F,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE;IACF,iFAAiF;IACjF,kFAAkF;IAClF,iFAAiF;IACjF,+DAA+D;IAC/D,+FAA+F;IAC/F,EAAE;IACF,gFAAgF;IAChF,mFAAmF;IACnF,iFAAiF;IACjF,uEAAuE;IACvE,mFAAmF;IACnF,yEAAyE;IACzE,gEAAgE;IAChE,EAAE;IACF,8EAA8E;IAC9E,oFAAoF;IACpF,0CAA0C;IAC1C,EAAE;IACF,iFAAiF;IACjF,mFAAmF;IACnF,uDAAuD;IACvD,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC/H,iFAAiF;IACjF,mFAAmF;IACnF,6CAA6C;IAC7C,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEtG,6EAA6E;IAC7E,sFAAsF;IACtF,EAAE;IACF,kGAAkG;IAClG,4FAA4F;IAC5F,0FAA0F;IAC1F,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,iGAAiG;IACjG,gGAAgG;IAChG,iFAAiF;IACjF,iGAAiG;IACjG,wCAAwC;IACxC,EAAE;IACF,2FAA2F;IAC3F,wFAAwF;IACxF,0EAA0E;IAC1E,wEAAwE;IACxE,wCAAwC;IACxC,gFAAgF;IAChF,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;SACtD,OAAO,CAAC,6BAA6B,CAAC,QAAQ,CAAC;SAC/C,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;CAErB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACvE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;CACnG,CAAC,CAAC","sourcesContent":["/*\n OAuth Client Shared Schemas\n \n Frontend/backend shared schemas + DTOs for the registered OAuth-client\n * credential resource (`organizationOAuthClients`, `applicationOAuthClients`).\n * Backend-specific logic (secret minting/hashing, mint pipeline) stays in\n * saas-backend-lib.\n \n This resource is a FAITHFUL MIRROR of the api-keys resource\n * (`api-keys.shared.schemas.ts`): the same long-lived secret + rotation-grace\n * shape, the same server-managed strip-seam contract, the same org\|app scope\n * split. It exists as its OWN resource (not a variant of api-keys) because the\n * request-auth choke point routes a presented secret to a DISTINCT principal\n * by the plaintext prefix (`oc_org_`/`oc_app_` vs the api-key `sk_org_`/`sk_app_`)\n * — an OAuth client and an api-key both authenticate the SAME machine principal\n * (`ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`); they are distinct credential types, an api-key acts\n * as an api-key principal.\n \n OIDC authorization code, interactive consent, persistent consent grants,\n * exact redirect allowlists and public/confidential client classification are\n * implemented. The resource remains the registered-client authority; issued\n * codes, tokens and user consent records have their own runtime/storage owners.\n /\n\nimport { z } from 'zod';\nimport { RolesSchema } from '../authorizations/roles.shared.schemas';\nimport { ApiKeyScope } from '../api-keys/api-keys.shared.schemas';\n\n// ===============================\n// OAUTH CLIENT ENUMS\n// ===============================\n\n/\n Lifecycle status of a registered OAuth client. Mirrors `ApiKeyStatus`: an\n * INACTIVE or EXPIRED client cannot mint tokens at the request-auth choke point.\n /\nexport enum OAuthClientStatus {\n ACTIVE = 'active',\n INACTIVE = 'inactive',\n EXPIRED = 'expired',\n}\n\n/\n OAuth 2.0 grant types a registered client may be authorized to use. The trunk\n * resource ships CLIENT_CREDENTIALS (the machine-to-machine front); the\n * AUTHORIZATION_CODE / REFRESH_TOKEN arms are declared here so the OIDC branch can\n * enable them per-client via `allowedGrants` without a schema reshape.\n /\n/\n How a client got registered — a TRUST classification, not a bookkeeping detail.\n \n Kept separate from `ApiKeyScope` on purpose. `scope` answers \"which of this application's scopes\n * owns the credential\", and both of its members imply someone with standing inside the application\n * created it. This enum answers \"did anyone vouch for this client at all\", and the two questions\n * became independent the moment an anonymous caller could register one.\n \n semantic-literal-boundary: a closed Wildo vocabulary with one named runtime source. Every schema,\n * default, comparison and mapping over registration provenance derives from THIS enum.\n /\nexport enum OAuthClientRegistrationOrigin {\n /\n Created by a principal with standing in this application — an organization administrator\n * through the org-clients API, a platform operator, or a seed. The default, so nothing that\n * existed before dynamic registration changes posture.\n /\n OPERATOR = 'operator',\n /\n Self-registered by an anonymous caller at the RFC 7591 `/register` endpoint.\n \n The client asserted its own name and redirect URIs and proved nothing. It is granted no roles,\n * capped at identity scopes, and always faces the user's consent prompt.\n /\n DYNAMIC = 'dynamic',\n}\n\nexport enum OAuthGrantType {\n CLIENT_CREDENTIALS = 'client_credentials',\n AUTHORIZATION_CODE = 'authorization_code',\n REFRESH_TOKEN = 'refresh_token',\n}\n\n/\n How a registered OAuth client authenticates AT THIS APP'S token endpoint (OIDC\n * `token_endpoint_auth_method`) — the PROVIDER-side classification of OUR clients. Deliberately\n * DISTINCT from `OAuth2_TokenEndpoint_AuthMethod` in `external-connectors-models`, which describes how\n * Wildo-as-CLIENT authenticates to an EXTERNAL IdP's token endpoint (the opposite direction); the two\n * are separate concepts even though they share the OAuth wire vocabulary. Values are the OIDC-registered\n * method names advertised in the discovery document's `token_endpoint_auth_methods_supported`.\n \n - `NONE` — a PUBLIC client: no client secret at the token endpoint; the authorization_code exchange\n * relies on mandatory PKCE (S256) + exact redirect_uri (the OAuth 2.1 baseline for SPA / native /\n * agent clients). This is the default because a client is public unless its\n * server-side secret-retention and token authentication method are explicit.\n * - `CLIENT_SECRET_BASIC` / `CLIENT_SECRET_POST` — a CONFIDENTIAL client: it MUST present its\n * `client_secret` (via HTTP Basic, or the request body, respectively) at the token endpoint, as\n * defense-in-depth on top of PKCE. Both map to \"confidential\" for enforcement — the basic-vs-body\n * distinction is a per-request transport choice the token endpoint already accepts either way.\n /\nexport enum OAuthTokenEndpointAuthMethod {\n NONE = 'none',\n CLIENT_SECRET_BASIC = 'client_secret_basic',\n CLIENT_SECRET_POST = 'client_secret_post',\n}\n\n/\n The single semantic authority for the public-vs-confidential decision: a client is CONFIDENTIAL\n * (must present its secret at the token endpoint) iff its `tokenEndpointAuthMethod` is not `NONE`.\n * Every enforcement site (authorization_code secret check, revocation client-auth) derives from this\n * helper rather than re-deciding, so the classification never drifts.\n /\nexport function isConfidentialTokenEndpointAuthMethod(method: OAuthTokenEndpointAuthMethod): boolean {\n return method !== OAuthTokenEndpointAuthMethod.NONE;\n}\n\n/\n Safe redirect-URI policy for a registered OAuth client — the anti-open-redirect / anti-XSS gate\n * on every entry of the `redirectUris` allowlist.\n \n The authorization_code flow matches a request's `redirect_uri` by EXACT string against this\n * allowlist, and the authorize handler then emits the matched value as the browser's navigation\n * target (`redirect_to`). A registered entry is therefore a literal, user-navigated URL, so the\n * allowlist must never contain a scheme or shape that can execute script or redirect off-origin:\n \n - `https:` — allowed for any host/port (the standard for web / SPA / agent RPs).\n * - `http:` — allowed ONLY for a loopback host (`localhost` / `127.0.0.1` / `::1`), per OAuth 2.1\n * + RFC 8252 (native / CLI / dev clients); loopback is unreachable by a network\n * attacker, so plain http there is safe.\n * - a PRIVATE-USE URI scheme (`cursor:`, `com.example.app:`) — allowed, because that is how a native\n * app receives the code on a platform with no loopback listener. See below.\n * - everything else — `javascript:`, `data:`, `vbscript:`, `file:`, and plain `http:` to a\n * NON-loopback host — is REJECTED.\n * - a fragment (`#…`) is REJECTED (RFC 6749 §3.1.2: a redirect endpoint URI MUST NOT include one).\n * - embedded credentials (`https://user:pass@host`) are REJECTED (a phishing / host-confusion vector).\n * - leading/trailing whitespace is REJECTED — the WHATWG `URL` constructor silently trims it, so a\n * padded value would parse to a different string than the one exact-matched at authorize time.\n \n ## Private-use schemes: why they were added on 2026-08-11\n \n This policy previously refused every non-http(s) scheme, and the note here said to extend it\n * \"deliberately\" if an app ever needed one. A real client made that concrete: Cursor registered\n * `cursor://anysphere.cursor-mcp/oauth/callback` and was refused, which means *no native MCP client\n using a custom-scheme callback could register with a Wildo application at all.** None of our own\n * lanes could have found it — every one of them registers `http://localhost/...`.\n \n The standard sanctions the pattern: native apps \"MAY use whichever redirect option suits their\n * needs best, taking into account platform-specific implementation details\", and private-use URI\n * scheme redirection is one of the three named options.\n * spec-cite: RFC 8252 § 7 and § 7.1 (Private-Use URI Scheme Redirection).\n \n The known weakness is NOT that such a URI is unsafe to navigate to — it is that the code may reach\n * the wrong recipient: \"A limitation of using private-use URI schemes for redirect URIs is that\n * multiple apps can typically register the same scheme, which makes it indeterminate as to which app\n * will receive the authorization code.\"\n * spec-cite: RFC 8252 § 8.1 (Protecting the Authorization Code).\n \n That is an interception risk, and PKCE is the mitigation the same section prescribes. This server\n * REQUIRES PKCE and advertises `S256` alone, so a code delivered to the wrong app is unusable without\n * the verifier. Refusing the scheme outright bought no protection PKCE does not already provide, and\n * cost the entire native-client ecosystem.\n \n What is still refused is what actually executes or reads local state — the danger is the SCHEME's\n * capability, not its unfamiliarity, so the check is a denylist of dangerous schemes rather than an\n * allowlist of known apps. An allowlist is impossible here by construction: the set of legitimate app\n * schemes is open, and every entry would be a new client the framework has to be taught about.\n \n Rejected alternatives: `z.string().url()` (the original guard) accepts every dangerous scheme; a\n * strict https-only rule is too tight for the native/CLI loopback flow; requiring a reverse-DNS\n * scheme (`com.example.app:`, which RFC 8252 § 7.1 RECOMMENDS) was rejected because it would still\n * refuse `cursor:` — the recommendation binds the app author, not the authorization server, and a\n * server that enforces it rejects conformant clients for a style violation.\n \n assurance-control: WILDO.IDENTITY.REDIRECT_TARGET_VALIDATION — registered OAuth redirect targets are constrained to\n * safe absolute URLs, closing an open-redirect / stored-XSS delegation primitive.\n /\n/\n * EXPORTED as of 2026-09-02, and the export is the point rather than a convenience.\n \n This is a closed vocabulary with one named runtime source — the shape `CLAUDE.md` asks for — and it\n * was reachable by nothing outside this file, so the assurance authority basis could not attest\n * `WILDO.IDENTITY.REDIRECT_TARGET_VALIDATION` against the set the guard actually branches on. It would\n * have had to transcribe the schemes into a second list, free to drift from this one, which is the\n * failure the single-source rule exists to prevent.\n \n Nothing else may BRANCH on it: the validator below is the only enforcement site. A reader is a\n * reader — the basis names the members so a programme can say which schemes are refused.\n /\nexport const DANGEROUS_REDIRECT_URI_SCHEMES: ReadonlySet<string> = new Set([\n // Executes script in the navigating context — the open-redirect-to-XSS primitive this guard exists\n // to close.\n 'javascript:',\n 'vbscript:',\n // Carries its own payload, so the \"redirect target\" IS attacker-authored content.\n 'data:',\n 'blob:',\n // Reads local state rather than handing the code to an application.\n 'file:',\n 'filesystem:',\n // Browser-internal surfaces; never a native app's callback.\n 'about:',\n 'chrome:',\n 'chrome-extension:',\n 'moz-extension:',\n 'view-source:',\n]);\n\n/\n The WHATWG \"special\" schemes, minus the two handled explicitly above.\n \n These are web-platform schemes with defined network semantics — never a native app's private-use\n * callback. Refusing them is what keeps \"private-use scheme\" meaning what it says: an app-owned\n * scheme, not any string that happens to parse. `ftp:` in particular was pinned as refused before\n * private-use schemes were admitted, and it stays refused.\n /\nconst NON_CALLBACK_SPECIAL_SCHEMES: ReadonlySet<string> = new Set(['ftp:', 'ws:', 'wss:', 'file:']);\n\n/* RFC 3986 § 3.1 scheme grammar: ALPHA ( ALPHA / DIGIT / \"+\" / \"-\" / \".\" ), plus the WHATWG colon. /\nconst RFC3986_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]:$/;\n\nexport function isSafeOAuthRedirectUri(value: string): boolean {\n if (typeof value !== 'string' \|\| value.length === 0 \|\| value !== value.trim()) return false;\n let url: URL;\n try {\n url = new URL(value);\n } catch {\n return false;\n }\n if (url.hash) return false;\n if (url.username \|\| url.password) return false;\n if (url.protocol === 'https:') return true;\n if (url.protocol === 'http:') {\n const host = url.hostname.toLowerCase();\n return host === 'localhost' \|\| host === '127.0.0.1' \|\| host === '::1' \|\| host === '[::1]';\n }\n // A private-use scheme for a native app. Refused only when the scheme itself confers a dangerous\n // capability; the shape is otherwise held to the same rules as an https target (no fragment, no\n // embedded credentials, both checked above), and interception is answered by mandatory PKCE.\n const scheme = url.protocol.toLowerCase();\n if (DANGEROUS_REDIRECT_URI_SCHEMES.has(scheme)) return false;\n if (NON_CALLBACK_SPECIAL_SCHEMES.has(scheme)) return false;\n return RFC3986_SCHEME_PATTERN.test(scheme);\n}\n\n// ===============================\n// CORE OAUTH CLIENT SCHEMAS\n// ===============================\n\n/\n Base schema for extension (needs to be z.object for `.extend()` to work).\n \n `scope` reuses `ApiKeyScope` (ORGANIZATION\|APPLICATION) — the same primary-scope\n * split as api-keys; the org/app variants narrow it to a literal + add the FK.\n \n SECRET + ROTATION GRACE (`hashedSecret`/`secretPrefix`/`previous`) mirror the\n api-key `hashedKey`/`keyPrefix`/`previous` fields VERBATIM (same decorators,\n same server-managed strip-seam contract). Unlike api-keys — which declare\n * `hashedKey`/`keyPrefix` on the concrete org/app variant schemas — the OAuth\n * client keeps them on the base: every scope persists the identical secret shape,\n * so a single base declaration is the honest single source of truth.\n */\nexport const OAuthClientSchemaBase = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(), // == clientId\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n description: z.string().max(500).optional(),\n scope: z.enum(ApiKeyScope).isDBIndexed().isSummaryField(),\n // `.isAuditEvidence()` — the roles an OAuth client acts with. Same reasoning as the API-key\n // authority field: roles are the single authorization axis, so their before/after IS the\n // evidence. assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n roles: z.array(RolesSchema).default([]).isAuditEvidence(),\n // OIDC IDENTITY scopes this client may request in the authorization_code flow (e.g. `openid`,\n // `profile`, `email`) — validated against the requested `scope` when minting the ID token /\n // serving `/oauth/userinfo`. This is IDENTITY only: it is NOT an authorization axis. Authorization\n // is roles-only (scope-based authorization was deleted 2026-07-21 — do NOT re-introduce it). Empty\n // for pure client_credentials machine clients (they carry no scopes; their access is roles-only).\n allowedScopes: z.array(z.string()).default([]),\n // Grant types this client is authorized to use. Defaults to the machine front.\n allowedGrants: z.array(z.enum(OAuthGrantType)).default([OAuthGrantType.CLIENT_CREDENTIALS]),\n // OIDC authorization_code: exact-match allowlist of redirect URIs. Empty for pure\n // client_credentials clients. An authorization request's `redirect_uri` MUST equal one of\n // these by EXACT string match (no wildcards / no substring) — the anti-open-redirect guard.\n // Each entry is additionally constrained to a SAFE absolute URL by `isSafeOAuthRedirectUri`\n // (https anywhere · http loopback only · no javascript:/data:/fragment/embedded-credentials) so a\n // malicious registered entry cannot become a stored-XSS / off-origin redirect navigation target.\n redirectUris: z\n .array(\n z.string().refine(isSafeOAuthRedirectUri, {\n message: 'redirect_uri must be an absolute https URL (or an http loopback URL) with no fragment or embedded credentials',\n }),\n )\n // Bounded. RFC 7591 sets no limit, and one is needed here because `/oauth/register` accepts this\n // array from an ANONYMOUS caller: without a ceiling a single registration can carry an arbitrary\n // number of URIs, and the per-IP registration limit bounds how MANY registrations happen, not how\n // large each one is. 50 is far above any real client — several environments times a few loopback\n // ports — so this constrains only abuse. Every entry is independently constrained by\n // `isSafeOAuthRedirectUri`, so this is a storage bound, not an authorization one.\n .max(50)\n .default([]),\n // OIDC RP-Initiated Logout 1.0: exact-match allowlist of POST-LOGOUT redirect URIs (revocation-C). When\n // an RP calls `/oauth/end-session` with a `post_logout_redirect_uri`, that value MUST equal one of these\n // by EXACT string match — the SAME anti-open-redirect discipline as `redirectUris` (no wildcards, no\n // substring). A non-matching value is refused and the OP lands the user on its own logged-out page rather\n // than redirecting back to the RP. Empty for clients that never drive an interactive logout (pure\n // client_credentials machines). Each entry is independently held to a SAFE absolute URL by\n // `isSafeOAuthRedirectUri` (https anywhere · http loopback only · no fragment/embedded-credentials), and\n // the array is `.max(50)`-bounded for the same anonymous-`/oauth/register` abuse reason as `redirectUris`.\n // spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (`post_logout_redirect_uri` MUST have been\n // registered with the OP).\n postLogoutRedirectUris: z\n .array(\n z.string().refine(isSafeOAuthRedirectUri, {\n message: 'post_logout_redirect_uri must be an absolute https URL (or an http loopback URL) with no fragment or embedded credentials',\n }),\n )\n .max(50)\n .default([]),\n // OIDC INTERACTIVE CONSENT gate. When TRUE, the authorization_code flow requires EXPLICIT user\n // consent before a code is minted: `/oauth/authorize` returns `consent_required` (with a single-use\n // consent-request token + the client/resource/scope details) instead of auto-issuing the code, and\n // the user must approve at `/oauth/authorize/decision`. Defaults FALSE = a first-party / trusted\n // client whose consent is auto-granted (the pre-consent behavior, so machine + trusted clients are\n // UNAFFECTED). Set TRUE for a THIRD-PARTY client that acts on the user's behalf and must therefore\n // be explicitly authorized by the user before it can obtain a delegated token. The gate is\n // SERVER-owned (a client property, never a request parameter) so a third-party client cannot\n // suppress its own consent prompt.\n requiresConsent: z.boolean().default(false),\n // OIDC `token_endpoint_auth_method` — PUBLIC (`NONE`, the default: PKCE-only, no secret at the token\n // endpoint) vs CONFIDENTIAL (`CLIENT_SECRET_BASIC`/`POST`: the authorization_code exchange AND token\n // revocation REQUIRE the client to present its `client_secret`, defense-in-depth over PKCE). Default\n // `NONE` is the safe default: a server-side confidential client must opt into\n // a secret-bearing token-endpoint method explicitly.\n // Settable at create/update — flipping a client confidential simply starts requiring the secret it\n // already has. The public-vs-confidential decision is derived ONLY via\n // `isConfidentialTokenEndpointAuthMethod`, never by re-comparing the enum inline.\n tokenEndpointAuthMethod: z.enum(OAuthTokenEndpointAuthMethod).default(OAuthTokenEndpointAuthMethod.NONE).isSummaryField(),\n // `.isAuditEvidence()` — whether this client's delegated access is live.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n status: z.enum(OAuthClientStatus).default(OAuthClientStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),\n expiresAt: z.date().optional().isDBIndexed().isSummaryField(),\n lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // ── Client secret ─────────────────────────────────────────────────────────\n // `hashedSecret` is the lookup key for the client-credentials token exchange\n // (the request-auth choke point resolves a presented secret against it on every\n // exchange). Without an index this is an O(n) collection scan; the compound\n // unique guarantees only one active row per hash — cryptographically near-\n // impossible to collide by accident, but a uniqueness contract avoids two rows\n // being returned to the resolver on a hash collision and prevents shadow-client\n // duplicates during rotation. Backend-only (a secret hash, never surfaced except\n // once at creation via `isReturnedAtCreation`, which the mint postfix correlates\n // the one-time plaintext against). `.excludeFrom{Create,Update}()` — the client\n // never supplies it; the mint impl is the single server-side choke point.\n hashedSecret: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),\n // First 8 chars of the plaintext secret — persisted + shown in lists\n // (`.isSummaryField()`) so an admin can identify a client without revealing the\n // secret. Server-managed.\n secretPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n\n // ── Rotation grace window ─────────────────────────────────────────────────\n // When a client secret is ROTATED or REGENERATEd, the PRIOR secret is retained\n // here so it keeps authenticating during an overlap window — callers can migrate\n // to the new secret without a hard cutover. The client-credentials exchange\n // resolves a presented secret against the current `hashedSecret` OR this\n // `previousHashedSecret` while the window is open (`previousSecretInvalidationDate`\n // is null or in the future) AND the client is ACTIVE. All three are server-managed\n // by the rotate/regenerate impls only — never client-settable\n // (`.excludeFromCreate().excludeFromUpdate()`).\n //\n // `previousHashedSecret` — `sha256` of the prior secret; the auth path looks a\n // presented secret up against it, so it is `.isDBIndexed()`. Backend-only (a\n // secret hash, never surfaced). Absent until the first rotation.\n previousHashedSecret: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n // First 8 chars of the prior secret — retained for support/audit display while\n // the previous secret is still valid (not a secret, so surfaced). Overwritten on\n // the next rotation.\n previousSecretPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),\n // When the previous secret stops authenticating. `null`/absent = no scheduled\n // invalidation (REGENERATE overlap — the prior secret stays valid until the next\n // rotation). A future date (ROTATE `oldSecretInvalidationDate`) = honored until\n // then, then rejected. `now`/past (ROTATE default) = immediate hard cutover.\n // Surfaced so operators can see when the old secret dies.\n previousSecretInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n\n // ── Registration access token (RFC 7592) ──────────────────────────────────\n // The credential a DYNAMICALLY REGISTERED client uses to read, update or delete\n // its own registration at the client configuration endpoint. Issued once, at\n // registration, and returned exactly once in the 201 body.\n //\n // \"registration_access_token: REQUIRED. String containing the access token to be\n // used at the client configuration endpoint to perform subsequent operations upon\n // the client registration.\" … \"The client MUST use its registration access token\n // in all calls to this endpoint as an OAuth 2.0 Bearer Token.\"\n // spec-cite: RFC 7592 §3 (Client Information Response) and §2 (Client Configuration Endpoint).\n //\n // SEPARATE FROM `hashedSecret`, deliberately, and not merely for tidiness. They\n // authenticate different things: the client secret authenticates the CLIENT at the\n // token endpoint, while this authenticates a caller's standing to administer the\n // client's own REGISTRATION. A dynamically registered client is public\n // (`token_endpoint_auth_method=none`) and never uses its secret at all, so folding\n // the two together would give a credential two unrelated powers and make\n // \"rotate the secret\" silently mean \"revoke management access\".\n //\n // ABSENT on every client that is not dynamically registered — an operator- or\n // organization-registered client is administered through the ordinary authenticated\n // resource surface, not through RFC 7592.\n //\n // `sha256` hex, matching every other token in this framework: deterministic so a\n // presented Bearer token resolves by re-hashing and matching, and safe because the\n // plaintext is 32 random bytes rather than a password.\n registrationAccessTokenHash: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n // First 8 characters of the plaintext, so an operator can identify which token a\n // client holds without seeing it — the same affordance `secretPrefix` provides for\n // the client secret. Not a secret; surfaced.\n registrationAccessTokenPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),\n\n // ── How this client came to exist ─────────────────────────────────────────\n // WHO registered this client, which is a different question from WHERE the row lives.\n //\n // Every other client on this collection was created by someone with standing in this application:\n // an organization administrator, or a platform operator. A DYNAMIC client was created by an\n // anonymous caller at the RFC 7591 `/register` endpoint, and proved nothing about itself.\n //\n // The field exists because the STORAGE LOCATION can no longer carry that meaning. A dynamically\n // registered client has no organization, so it must live on the APPLICATION collection — and\n // `scope: APPLICATION` otherwise means \"platform-operator first-party\", the most trusted posture\n // there is. Without this discriminator a stranger's client would inherit that trust purely from\n // where it was filed. `ResolvedAuthorizationClient` reads it and maps DYNAMIC to\n // `AuthorizationClientTenancy.UNAFFILIATED`, so the authorize path treats it like a CIMD client:\n // always consent, identity scopes only.\n //\n // `.excludeFromCreate().excludeFromUpdate()` is load-bearing, not hygiene: this is a TRUST\n // CLASSIFICATION, and a caller who could set it could file itself as OPERATOR. Only the\n // registration endpoint writes it, through the system door. Authenticated\n // administrative registration receives OPERATOR by default because that\n // administrator vouches for the client.\n // `.isAuditEvidence()` — a change here changes how much this client is trusted.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n registrationOrigin: z.enum(OAuthClientRegistrationOrigin)\n .default(OAuthClientRegistrationOrigin.OPERATOR)\n .isDBIndexed()\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isAuditEvidence(),\n\n});\n\nexport type OAuthClientBase = z.infer<typeof OAuthClientSchemaBase>;\n\nexport const OAuthClientOrganizationSchema = OAuthClientSchemaBase.extend({\n scope: z.literal(ApiKeyScope.ORGANIZATION),\n organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n});\n\nexport type OAuthClientOrganization = z.infer<typeof OAuthClientOrganizationSchema>;\n\nexport const OAuthClientApplicationSchema = OAuthClientSchemaBase.extend({\n scope: z.literal(ApiKeyScope.APPLICATION),\n applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n});\n\nexport type OAuthClientApplication = z.infer<typeof OAuthClientApplicationSchema>;\n"]}
1	+ {"version":3,"file":"oauth-clients.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oCAAoC,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AACrI,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAElE,kCAAkC;AAClC,qBAAqB;AACrB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,0CAAqB,CAAA;IACrB,wCAAmB,CAAA;AACrB,CAAC,EAJW,iBAAiB,KAAjB,iBAAiB,QAI5B;AAED;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,6BAcX;AAdD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,sDAAqB,CAAA;IACrB;;;;;OAKG;IACH,oDAAmB,CAAA;AACrB,CAAC,EAdW,6BAA6B,KAA7B,6BAA6B,QAcxC;AAED,MAAM,CAAN,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,2DAAyC,CAAA;IACzC,2DAAyC,CAAA;IACzC,iDAA+B,CAAA;AACjC,CAAC,EAJW,cAAc,KAAd,cAAc,QAIzB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,4BAIX;AAJD,WAAY,4BAA4B;IACtC,6CAAa,CAAA;IACb,2EAA2C,CAAA;IAC3C,yEAAyC,CAAA;AAC3C,CAAC,EAJW,4BAA4B,KAA5B,4BAA4B,QAIvC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAAoC;IACxF,OAAO,MAAM,KAAK,4BAA4B,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,mGAAmG;IACnG,YAAY;IACZ,aAAa;IACb,WAAW;IACX,kFAAkF;IAClF,OAAO;IACP,OAAO;IACP,oEAAoE;IACpE,OAAO;IACP,aAAa;IACb,4DAA4D;IAC5D,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpG,wGAAwG;AACxG,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AAEtD,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;IAC5F,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,4BAA4B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,kCAAkC;AAClC,4BAA4B;AAC5B,kCAAkC;AAElC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,EAAE,cAAc;IACtE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IACzD,4FAA4F;IAC5F,yFAAyF;IACzF,+DAA+D;IAC/D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACzD,8FAA8F;IAC9F,4FAA4F;IAC5F,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAC3F,kFAAkF;IAClF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,kGAAkG;IAClG,iGAAiG;IACjG,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE;QACxC,OAAO,EAAE,+GAA+G;KACzH,CAAC,CACH;QACD,iGAAiG;QACjG,iGAAiG;QACjG,kGAAkG;QAClG,iGAAiG;QACjG,qFAAqF;QACrF,kFAAkF;SACjF,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,EAAE,CAAC;IACd,wGAAwG;IACxG,yGAAyG;IACzG,qGAAqG;IACrG,0GAA0G;IAC1G,kGAAkG;IAClG,2FAA2F;IAC3F,yGAAyG;IACzG,2GAA2G;IAC3G,kGAAkG;IAClG,2BAA2B;IAC3B,sBAAsB,EAAE,CAAC;SACtB,KAAK,CACJ,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE;QACxC,OAAO,EAAE,2HAA2H;KACrI,CAAC,CACH;SACA,GAAG,CAAC,EAAE,CAAC;SACP,OAAO,CAAC,EAAE,CAAC;IACd,+FAA+F;IAC/F,oGAAoG;IACpG,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,mGAAmG;IACnG,2FAA2F;IAC3F,6FAA6F;IAC7F,mCAAmC;IACnC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,qGAAqG;IACrG,qGAAqG;IACrG,qGAAqG;IACrG,8EAA8E;IAC9E,qDAAqD;IACrD,mGAAmG;IACnG,uEAAuE;IACvE,kFAAkF;IAClF,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;IACzH,yEAAyE;IACzE,qDAAqD;IACrD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAC7D,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SAClF,QAAQ,CAAC,+JAA+J,CAAC;IAC5K,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEnG,6EAA6E;IAC7E,6EAA6E;IAC7E,gFAAgF;IAChF,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,iFAAiF;IACjF,gFAAgF;IAChF,0EAA0E;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;SAC3I,QAAQ,CAAC,0KAA0K,CAAC;IACvL,qEAAqE;IACrE,gFAAgF;IAChF,0BAA0B;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAE3F,6EAA6E;IAC7E,+EAA+E;IAC/E,iFAAiF;IACjF,4EAA4E;IAC5E,yEAAyE;IACzE,oFAAoF;IACpF,mFAAmF;IACnF,8DAA8D;IAC9D,gDAAgD;IAChD,EAAE;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,iEAAiE;IACjE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACxH,+EAA+E;IAC/E,iFAAiF;IACjF,qBAAqB;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC7F,8EAA8E;IAC9E,iFAAiF;IACjF,gFAAgF;IAChF,6EAA6E;IAC7E,0DAA0D;IAC1D,8BAA8B,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAE3F,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE;IACF,iFAAiF;IACjF,kFAAkF;IAClF,iFAAiF;IACjF,+DAA+D;IAC/D,+FAA+F;IAC/F,EAAE;IACF,gFAAgF;IAChF,mFAAmF;IACnF,iFAAiF;IACjF,uEAAuE;IACvE,mFAAmF;IACnF,yEAAyE;IACzE,gEAAgE;IAChE,EAAE;IACF,8EAA8E;IAC9E,oFAAoF;IACpF,0CAA0C;IAC1C,EAAE;IACF,iFAAiF;IACjF,mFAAmF;IACnF,uDAAuD;IACvD,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC/H,iFAAiF;IACjF,mFAAmF;IACnF,6CAA6C;IAC7C,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAEtG,6EAA6E;IAC7E,sFAAsF;IACtF,EAAE;IACF,kGAAkG;IAClG,4FAA4F;IAC5F,0FAA0F;IAC1F,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,iGAAiG;IACjG,gGAAgG;IAChG,iFAAiF;IACjF,iGAAiG;IACjG,wCAAwC;IACxC,EAAE;IACF,2FAA2F;IAC3F,wFAAwF;IACxF,0EAA0E;IAC1E,wEAAwE;IACxE,wCAAwC;IACxC,gFAAgF;IAChF,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;SACtD,OAAO,CAAC,6BAA6B,CAAC,QAAQ,CAAC;SAC/C,WAAW,EAAE;SACb,cAAc,EAAE;SAChB,iBAAiB,EAAE;SACnB,iBAAiB,EAAE;SACnB,eAAe,EAAE;CAErB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,yFAAyF,CAAC;IAC9I,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IACnG;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACzG,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;CAC5F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACvE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,+GAA+G,CAAC;IACnK,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;CACnG,CAAC,CAAC","sourcesContent":["/*\n OAuth Client Shared Schemas\n \n Frontend/backend shared schemas + DTOs for the registered OAuth-client\n * credential resource (`organizationOAuthClients`, `applicationOAuthClients`).\n * Backend-specific logic (secret minting/hashing, mint pipeline) stays in\n * saas-backend-lib.\n \n This resource is a FAITHFUL MIRROR of the api-keys resource\n * (`api-keys.shared.schemas.ts`): the same long-lived secret + rotation-grace\n * shape, the same server-managed strip-seam contract, the same org\|app scope\n * split. It exists as its OWN resource (not a variant of api-keys) because the\n * request-auth choke point routes a presented secret to a DISTINCT principal\n * by the plaintext prefix (`oc_org_`/`oc_app_` vs the api-key `sk_org_`/`sk_app_`)\n * — an OAuth client and an api-key both authenticate the SAME machine principal\n * (`ORGANIZATION_MACHINE` / `APPLICATION_MACHINE`); they are distinct credential types, an api-key acts\n * as an api-key principal.\n \n OIDC authorization code, interactive consent, persistent consent grants,\n * exact redirect allowlists and public/confidential client classification are\n * implemented. The resource remains the registered-client authority; issued\n * codes, tokens and user consent records have their own runtime/storage owners.\n /\n\nimport { z } from 'zod';\nimport { AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX, AutonomousAgentRefSchema } from '../../flows-actors/autonomous-agents.shared.schemas';\nimport { RolesSchema } from '../authorizations/roles.shared.schemas';\nimport { ApiKeyScope } from '../api-keys/api-keys.shared.schemas';\n\n// ===============================\n// OAUTH CLIENT ENUMS\n// ===============================\n\n/\n Lifecycle status of a registered OAuth client. Mirrors `ApiKeyStatus`: an\n * INACTIVE or EXPIRED client cannot mint tokens at the request-auth choke point.\n /\nexport enum OAuthClientStatus {\n ACTIVE = 'active',\n INACTIVE = 'inactive',\n EXPIRED = 'expired',\n}\n\n/\n OAuth 2.0 grant types a registered client may be authorized to use. The trunk\n * resource ships CLIENT_CREDENTIALS (the machine-to-machine front); the\n * AUTHORIZATION_CODE / REFRESH_TOKEN arms are declared here so the OIDC branch can\n * enable them per-client via `allowedGrants` without a schema reshape.\n /\n/\n How a client got registered — a TRUST classification, not a bookkeeping detail.\n \n Kept separate from `ApiKeyScope` on purpose. `scope` answers \"which of this application's scopes\n * owns the credential\", and both of its members imply someone with standing inside the application\n * created it. This enum answers \"did anyone vouch for this client at all\", and the two questions\n * became independent the moment an anonymous caller could register one.\n \n semantic-literal-boundary: a closed Wildo vocabulary with one named runtime source. Every schema,\n * default, comparison and mapping over registration provenance derives from THIS enum.\n /\nexport enum OAuthClientRegistrationOrigin {\n /\n Created by a principal with standing in this application — an organization administrator\n * through the org-clients API, a platform operator, or a seed. The default, so nothing that\n * existed before dynamic registration changes posture.\n /\n OPERATOR = 'operator',\n /\n Self-registered by an anonymous caller at the RFC 7591 `/register` endpoint.\n \n The client asserted its own name and redirect URIs and proved nothing. It is granted no roles,\n * capped at identity scopes, and always faces the user's consent prompt.\n /\n DYNAMIC = 'dynamic',\n}\n\nexport enum OAuthGrantType {\n CLIENT_CREDENTIALS = 'client_credentials',\n AUTHORIZATION_CODE = 'authorization_code',\n REFRESH_TOKEN = 'refresh_token',\n}\n\n/\n How a registered OAuth client authenticates AT THIS APP'S token endpoint (OIDC\n * `token_endpoint_auth_method`) — the PROVIDER-side classification of OUR clients. Deliberately\n * DISTINCT from `OAuth2_TokenEndpoint_AuthMethod` in `external-connectors-models`, which describes how\n * Wildo-as-CLIENT authenticates to an EXTERNAL IdP's token endpoint (the opposite direction); the two\n * are separate concepts even though they share the OAuth wire vocabulary. Values are the OIDC-registered\n * method names advertised in the discovery document's `token_endpoint_auth_methods_supported`.\n \n - `NONE` — a PUBLIC client: no client secret at the token endpoint; the authorization_code exchange\n * relies on mandatory PKCE (S256) + exact redirect_uri (the OAuth 2.1 baseline for SPA / native /\n * agent clients). This is the default because a client is public unless its\n * server-side secret-retention and token authentication method are explicit.\n * - `CLIENT_SECRET_BASIC` / `CLIENT_SECRET_POST` — a CONFIDENTIAL client: it MUST present its\n * `client_secret` (via HTTP Basic, or the request body, respectively) at the token endpoint, as\n * defense-in-depth on top of PKCE. Both map to \"confidential\" for enforcement — the basic-vs-body\n * distinction is a per-request transport choice the token endpoint already accepts either way.\n /\nexport enum OAuthTokenEndpointAuthMethod {\n NONE = 'none',\n CLIENT_SECRET_BASIC = 'client_secret_basic',\n CLIENT_SECRET_POST = 'client_secret_post',\n}\n\n/\n The single semantic authority for the public-vs-confidential decision: a client is CONFIDENTIAL\n * (must present its secret at the token endpoint) iff its `tokenEndpointAuthMethod` is not `NONE`.\n * Every enforcement site (authorization_code secret check, revocation client-auth) derives from this\n * helper rather than re-deciding, so the classification never drifts.\n /\nexport function isConfidentialTokenEndpointAuthMethod(method: OAuthTokenEndpointAuthMethod): boolean {\n return method !== OAuthTokenEndpointAuthMethod.NONE;\n}\n\n/\n Safe redirect-URI policy for a registered OAuth client — the anti-open-redirect / anti-XSS gate\n * on every entry of the `redirectUris` allowlist.\n \n The authorization_code flow matches a request's `redirect_uri` by EXACT string against this\n * allowlist, and the authorize handler then emits the matched value as the browser's navigation\n * target (`redirect_to`). A registered entry is therefore a literal, user-navigated URL, so the\n * allowlist must never contain a scheme or shape that can execute script or redirect off-origin:\n \n - `https:` — allowed for any host/port (the standard for web / SPA / agent RPs).\n * - `http:` — allowed ONLY for a loopback host (`localhost` / `127.0.0.1` / `::1`), per OAuth 2.1\n * + RFC 8252 (native / CLI / dev clients); loopback is unreachable by a network\n * attacker, so plain http there is safe.\n * - a PRIVATE-USE URI scheme (`cursor:`, `com.example.app:`) — allowed, because that is how a native\n * app receives the code on a platform with no loopback listener. See below.\n * - everything else — `javascript:`, `data:`, `vbscript:`, `file:`, and plain `http:` to a\n * NON-loopback host — is REJECTED.\n * - a fragment (`#…`) is REJECTED (RFC 6749 §3.1.2: a redirect endpoint URI MUST NOT include one).\n * - embedded credentials (`https://user:pass@host`) are REJECTED (a phishing / host-confusion vector).\n * - leading/trailing whitespace is REJECTED — the WHATWG `URL` constructor silently trims it, so a\n * padded value would parse to a different string than the one exact-matched at authorize time.\n \n ## Private-use schemes: why they were added on 2026-08-11\n \n This policy previously refused every non-http(s) scheme, and the note here said to extend it\n * \"deliberately\" if an app ever needed one. A real client made that concrete: Cursor registered\n * `cursor://anysphere.cursor-mcp/oauth/callback` and was refused, which means *no native MCP client\n using a custom-scheme callback could register with a Wildo application at all.** None of our own\n * lanes could have found it — every one of them registers `http://localhost/...`.\n \n The standard sanctions the pattern: native apps \"MAY use whichever redirect option suits their\n * needs best, taking into account platform-specific implementation details\", and private-use URI\n * scheme redirection is one of the three named options.\n * spec-cite: RFC 8252 § 7 and § 7.1 (Private-Use URI Scheme Redirection).\n \n The known weakness is NOT that such a URI is unsafe to navigate to — it is that the code may reach\n * the wrong recipient: \"A limitation of using private-use URI schemes for redirect URIs is that\n * multiple apps can typically register the same scheme, which makes it indeterminate as to which app\n * will receive the authorization code.\"\n * spec-cite: RFC 8252 § 8.1 (Protecting the Authorization Code).\n \n That is an interception risk, and PKCE is the mitigation the same section prescribes. This server\n * REQUIRES PKCE and advertises `S256` alone, so a code delivered to the wrong app is unusable without\n * the verifier. Refusing the scheme outright bought no protection PKCE does not already provide, and\n * cost the entire native-client ecosystem.\n \n What is still refused is what actually executes or reads local state — the danger is the SCHEME's\n * capability, not its unfamiliarity, so the check is a denylist of dangerous schemes rather than an\n * allowlist of known apps. An allowlist is impossible here by construction: the set of legitimate app\n * schemes is open, and every entry would be a new client the framework has to be taught about.\n \n Rejected alternatives: `z.string().url()` (the original guard) accepts every dangerous scheme; a\n * strict https-only rule is too tight for the native/CLI loopback flow; requiring a reverse-DNS\n * scheme (`com.example.app:`, which RFC 8252 § 7.1 RECOMMENDS) was rejected because it would still\n * refuse `cursor:` — the recommendation binds the app author, not the authorization server, and a\n * server that enforces it rejects conformant clients for a style violation.\n \n assurance-control: WILDO.IDENTITY.REDIRECT_TARGET_VALIDATION — registered OAuth redirect targets are constrained to\n * safe absolute URLs, closing an open-redirect / stored-XSS delegation primitive.\n /\n/\n * EXPORTED as of 2026-09-02, and the export is the point rather than a convenience.\n \n This is a closed vocabulary with one named runtime source — the shape `CLAUDE.md` asks for — and it\n * was reachable by nothing outside this file, so the assurance authority basis could not attest\n * `WILDO.IDENTITY.REDIRECT_TARGET_VALIDATION` against the set the guard actually branches on. It would\n * have had to transcribe the schemes into a second list, free to drift from this one, which is the\n * failure the single-source rule exists to prevent.\n \n Nothing else may BRANCH on it: the validator below is the only enforcement site. A reader is a\n * reader — the basis names the members so a programme can say which schemes are refused.\n /\nexport const DANGEROUS_REDIRECT_URI_SCHEMES: ReadonlySet<string> = new Set([\n // Executes script in the navigating context — the open-redirect-to-XSS primitive this guard exists\n // to close.\n 'javascript:',\n 'vbscript:',\n // Carries its own payload, so the \"redirect target\" IS attacker-authored content.\n 'data:',\n 'blob:',\n // Reads local state rather than handing the code to an application.\n 'file:',\n 'filesystem:',\n // Browser-internal surfaces; never a native app's callback.\n 'about:',\n 'chrome:',\n 'chrome-extension:',\n 'moz-extension:',\n 'view-source:',\n]);\n\n/\n The WHATWG \"special\" schemes, minus the two handled explicitly above.\n \n These are web-platform schemes with defined network semantics — never a native app's private-use\n * callback. Refusing them is what keeps \"private-use scheme\" meaning what it says: an app-owned\n * scheme, not any string that happens to parse. `ftp:` in particular was pinned as refused before\n * private-use schemes were admitted, and it stays refused.\n /\nconst NON_CALLBACK_SPECIAL_SCHEMES: ReadonlySet<string> = new Set(['ftp:', 'ws:', 'wss:', 'file:']);\n\n/* RFC 3986 § 3.1 scheme grammar: ALPHA ( ALPHA / DIGIT / \"+\" / \"-\" / \".\" ), plus the WHATWG colon. /\nconst RFC3986_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]:$/;\n\nexport function isSafeOAuthRedirectUri(value: string): boolean {\n if (typeof value !== 'string' \|\| value.length === 0 \|\| value !== value.trim()) return false;\n let url: URL;\n try {\n url = new URL(value);\n } catch {\n return false;\n }\n if (url.hash) return false;\n if (url.username \|\| url.password) return false;\n if (url.protocol === 'https:') return true;\n if (url.protocol === 'http:') {\n const host = url.hostname.toLowerCase();\n return host === 'localhost' \|\| host === '127.0.0.1' \|\| host === '::1' \|\| host === '[::1]';\n }\n // A private-use scheme for a native app. Refused only when the scheme itself confers a dangerous\n // capability; the shape is otherwise held to the same rules as an https target (no fragment, no\n // embedded credentials, both checked above), and interception is answered by mandatory PKCE.\n const scheme = url.protocol.toLowerCase();\n if (DANGEROUS_REDIRECT_URI_SCHEMES.has(scheme)) return false;\n if (NON_CALLBACK_SPECIAL_SCHEMES.has(scheme)) return false;\n return RFC3986_SCHEME_PATTERN.test(scheme);\n}\n\n// ===============================\n// CORE OAUTH CLIENT SCHEMAS\n// ===============================\n\n/\n Base schema for extension (needs to be z.object for `.extend()` to work).\n \n `scope` reuses `ApiKeyScope` (ORGANIZATION\|APPLICATION) — the same primary-scope\n * split as api-keys; the org/app variants narrow it to a literal + add the FK.\n \n SECRET + ROTATION GRACE (`hashedSecret`/`secretPrefix`/`previous`) mirror the\n api-key `hashedKey`/`keyPrefix`/`previous` fields VERBATIM (same decorators,\n same server-managed strip-seam contract). Unlike api-keys — which declare\n * `hashedKey`/`keyPrefix` on the concrete org/app variant schemas — the OAuth\n * client keeps them on the base: every scope persists the identical secret shape,\n * so a single base declaration is the honest single source of truth.\n /\nexport const OAuthClientSchemaBase = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(), // == clientId\n name: z.string().min(1).max(100).isDBIndexed().isSummaryField(),\n description: z.string().max(500).optional(),\n scope: z.enum(ApiKeyScope).isDBIndexed().isSummaryField(),\n // `.isAuditEvidence()` — the roles an OAuth client acts with. Same reasoning as the API-key\n // authority field: roles are the single authorization axis, so their before/after IS the\n // evidence. assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n roles: z.array(RolesSchema).default([]).isAuditEvidence(),\n // OIDC IDENTITY scopes this client may request in the authorization_code flow (e.g. `openid`,\n // `profile`, `email`) — validated against the requested `scope` when minting the ID token /\n // serving `/oauth/userinfo`. This is IDENTITY only: it is NOT an authorization axis. Authorization\n // is roles-only (scope-based authorization was deleted 2026-07-21 — do NOT re-introduce it). Empty\n // for pure client_credentials machine clients (they carry no scopes; their access is roles-only).\n allowedScopes: z.array(z.string()).default([]),\n // Grant types this client is authorized to use. Defaults to the machine front.\n allowedGrants: z.array(z.enum(OAuthGrantType)).default([OAuthGrantType.CLIENT_CREDENTIALS]),\n // OIDC authorization_code: exact-match allowlist of redirect URIs. Empty for pure\n // client_credentials clients. An authorization request's `redirect_uri` MUST equal one of\n // these by EXACT string match (no wildcards / no substring) — the anti-open-redirect guard.\n // Each entry is additionally constrained to a SAFE absolute URL by `isSafeOAuthRedirectUri`\n // (https anywhere · http loopback only · no javascript:/data:/fragment/embedded-credentials) so a\n // malicious registered entry cannot become a stored-XSS / off-origin redirect navigation target.\n redirectUris: z\n .array(\n z.string().refine(isSafeOAuthRedirectUri, {\n message: 'redirect_uri must be an absolute https URL (or an http loopback URL) with no fragment or embedded credentials',\n }),\n )\n // Bounded. RFC 7591 sets no limit, and one is needed here because `/oauth/register` accepts this\n // array from an ANONYMOUS caller: without a ceiling a single registration can carry an arbitrary\n // number of URIs, and the per-IP registration limit bounds how MANY registrations happen, not how\n // large each one is. 50 is far above any real client — several environments times a few loopback\n // ports — so this constrains only abuse. Every entry is independently constrained by\n // `isSafeOAuthRedirectUri`, so this is a storage bound, not an authorization one.\n .max(50)\n .default([]),\n // OIDC RP-Initiated Logout 1.0: exact-match allowlist of POST-LOGOUT redirect URIs (revocation-C). When\n // an RP calls `/oauth/end-session` with a `post_logout_redirect_uri`, that value MUST equal one of these\n // by EXACT string match — the SAME anti-open-redirect discipline as `redirectUris` (no wildcards, no\n // substring). A non-matching value is refused and the OP lands the user on its own logged-out page rather\n // than redirecting back to the RP. Empty for clients that never drive an interactive logout (pure\n // client_credentials machines). Each entry is independently held to a SAFE absolute URL by\n // `isSafeOAuthRedirectUri` (https anywhere · http loopback only · no fragment/embedded-credentials), and\n // the array is `.max(50)`-bounded for the same anonymous-`/oauth/register` abuse reason as `redirectUris`.\n // spec-cite: OpenID Connect RP-Initiated Logout 1.0 §2 (`post_logout_redirect_uri` MUST have been\n // registered with the OP).\n postLogoutRedirectUris: z\n .array(\n z.string().refine(isSafeOAuthRedirectUri, {\n message: 'post_logout_redirect_uri must be an absolute https URL (or an http loopback URL) with no fragment or embedded credentials',\n }),\n )\n .max(50)\n .default([]),\n // OIDC INTERACTIVE CONSENT gate. When TRUE, the authorization_code flow requires EXPLICIT user\n // consent before a code is minted: `/oauth/authorize` returns `consent_required` (with a single-use\n // consent-request token + the client/resource/scope details) instead of auto-issuing the code, and\n // the user must approve at `/oauth/authorize/decision`. Defaults FALSE = a first-party / trusted\n // client whose consent is auto-granted (the pre-consent behavior, so machine + trusted clients are\n // UNAFFECTED). Set TRUE for a THIRD-PARTY client that acts on the user's behalf and must therefore\n // be explicitly authorized by the user before it can obtain a delegated token. The gate is\n // SERVER-owned (a client property, never a request parameter) so a third-party client cannot\n // suppress its own consent prompt.\n requiresConsent: z.boolean().default(false),\n // OIDC `token_endpoint_auth_method` — PUBLIC (`NONE`, the default: PKCE-only, no secret at the token\n // endpoint) vs CONFIDENTIAL (`CLIENT_SECRET_BASIC`/`POST`: the authorization_code exchange AND token\n // revocation REQUIRE the client to present its `client_secret`, defense-in-depth over PKCE). Default\n // `NONE` is the safe default: a server-side confidential client must opt into\n // a secret-bearing token-endpoint method explicitly.\n // Settable at create/update — flipping a client confidential simply starts requiring the secret it\n // already has. The public-vs-confidential decision is derived ONLY via\n // `isConfidentialTokenEndpointAuthMethod`, never by re-comparing the enum inline.\n tokenEndpointAuthMethod: z.enum(OAuthTokenEndpointAuthMethod).default(OAuthTokenEndpointAuthMethod.NONE).isSummaryField(),\n // `.isAuditEvidence()` — whether this client's delegated access is live.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n status: z.enum(OAuthClientStatus).default(OAuthClientStatus.ACTIVE).isDBIndexed().isSummaryField().isAuditEvidence(),\n expiresAt: z.date().optional().isDBIndexed().isSummaryField(),\n lastUsedAt: z.date().optional().isDBIndexed().excludeFromCreate().excludeFromUpdate()\n .describe('When the client was last accepted, to the minute: at the token endpoint, with its secret, or through one of its access tokens. Absent until it is first used.'),\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n\n // ── Client secret ─────────────────────────────────────────────────────────\n // `hashedSecret` is the lookup key for the client-credentials token exchange\n // (the request-auth choke point resolves a presented secret against it on every\n // exchange). Without an index this is an O(n) collection scan; the compound\n // unique guarantees only one active row per hash — cryptographically near-\n // impossible to collide by accident, but a uniqueness contract avoids two rows\n // being returned to the resolver on a hash collision and prevents shadow-client\n // duplicates during rotation. Backend-only (a secret hash, never surfaced except\n // once at creation via `isReturnedAtCreation`, which the mint postfix correlates\n // the one-time plaintext against). `.excludeFrom{Create,Update}()` — the client\n // never supplies it; the mint impl is the single server-side choke point.\n hashedSecret: z.string().min(1).isDBIndexed().isUnique().isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate()\n .describe('The SHA-256 hash of the client secret, the only form the application keeps. Returned in the creation response only; the secret itself is `plainSecret`, shown that once.'),\n // First 8 chars of the plaintext secret — persisted + shown in lists\n // (`.isSummaryField()`) so an admin can identify a client without revealing the\n // secret. Server-managed.\n secretPrefix: z.string().length(8).isSummaryField().excludeFromCreate().excludeFromUpdate(),\n\n // ── Rotation grace window ─────────────────────────────────────────────────\n // When a client secret is ROTATED or REGENERATEd, the PRIOR secret is retained\n // here so it keeps authenticating during an overlap window — callers can migrate\n // to the new secret without a hard cutover. The client-credentials exchange\n // resolves a presented secret against the current `hashedSecret` OR this\n // `previousHashedSecret` while the window is open (`previousSecretInvalidationDate`\n // is null or in the future) AND the client is ACTIVE. All three are server-managed\n // by the rotate/regenerate impls only — never client-settable\n // (`.excludeFromCreate().excludeFromUpdate()`).\n //\n // `previousHashedSecret` — `sha256` of the prior secret; the auth path looks a\n // presented secret up against it, so it is `.isDBIndexed()`. Backend-only (a\n // secret hash, never surfaced). Absent until the first rotation.\n previousHashedSecret: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n // First 8 chars of the prior secret — retained for support/audit display while\n // the previous secret is still valid (not a secret, so surfaced). Overwritten on\n // the next rotation.\n previousSecretPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),\n // When the previous secret stops authenticating. `null`/absent = no scheduled\n // invalidation (REGENERATE overlap — the prior secret stays valid until the next\n // rotation). A future date (ROTATE `oldSecretInvalidationDate`) = honored until\n // then, then rejected. `now`/past (ROTATE default) = immediate hard cutover.\n // Surfaced so operators can see when the old secret dies.\n previousSecretInvalidationDate: z.date().optional().excludeFromCreate().excludeFromUpdate(),\n\n // ── Registration access token (RFC 7592) ──────────────────────────────────\n // The credential a DYNAMICALLY REGISTERED client uses to read, update or delete\n // its own registration at the client configuration endpoint. Issued once, at\n // registration, and returned exactly once in the 201 body.\n //\n // \"registration_access_token: REQUIRED. String containing the access token to be\n // used at the client configuration endpoint to perform subsequent operations upon\n // the client registration.\" … \"The client MUST use its registration access token\n // in all calls to this endpoint as an OAuth 2.0 Bearer Token.\"\n // spec-cite: RFC 7592 §3 (Client Information Response) and §2 (Client Configuration Endpoint).\n //\n // SEPARATE FROM `hashedSecret`, deliberately, and not merely for tidiness. They\n // authenticate different things: the client secret authenticates the CLIENT at the\n // token endpoint, while this authenticates a caller's standing to administer the\n // client's own REGISTRATION. A dynamically registered client is public\n // (`token_endpoint_auth_method=none`) and never uses its secret at all, so folding\n // the two together would give a credential two unrelated powers and make\n // \"rotate the secret\" silently mean \"revoke management access\".\n //\n // ABSENT on every client that is not dynamically registered — an operator- or\n // organization-registered client is administered through the ordinary authenticated\n // resource surface, not through RFC 7592.\n //\n // `sha256` hex, matching every other token in this framework: deterministic so a\n // presented Bearer token resolves by re-hashing and matching, and safe because the\n // plaintext is 32 random bytes rather than a password.\n registrationAccessTokenHash: z.string().min(1).optional().isDBIndexed().isBackendOnly().excludeFromCreate().excludeFromUpdate(),\n // First 8 characters of the plaintext, so an operator can identify which token a\n // client holds without seeing it — the same affordance `secretPrefix` provides for\n // the client secret. Not a secret; surfaced.\n registrationAccessTokenPrefix: z.string().length(8).optional().excludeFromCreate().excludeFromUpdate(),\n\n // ── How this client came to exist ─────────────────────────────────────────\n // WHO registered this client, which is a different question from WHERE the row lives.\n //\n // Every other client on this collection was created by someone with standing in this application:\n // an organization administrator, or a platform operator. A DYNAMIC client was created by an\n // anonymous caller at the RFC 7591 `/register` endpoint, and proved nothing about itself.\n //\n // The field exists because the STORAGE LOCATION can no longer carry that meaning. A dynamically\n // registered client has no organization, so it must live on the APPLICATION collection — and\n // `scope: APPLICATION` otherwise means \"platform-operator first-party\", the most trusted posture\n // there is. Without this discriminator a stranger's client would inherit that trust purely from\n // where it was filed. `ResolvedAuthorizationClient` reads it and maps DYNAMIC to\n // `AuthorizationClientTenancy.UNAFFILIATED`, so the authorize path treats it like a CIMD client:\n // always consent, identity scopes only.\n //\n // `.excludeFromCreate().excludeFromUpdate()` is load-bearing, not hygiene: this is a TRUST\n // CLASSIFICATION, and a caller who could set it could file itself as OPERATOR. Only the\n // registration endpoint writes it, through the system door. Authenticated\n // administrative registration receives OPERATOR by default because that\n // administrator vouches for the client.\n // `.isAuditEvidence()` — a change here changes how much this client is trusted.\n // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n registrationOrigin: z.enum(OAuthClientRegistrationOrigin)\n .default(OAuthClientRegistrationOrigin.OPERATOR)\n .isDBIndexed()\n .isSummaryField()\n .excludeFromCreate()\n .excludeFromUpdate()\n .isAuditEvidence(),\n\n});\n\nexport type OAuthClientBase = z.infer<typeof OAuthClientSchemaBase>;\n\nexport const OAuthClientOrganizationSchema = OAuthClientSchemaBase.extend({\n scope: z.literal(ApiKeyScope.ORGANIZATION).describe(\"Always `organization`: the client is registered by one organization and acts within it.\"),\n organizationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n /\n The application-declared autonomous agents this client runs as (#1611). A schedule tick or an inbound\n * delivery for one of these refs starts a turn in this organization under THIS client's current roles,\n * with nobody on a socket.\n \n On the credential, so revocation, expiry and binding are ONE row, re-read when a turn starts and again\n * before a reviewer's decision resumes it. A separate binding resource was rejected: two rows that drift.\n * ORGANIZATION variant only, by decision (Paul, 2026-09-25): an application-wide client acting in every\n * tenant is the ambient reach the platform refuses; a firm acting in a client organization does so\n * through a service-provider relationship that admits its client.\n \n Written only by the `setAutonomousAgents` operation, which serializes on the organization row so that\n * at most one client in the organization carries a given ref; CREATE never sets it.\n \n assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — which agents a credential runs is a grant of authority, recorded before and after.\n */\n autonomousAgentRefs: z.array(AutonomousAgentRefSchema).max(AUTONOMOUS_AGENT_REFS_PER_CLIENT_MAX).default([])\n .isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate().isAuditEvidence(),\n});\n\nexport type OAuthClientOrganization = z.infer<typeof OAuthClientOrganizationSchema>;\n\nexport const OAuthClientApplicationSchema = OAuthClientSchemaBase.extend({\n scope: z.literal(ApiKeyScope.APPLICATION).describe(\"Always `application`: the client is registered for the application as a whole rather than by an organization.\"),\n applicationId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n});\n\nexport type OAuthClientApplication = z.infer<typeof OAuthClientApplicationSchema>;\n"]}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-consent-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAK1I,eAAO,MAAM,6DAA6D,GACxE,wBAAwB,oBAAoB,EAAE;;;;;;;;;kCAsG9C,CAAC"}
1	+ {"version":3,"file":"oauth-consent-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-consent-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAK1I,eAAO,MAAM,6DAA6D,GACxE,wBAAwB,oBAAoB,EAAE;;;;;;;;;kCAsG9C,CAAC"}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-consent-grants.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,uBAAuB;;;;;;;;;kBAsDlC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,MAAM,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}
1	+ {"version":3,"file":"oauth-consent-grants.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,uBAAuB;;;;;;;;;kBAsDlC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,MAAM,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/esm/security/oauth-clients/oauth-consent-grants.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-consent-grants.shared.schemas.js","sourceRoot":"","sources":["~~../../../../~~src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,6EAA6E;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,iGAAiG;IACjG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE1D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE9D;;;;;OAKG;IACH,+FAA+F;IAC/F,wFAAwF;IACxF,2IAA2I;IAC3I,iGAAiG;IACjG,iGAAiG;IACjG,wFAAwF;IACxF,MAAM,EAAE,oBAAoB,CAC5B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EACxE,aAAa,CAAC,KAAK,CACpB;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,GAAG,CAAC","sourcesContent":["/*\n OIDC Persistent Consent Grants (\"remember this app\")\n \n A durable \"user X authorized OAuth client Y for identity scopes Z (at resource R)\" record. It is\n * CREATED (via the system write primitive) when a user APPROVES an interactive-consent request AND\n * opts to remember the app, and READ at `/oauth/authorize` to SKIP re-prompting when an existing grant\n * already covers the requested scopes. The user can list their grants (\"authorized apps\") and revoke\n * one.\n \n USER-scoped: owned by `userId` (USER_SELF primary scope, derived from the `USERS → OAUTH_CONSENT_GRANTS`\n * composition relationship). One grant per `(userId, clientId, resource)` — a re-consent UPDATES the\n * granted scopes rather than creating a duplicate. `resource` participates in the grain because two\n * authorize requests from the same client for different RFC 8707 resources (distinct A2A / MCP agent\n * endpoints) are genuinely distinct delegations; an OIDC-only login carries no `resource` and yields a\n * single resource-less grant.\n /\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\nexport const OAuthConsentGrantSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n /* FK → USERS — the user who granted consent (the USER_SELF scope owner). /\n userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n /* The registered OAuth client (`_id`, `oc_`) the user authorized. Part of the business key. /\n clientId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n /*\n The RFC 8707 `resource` (the target A2A / MCP agent endpoint) this grant covers. Absent for an\n * OIDC-only login with no delegation. Part of the business key — a grant authorizes one client for\n * one resource, so different agent endpoints require separate, explicit consent.\n /\n resource: z.string().optional().isDBIndexed().isSummaryField(),\n\n /\n The IDENTITY scopes the user granted (e.g. `openid`, `profile`, `email`). A later authorize whose\n * requested scopes are a SUBSET of these skips the prompt; a request for a scope NOT in the grant\n * re-prompts (silent scope expansion is forbidden). Identity only — scopes carry no authorization\n * weight (authorization is roles-only).\n /\n // USAGE — what this person authorized a third-party client to reach on their behalf, and when.\n // A consent record is an observation of a decision they made, not an attribute of them.\n // RESET on erasure — returns this field to its schema default. It holds which scopes this person authorized a third-party client to reach,\n // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK\n // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK\n // needs a string. The value comes from the schema, so there is no second copy to drift.\n scopes: addImpersonalizeWith(\n z.array(z.string()).default([]).dataCategories(PersonalDataCategory.USAGE),\n RedactionType.RESET,\n ),\n\n /\n Expiry. The authorize lookup ignores a grant past this instant, fail-closed to a fresh consent\n * prompt.\n \n SET ON EVERY AFFIRMATIVE CONSENT since 2026-09-08 (#465) — on creation and again on every widen,\n * because a widen is the user approving again and a re-affirmation should restart the clock. It\n * was declared here with a reader and NO WRITER before that, so a remembered approval lived until\n * the person revoked it while the field read to an operator as a policy knob that existed.\n \n Still optional on the SCHEMA, for two reasons that are not the same: grants created before that\n * date carry none and must keep working (an absent expiry means \"never\", which is what they were\n * granted under), and a resource may be written by a path that has no operator policy in hand.\n /\n expiresAt: z.date().optional().isDBIndexed(),\n\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n 'userId',\n 'clientId',\n 'resource',\n]);\n\n/\n How long a remembered consent lasts when the application authors no policy of its own.\n \n 180 days, and the reasoning matters more than the number. A remembered consent is a standing\n * delegation of authority to a third party, so it should lapse on its own if nobody re-affirms it —\n * but a prompt the user meets every few weeks trains them to click through, which makes the consent\n * screen worth less rather than more. Half a year is long enough not to nag and short enough that an\n * authorization the user has forgotten about does not outlive their interest in the client by years.\n \n An application overrides it with `auth.consentGrantLifetimeDays`. There is deliberately no way to\n * express \"never expires\": that was the state this default replaced, and it was not chosen.\n */\nexport const OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS = 180;\n\nexport type OAuthConsentGrant = z.infer<typeof OAuthConsentGrantSchema>;\n"]}
1	+ {"version":3,"file":"oauth-consent-grants.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-consent-grants.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gEAAgE,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,6EAA6E;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE;IAE3F,iGAAiG;IACjG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE1D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE;IAE9D;;;;;OAKG;IACH,+FAA+F;IAC/F,wFAAwF;IACxF,2IAA2I;IAC3I,iGAAiG;IACjG,iGAAiG;IACjG,wFAAwF;IACxF,MAAM,EAAE,oBAAoB,CAC5B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,KAAK,CAAC,EACxE,aAAa,CAAC,KAAK,CACpB;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE;IAE5C,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACpH,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACpG,CAAC,CAAC,cAAc,CAAC;IAChB,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,GAAG,CAAC","sourcesContent":["/*\n OIDC Persistent Consent Grants (\"remember this app\")\n \n A durable \"user X authorized OAuth client Y for identity scopes Z (at resource R)\" record. It is\n * CREATED (via the system write primitive) when a user APPROVES an interactive-consent request AND\n * opts to remember the app, and READ at `/oauth/authorize` to SKIP re-prompting when an existing grant\n * already covers the requested scopes. The user can list their grants (\"authorized apps\") and revoke\n * one.\n \n USER-scoped: owned by `userId` (USER_SELF primary scope, derived from the `USERS → OAUTH_CONSENT_GRANTS`\n * composition relationship). One grant per `(userId, clientId, resource)` — a re-consent UPDATES the\n * granted scopes rather than creating a duplicate. `resource` participates in the grain because two\n * authorize requests from the same client for different RFC 8707 resources (distinct A2A / MCP agent\n * endpoints) are genuinely distinct delegations; an OIDC-only login carries no `resource` and yields a\n * single resource-less grant.\n /\n\nimport { z } from 'zod';\nimport { PersonalDataCategory } from '../../compliance/privacy/personal-data-category.shared.schemas';\nimport { RedactionType } from '../../compliance/privacy/redaction.shared.schemas';\nimport { addImpersonalizeWith } from '@wildo-ai/zod-decorators';\n\nexport const OAuthConsentGrantSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n /* FK → USERS — the user who granted consent (the USER_SELF scope owner). /\n userId: z.string().min(1).isDBIndexed().isForeignKey().isSummaryField().excludeFromUpdate(),\n\n /* The registered OAuth client (`_id`, `oc_`) the user authorized. Part of the business key. /\n clientId: z.string().min(1).isDBIndexed().isSummaryField(),\n\n /*\n The RFC 8707 `resource` (the target A2A / MCP agent endpoint) this grant covers. Absent for an\n * OIDC-only login with no delegation. Part of the business key — a grant authorizes one client for\n * one resource, so different agent endpoints require separate, explicit consent.\n /\n resource: z.string().optional().isDBIndexed().isSummaryField(),\n\n /\n The IDENTITY scopes the user granted (e.g. `openid`, `profile`, `email`). A later authorize whose\n * requested scopes are a SUBSET of these skips the prompt; a request for a scope NOT in the grant\n * re-prompts (silent scope expansion is forbidden). Identity only — scopes carry no authorization\n * weight (authorization is roles-only).\n /\n // USAGE — what this person authorized a third-party client to reach on their behalf, and when.\n // A consent record is an observation of a decision they made, not an attribute of them.\n // RESET on erasure — returns this field to its schema default. It holds which scopes this person authorized a third-party client to reach,\n // which the category above correctly declares as personal data. RESET rather than REMOVE or MASK\n // because the field is non-nullable WITH a `.default()`: REMOVE needs a clearable field and MASK\n // needs a string. The value comes from the schema, so there is no second copy to drift.\n scopes: addImpersonalizeWith(\n z.array(z.string()).default([]).dataCategories(PersonalDataCategory.USAGE),\n RedactionType.RESET,\n ),\n\n /\n Expiry. The authorize lookup ignores a grant past this instant, fail-closed to a fresh consent\n * prompt.\n \n SET ON EVERY AFFIRMATIVE CONSENT since 2026-09-08 (#465) — on creation and again on every widen,\n * because a widen is the user approving again and a re-affirmation should restart the clock. It\n * was declared here with a reader and NO WRITER before that, so a remembered approval lived until\n * the person revoked it while the field read to an operator as a policy knob that existed.\n \n Still optional on the SCHEMA, for two reasons that are not the same: grants created before that\n * date carry none and must keep working (an absent expiry means \"never\", which is what they were\n * granted under), and a resource may be written by a path that has no operator policy in hand.\n /\n expiresAt: z.date().optional().isDBIndexed(),\n\n createdAt: z.date().default(() => new Date()).isDBIndexed().isSummaryField().excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).isDBIndexed().excludeFromCreate().excludeFromUpdate(),\n}).businessKeySet([\n 'userId',\n 'clientId',\n 'resource',\n]);\n\n/\n How long a remembered consent lasts when the application authors no policy of its own.\n \n 180 days, and the reasoning matters more than the number. A remembered consent is a standing\n * delegation of authority to a third party, so it should lapse on its own if nobody re-affirms it —\n * but a prompt the user meets every few weeks trains them to click through, which makes the consent\n * screen worth less rather than more. Half a year is long enough not to nag and short enough that an\n * authorization the user has forgotten about does not outlive their interest in the client by years.\n \n An application overrides it with `auth.consentGrantLifetimeDays`. There is deliberately no way to\n * express \"never expires\": that was the state this default replaced, and it was not chosen.\n */\nexport const OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS = 180;\n\nexport type OAuthConsentGrant = z.infer<typeof OAuthConsentGrantSchema>;\n"]}

package/dist/esm/security/oauth-clients/oauth-resource-server.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-resource-server.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,oBAAY,kBAAkB;IAC5B,uFAAuF;IACvF,GAAG,QAAQ;IACX,gGAAgG;IAChG,GAAG,QAAQ;IACX,uGAAuG;IACvG,GAAG,QAAQ;CACZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAC9C,OAAO,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACnD,wBAAwB,CAIzB,CAAC;AAEF;yGACyG;AACzG,eAAO,MAAM,gCAAgC,EAAE,SAAS,kBAAkB,EAGzE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,kBAAkB,EAIvE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAGtE,CAAC;AAoEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAGlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBASjC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;2BAAkF,CAAC;AAE5H,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,kEAAkE"}
1	+ {"version":3,"file":"oauth-resource-server.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-resource-server.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,oBAAY,kBAAkB;IAC5B,uFAAuF;IACvF,GAAG,QAAQ;IACX,gGAAgG;IAChG,GAAG,QAAQ;IACX,uGAAuG;IACvG,GAAG,QAAQ;CACZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAC9C,OAAO,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,EACnD,wBAAwB,CAIzB,CAAC;AAEF;yGACyG;AACzG,eAAO,MAAM,gCAAgC,EAAE,SAAS,kBAAkB,EAGzE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,kBAAkB,EAIvE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAGtE,CAAC;AAoEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;iBAGlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBASjC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;2BAAkF,CAAC;AAE5H,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,+FAA+F;AAC/F,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,kEAAkE"}

package/dist/esm/security/outbound-target-control.shared.schemas.d.ts ADDED Viewed

@@ -0,0 +1,73 @@
+/**
+ * The classes of server-side request whose DESTINATION is chosen by somebody other than the
+ * deployment that makes the request — and how much of the private network each may reach.
+ *
+ * ## Why the class, and not the call site, is the unit
+ *
+ * The request-forgery question is never "is this URL safe?" in the abstract. It is "who picked this
+ * destination, and are they allowed to point this server at its own network?". An organization
+ * administrator who authors a webhook endpoint, an A2A client registering a push target, and an
+ * unauthenticated stranger presenting an OAuth `client_id` URL all answer it differently — and the
+ * application developer who writes a provider endpoint into the backend's own configuration is not a
+ * request-forgery threat at all, because they already own the server.
+ *
+ * So the vocabulary names the CLASS of destination, by who authors it. Every engine site that issues
+ * such a request declares which class it is serving, and the admission follows from the class plus
+ * the operator-declared runtime environment — never from anything the destination's author can set.
+ *
+ * ## What is deliberately NOT a class
+ *
+ * Destinations the application's own code declares — a provider API endpoint, an `httpApiBinding`
+ * base URL — are trusted as authored. What those sites must still refuse is a REMOTE server
+ * re-pointing the request (a redirect), which is a property of the transport, not an admission.
+ * Platform topology (the apps-manager, the module registry, infrastructure sidecars) is operator
+ * configuration and private by design.
+ */
+export declare enum OutboundTargetClass {
+    /** An M2M webhook endpoint. Authored by an organization administrator. */
+    M2M_WEBHOOK_ENDPOINT = "m2m_webhook_endpoint",
+    /** An A2A push-notification target. Supplied by the external A2A client that registered it. */
+    A2A_PUSH_NOTIFICATION_ENDPOINT = "a2a_push_notification_endpoint",
+    /**
+     * A SIEM collector. Authored by an organization administrator; the one class the operator may
+     * admit onto a private network, because a self-hosted collector on the same network is a supported
+     * deployment shape.
+     */
+    SIEM_COLLECTOR = "siem_collector",
+    /** An OAuth client metadata document. Its URL is presented by an UNAUTHENTICATED stranger. */
+    OAUTH_CLIENT_METADATA_DOCUMENT = "oauth_client_metadata_document",
+    /**
+     * A federated identity provider's endpoints — OIDC discovery, token, userinfo, profile extension,
+     * JWKS, SAML metadata and the SAML SSO/SLO reachability checks. Authored by an organization
+     * administrator on an SSO connection, or discovered from a document that administrator's IdP serves.
+     */
+    FEDERATED_IDENTITY_PROVIDER = "federated_identity_provider",
+    /**
+     * A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's
+     * service, reached with the agent's delegated credentials, and its answers can re-point a request.
+     */
+    MCP_SERVER = "mcp_server",
+    /**
+     * A download link an EMAIL provider hands back at runtime — the original bytes of a received message, an
+     * attachment (#1600). The application declared the provider, but the VENDOR chose this URL, so it is admitted
+     * only against the hosts the provider's contract declares, and never re-pointed by a redirect.
+     */
+    EMAIL_PROVIDER_CONTENT_URL = "email_provider_content_url"
+}
+/**
+ * How much of the network an outbound request may reach beyond the public internet.
+ *
+ * Three members rather than a boolean, because the useful middle is not "private" and not "public":
+ * local development and automated test runs legitimately reach doubles on LOOPBACK, and nothing about
+ * that justifies reaching the cloud instance-metadata address (link-local) or a cluster-internal
+ * service (RFC 1918), which are the addresses a request-forgery attack actually wants.
+ */
+export declare enum OutboundPrivateAddressAdmission {
+    /** Public addresses only. The default, and the only posture a stranger-supplied destination ever gets. */
+    NONE = "none",
+    /** Public addresses plus loopback (`127.0.0.0/8`, `::1`, `localhost`). Never link-local, never RFC 1918. */
+    LOOPBACK_ONLY = "loopback_only",
+    /** Any address. Only by an explicit operator declaration, and only for a class the operator may admit. */
+    PRIVATE_NETWORK = "private_network"
+}
+//# sourceMappingURL=outbound-target-control.shared.schemas.d.ts.map

package/dist/esm/security/outbound-target-control.shared.schemas.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"outbound-target-control.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oBAAoB,yBAAyB;IAC7C,+FAA+F;IAC/F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,cAAc,mBAAmB;IACjC,8FAA8F;IAC9F,8BAA8B,mCAAmC;IACjE;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D;;;OAGG;IACH,UAAU,eAAe;IACzB;;;;OAIG;IACH,0BAA0B,+BAA+B;CAC1D;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,0GAA0G;IAC1G,IAAI,SAAS;IACb,4GAA4G;IAC5G,aAAa,kBAAkB;IAC/B,0GAA0G;IAC1G,eAAe,oBAAoB;CACpC"}

package/dist/esm/security/outbound-target-control.shared.schemas.js ADDED Viewed

@@ -0,0 +1,75 @@
+/**
+ * The classes of server-side request whose DESTINATION is chosen by somebody other than the
+ * deployment that makes the request — and how much of the private network each may reach.
+ *
+ * ## Why the class, and not the call site, is the unit
+ *
+ * The request-forgery question is never "is this URL safe?" in the abstract. It is "who picked this
+ * destination, and are they allowed to point this server at its own network?". An organization
+ * administrator who authors a webhook endpoint, an A2A client registering a push target, and an
+ * unauthenticated stranger presenting an OAuth `client_id` URL all answer it differently — and the
+ * application developer who writes a provider endpoint into the backend's own configuration is not a
+ * request-forgery threat at all, because they already own the server.
+ *
+ * So the vocabulary names the CLASS of destination, by who authors it. Every engine site that issues
+ * such a request declares which class it is serving, and the admission follows from the class plus
+ * the operator-declared runtime environment — never from anything the destination's author can set.
+ *
+ * ## What is deliberately NOT a class
+ *
+ * Destinations the application's own code declares — a provider API endpoint, an `httpApiBinding`
+ * base URL — are trusted as authored. What those sites must still refuse is a REMOTE server
+ * re-pointing the request (a redirect), which is a property of the transport, not an admission.
+ * Platform topology (the apps-manager, the module registry, infrastructure sidecars) is operator
+ * configuration and private by design.
+ */
+export var OutboundTargetClass;
+(function (OutboundTargetClass) {
+    /** An M2M webhook endpoint. Authored by an organization administrator. */
+    OutboundTargetClass["M2M_WEBHOOK_ENDPOINT"] = "m2m_webhook_endpoint";
+    /** An A2A push-notification target. Supplied by the external A2A client that registered it. */
+    OutboundTargetClass["A2A_PUSH_NOTIFICATION_ENDPOINT"] = "a2a_push_notification_endpoint";
+    /**
+     * A SIEM collector. Authored by an organization administrator; the one class the operator may
+     * admit onto a private network, because a self-hosted collector on the same network is a supported
+     * deployment shape.
+     */
+    OutboundTargetClass["SIEM_COLLECTOR"] = "siem_collector";
+    /** An OAuth client metadata document. Its URL is presented by an UNAUTHENTICATED stranger. */
+    OutboundTargetClass["OAUTH_CLIENT_METADATA_DOCUMENT"] = "oauth_client_metadata_document";
+    /**
+     * A federated identity provider's endpoints — OIDC discovery, token, userinfo, profile extension,
+     * JWKS, SAML metadata and the SAML SSO/SLO reachability checks. Authored by an organization
+     * administrator on an SSO connection, or discovered from a document that administrator's IdP serves.
+     */
+    OutboundTargetClass["FEDERATED_IDENTITY_PROVIDER"] = "federated_identity_provider";
+    /**
+     * A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's
+     * service, reached with the agent's delegated credentials, and its answers can re-point a request.
+     */
+    OutboundTargetClass["MCP_SERVER"] = "mcp_server";
+    /**
+     * A download link an EMAIL provider hands back at runtime — the original bytes of a received message, an
+     * attachment (#1600). The application declared the provider, but the VENDOR chose this URL, so it is admitted
+     * only against the hosts the provider's contract declares, and never re-pointed by a redirect.
+     */
+    OutboundTargetClass["EMAIL_PROVIDER_CONTENT_URL"] = "email_provider_content_url";
+})(OutboundTargetClass || (OutboundTargetClass = {}));
+/**
+ * How much of the network an outbound request may reach beyond the public internet.
+ *
+ * Three members rather than a boolean, because the useful middle is not "private" and not "public":
+ * local development and automated test runs legitimately reach doubles on LOOPBACK, and nothing about
+ * that justifies reaching the cloud instance-metadata address (link-local) or a cluster-internal
+ * service (RFC 1918), which are the addresses a request-forgery attack actually wants.
+ */
+export var OutboundPrivateAddressAdmission;
+(function (OutboundPrivateAddressAdmission) {
+    /** Public addresses only. The default, and the only posture a stranger-supplied destination ever gets. */
+    OutboundPrivateAddressAdmission["NONE"] = "none";
+    /** Public addresses plus loopback (`127.0.0.0/8`, `::1`, `localhost`). Never link-local, never RFC 1918. */
+    OutboundPrivateAddressAdmission["LOOPBACK_ONLY"] = "loopback_only";
+    /** Any address. Only by an explicit operator declaration, and only for a class the operator may admit. */
+    OutboundPrivateAddressAdmission["PRIVATE_NETWORK"] = "private_network";
+})(OutboundPrivateAddressAdmission || (OutboundPrivateAddressAdmission = {}));
+//# sourceMappingURL=outbound-target-control.shared.schemas.js.map

package/dist/esm/security/outbound-target-control.shared.schemas.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"outbound-target-control.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/outbound-target-control.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAN,IAAY,mBA8BX;AA9BD,WAAY,mBAAmB;IAC7B,0EAA0E;IAC1E,oEAA6C,CAAA;IAC7C,+FAA+F;IAC/F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,wDAAiC,CAAA;IACjC,8FAA8F;IAC9F,wFAAiE,CAAA;IACjE;;;;OAIG;IACH,kFAA2D,CAAA;IAC3D;;;OAGG;IACH,gDAAyB,CAAA;IACzB;;;;OAIG;IACH,gFAAyD,CAAA;AAC3D,CAAC,EA9BW,mBAAmB,KAAnB,mBAAmB,QA8B9B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,0GAA0G;IAC1G,gDAAa,CAAA;IACb,4GAA4G;IAC5G,kEAA+B,CAAA;IAC/B,0GAA0G;IAC1G,sEAAmC,CAAA;AACrC,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C","sourcesContent":["/**\n * The classes of server-side request whose DESTINATION is chosen by somebody other than the\n * deployment that makes the request — and how much of the private network each may reach.\n *\n * ## Why the class, and not the call site, is the unit\n *\n * The request-forgery question is never \"is this URL safe?\" in the abstract. It is \"who picked this\n * destination, and are they allowed to point this server at its own network?\". An organization\n * administrator who authors a webhook endpoint, an A2A client registering a push target, and an\n * unauthenticated stranger presenting an OAuth `client_id` URL all answer it differently — and the\n * application developer who writes a provider endpoint into the backend's own configuration is not a\n * request-forgery threat at all, because they already own the server.\n *\n * So the vocabulary names the CLASS of destination, by who authors it. Every engine site that issues\n * such a request declares which class it is serving, and the admission follows from the class plus\n * the operator-declared runtime environment — never from anything the destination's author can set.\n *\n * ## What is deliberately NOT a class\n *\n * Destinations the application's own code declares — a provider API endpoint, an `httpApiBinding`\n * base URL — are trusted as authored. What those sites must still refuse is a REMOTE server\n * re-pointing the request (a redirect), which is a property of the transport, not an admission.\n * Platform topology (the apps-manager, the module registry, infrastructure sidecars) is operator\n * configuration and private by design.\n */\nexport enum OutboundTargetClass {\n /** An M2M webhook endpoint. Authored by an organization administrator. */\n M2M_WEBHOOK_ENDPOINT = 'm2m_webhook_endpoint',\n /** An A2A push-notification target. Supplied by the external A2A client that registered it. */\n A2A_PUSH_NOTIFICATION_ENDPOINT = 'a2a_push_notification_endpoint',\n /**\n * A SIEM collector. Authored by an organization administrator; the one class the operator may\n * admit onto a private network, because a self-hosted collector on the same network is a supported\n * deployment shape.\n */\n SIEM_COLLECTOR = 'siem_collector',\n /** An OAuth client metadata document. Its URL is presented by an UNAUTHENTICATED stranger. */\n OAUTH_CLIENT_METADATA_DOCUMENT = 'oauth_client_metadata_document',\n /**\n * A federated identity provider's endpoints — OIDC discovery, token, userinfo, profile extension,\n * JWKS, SAML metadata and the SAML SSO/SLO reachability checks. Authored by an organization\n * administrator on an SSO connection, or discovered from a document that administrator's IdP serves.\n */\n FEDERATED_IDENTITY_PROVIDER = 'federated_identity_provider',\n /**\n * A remote MCP server an agent calls. Declared by the application, but it is a THIRD PARTY's\n * service, reached with the agent's delegated credentials, and its answers can re-point a request.\n */\n MCP_SERVER = 'mcp_server',\n /**\n * A download link an EMAIL provider hands back at runtime — the original bytes of a received message, an\n * attachment (#1600). The application declared the provider, but the VENDOR chose this URL, so it is admitted\n * only against the hosts the provider's contract declares, and never re-pointed by a redirect.\n */\n EMAIL_PROVIDER_CONTENT_URL = 'email_provider_content_url',\n}\n\n/**\n * How much of the network an outbound request may reach beyond the public internet.\n *\n * Three members rather than a boolean, because the useful middle is not \"private\" and not \"public\":\n * local development and automated test runs legitimately reach doubles on LOOPBACK, and nothing about\n * that justifies reaching the cloud instance-metadata address (link-local) or a cluster-internal\n * service (RFC 1918), which are the addresses a request-forgery attack actually wants.\n */\nexport enum OutboundPrivateAddressAdmission {\n /** Public addresses only. The default, and the only posture a stranger-supplied destination ever gets. */\n NONE = 'none',\n /** Public addresses plus loopback (`127.0.0.0/8`, `::1`, `localhost`). Never link-local, never RFC 1918. */\n LOOPBACK_ONLY = 'loopback_only',\n /** Any address. Only by an explicit operator declaration, and only for a class the operator may admit. */\n PRIVATE_NETWORK = 'private_network',\n}\n"]}

package/dist/esm/security/submission-challenge/submission-challenge.shared.d.ts ADDED Viewed

@@ -0,0 +1,143 @@
+/**
+ * The challenge a public submission answers before the backend accepts it (#1735).
+ *
+ * ## Why two kinds, and why the second one is not optional
+ *
+ * A captcha vendor that analyses visitors for its own purposes needs their consent (Google reCAPTCHA:
+ * CNIL Délibération SAN-2023-003, recorded on the frontend consent classification), so a visitor who
+ * declines must still be able to submit. If declining meant "no challenge", a bot would decline too and
+ * the captcha would protect nothing. So an application that protects a form accepts EITHER:
+ *
+ * - a vendor token (`PROVIDER_TOKEN`) — obtained by the consented vendor's browser part and verified by its
+ *   backend part (reCAPTCHA `siteverify`);
+ * - a proof of work (`PROOF_OF_WORK`) — the engine's own challenge, consent-exempt because nothing leaves
+ *   the application and nothing is stored in the visitor's browser: the backend issues a salted SHA-256
+ *   puzzle signed with an application key, the browser searches for the number, the backend re-derives it.
+ *   It makes each submission cost the sender CPU time instead of identifying anyone.
+ *
+ * A submission with neither, or with one that fails, is refused: the challenge fails CLOSED.
+ *
+ * The proof-of-work scheme is ALTCHA's: challenge = SHA-256(salt + number), the client iterates numbers until the hash
+ * matches. The signature here covers the salt as well as the hash (HMAC(salt + "\n" + challenge)): the hash input has
+ * no separator and the salt ends in its expiry digits, so a signature over the hash alone would let digits move from
+ * the number onto the salt and forge a later expiry.
+ * spec-cite: https://altcha.org/docs/proof-of-work/ (read through its search summary 2026-09-29) — the scheme
+ * is described, not quoted; the field names below are this framework's own.
+ *
+ * ## Browser-safe on purpose
+ *
+ * The website's contact form encodes and solves challenges in the visitor's browser, so this file imports
+ * nothing and uses only `globalThis.crypto.subtle`, which both browsers and Node provide.
+ */
+/** Which kind of answer a submission carries. */
+export declare enum SubmissionChallengeResponseKind {
+    /** A token from a consented captcha vendor's browser part, verified by the same vendor's backend part. */
+    PROVIDER_TOKEN = "provider_token",
+    /** The engine's own consent-exempt proof of work. */
+    PROOF_OF_WORK = "proof_of_work"
+}
+/**
+ * The actions the ENGINE's own protected operations are bound to. A vendor token is minted for an action and the
+ * backend refuses one minted for another, so a token solved on one form cannot be replayed on another.
+ *
+ * This enum names the engine's actions only. An application protects its OWN anonymous operation by declaring
+ * `submissionChallenge: { action: '<its action>' }` on the operation variant (#1985), with an action it names in its
+ * own vocabulary; see {@link ResourceOperationSubmissionChallenge} for why the declaration takes a name rather than a
+ * member of this enum.
+ */
+export declare enum SubmissionChallengeAction {
+    /** The public contact form (`POST /inbound-contacts`). */
+    INBOUND_CONTACT = "inbound_contact"
+}
+/**
+ * The names a submission-challenge action may take: letters, digits, underscores and slashes, 1 to 100 characters.
+ *
+ * The character set is the captcha vendor's. The action is sent to Google reCAPTCHA as the `action` a token is minted
+ * for and checked against on `siteverify`, and reCAPTCHA v3 states "Actions might contain only alphanumeric
+ * characters, slashes, and underscores." A name outside it would be minted by no vendor, so every token for it would
+ * be refused. The 100-character bound is this framework's own: nothing longer is a name a person reads in a console.
+ * spec-cite: https://developers.google.com/recaptcha/docs/v3 §"Actions" (fetched 2026-09-29)
+ */
+export declare const SUBMISSION_CHALLENGE_ACTION_PATTERN: RegExp;
+/** Whether `value` is an action name a captcha vendor can mint a token for. See {@link SUBMISSION_CHALLENGE_ACTION_PATTERN}. */
+export declare function isSubmissionChallengeActionName(value: unknown): value is string;
+/**
+ * An operation variant's declaration that an UNAUTHENTICATED caller answers a submission challenge (#1985).
+ *
+ * `action` is a NAME (an open identifier), not a member of {@link SubmissionChallengeAction}, so an application can
+ * protect its own anonymous create (a waitlist, a quote request) without the engine growing a member for it. The
+ * engine's own operations pass their enum member; an application passes a member of its own enum. What keeps the name
+ * honest is the grammar ({@link SUBMISSION_CHALLENGE_ACTION_PATTERN}), which the resource factory enforces.
+ *
+ * Rejected alternatives, recorded because each was on the table:
+ * - A closed engine enum grown one member per protected operation. The engine cannot know an application's forms, so
+ *   an application's own create could never be protected: exactly the gap this declaration closes.
+ * - Deriving the action from the operation (`<resource>/<operation>`). It needs no authoring, but a resource or variant
+ *   identifier may carry characters the vendor refuses (a hyphen), so the derivation would have to rewrite them, and two
+ *   operations could then collide on one action with nothing saying so. A declared name is visible, reviewable and fixed.
+ */
+export interface ResourceOperationSubmissionChallenge {
+    /** The action a vendor token must have been minted for. Name one per form: sharing it lets a token move between them. */
+    readonly action: string;
+}
+/** The only hash the proof of work uses. Named so the wire value has one runtime source. */
+export declare enum ProofOfWorkAlgorithm {
+    SHA_256 = "SHA-256"
+}
+/** A proof-of-work challenge as the backend issues it. Every field is echoed back unchanged in the answer. */
+export interface ProofOfWorkChallenge {
+    readonly algorithm: ProofOfWorkAlgorithm;
+    /** Random, and carries the expiry (`<hex>?expires=<unix seconds>`) so the signature covers it. */
+    readonly salt: string;
+    /** Hex SHA-256 of `salt + number` for the secret number. */
+    readonly challenge: string;
+    /** The largest number the search has to try. */
+    readonly maxNumber: number;
+    /** Hex HMAC-SHA-256 of `salt`, a newline and `challenge`, under the application's challenge key — so the salt and its expiry cannot be edited. */
+    readonly signature: string;
+}
+/** What a submission sends, in the `WildoHeaderKeys.SUBMISSION_CHALLENGE_RESPONSE` header, JSON-encoded. */
+export type SubmissionChallengeResponse = {
+    readonly kind: SubmissionChallengeResponseKind.PROVIDER_TOKEN;
+    /** The captcha provider whose browser part minted the token (`recaptcha`). */
+    readonly providerRef: string;
+    readonly token: string;
+} | {
+    readonly kind: SubmissionChallengeResponseKind.PROOF_OF_WORK;
+    readonly challenge: ProofOfWorkChallenge;
+    /** The number the browser found. */
+    readonly number: number;
+};
+/**
+ * Where a browser asks for a proof-of-work challenge, under the API base path. The ONE source of this path: the
+ * backend's route table (`MANUAL_CONTROLLER_ROUTES_URLS`) reads it from here, so a browser form can reach it without
+ * pulling that whole table into its bundle.
+ */
+export declare const SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH = "/submission-challenges/proof-of-work";
+/**
+ * The stable `error.code` of a refused public submission — what a client branches on (the engine hoists an error's
+ * `context.code` to the top-level `error.code` of its response). A form answers either one again, with the proof of
+ * work.
+ */
+export declare enum SubmissionChallengeRefusalCode {
+    /** No answer was sent, and the application protects this form. */
+    REQUIRED = "SUBMISSION_CHALLENGE_REQUIRED",
+    /** An answer was sent and not accepted. */
+    REFUSED = "SUBMISSION_CHALLENGE_REFUSED"
+}
+/** The largest encoded answer the backend reads; anything longer is refused before it is parsed. */
+export declare const SUBMISSION_CHALLENGE_RESPONSE_MAX_LENGTH = 8192;
+/** Encode an answer for the request header. */
+export declare function encodeSubmissionChallengeResponse(response: SubmissionChallengeResponse): string;
+/** Hex SHA-256 of `salt + number` — the one hash both the solver and the backend compute. */
+export declare function hashProofOfWorkCandidate(salt: string, number: number): Promise<string>;
+/**
+ * Find the number a challenge was built from, or `undefined` when none up to `maxNumber` matches (a
+ * challenge not issued by this scheme). Yields to the event loop every `yieldEvery` tries so a page stays
+ * responsive while it searches.
+ */
+export declare function solveProofOfWorkChallenge(challenge: ProofOfWorkChallenge, options?: {
+    readonly yieldEvery?: number;
+    readonly signal?: AbortSignal;
+}): Promise<SubmissionChallengeResponse | undefined>;
+//# sourceMappingURL=submission-challenge.shared.d.ts.map

package/dist/esm/security/submission-challenge/submission-challenge.shared.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"submission-challenge.shared.d.ts","sourceRoot":"","sources":["../../../../../src/security/submission-challenge/submission-challenge.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,iDAAiD;AACjD,oBAAY,+BAA+B;IACzC,0GAA0G;IAC1G,cAAc,mBAAmB;IACjC,qDAAqD;IACrD,aAAa,kBAAkB;CAChC;AAED;;;;;;;;GAQG;AACH,oBAAY,yBAAyB;IACnC,0DAA0D;IAC1D,eAAe,oBAAoB;CACpC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,QAA4B,CAAC;AAE7E,gIAAgI;AAChI,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oCAAoC;IACnD,yHAAyH;IACzH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,4FAA4F;AAC5F,oBAAY,oBAAoB;IAC9B,OAAO,YAAY;CACpB;AAED,8GAA8G;AAC9G,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kJAAkJ;IAClJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,4GAA4G;AAC5G,MAAM,MAAM,2BAA2B,GACnC;IACA,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,cAAc,CAAC;IAC9D,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,aAAa,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,yCAAyC,CAAC;AAE9F;;;;GAIG;AACH,oBAAY,8BAA8B;IACxC,kEAAkE;IAClE,QAAQ,kCAAkC;IAC1C,2CAA2C;IAC3C,OAAO,iCAAiC;CACzC;AAED,oGAAoG;AACpG,eAAO,MAAM,wCAAwC,OAAO,CAAC;AAE7D,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,2BAA2B,GAAG,MAAM,CAE/F;AAMD,6FAA6F;AAC7F,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,oBAAoB,EAC/B,OAAO,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAC5E,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAUlD"}