agentfootprint 9.116.0 → 9.117.0

package/CAPABILITIES.md

@@ -73,7 +73,15 @@ not in this table, search `src/index.ts` for the nearest noun before writing cod
 | proving a session store really honours the port | `runSessionLifecycleConformance` + `declared` skips (by case name WITH the reason; a declared case still RUNS) + outcomes `'passed'`/`'not-applicable'`/`'declared'`/`'failed'` | `src/hosting/conformance/` | 9.37.0 |
 | deciding who owns a contested session write | `resolveSessionOwner` | `src/hosting/sessionOwnership.ts` | 9.37.0 |
 | a host filing its OWN per-turn artifacts (a story, the person's clicks) where `artifact-get` will look for the same caller — never composing a scope itself; awaited inside the turn, bounded (`turnArtifactsTimeoutMs`, default `TURN_ARTIFACTS_TIMEOUT_MS`), revoked after it (`TurnArtifactsExpiredError`), failures on the stream (`artifacts.hand_over_failed`) | `HostReply.turnArtifacts` + `TurnArtifacts` | `src/hosting/turnArtifacts.ts` | 9.115.0 |
+| a host reading or filing artifacts in the scope a redemption by the same caller reads, OUTSIDE a turn (a read by ref before a run, an app-owned route) — the redemption door's verifier (the proven person, or at an open door the session id and claim), session-id check, ownership rule and ONE scope composer; refusals as values (`unverified` / `unavailable` / `no-session` / `invalid-session` / `not-found` / `no-store`); never builds or evicts an instance, never the unscoped store; revoked with its instance | `handle.artifactsForRequest` + `ArtifactsForRequestResult` | `src/hosting/standingAgent.ts` | 9.117.0 |
 | refusing a forged cross-site request, DNS rebinding or an oversized session id at the hosting door — before any handler, in every identity mode; the same rule for an app's own routes beside the door | `doorGuard` + `checkSessionId` + `MAX_SESSION_ID_LENGTH` + `CrossSiteOptions` (`allowedOrigins` / `allowedHosts` / `requireJsonContentType` on `httpHost`, `nodeHost` and the hosted-runtime adapters, which default the browser rules OFF on a non-loopback bind; a loopback bind defaults `allowedHosts` to the loopback names) + `AgentHost.onRefusal` (feeds the ingress record) | `src/hosting/doorGuard.ts` | 9.115.0 |
+| choosing how callers prove who they are from CONFIG at install time — one strategy per deployment, a wrong or missing setting refused at boot by name (production must name its strategy, even `open`; a typo or a key a later release reads is never ignored), an unreachable IdP started with a banner warning and 503s, a boot banner with no secrets | `identityFromConfig` + `identityConfigFromEnv` + `IdentityConfigError` + `IdentityChoice` (strategies `open`, `oidc-token`, `local-password`, `directory-password`, `proxy-token`) | `src/adapters/identity/strategies/` | 9.117.0 |
+| refusing an application's own token posing as a PERSON at the door — verifying an access token from AD FS, Entra ID, Keycloak or Okta by discovery, with AD FS's `access_token_issuer`, a required id claim (no `sub` default), `exp` required, the person test (required scope, `idtyp: app`, `oid == sub`, roles-without-scope, the obtaining client) and group overage refused as unknown | `oidcIdentity` + `IdentityFailureClass` `'not-a-user-token'` / `'wrong-client'` / `'roles-unknown'` | `src/adapters/identity/oidc.ts` | 9.117.0 |
+| keeping a browser's sign-in cookie away from every handler and log line — the transport strips it and passes only its SHA-256 key; one credential per request (a token and a sign-in together refused); a WebSocket's sign-in checked before the 101, re-checked before every inbound frame, and the socket closed when the sign-in ends | `signIn` on `nodeHost`/`httpHost` + `HostRequest.signInKey` + `readSignIn` + `withoutCredentials` + `signInSource` + `SignInStore` + `IdentityVerificationOptions.signIn` / `tokenHeader` + `'two-credentials'` | `src/hosting/signin/` | 9.117.0 |
+| a browser sign-in with a password for development, tests and demos — `/auth/config`, `/auth/me`, `/auth/login`, `/auth/logout`; an HttpOnly `__Host-Http-` cookie, no IdP token in the browser; the door guard on every login, one answer for every wrong credential after a minimum time, attempt limits with growing delay, a bounded per-process store; scrypt-hashed password lists only, refused in production | `signInDoor` + `memorySignIns` + `PasswordChecker` + `localPasswords` + `hashPassword` + `IDENTITY_STRATEGY=local-password` (`identityFromConfig` → `signInDoor` / `hostSignIn`) | `src/hosting/signin/door.ts` | 9.117.0 |
+| signing people in through the company's identity provider in the browser (OIDC authorization code + PKCE) — PENDING INDEPENDENT REVIEW: a sealed per-attempt transaction cookie (nothing on the server), `returnTo` pinned to the public origin, the person read from an ACCESS token by the strategy's own verify (one id for browser and bearer), private-key or secret client authentication, AD FS `resource`, 303 with no-referrer, end-session | `oidcSignIn` + `signInDoor({ redirect })` + `safeReturnTo` + `IDENTITY_CLIENT_ID` / `IDENTITY_CLIENT_KEY_FILE` / `IDENTITY_PKCE` (`identityFromConfig` → mode `redirect`) | `src/adapters/identity/oidcSignIn.ts` | 9.117.0 |
+| signing people in with their Windows password against plain Active Directory (no federation server) — LDAPS only, the empty password refused before the bind, RFC 4532 Who-am-I then exactly one entry (the rename collision closed), the id = objectGUID, a nested required group, one answer for every wrong credential, limits from AD's lockout threshold (a third per ACCOUNT via `PasswordChecker.budgetKey`, reset from the LAST failure; threshold 1–2 refused unless overridden), the MFA bypass stated — PENDING INDEPENDENT REVIEW | `directoryPasswords` + `ldapDirectory` + `IDENTITY_STRATEGY=directory-password` (`IDENTITY_LDAP_*`) | `src/adapters/identity/directory/` | 9.117.0 |
+| trusting a company login proxy (oauth2-proxy, mod_auth_openidc, Pomerium) only as far as the signed ACCESS token it forwards — verified with a literal issuer and a JWKS URL (no discovery, no redirects), the person test and the proxy's client check; an ID token refused; the door guard required because the proxy's cookie rides along on forged requests | `proxyTokenChoice` + `IDENTITY_PROXY_TOKEN` + `IDENTITY_PROXY_HEADER` (strategy `proxy-token` of `identityFromConfig`, mode `proxy`) | `src/adapters/identity/strategies/proxyChoice.ts` | 9.117.0 |
 | making a caller-supplied id safe for a backend | `encodeIdentityField` | `src/memory/identity/encode.ts` | 9.37.0 |
 | scoping a skill's tools so they reach the model only while it is active | `toolsFromActiveSkill` + a no-arg posture (default off) + the stamp `autoActivate: 'currentSkill'` (a default, never an override) | `src/core/agent/toolsFromActiveSkill.ts` | 9.36.0 |
 | subscribing to every event in one domain at once | `DomainWildcard` | `src/events/dispatcher.ts` | 9.4.0 |

package/dist/adapters/identity/directory/directoryPasswords.js

@@ -0,0 +1,203 @@
+"use strict";
+/**
+ * directory/directoryPasswords — the `directory-password` strategy's check:
+ * a person types their Windows username and password, and Active Directory
+ * says who they are (design §4.5).
+ *
+ * The steps, in order (the sign-in door around this already applied the door
+ * guard, the JSON body, the minimum time and the attempt limits):
+ *
+ *  1. **An empty password is refused before the directory is touched.** RFC
+ *     4513 §5.1.2: a simple bind with a name and an empty password is an
+ *     UNAUTHENTICATED bind, which a directory may answer as a success.
+ *  2. **The username is checked before the bind**: 1–64 characters of
+ *     `A–Z a–z 0–9 . _ -`, after removing a trailing `@<domain>` or a leading
+ *     `<NETBIOS>\` only when it is exactly the configured one (people paste
+ *     their UPN, or type the down-level `CORP\alice`). Anything else — another
+ *     `@domain` or `OTHER\`, `,`, `=`, parentheses, `*`, a space, a quote,
+ *     letters outside ASCII (`o'brien`, `mary ann`, `josé` are legal Windows
+ *     names this door does not take) — never reaches the directory. A password
+ *     holding a control character never does either (Samba cuts a password at
+ *     NUL — review idI57 N-7).
+ *  3. **Bind as `<name>@<domain>`** with the typed password, over LDAPS only.
+ *     No service account, so no stored directory secret.
+ *  4. **Ask who it authenticated: RFC 4532 Who-am-I**, on the same connection.
+ *     An empty answer is anonymous and refused (a second guard behind step 1).
+ *  5. **Parse the answer**: `u:<NETBIOS>\<sAMAccountName>` (the domain must be
+ *     the configured NetBIOS domain) or `u:<SID>`. Anything else is refused.
+ *  6. **Find EXACTLY ONE entry** for that account under the base DN, by
+ *     `sAMAccountName` or `objectSid`, every value escaped (RFC 4515). Zero or
+ *     two is a refusal. The id is THAT entry's `objectGUID` (base64 of its 16
+ *     bytes) — never re-derived from the typed text.
+ *  7. **The required group**, when set: nested membership of that same DN
+ *     (`LDAP_MATCHING_RULE_IN_CHAIN`), the group DN escaped as a filter value.
+ *
+ * ── Why Who-am-I (the rename collision, review B-3) ─────────────────────────
+ * AD does not authenticate "the object whose name is the typed text". An
+ * explicit userPrincipalName beats another object's implicit
+ * `sAMAccountName@domain` (MS-ADTS "Simple Authentication"). If Jane's UPN is
+ * `jsmith@corp` and a new John's sAMAccountName is `jsmith`, Jane typing
+ * `jsmith` and HER password authenticates Jane — and a search for
+ * `sAMAccountName=jsmith` finds John. Asking the directory which object it
+ * authenticated is the only answer that cannot hand Jane John's conversations.
+ *
+ * **The attempt budget is kept per ACCOUNT** (`budgetKey`, review idI57 B-1):
+ * AD folds case and binds `alice`, `CORP\alice` and `alice@corp` to one
+ * object, so the door counts them under one key — lower-cased, prefix and
+ * suffix removed, NFC.
+ *
+ * Every wrong credential — an unknown name, a wrong password, an expired or
+ * must-change password (AD sub-codes 52e, 525, 530, 531, 532, 533, 701, 773,
+ * 775), a name that fails the pattern, a missing group — is ONE answer
+ * (`undefined`). A directory that cannot be reached throws
+ * `PasswordCheckUnreachableError` (the door answers 503 and un-counts the
+ * attempt); a failure after the bind was sent throws anything else (503, and
+ * the attempt stays counted — AD may have counted it). The password is never
+ * stored, logged or forwarded.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.accountFilter = exports.accountBudgetKey = exports.accountName = exports.directoryPasswords = void 0;
+const errors_js_1 = require("../../../hosting/signin/errors.js");
+const port_js_1 = require("./port.js");
+const NAME = /^[A-Za-z0-9._-]{1,64}$/;
+const CONTROL_CHARACTER = /\p{Cc}/u;
+/** One RDN component per comma: `attr=value`, nothing a filter or DN parser would read twice. */
+const BASE_DN = /^[A-Za-z][A-Za-z0-9-]*=[^,=+<>#;\\"()*\p{Cc}]+(?:,\s*[A-Za-z][A-Za-z0-9-]*=[^,=+<>#;\\"()*\p{Cc}]+)*$/u;
+/** LDAP_MATCHING_RULE_IN_CHAIN: nested group membership. */
+const IN_CHAIN = '1.2.840.113556.1.4.1941';
+function directoryPasswords(options) {
+    const domain = required(options.domain, 'domain');
+    const netbios = required(options.netbiosDomain, 'netbiosDomain').toUpperCase();
+    const baseDn = required(options.baseDn, 'baseDn');
+    if (!BASE_DN.test(baseDn)) {
+        throw new TypeError(`[identity] directoryPasswords: baseDn '${baseDn}' is not a DN (DC=corp,DC=example).`);
+    }
+    const suffix = `@${domain}`.toLowerCase();
+    return {
+        strategy: 'directory-password',
+        budgetKey: (typed) => accountBudgetKey(typed),
+        async check(typed, password) {
+            if (password.length === 0 || CONTROL_CHARACTER.test(password))
+                return undefined;
+            const name = accountName(typed, suffix, netbios);
+            if (name === undefined)
+                return undefined;
+            let session;
+            try {
+                session = await options.directory.open();
+            }
+            catch (err) {
+                // Opening a session sends nothing (no password has left this process).
+                if (err instanceof errors_js_1.PasswordCheckUnreachableError)
+                    throw err;
+                throw new errors_js_1.PasswordCheckUnreachableError('the directory could not be opened', {
+                    cause: err,
+                });
+            }
+            try {
+                return await authenticated(session, name, password);
+            }
+            finally {
+                await session.close().catch(() => undefined);
+            }
+        },
+    };
+    async function authenticated(session, name, password) {
+        if ((await session.bind(`${name}@${domain}`, password)) !== 'ok')
+            return undefined;
+        const filter = accountFilter(await session.whoAmI(), netbios);
+        if (filter === undefined) {
+            options.log?.('[identity] directory-password: Who-am-I did not name an account of this domain');
+            return undefined;
+        }
+        const entries = await session.search(baseDn, filter, 'sub');
+        if (entries.length !== 1) {
+            options.log?.(`[identity] directory-password: ${entries.length} entries matched the authenticated account`);
+            return undefined;
+        }
+        const entry = entries[0];
+        if (entry.objectGUID === undefined || entry.objectGUID.length !== 16)
+            return undefined;
+        if (options.requiredGroup !== undefined) {
+            const member = await session.search(entry.dn, `(memberOf:${IN_CHAIN}:=${(0, port_js_1.escapeFilterValue)(options.requiredGroup)})`, 'base');
+            if (member.length !== 1)
+                return undefined;
+        }
+        const userId = entry.objectGUID.toString('base64');
+        return {
+            identity: { userId },
+            ...(entry.displayName !== undefined &&
+                entry.displayName.length > 0 && {
+                displayName: entry.displayName,
+            }),
+        };
+    }
+}
+exports.directoryPasswords = directoryPasswords;
+/**
+ * The account name to bind as, or `undefined` for a name that never reaches
+ * the directory. A trailing `@<domain>` and a leading `<NETBIOS>\` are
+ * removed only when they are exactly the configured ones.
+ */
+function accountName(typed, domainSuffix, netbiosDomain) {
+    let name = typed.trim();
+    if (name.toLowerCase().endsWith(domainSuffix))
+        name = name.slice(0, -domainSuffix.length);
+    const slash = name.indexOf('\\');
+    if (slash > 0 && netbiosDomain !== undefined) {
+        if (name.slice(0, slash).toUpperCase() === netbiosDomain.toUpperCase()) {
+            name = name.slice(slash + 1);
+        }
+    }
+    return NAME.test(name) ? name : undefined;
+}
+exports.accountName = accountName;
+/**
+ * The key a typed name's attempts are counted under — the ACCOUNT, as AD
+ * resolves it: lower-cased (AD names are case-insensitive), ANY `@suffix` and
+ * ANY `DOMAIN\` prefix removed, NFC. Deliberately wider than `accountName`: a
+ * spelling that never binds still shares the account's budget, so no spelling
+ * buys a fresh one (review idI57 B-1).
+ */
+function accountBudgetKey(typed) {
+    let key = typed.trim().toLowerCase();
+    const slash = key.lastIndexOf('\\');
+    if (slash >= 0)
+        key = key.slice(slash + 1);
+    const at = key.indexOf('@');
+    if (at >= 0)
+        key = key.slice(0, at);
+    return key.trim().normalize('NFC');
+}
+exports.accountBudgetKey = accountBudgetKey;
+/**
+ * Who-am-I's answer → the filter for exactly that account, or `undefined`.
+ * `u:CORP\alice` → `(sAMAccountName=alice)` (the domain must be ours);
+ * `u:S-1-5-21-…` → `(objectSid=<bytes>)`; anything else (empty = anonymous,
+ * `dn:` = AD LDS) is refused.
+ */
+function accountFilter(authzId, netbiosDomain) {
+    if (!authzId.startsWith('u:'))
+        return undefined;
+    const who = authzId.slice(2);
+    const sid = (0, port_js_1.sidToBytes)(who);
+    if (sid !== undefined)
+        return `(&(objectClass=user)(objectSid=${(0, port_js_1.escapeFilterValue)(sid)}))`;
+    const slash = who.indexOf('\\');
+    if (slash <= 0)
+        return undefined;
+    if (who.slice(0, slash).toUpperCase() !== netbiosDomain.toUpperCase())
+        return undefined;
+    const sam = who.slice(slash + 1);
+    if (sam.length === 0)
+        return undefined;
+    return `(&(objectClass=user)(sAMAccountName=${(0, port_js_1.escapeFilterValue)(sam)}))`;
+}
+exports.accountFilter = accountFilter;
+function required(value, name) {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new TypeError(`[identity] directoryPasswords: ${name} is required.`);
+    }
+    return value.trim();
+}
+//# sourceMappingURL=directoryPasswords.js.map

package/dist/adapters/identity/directory/directoryPasswords.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directoryPasswords.js","sourceRoot":"","sources":["../../../../src/adapters/identity/directory/directoryPasswords.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;;;AAEH,iEAAkF;AAElF,uCAAiG;AAiBjG,MAAM,IAAI,GAAG,wBAAwB,CAAC;AACtC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,iGAAiG;AACjG,MAAM,OAAO,GACX,wGAAwG,CAAC;AAC3G,4DAA4D;AAC5D,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAE3C,SAAgB,kBAAkB,CAAC,OAAkC;IACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CACjB,0CAA0C,MAAM,qCAAqC,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IAE1C,OAAO;QACL,QAAQ,EAAE,oBAAoB;QAC9B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAC7C,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB;YACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChF,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACzC,IAAI,OAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,IAAI,GAAG,YAAY,yCAA6B;oBAAE,MAAM,GAAG,CAAC;gBAC5D,MAAM,IAAI,yCAA6B,CAAC,mCAAmC,EAAE;oBAC3E,KAAK,EAAE,GAAG;iBACX,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACtD,CAAC;oBAAS,CAAC;gBACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;KACF,CAAC;IAEF,KAAK,UAAU,aAAa,CAC1B,OAAyB,EACzB,IAAY,EACZ,QAAgB;QAEhB,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,EAAE,CACX,gFAAgF,CACjF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,EAAE,CACX,kCAAkC,OAAO,CAAC,MAAM,4CAA4C,CAC7F,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAA6B,CAAC;QACrD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QACvF,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CACjC,KAAK,CAAC,EAAE,EACR,aAAa,QAAQ,KAAK,IAAA,2BAAiB,EAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EACrE,MAAM,CACP,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC5C,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO;YACL,QAAQ,EAAE,EAAE,MAAM,EAAE;YACpB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;gBACjC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC;SACL,CAAC;IACJ,CAAC;AACH,CAAC;AA3ED,gDA2EC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CACzB,KAAa,EACb,YAAoB,EACpB,aAAsB;IAEtB,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;YACvE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAdD,kCAcC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,IAAI,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAPD,4CAOC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,OAAe,EAAE,aAAqB;IAClE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,kCAAkC,IAAA,2BAAiB,EAAC,GAAG,CAAC,IAAI,CAAC;IAC3F,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,uCAAuC,IAAA,2BAAiB,EAAC,GAAG,CAAC,IAAI,CAAC;AAC3E,CAAC;AAXD,sCAWC;AAED,SAAS,QAAQ,CAAC,KAAyB,EAAE,IAAY;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,kCAAkC,IAAI,eAAe,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/adapters/identity/directory/ldapDirectory.js

@@ -0,0 +1,187 @@
+"use strict";
+/**
+ * directory/ldapDirectory — the {@link Directory} port over LDAPS, through
+ * `ldapts` (an optional peer, loaded lazily — the `jose` precedent).
+ *
+ * LDAPS only: `ldap://` would send the password in the clear on the bind, and
+ * StartTLS needs the same DC certificate LDAPS does, so refusing it loses
+ * nothing real. The certificate chain is checked against the CA the operator
+ * supplies (`caPem`) and the host name against the URL — there is no switch to
+ * skip either.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.caPemProblem = exports.ldapDirectory = exports.MissingLdaptsError = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_tls_1 = require("node:tls");
+const errors_js_1 = require("../../../hosting/signin/errors.js");
+const lazyRequire_js_1 = require("../../../lib/lazyRequire.js");
+/** Raised when `directory-password` is configured and `ldapts` is not installed. */
+class MissingLdaptsError extends Error {
+    code = 'ERR_MISSING_LDAPTS';
+    constructor() {
+        super('directory-password requires the `ldapts` peer dependency.\n  Install:  npm install ldapts');
+        this.name = 'MissingLdaptsError';
+    }
+}
+exports.MissingLdaptsError = MissingLdaptsError;
+/** RFC 4532 "Who am I?" extended operation. */
+const WHO_AM_I = '1.3.6.1.4.1.4203.1.11.3';
+/** LDAP result code 49: invalidCredentials — every wrong credential. */
+const INVALID_CREDENTIALS = 49;
+function ldapDirectory(options) {
+    let url;
+    try {
+        url = new URL(options.url);
+    }
+    catch {
+        throw new TypeError(`[identity] ldapDirectory: '${options.url}' is not an ldaps:// URL.`);
+    }
+    if (url.protocol !== 'ldaps:') {
+        throw new TypeError(`[identity] ldapDirectory: '${options.url}' is not ldaps://. A bind over plain LDAP sends ` +
+            `the password in the clear; use LDAPS (port 636) with the company CA.`);
+    }
+    const caProblem = caPemProblem(options.caPem);
+    if (caProblem !== undefined)
+        throw new TypeError(`[identity] ldapDirectory: ${caProblem}.`);
+    const timeout = options.timeoutMs ?? 5_000;
+    let lib = options.backend;
+    return {
+        async open() {
+            lib ??= await loadLdapts();
+            // Whether the TLS connection OPENED — the one bit that says whether a
+            // failed bind could have reached the DC (review idI57 S-6).
+            let reached = false;
+            const client = new lib.Client({
+                url: options.url,
+                timeout,
+                connectTimeout: timeout,
+                tlsOptions: { ca: [options.caPem], minVersion: 'TLSv1.2', rejectUnauthorized: true },
+                createSecureConnection: (port, host, tls) => {
+                    const socket = (0, node_tls_1.connect)(port, host, tls);
+                    socket.once('secureConnect', () => {
+                        reached = true;
+                    });
+                    return socket;
+                },
+            });
+            return {
+                async bind(name, password) {
+                    try {
+                        await client.bind(name, password);
+                        return 'ok';
+                    }
+                    catch (err) {
+                        if (err?.code === INVALID_CREDENTIALS) {
+                            const sub = /data ([0-9a-f]{3,4})/i.exec(String(err.message))?.[1];
+                            options.log?.(`[identity] directory bind refused${sub ? ` (AD sub-code ${sub})` : ''}`);
+                            return 'invalid';
+                        }
+                        // Never connected (refused, unreachable, a TLS failure): the
+                        // password never left, so the attempt is un-counted. Connected,
+                        // then failed (a bind that timed out): AD may have counted it,
+                        // so the error stays an ordinary one and the door counts it.
+                        if (!reached) {
+                            options.log?.('[identity] directory unreachable (no TLS connection opened)');
+                            throw new errors_js_1.PasswordCheckUnreachableError('the directory could not be reached', {
+                                cause: err,
+                            });
+                        }
+                        options.log?.('[identity] directory bind failed after it was sent (counted)');
+                        throw err;
+                    }
+                },
+                async whoAmI() {
+                    const answer = await client.exop(WHO_AM_I);
+                    return typeof answer.value === 'string' ? answer.value : '';
+                },
+                async search(base, filter, scope) {
+                    const found = await client.search(base, {
+                        scope,
+                        filter,
+                        attributes: ['objectGUID', 'displayName'],
+                        explicitBufferAttributes: ['objectGUID'],
+                        sizeLimit: 2,
+                    });
+                    return found.searchEntries.map(toEntry);
+                },
+                async close() {
+                    await client.unbind();
+                },
+            };
+        },
+    };
+}
+exports.ldapDirectory = ldapDirectory;
+/**
+ * Why a CA file is not one, or `undefined`: every PEM block must parse as an
+ * X.509 certificate with the CA flag set (review idI57 N-10 — a leaf
+ * certificate booted, then failed every sign-in).
+ */
+function caPemProblem(caPem) {
+    if (typeof caPem !== 'string')
+        return 'caPem must be a PEM CA certificate';
+    const blocks = caPem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+    if (blocks === null)
+        return 'caPem must be a PEM CA certificate';
+    for (const block of blocks) {
+        let cert;
+        try {
+            cert = new node_crypto_1.X509Certificate(block);
+        }
+        catch {
+            return 'caPem holds a block that is not an X.509 certificate';
+        }
+        if (!cert.ca) {
+            return `caPem holds a certificate that is not a CA (${cert.subject.replace(/\n/g, ', ')}); give the CA that issued the DC's certificate`;
+        }
+    }
+    return undefined;
+}
+exports.caPemProblem = caPemProblem;
+function toEntry(raw) {
+    const guid = raw.objectGUID;
+    const name = raw.displayName;
+    return {
+        dn: String(raw.dn ?? ''),
+        ...(Buffer.isBuffer(guid) && { objectGUID: guid }),
+        ...(typeof name === 'string' && { displayName: name }),
+    };
+}
+async function loadLdapts() {
+    try {
+        const spec = 'ldapts';
+        return (await Promise.resolve(`${spec}`).then(s => __importStar(require(s))));
+    }
+    catch {
+        try {
+            return (0, lazyRequire_js_1.lazyRequire)('ldapts');
+        }
+        catch {
+            throw new MissingLdaptsError();
+        }
+    }
+}
+//# sourceMappingURL=ldapDirectory.js.map

package/dist/adapters/identity/directory/ldapDirectory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ldapDirectory.js","sourceRoot":"","sources":["../../../../src/adapters/identity/directory/ldapDirectory.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,6CAA8C;AAC9C,uCAAyF;AAEzF,iEAAkF;AAClF,gEAA0D;AAiC1D,oFAAoF;AACpF,MAAa,kBAAmB,SAAQ,KAAK;IAClC,IAAI,GAAG,oBAA6B,CAAC;IAE9C;QACE,KAAK,CACH,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AATD,gDASC;AAED,+CAA+C;AAC/C,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAC3C,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,SAAgB,aAAa,CAAC,OAA6B;IACzD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,8BAA8B,OAAO,CAAC,GAAG,2BAA2B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CACjB,8BAA8B,OAAO,CAAC,GAAG,kDAAkD;YACzF,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,SAAS,GAAG,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,IAAI,GAAG,GAA8B,OAAO,CAAC,OAAO,CAAC;IAErD,OAAO;QACL,KAAK,CAAC,IAAI;YACR,GAAG,KAAK,MAAM,UAAU,EAAE,CAAC;YAC3B,sEAAsE;YACtE,4DAA4D;YAC5D,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,OAAO;gBACP,cAAc,EAAE,OAAO;gBACvB,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE;gBACpF,sBAAsB,EAAE,CAAC,IAAY,EAAE,IAAY,EAAE,GAAsB,EAAa,EAAE;oBACxF,MAAM,MAAM,GAAG,IAAA,kBAAU,EAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC3C,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;wBAChC,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC,CAAC,CAAC;oBACH,OAAO,MAAM,CAAC;gBAChB,CAAC;aACF,CAAC,CAAC;YACH,OAAO;gBACL,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ;oBACvB,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;wBAClC,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAK,GAA0B,EAAE,IAAI,KAAK,mBAAmB,EAAE,CAAC;4BAC9D,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;4BAC9E,OAAO,CAAC,GAAG,EAAE,CACX,oCAAoC,GAAG,CAAC,CAAC,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,CAAC;4BACF,OAAO,SAAS,CAAC;wBACnB,CAAC;wBACD,6DAA6D;wBAC7D,gEAAgE;wBAChE,+DAA+D;wBAC/D,6DAA6D;wBAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;4BACb,OAAO,CAAC,GAAG,EAAE,CAAC,6DAA6D,CAAC,CAAC;4BAC7E,MAAM,IAAI,yCAA6B,CAAC,oCAAoC,EAAE;gCAC5E,KAAK,EAAE,GAAG;6BACX,CAAC,CAAC;wBACL,CAAC;wBACD,OAAO,CAAC,GAAG,EAAE,CAAC,8DAA8D,CAAC,CAAC;wBAC9E,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;gBACD,KAAK,CAAC,MAAM;oBACV,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC3C,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,CAAC;gBACD,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK;oBAC9B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;wBACtC,KAAK;wBACL,MAAM;wBACN,UAAU,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;wBACzC,wBAAwB,EAAE,CAAC,YAAY,CAAC;wBACxC,SAAS,EAAE,CAAC;qBACb,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC1C,CAAC;gBACD,KAAK,CAAC,KAAK;oBACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxB,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AApFD,sCAoFC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,oCAAoC,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC5F,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,oCAAoC,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,6BAAe,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,sDAAsD,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,+CAA+C,IAAI,CAAC,OAAO,CAAC,OAAO,CACxE,KAAK,EACL,IAAI,CACL,iDAAiD,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAnBD,oCAmBC;AAED,SAAS,OAAO,CAAC,GAA4B;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC;IAC7B,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC;QACtB,OAAO,CAAC,yBAAa,IAAI,uCAAC,CAA6B,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,IAAA,4BAAW,EAAgB,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/adapters/identity/directory/port.js

@@ -0,0 +1,54 @@
+"use strict";
+/**
+ * directory/port — the four directory operations `directory-password` needs,
+ * as a port, so the rules run over a fake directory in tests and over LDAPS
+ * (`ldapDirectory`, through `ldapts`) in a deployment.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sidToBytes = exports.escapeFilterValue = void 0;
+/**
+ * RFC 4515 §3: escape a value for an LDAP search filter. A string escapes `*`,
+ * `(`, `)`, `\` and NUL (and every non-ASCII byte, so nothing depends on how a
+ * server reads UTF-8 in a filter); bytes are escaped whole.
+ */
+function escapeFilterValue(value) {
+    const bytes = typeof value === 'string' ? Buffer.from(value, 'utf8') : value;
+    let out = '';
+    for (const byte of bytes) {
+        const plain = byte >= 0x20 &&
+            byte < 0x7f &&
+            byte !== 0x2a &&
+            byte !== 0x28 &&
+            byte !== 0x29 &&
+            byte !== 0x5c;
+        out += plain ? String.fromCharCode(byte) : `\\${byte.toString(16).padStart(2, '0')}`;
+    }
+    return out;
+}
+exports.escapeFilterValue = escapeFilterValue;
+/**
+ * A SID in SDDL string form (`S-1-5-21-…-1104`) as the binary `objectSid` a
+ * filter compares, or `undefined` when it is not one.
+ */
+function sidToBytes(sid) {
+    const parts = /^S-1-(\d+)((?:-\d+){0,15})$/.exec(sid);
+    if (parts === null)
+        return undefined;
+    const authority = BigInt(parts[1]);
+    const subs = parts[2]
+        .split('-')
+        .filter((p) => p.length > 0)
+        .map(Number);
+    if (authority >= 2n ** 48n || subs.some((n) => !Number.isInteger(n) || n < 0 || n > 0xffffffff)) {
+        return undefined;
+    }
+    const out = Buffer.alloc(8 + subs.length * 4);
+    out[0] = 1;
+    out[1] = subs.length;
+    for (let i = 0; i < 6; i += 1)
+        out[2 + i] = Number((authority >> BigInt(8 * (5 - i))) & 0xffn);
+    subs.forEach((n, i) => out.writeUInt32LE(n, 8 + i * 4));
+    return out;
+}
+exports.sidToBytes = sidToBytes;
+//# sourceMappingURL=port.js.map

package/dist/adapters/identity/directory/port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"port.js","sourceRoot":"","sources":["../../../../src/adapters/identity/directory/port.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AA6BH;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,KAAsB;IACtD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GACT,IAAI,IAAI,IAAI;YACZ,IAAI,GAAG,IAAI;YACX,IAAI,KAAK,IAAI;YACb,IAAI,KAAK,IAAI;YACb,IAAI,KAAK,IAAI;YACb,IAAI,KAAK,IAAI,CAAC;QAChB,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAdD,8CAcC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAI,KAAK,CAAC,CAAC,CAAY;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,MAAM,CAAC,CAAC;IACf,IAAI,SAAS,IAAI,EAAE,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;QAChG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC;AACb,CAAC;AAjBD,gCAiBC"}