{"version":3,"sources":["../src/paths.ts"],"names":[],"mappings":";;;AAoBO,IAAM,UAAA,GAAa;AAAA;AAAA,EAExB,SAAA,EAAW,mCAAA;AAAA;AAAA,EAEX,SAAA,EAAW,yBAAA;AAAA;AAAA,EAEX,KAAA,EAAO,qBAAA;AAAA;AAAA,EAEP,QAAA,EAAU,wBAAA;AAAA;AAAA,EAEV,IAAA,EAAM,0BAAA;AAAA;AAAA,EAEN,MAAA,EAAQ;AACV;AASO,IAAM,SAAA,GAAY;AAAA;AAAA,EAEvB,WAAA,EAAa,sBAAA;AAAA;AAAA,EAEb,UAAA,EAAY,oBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQZ,KAAA,EAAO,eAAA;AAAA;AAAA,EAEP,QAAA,EAAU,gCAAA;AAAA;AAAA,EAEV,MAAA,EAAQ;AACV;AAWO,IAAM,iBAAA,GAAoB;AAAA,EAC/B,KAAA,EAAO,sBAAA;AAAA,EACP,GAAA,EAAK,gBAAA;AAAA,EACL,GAAA,EAAK,gBAAA;AAAA,EACL,QAAA,EAAU,sBAAA;AAAA,EACV,IAAA,EAAM;AACR;AAWO,SAAS,kBAAkB,KAAA,EAAyB;AACzD,EAAA,OAAO,kBAAkB,KAAK,CAAA;AAChC;AAGO,SAAS,cAAc,SAAA,EAA2B;AACvD,EAAA,OAAO,SAAA,CAAU,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACrC;AAQO,SAAS,MAAA,CAAO,WAAmB,GAAA,EAA0B;AAClE,EAAA,OAAO,GAAG,aAAA,CAAc,SAAS,CAAC,CAAA,EAAG,UAAA,CAAW,GAAG,CAAC,CAAA,CAAA;AACtD","file":"paths.cjs","sourcesContent":["/**\n * The single source of truth for Hanzo IAM OIDC endpoint paths.\n *\n * Hanzo IAM is a Casdoor-derived OIDC provider served per-brand from a\n * configurable origin (`serverUrl`): hanzo → https://iam.hanzo.ai,\n * lux → https://lux.id, zoo → https://zoo.id, bootnode → https://id.bootno.de.\n *\n * These are the ONLY paths. There is no legacy `/oauth/*` and no\n * `/api/login/*`. Every module in this SDK references `OIDC_PATHS` —\n * no path string is written anywhere else.\n *\n * CRITICAL GOTCHA: IAM serves a 200 `text/html` SPA catch-all for ANY\n * unregistered path. A client that hits a wrong path therefore gets a\n * 200 HTML body, not a 404 — silent breakage. So clients MUST hit these\n * exact paths, and a discovery round-trip must never be allowed to\n * resolve to a different path. The hard-coded fallbacks here are these\n * same values, so a failed discovery degrades to correct paths.\n */\n\n/** OIDC endpoint paths, relative to the brand `serverUrl`. */\nexport const OIDC_PATHS = {\n /** OIDC discovery document. */\n discovery: \"/.well-known/openid-configuration\",\n /** Authorization endpoint (RFC 6749 §3.1). */\n authorize: \"/v1/iam/oauth/authorize\",\n /** Token endpoint (RFC 6749 §3.2). */\n token: \"/v1/iam/oauth/token\",\n /** UserInfo endpoint (OIDC Core §5.3). */\n userinfo: \"/v1/iam/oauth/userinfo\",\n /** JWKS endpoint (RFC 7517). */\n jwks: \"/v1/iam/.well-known/jwks\",\n /** RP-initiated logout endpoint (OIDC RP-Initiated Logout). */\n logout: \"/v1/iam/oauth/logout\",\n} as const;\n\nexport type OidcPathKey = keyof typeof OIDC_PATHS;\n\n/**\n * Hanzo-IAM application paths that are NOT part of the OIDC spec — the\n * auth-method discovery endpoint and the onboarding state machine the\n * embedded views drive. Mounted under the same `/v1/iam` prefix.\n */\nexport const IAM_PATHS = {\n /** Live list of enabled auth methods for the embedded login views. */\n authMethods: \"/v1/iam/auth/methods\",\n /** Onboarding state-machine base (steps append `/identity`, etc.). */\n onboarding: \"/v1/iam/onboarding\",\n /**\n * Casdoor credential-login endpoint the embedded `` views POST to.\n * `type=code` (a client `redirectUri` is present) mints an authorization\n * code returned in `data`; `type=login` establishes the session cookie.\n * This is what the deployed IAM actually authenticates against — the OIDC\n * token endpoint's password/OTP grants are NOT enabled per-client.\n */\n login: \"/v1/iam/login\",\n /** Send an email/SMS verification code (passwordless login). */\n sendCode: \"/v1/iam/send-verification-code\",\n /** Account registration. */\n signup: \"/v1/iam/signup\",\n} as const;\n\nexport type IamPathKey = keyof typeof IAM_PATHS;\n\n/**\n * The canonical `serverUrl` origin for each Hanzo IAM brand. White-label\n * is host-based: one IAM deployment serves every brand and selects the\n * tenant by the origin it is reached on. This is the SINGLE place the\n * brand→origin mapping lives — adapters take a `brand` and resolve here\n * rather than each app hard-coding a hostname.\n */\nexport const BRAND_SERVER_URLS = {\n hanzo: \"https://iam.hanzo.ai\",\n lux: \"https://lux.id\",\n zoo: \"https://zoo.id\",\n bootnode: \"https://id.bootno.de\",\n pars: \"https://pars.id\",\n} as const;\n\n/** A known Hanzo IAM brand key. */\nexport type IamBrand = keyof typeof BRAND_SERVER_URLS;\n\n/**\n * Resolve a brand to its canonical IAM `serverUrl`.\n *\n * @example\n * serverUrlForBrand(\"lux\") // → \"https://lux.id\"\n */\nexport function serverUrlForBrand(brand: IamBrand): string {\n return BRAND_SERVER_URLS[brand];\n}\n\n/** Strip trailing slashes from a server origin so paths concat cleanly. */\nexport function trimServerUrl(serverUrl: string): string {\n return serverUrl.replace(/\\/+$/, \"\");\n}\n\n/**\n * Build an absolute IAM endpoint URL from a server origin and a path key.\n *\n * @example\n * iamUrl(\"https://iam.hanzo.ai\", \"token\") // → \"https://iam.hanzo.ai/v1/iam/oauth/token\"\n */\nexport function iamUrl(serverUrl: string, key: OidcPathKey): string {\n return `${trimServerUrl(serverUrl)}${OIDC_PATHS[key]}`;\n}\n"]}