@_mustachio/openauth 0.11.0 → 0.13.0

package/dist/types/types/scim.d.ts

@@ -0,0 +1,269 @@
+/**
+ * SCIM 2.0 — public types.
+ *
+ * The library is the SCIM **Service Provider** (the system being
+ * provisioned into); corporate IdPs are the SCIM clients. Inbound only —
+ * we never originate provisioning traffic. See `SCIM-AD1` in
+ * `docs/plans/claude/scim-plan.md`.
+ *
+ * These types are the whole contract between the library's protocol
+ * layer and the host's data layer. No SCIM JSON shape, path expression,
+ * or filter string reaches the host: it receives validated, normalized
+ * values and returns records. See `SCIM-AD2`.
+ *
+ * Plain TypeScript, no third-party types, no Node APIs — SCIM is JSON
+ * over HTTP, so unlike SAML this surface lives on the root entry and
+ * stays edge-clean.
+ */
+/** RFC 7643 §4.1.2 — a multi-valued attribute entry. */
+export type ScimMultiValue = {
+    value: string;
+    /** e.g. `"work"` / `"home"` / `"mobile"`. */
+    type?: string;
+    /** At most one entry per attribute should be primary. */
+    primary?: boolean;
+};
+/** RFC 7643 §4.1.1 — the `name` complex attribute. */
+export type ScimName = {
+    formatted?: string;
+    familyName?: string;
+    givenName?: string;
+    middleName?: string;
+    honorificPrefix?: string;
+    honorificSuffix?: string;
+};
+/**
+ * RFC 7643 §4.3 — the enterprise user extension
+ * (`urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`).
+ * Okta and Entra both populate parts of this; `department` and
+ * `manager` are the ones hosts usually care about.
+ */
+export type ScimEnterpriseUser = {
+    employeeNumber?: string;
+    costCenter?: string;
+    organization?: string;
+    division?: string;
+    department?: string;
+    /** `manager.value` is the manager's SCIM `id`. */
+    manager?: {
+        value?: string;
+        displayName?: string;
+    };
+};
+/**
+ * A user as the **host** stores it. Returned from every `ScimDirectory`
+ * read and write.
+ *
+ * `id` is the host's stable identifier and becomes the SCIM resource id
+ * in URLs — it must be opaque, stable, and URL-safe.
+ *
+ * `externalId` is the **IdP's** identifier for the same person. It is
+ * what reconciliation depends on in practice (a user can change
+ * `userName`; `externalId` survives), so hosts should persist and index
+ * it even though SCIM marks it optional.
+ */
+export type ScimUserRecord = {
+    id: string;
+    externalId?: string;
+    userName: string;
+    /** `false` is the normal deprovisioning signal — see `SCIM-AD8`. */
+    active: boolean;
+    name?: ScimName;
+    displayName?: string;
+    emails?: ScimMultiValue[];
+    phoneNumbers?: ScimMultiValue[];
+    enterprise?: ScimEnterpriseUser;
+    /** Unix ms. Surfaced as `meta.created` when present. */
+    createdAt?: number;
+    /** Unix ms. Surfaced as `meta.lastModified` when present. */
+    updatedAt?: number;
+};
+/**
+ * A validated create / replace payload. Same shape as a record minus
+ * the host-assigned `id` and timestamps.
+ *
+ * `active` is always present: SCIM defaults it to `true` on create, and
+ * resolving that default in the library rather than the host keeps the
+ * semantics in one place.
+ *
+ * Note there is no `password` field, deliberately — see `SCIM-AD1`
+ * non-goals. A `password` in the payload is refused, not silently
+ * dropped.
+ */
+export type ScimUserWrite = {
+    externalId?: string;
+    userName: string;
+    active: boolean;
+    name?: ScimName;
+    displayName?: string;
+    emails?: ScimMultiValue[];
+    phoneNumbers?: ScimMultiValue[];
+    enterprise?: ScimEnterpriseUser;
+};
+/**
+ * A **normalized** PATCH delta (`SCIM-AD6`).
+ *
+ * The library resolves `urn:ietf:params:scim:api:messages:2.0:PatchOp`
+ * operations — including path expressions like
+ * `emails[type eq "work"].value` and the different shapes Okta and Entra
+ * emit for the same intent — into this flat delta. The host never parses
+ * a SCIM path.
+ *
+ * Present key ⇒ set to that value. Absent key ⇒ leave untouched.
+ * `null` ⇒ the attribute was removed and should be cleared.
+ */
+export type ScimUserPatch = {
+    externalId?: string | null;
+    userName?: string;
+    active?: boolean;
+    name?: ScimName | null;
+    displayName?: string | null;
+    emails?: ScimMultiValue[] | null;
+    phoneNumbers?: ScimMultiValue[] | null;
+    enterprise?: ScimEnterpriseUser | null;
+};
+/**
+ * Attributes the filter subset may reference (`SCIM-AD3`).
+ *
+ * `emails.value` is the normalized form of the complex path Entra emits
+ * (`emails[type eq "work"].value`) — the host matches on any email
+ * value and need not model the `type` qualifier.
+ */
+export type ScimFilterAttribute = "id" | "userName" | "externalId" | "active" | "emails.value"
+/** Groups only. */
+ | "displayName";
+/**
+ * The parsed filter, as a small typed tree. The host never receives the
+ * raw filter string — parsing is the library's job, and an expression
+ * outside the supported subset is rejected with `400 invalidFilter`
+ * before the port is called.
+ */
+export type ScimFilter = {
+    op: "eq";
+    attribute: ScimFilterAttribute;
+    value: string | boolean;
+} | {
+    op: "and";
+    left: ScimFilter;
+    right: ScimFilter;
+};
+/** Input to `ScimDirectory.findUsers`. */
+export type ScimUserQuery = {
+    /** Absent ⇒ unfiltered list. */
+    filter?: ScimFilter;
+    /**
+     * **1-based**, per RFC 7644 §3.4.2.4 — not zero. Already clamped to
+     * `>= 1` by the library.
+     */
+    startIndex: number;
+    /** Page size, already clamped to the connection's configured maximum. */
+    count: number;
+};
+/**
+ * One page of results. `totalResults` is the count of everything
+ * matching the filter, not the size of `resources` — SCIM clients use it
+ * to drive pagination, so a host that returns the page size here will
+ * make Okta loop or stop early.
+ */
+export type ScimPage<T> = {
+    resources: T[];
+    totalResults: number;
+};
+/**
+ * One group membership entry. `value` is the member's SCIM `id` — for
+ * us always a User id, since we do not support nested groups.
+ */
+export type ScimGroupMember = {
+    value: string;
+    /** Human label the IdP supplied. Advisory; not authoritative. */
+    display?: string;
+};
+/** A group as the **host** stores it. */
+export type ScimGroupRecord = {
+    id: string;
+    externalId?: string;
+    displayName: string;
+    /**
+     * Omit when the caller asked for `excludedAttributes=members`, which
+     * Okta does while enumerating groups. Distinguish "not requested"
+     * (omit) from "no members" (`[]`) — returning `[]` for the former
+     * tells the client the group was emptied.
+     */
+    members?: ScimGroupMember[];
+    /** Unix ms → `meta.created`. */
+    createdAt?: number;
+    /** Unix ms → `meta.lastModified`. */
+    updatedAt?: number;
+};
+/** A validated group create / replace payload. */
+export type ScimGroupWrite = {
+    externalId?: string;
+    displayName: string;
+    /** Full membership for a create or replace. */
+    members?: ScimGroupMember[];
+};
+/**
+ * A normalized group PATCH.
+ *
+ * Membership is handled differently from every user attribute, and
+ * deliberately so (`SCIM-AD9`). For a user, the library resolves a
+ * targeted patch into the complete new value because the lists involved
+ * are small and bounded. Group membership is neither: resolving
+ * "add one member" against a 20,000-member group would mean reading all
+ * 20,000 rows and handing them back on every single change.
+ *
+ * So the client's *intent* is preserved instead. `addMembers` /
+ * `removeMembers` are incremental and let the host issue one insert or
+ * delete; `members` is a full replacement. They are mutually exclusive
+ * — the library never emits `members` alongside either incremental
+ * field, so a host can branch on which is present without ordering
+ * concerns.
+ */
+export type ScimGroupPatch = {
+    displayName?: string;
+    externalId?: string | null;
+    /** Replace the entire membership with exactly these members. */
+    members?: ScimGroupMember[];
+    /** Add these members, leaving existing ones alone. Idempotent. */
+    addMembers?: ScimGroupMember[];
+    /** Remove these member ids. Removing a non-member is not an error. */
+    removeMembers?: string[];
+};
+/** Input to `ScimDirectory.findGroups`. */
+export type ScimGroupQuery = {
+    filter?: ScimFilter;
+    /** 1-based. */
+    startIndex: number;
+    count: number;
+    /**
+     * `true` when the client sent `excludedAttributes=members`. The host
+     * may skip loading membership entirely — Okta sets this while
+     * enumerating groups, and honouring it is the difference between a
+     * cheap listing and a fan-out read per group.
+     */
+    excludeMembers: boolean;
+};
+/**
+ * Per-tenant SCIM connection config, carried on `TenantConfig.scim`.
+ *
+ * SCIM is not an `AuthMethod` — no `/authorize`, no flow, no user agent
+ * — so it is tenant-level config rather than a `MethodConfig`
+ * (`SCIM-AD5`).
+ */
+export type ScimConfig = {
+    /** `false` (or absent config) ⇒ `/scim/v2/*` responds 403 for this tenant. */
+    enabled: boolean;
+    /**
+     * Hash of the bearer token issued to the IdP, produced with
+     * `hashClientSecret` — the same treatment as
+     * `ClientConfig.secretHash`. Never store the raw token.
+     */
+    tokenHash: string;
+    /**
+     * Largest page this connection will return, whatever the client asks
+     * for. Defaults to 100; hard-capped at 500 so a hostile or
+     * misconfigured `count` cannot ask the host for an unbounded read.
+     */
+    maxPageSize?: number;
+};
+//# sourceMappingURL=scim.d.ts.map

package/dist/types/types/scim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.d.ts","sourceRoot":"","sources":["../../../src/types/scim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED,sDAAsD;AACtD,MAAM,MAAM,QAAQ,GAAG;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kDAAkD;IAClD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACnD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,YAAY,CAAC,EAAE,cAAc,EAAE,CAAA;IAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,YAAY,CAAC,EAAE,cAAc,EAAE,CAAA;IAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,MAAM,CAAC,EAAE,cAAc,EAAE,GAAG,IAAI,CAAA;IAChC,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,IAAI,CAAA;IACtC,UAAU,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACvC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B,IAAI,GACJ,UAAU,GACV,YAAY,GACZ,QAAQ,GACR,cAAc;AAChB,mBAAmB;GACjB,aAAa,CAAA;AAEjB;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACrE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAA;AAEtD,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG;IAC1B,gCAAgC;IAChC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI;IACxB,SAAS,EAAE,CAAC,EAAE,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;IAC3B,gCAAgC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;CAC5B,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,gEAAgE;IAChE,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;IAC3B,kEAAkE;IAClE,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;IAC9B,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB,CAAA;AAED,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,eAAe;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAA;CACxB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,8EAA8E;IAC9E,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA"}

package/dist/types/types/tenant.d.ts

@@ -11,6 +11,7 @@
  * providers carries only `{ tenantId, flowId, nonce, kid }`. Everything else
  * lives in the server-side `FlowRecord` (see `./flow.ts`).
  */
+import type { ScimConfig } from "./scim";
 /**
  * Branded tenant id — **opaque to the framework**.
  *
@@ -181,6 +182,15 @@ export type TenantConfig = {
     refreshTtl?: number;
     /** Override default access-token TTL (seconds). */
     accessTtl?: number;
+    /**
+     * SCIM 2.0 provisioning for this tenant. Absent or `enabled: false` ⇒
+     * `/scim/v2/*` answers 403 for this tenant.
+     *
+     * Tenant-level rather than a `MethodConfig` because SCIM is not an
+     * auth method — no `/authorize`, no flow, no user agent. See
+     * `SCIM-AD5` in `docs/plans/claude/scim-plan.md`.
+     */
+    scim?: ScimConfig;
 };
 /**
  * Per-request tenant context handed to methods and the user-supplied

package/dist/types/types/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/types/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,QAA6B,CAAA;AAExE,qFAAqF;AACrF,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8DAA8D;IAC9D,YAAY,EAAE,IAAI,CAAA;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAA;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,QAAQ,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,QAAQ,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE;QACP,GAAG,EAAE,OAAO,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,kFAAkF;IAClF,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/types/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,QAA6B,CAAA;AAExE,qFAAqF;AACrF,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8DAA8D;IAC9D,YAAY,EAAE,IAAI,CAAA;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAA;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,QAAQ,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,QAAQ,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE;QACP,GAAG,EAAE,OAAO,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,kFAAkF;IAClF,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@_mustachio/openauth",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -37,6 +37,12 @@
       "import": "./dist/esm/adapters/*/index.js",
       "types": "./dist/types/adapters/*/index.d.ts"
     },
+    "./methods/saml-sp": {
+      "node": {
+        "import": "./dist/esm/methods/saml-sp/index.js",
+        "types": "./dist/types/methods/saml-sp/index.d.ts"
+      }
+    },
     "./*": {
       "import": "./dist/esm/*.js",
       "types": "./dist/types/*.d.ts"
@@ -73,8 +79,10 @@
   },
   "dependencies": {
     "@noble/hashes": "2.2.0",
+    "@node-saml/node-saml": "5.1.0",
     "@simplewebauthn/server": "13.1.1",
     "@standard-schema/spec": "1.0.0-beta.3",
+    "@xmldom/xmldom": "0.8.13",
     "aws4fetch": "1.0.20",
     "jose": "5.9.6",
     "oauth4webapi": "3.8.6",

package/src/adapters/d1/migrations.ts

@@ -67,6 +67,11 @@ export const INITIAL_SCHEMA_SQL = [
     payload TEXT NOT NULL,
     expires_at INTEGER NOT NULL
   )`,
+  `CREATE TABLE IF NOT EXISTS openauth_scratch (
+    scratch_key TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    expires_at INTEGER NOT NULL
+  )`,
   `CREATE TABLE IF NOT EXISTS openauth_audit_events (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     ts INTEGER NOT NULL,

package/src/adapters/d1/session-store.ts

@@ -227,4 +227,72 @@ export class D1SessionStore implements SessionStore {
     }
     return ok(undefined)
   }
+
+  async saveScratch(
+    key: string,
+    value: string,
+    ttlMs: number,
+  ): Promise<Result<void>> {
+    if (ttlMs <= 0) {
+      return err(
+        authError.internalError(
+          `saveScratch: ttlMs must be positive, got ${ttlMs}`,
+        ),
+      )
+    }
+    const expiresAt = this.#clock() + ttlMs
+    try {
+      // Pinned to the primary — scratch backs InResponseTo replay
+      // protection, which is read-after-write sensitive at the ACS.
+      await primarySession(this.#db)
+        .prepare(
+          `INSERT INTO openauth_scratch (scratch_key, value, expires_at) VALUES (?1, ?2, ?3)
+           ON CONFLICT(scratch_key) DO UPDATE SET value = excluded.value, expires_at = excluded.expires_at`,
+        )
+        .bind(key, value, expiresAt)
+        .run()
+    } catch (e) {
+      return err(authError.internalError("saveScratch: upsert failed", e))
+    }
+    return ok(undefined)
+  }
+
+  async readScratch(key: string): Promise<Result<string>> {
+    let row: { value: string; expires_at: number } | null
+    try {
+      row = await primarySession(this.#db)
+        .prepare(
+          `SELECT value, expires_at FROM openauth_scratch WHERE scratch_key = ?1`,
+        )
+        .bind(key)
+        .first<{ value: string; expires_at: number }>()
+    } catch (e) {
+      return err(authError.internalError("readScratch: query failed", e))
+    }
+    if (!row) {
+      return err(authError.unknownState(`scratch "${key}" unknown`))
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await primarySession(this.#db)
+          .prepare(`DELETE FROM openauth_scratch WHERE scratch_key = ?1`)
+          .bind(key)
+          .run()
+      } catch {}
+      return err(authError.unknownState(`scratch "${key}" expired`))
+    }
+    return ok(row.value)
+  }
+
+  async deleteScratch(key: string): Promise<Result<void>> {
+    try {
+      await primarySession(this.#db)
+        .prepare(`DELETE FROM openauth_scratch WHERE scratch_key = ?1`)
+        .bind(key)
+        .run()
+    } catch (e) {
+      return err(authError.internalError("deleteScratch: delete failed", e))
+    }
+    return ok(undefined)
+  }
 }

package/src/adapters/durable-object/session-store.ts

@@ -51,6 +51,11 @@ type StoredSession = {
   expiresAt: number
 }
 
+type StoredScratch = {
+  value: string
+  expiresAt: number
+}
+
 export type DurableObjectSessionStoreOptions = {
   storage: DurableObjectStorageLike
   clock?: () => number
@@ -218,10 +223,66 @@ export class DurableObjectSessionStore implements SessionStore {
     }
     return ok(undefined)
   }
+
+  async saveScratch(
+    key: string,
+    value: string,
+    ttlMs: number,
+  ): Promise<Result<void>> {
+    if (ttlMs <= 0) {
+      return err(
+        authError.internalError(
+          `saveScratch: ttlMs must be positive, got ${ttlMs}`,
+        ),
+      )
+    }
+    const stored: StoredScratch = {
+      value,
+      expiresAt: this.#clock() + ttlMs,
+    }
+    try {
+      // Plain put — scratch overwrites any prior value for the key. No
+      // transaction needed: it is a single write, and the DO serializes
+      // all operations on this instance.
+      await this.#storage.put(scratchKey(key), stored)
+    } catch (e) {
+      return err(authError.internalError("saveScratch: put failed", e))
+    }
+    return ok(undefined)
+  }
+
+  async readScratch(key: string): Promise<Result<string>> {
+    let stored: StoredScratch | undefined
+    try {
+      stored = await this.#storage.get<StoredScratch>(scratchKey(key))
+    } catch (e) {
+      return err(authError.internalError("readScratch: get failed", e))
+    }
+    if (!stored) {
+      return err(authError.unknownState(`scratch "${key}" unknown`))
+    }
+    if (this.#clock() >= stored.expiresAt) {
+      try {
+        await this.#storage.delete(scratchKey(key))
+      } catch {}
+      return err(authError.unknownState(`scratch "${key}" expired`))
+    }
+    return ok(stored.value)
+  }
+
+  async deleteScratch(key: string): Promise<Result<void>> {
+    try {
+      await this.#storage.delete(scratchKey(key))
+    } catch (e) {
+      return err(authError.internalError("deleteScratch: delete failed", e))
+    }
+    return ok(undefined)
+  }
 }
 
 const flowKey = (flowId: string) => `flow:${flowId}`
 const sessionKey = (sessionId: string) => `session:${sessionId}`
+const scratchKey = (key: string) => `scratch:${key}`
 
 // Re-exported for adapter users wiring `storage.transaction` callbacks.
 export type { DurableObjectStorageLike, DurableObjectTransactionLike }

package/src/adapters/dynamo/session-store.ts

@@ -211,6 +211,69 @@ export class DynamoSessionStore implements SessionStore {
     }
     return ok(undefined)
   }
+
+  async saveScratch(
+    key: string,
+    value: string,
+    ttlMs: number,
+  ): Promise<Result<void>> {
+    if (ttlMs <= 0) {
+      return err(
+        authError.internalError(
+          `saveScratch: ttlMs must be positive, got ${ttlMs}`,
+        ),
+      )
+    }
+    const expiresAtMs = this.#clock() + ttlMs
+    try {
+      // Unconditional put — scratch overwrites any prior value for the key.
+      await this.#exec.put({
+        item: {
+          pk: "scratch",
+          sk: key,
+          value,
+          expires_at: expiresAtMs,
+          ttl: Math.floor(expiresAtMs / 1000),
+        },
+      })
+    } catch (e) {
+      return err(authError.internalError("saveScratch: put failed", e))
+    }
+    return ok(undefined)
+  }
+
+  async readScratch(key: string): Promise<Result<string>> {
+    let row: Record<string, unknown> | undefined
+    try {
+      row = await this.#exec.get({
+        key: { pk: "scratch", sk: key },
+        consistentRead: true,
+      })
+    } catch (e) {
+      return err(authError.internalError("readScratch: get failed", e))
+    }
+    if (!row) {
+      return err(authError.unknownState(`scratch "${key}" unknown`))
+    }
+    // Native DynamoDB TTL eviction is best-effort (can lag up to ~48h), so
+    // filter on the adapter clock for correctness.
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await this.#exec.delete({ key: { pk: "scratch", sk: key } })
+      } catch {}
+      return err(authError.unknownState(`scratch "${key}" expired`))
+    }
+    return ok(String(row.value))
+  }
+
+  async deleteScratch(key: string): Promise<Result<void>> {
+    try {
+      await this.#exec.delete({ key: { pk: "scratch", sk: key } })
+    } catch (e) {
+      return err(authError.internalError("deleteScratch: delete failed", e))
+    }
+    return ok(undefined)
+  }
 }
 
 function parseFlowPayload(raw: unknown): FlowRecord {

package/src/adapters/memory/session-store.ts

@@ -28,6 +28,11 @@ type StoredPar = {
   expiresAt: number
 }
 
+type StoredScratch = {
+  value: string
+  expiresAt: number
+}
+
 export type MemorySessionStoreOptions = {
   clock?: Clock
 }
@@ -37,6 +42,7 @@ export class MemorySessionStore implements SessionStore {
   #flows = new Map<string, StoredFlow>()
   #sessions = new Map<string, SessionRecord>()
   #par = new Map<string, StoredPar>()
+  #scratch = new Map<string, StoredScratch>()
 
   constructor(opts: MemorySessionStoreOptions = {}) {
     this.#clock = opts.clock ?? realClock
@@ -168,4 +174,37 @@ export class MemorySessionStore implements SessionStore {
     }
     return ok(stored.record)
   }
+
+  async saveScratch(
+    key: string,
+    value: string,
+    ttlMs: number,
+  ): Promise<Result<void>> {
+    if (ttlMs <= 0) {
+      return err(
+        authError.internalError(
+          `saveScratch: ttlMs must be positive, got ${ttlMs}`,
+        ),
+      )
+    }
+    this.#scratch.set(key, { value, expiresAt: this.#clock() + ttlMs })
+    return ok(undefined)
+  }
+
+  async readScratch(key: string): Promise<Result<string>> {
+    const stored = this.#scratch.get(key)
+    if (!stored) {
+      return err(authError.unknownState(`scratch "${key}" unknown`))
+    }
+    if (this.#clock() >= stored.expiresAt) {
+      this.#scratch.delete(key)
+      return err(authError.unknownState(`scratch "${key}" expired`))
+    }
+    return ok(stored.value)
+  }
+
+  async deleteScratch(key: string): Promise<Result<void>> {
+    this.#scratch.delete(key)
+    return ok(undefined)
+  }
 }

package/src/adapters/postgres/migrations.ts

@@ -89,6 +89,12 @@ CREATE TABLE IF NOT EXISTS openauth_sessions (
   expires_at bigint NOT NULL
 );
 
+CREATE TABLE IF NOT EXISTS openauth_scratch (
+  scratch_key text PRIMARY KEY,
+  value text NOT NULL,
+  expires_at bigint NOT NULL
+);
+
 CREATE TABLE IF NOT EXISTS openauth_audit_events (
   id bigserial PRIMARY KEY,
   ts bigint NOT NULL,