@_mustachio/openauth 0.11.0 → 0.13.0

package/dist/esm/http/schemas/token.js

@@ -46,12 +46,12 @@ var tokenRequestSchema = z.discriminatedUnion("grant_type", [
   tokenExchangeGrantSchema
 ]);
 export {
-  tokenRequestSchema,
-  tokenExchangeGrantSchema,
-  refreshTokenGrantSchema,
-  clientCredentialsGrantSchema,
-  authorizationCodeGrantSchema,
-  TOKEN_EXCHANGE_GRANT_TYPE,
+  ACCESS_TOKEN_TYPE,
   REFRESH_TOKEN_TYPE,
-  ACCESS_TOKEN_TYPE
+  TOKEN_EXCHANGE_GRANT_TYPE,
+  authorizationCodeGrantSchema,
+  clientCredentialsGrantSchema,
+  refreshTokenGrantSchema,
+  tokenExchangeGrantSchema,
+  tokenRequestSchema
 };

package/dist/esm/index.js

@@ -58,6 +58,7 @@ function createIdP(opts) {
     sessionStore: opts.sessionStore,
     keyStore: opts.keyStore,
     ...opts.methodStore ? { methodStore: opts.methodStore } : {},
+    ...opts.scimDirectory ? { scimDirectory: opts.scimDirectory } : {},
     ...auditLog ? { auditLog } : {},
     methodCache,
     stateKeys: opts.stateKeys,
@@ -65,6 +66,7 @@ function createIdP(opts) {
     ...opts.callbackHostFor ? { callbackHostFor: opts.callbackHostFor } : {},
     resolveTenant: opts.resolveTenant,
     success: opts.success,
+    ...opts.onLogout ? { onLogout: opts.onLogout } : {},
     ...opts.persistUpstreamTokens ? { persistUpstreamTokens: opts.persistUpstreamTokens } : {},
     ...opts.exchangeAudience ? { exchangeAudience: opts.exchangeAudience } : {},
     ...opts.renderPicker ? { renderPicker: opts.renderPicker } : {},
@@ -95,37 +97,37 @@ function createIdP(opts) {
   };
 }
 export {
-  yahooFactory,
-  xFactory,
-  twitchFactory,
-  spotifyFactory,
-  slackFactory,
-  revokeAllForSubject,
-  passwordMethod,
-  passkeyMethod,
-  ok,
-  oidcFactory,
-  oauth2Factory,
-  microsoftFactory,
-  m2mMethod,
-  linkedinFactory,
-  keycloakFactory,
-  jumpcloudFactory,
-  isOk,
-  isErr,
-  googleFactory,
-  githubFactory,
-  facebookFactory,
-  err,
-  discordFactory,
-  createIdP,
-  cognitoFactory,
-  codeMethod,
-  buildOidcMethod,
-  buildOauth2Method,
-  authError,
-  asTenantId,
-  argon2idHasher,
+  DEFAULT_ARGON2ID_PARAMS,
   appleFactory,
-  DEFAULT_ARGON2ID_PARAMS
+  argon2idHasher,
+  asTenantId,
+  authError,
+  buildOauth2Method,
+  buildOidcMethod,
+  codeMethod,
+  cognitoFactory,
+  createIdP,
+  discordFactory,
+  err,
+  facebookFactory,
+  githubFactory,
+  googleFactory,
+  isErr,
+  isOk,
+  jumpcloudFactory,
+  keycloakFactory,
+  linkedinFactory,
+  m2mMethod,
+  microsoftFactory,
+  oauth2Factory,
+  oidcFactory,
+  ok,
+  passkeyMethod,
+  passwordMethod,
+  revokeAllForSubject,
+  slackFactory,
+  spotifyFactory,
+  twitchFactory,
+  xFactory,
+  yahooFactory
 };

package/dist/esm/methods/oauth2-factory.js

@@ -79,6 +79,6 @@ var oidcFactory = {
   })
 };
 export {
-  oidcFactory,
-  oauth2Factory
+  oauth2Factory,
+  oidcFactory
 };

package/dist/esm/methods/password-hash.js

@@ -74,6 +74,6 @@ function parsePhc(stored) {
   }
 }
 export {
-  argon2idHasher,
-  DEFAULT_ARGON2ID_PARAMS
+  DEFAULT_ARGON2ID_PARAMS,
+  argon2idHasher
 };

package/dist/esm/methods/providers/index.js

@@ -1,17 +1,33 @@
+// src/methods/providers/index.ts
+import { googleFactory } from "./google";
+import { githubFactory } from "./github";
+import { appleFactory } from "./apple";
+import { microsoftFactory } from "./microsoft";
+import { discordFactory } from "./discord";
+import { facebookFactory } from "./facebook";
+import { linkedinFactory } from "./linkedin";
+import { slackFactory } from "./slack";
+import { spotifyFactory } from "./spotify";
+import { twitchFactory } from "./twitch";
+import { xFactory } from "./x";
+import { yahooFactory } from "./yahoo";
+import { jumpcloudFactory } from "./jumpcloud";
+import { keycloakFactory } from "./keycloak";
+import { cognitoFactory } from "./cognito";
 export {
-  yahooFactory,
-  xFactory,
-  twitchFactory,
-  spotifyFactory,
-  slackFactory,
-  microsoftFactory,
-  linkedinFactory,
-  keycloakFactory,
-  jumpcloudFactory,
-  googleFactory,
-  githubFactory,
-  facebookFactory,
-  discordFactory,
+  appleFactory,
   cognitoFactory,
-  appleFactory
+  discordFactory,
+  facebookFactory,
+  githubFactory,
+  googleFactory,
+  jumpcloudFactory,
+  keycloakFactory,
+  linkedinFactory,
+  microsoftFactory,
+  slackFactory,
+  spotifyFactory,
+  twitchFactory,
+  xFactory,
+  yahooFactory
 };

package/dist/esm/methods/saml-sp/acs.js

@@ -0,0 +1,232 @@
+// src/methods/saml-sp/acs.ts
+import xmldom from "@xmldom/xmldom";
+import { authError } from "../../types/error";
+import { mapProfile } from "./attributes";
+import { buildSamlInstance, resolveSpEntityId } from "./saml-instance";
+var { DOMParser } = xmldom;
+function parseVerifiedAssertion(profile) {
+  if (typeof profile.getAssertionXml !== "function") {
+    return {
+      failure: {
+        kind: "error",
+        error: authError.internalError("saml-sp: node-saml profile exposes no getAssertionXml(); cannot " + "perform the Recipient binding check. Refusing to authenticate.")
+      }
+    };
+  }
+  try {
+    return {
+      doc: new DOMParser().parseFromString(profile.getAssertionXml(), "text/xml")
+    };
+  } catch (e) {
+    return {
+      failure: {
+        kind: "error",
+        error: authError.internalError("saml-sp: failed to parse the verified assertion", e)
+      }
+    };
+  }
+}
+function checkRecipient(doc, acsUrl) {
+  const nodes = doc.getElementsByTagNameNS("*", "SubjectConfirmationData");
+  const recipients = [];
+  for (let i = 0;i < nodes.length; i++) {
+    const r = nodes[i]?.getAttribute("Recipient");
+    if (r)
+      recipients.push(r);
+  }
+  if (recipients.length === 0) {
+    return {
+      kind: "denied",
+      reason: "assertion has no SubjectConfirmationData/@Recipient binding it " + "to this ACS"
+    };
+  }
+  if (!recipients.includes(acsUrl)) {
+    return {
+      kind: "denied",
+      reason: "recipient mismatch: assertion not addressed to this ACS"
+    };
+  }
+  return null;
+}
+function extractReplayInfo(doc) {
+  const root = doc.documentElement;
+  const assertionId = root?.getAttribute("ID") ?? "";
+  if (!assertionId)
+    return null;
+  let earliest = null;
+  for (const tag of ["Conditions", "SubjectConfirmationData"]) {
+    const els = doc.getElementsByTagNameNS("*", tag);
+    for (let i = 0;i < els.length; i++) {
+      const v = els[i]?.getAttribute("NotOnOrAfter");
+      if (!v)
+        continue;
+      const ms = Date.parse(v);
+      if (!Number.isNaN(ms))
+        earliest = earliest === null ? ms : Math.min(earliest, ms);
+    }
+  }
+  return { assertionId, notOnOrAfterMs: earliest };
+}
+function extractAuthnStatement(doc) {
+  const out = {};
+  const stmt = doc.getElementsByTagNameNS("*", "AuthnStatement")[0];
+  if (!stmt)
+    return out;
+  const instant = stmt.getAttribute("AuthnInstant");
+  if (instant)
+    out.authnInstant = instant;
+  const sessionExpiry = stmt.getAttribute("SessionNotOnOrAfter");
+  if (sessionExpiry) {
+    const ms = Date.parse(sessionExpiry);
+    if (!Number.isNaN(ms))
+      out.sessionNotOnOrAfter = ms;
+  }
+  const ref = stmt.getElementsByTagNameNS("*", "AuthnContextClassRef")[0]?.textContent?.trim();
+  if (ref)
+    out.authnContextClassRef = ref;
+  return out;
+}
+async function consumeAssertion(ctx, methodId, config) {
+  const idpInitiated = ctx.flow === null;
+  let spEntityId;
+  let acsUrl;
+  if (idpInitiated) {
+    if (!config.idpInitiated) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: unsolicited Response reached a method with no " + "idpInitiated config")
+      };
+    }
+    if (!ctx.dispatch) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: IdP-initiated ACS dispatched without issuer context")
+      };
+    }
+    spEntityId = resolveSpEntityId(config, ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+    acsUrl = ctx.dispatch.callbackUrl;
+  } else {
+    const state = ctx.methodState;
+    if (!state || !state.spEntityId || !state.acsUrl) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: ACS reached without AuthnRequest method state " + "(spEntityId / acsUrl). The flow did not originate from this method.")
+      };
+    }
+    spEntityId = state.spEntityId;
+    acsUrl = state.acsUrl;
+  }
+  let samlResponse;
+  let relayState;
+  try {
+    const form = new URLSearchParams(await ctx.request.text());
+    samlResponse = form.get("SAMLResponse");
+    relayState = form.get("RelayState");
+  } catch {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: ACS could not read POST body")
+    };
+  }
+  if (!samlResponse) {
+    return { kind: "denied", reason: "missing SAMLResponse" };
+  }
+  let saml;
+  try {
+    saml = buildSamlInstance(config, {
+      spEntityId,
+      acsUrl,
+      scratch: ctx.methodScratch,
+      ...idpInitiated ? { idpInitiated: true } : {},
+      ...config.allowEncryptedAssertions && config.decryptionKey ? { decryptionPvk: config.decryptionKey.privateKeyPem } : {}
+    }, Date.now());
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.internalError(`saml-sp: cannot construct verifier: ${e instanceof Error ? e.message : String(e)}`, e)
+    };
+  }
+  let profile;
+  try {
+    const result = await saml.validatePostResponseAsync({
+      SAMLResponse: samlResponse,
+      ...relayState !== null ? { RelayState: relayState } : {}
+    });
+    profile = result.profile;
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    if (!config.allowEncryptedAssertions && msg.includes("No decryption key")) {
+      return {
+        kind: "denied",
+        reason: "encrypted assertion received but encrypted assertions are not " + "enabled for this SAML connection (set allowEncryptedAssertions " + "+ decryptionKey)"
+      };
+    }
+    return { kind: "denied", reason: `assertion rejected: ${msg}` };
+  }
+  if (!profile || !profile.nameID) {
+    return { kind: "denied", reason: "assertion produced no usable subject" };
+  }
+  const parsed = parseVerifiedAssertion(profile);
+  if ("failure" in parsed)
+    return parsed.failure;
+  const assertionDoc = parsed.doc;
+  const recipientFailure = checkRecipient(assertionDoc, acsUrl);
+  if (recipientFailure)
+    return recipientFailure;
+  if (idpInitiated) {
+    const replay = extractReplayInfo(assertionDoc);
+    if (!replay) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: cannot read assertion @ID for IdP-initiated replay " + "protection. Refusing to authenticate.")
+      };
+    }
+    const key = `idp-replay:${replay.assertionId}`;
+    const seen = await ctx.methodScratch.get(key);
+    if (seen.ok) {
+      return {
+        kind: "denied",
+        reason: "assertion replay detected (assertion ID already seen)"
+      };
+    }
+    const skewMs = (config.clockSkewSeconds ?? 60) * 1000;
+    const now = Date.now();
+    const horizon = replay.notOnOrAfterMs !== null ? replay.notOnOrAfterMs - now + skewMs : 10 * 60000;
+    const ttlMs = Math.min(Math.max(horizon, skewMs, 60000), 24 * 60 * 60000);
+    const recorded = await ctx.methodScratch.put(key, "1", ttlMs);
+    if (!recorded.ok) {
+      return {
+        kind: "error",
+        error: authError.internalError("saml-sp: could not record assertion ID for replay protection")
+      };
+    }
+  }
+  const authnStatement = extractAuthnStatement(assertionDoc);
+  const verified = {
+    nameID: profile.nameID,
+    nameIDFormat: profile.nameIDFormat ?? "",
+    ...profile.sessionIndex !== undefined ? { sessionIndex: profile.sessionIndex } : {},
+    ...authnStatement,
+    attributes: profile.attributes ?? {},
+    responseXml: profile.getSamlResponseXml?.() ?? ""
+  };
+  const mapped = mapProfile(verified, config.attributeMapping);
+  if ("error" in mapped) {
+    return { kind: "denied", reason: mapped.error };
+  }
+  return {
+    kind: "success",
+    providerSubject: mapped.providerSubject,
+    properties: mapped.properties,
+    ...idpInitiated && config.idpInitiated ? {
+      unsolicitedBinding: {
+        clientId: config.idpInitiated.defaultClientId,
+        redirectUri: config.idpInitiated.defaultRedirectUri,
+        scopes: config.idpInitiated.defaultScopes ?? []
+      }
+    } : {}
+  };
+}
+export {
+  consumeAssertion
+};

package/dist/esm/methods/saml-sp/attributes.js

@@ -0,0 +1,77 @@
+// src/methods/saml-sp/attributes.ts
+var NAME_ID_FORMAT_BY_URN = {
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent": "persistent",
+  "urn:oasis:names:tc:SAML:2.0:nameid-format:transient": "transient",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress": "emailAddress",
+  "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified": "unspecified"
+};
+function normalizeNameIdFormat(urn) {
+  return NAME_ID_FORMAT_BY_URN[urn] ?? "unspecified";
+}
+function scalar(v) {
+  if (typeof v === "string")
+    return v;
+  if (Array.isArray(v) && v.length > 0 && typeof v[0] === "string") {
+    return v[0];
+  }
+  return;
+}
+function multi(v) {
+  if (typeof v === "string")
+    return v;
+  if (Array.isArray(v)) {
+    const strs = v.filter((x) => typeof x === "string");
+    return strs.length > 0 ? strs : undefined;
+  }
+  return;
+}
+function resolveRef(ref, profile) {
+  if (ref.source === "nameId")
+    return profile.nameID;
+  return multi(profile.attributes[ref.name]);
+}
+function mapProfile(profile, mapping) {
+  const subjectRef = mapping.subject ?? { source: "nameId" };
+  const subjectVal = scalar(resolveRef(subjectRef, profile));
+  if (!subjectVal) {
+    return {
+      error: subjectRef.source === "nameId" ? "assertion NameID is empty; cannot derive subject" : `subject attribute "${subjectRef.name}" missing from assertion`
+    };
+  }
+  const attributes = {};
+  const put = (key, ref) => {
+    if (!ref)
+      return;
+    const v = resolveRef(ref, profile);
+    if (v !== undefined)
+      attributes[key] = v;
+  };
+  put("email", mapping.email);
+  put("name", mapping.name);
+  put("groups", mapping.groups);
+  if (mapping.emailVerified) {
+    attributes["emailVerified"] = mapping.emailVerified.value ? "true" : "false";
+  }
+  for (const [key, ref] of Object.entries(mapping.custom ?? {})) {
+    put(key, ref);
+  }
+  const authnInstant = profile.authnInstant ? Date.parse(profile.authnInstant) : Date.now();
+  return {
+    providerSubject: subjectVal,
+    properties: {
+      nameId: {
+        value: profile.nameID,
+        format: normalizeNameIdFormat(profile.nameIDFormat)
+      },
+      attributes,
+      ...profile.sessionIndex !== undefined ? { sessionIndex: profile.sessionIndex } : {},
+      authnInstant: Number.isNaN(authnInstant) ? Date.now() : authnInstant,
+      ...profile.sessionNotOnOrAfter !== undefined ? { sessionNotOnOrAfter: profile.sessionNotOnOrAfter } : {},
+      ...profile.authnContextClassRef !== undefined ? { authnContextClassRef: profile.authnContextClassRef } : {},
+      raw: { responseXml: profile.responseXml }
+    }
+  };
+}
+export {
+  mapProfile
+};

package/dist/esm/methods/saml-sp/authnrequest.js

@@ -0,0 +1,63 @@
+// src/methods/saml-sp/authnrequest.ts
+import { authError } from "../../types/error";
+import { isErr } from "../../types/result";
+import { buildSamlInstance, resolveSpEntityId } from "./saml-instance";
+async function buildAuthnRequestRedirect(ctx, methodId, config) {
+  if (!ctx.dispatch) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: dispatch missing on /authorize")
+    };
+  }
+  if (config.signAuthnRequest && !config.signingKey) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: signAuthnRequest is true but signingKey is missing " + "(config schema should have rejected this).")
+    };
+  }
+  const spEntityId = resolveSpEntityId(config, ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const acsUrl = ctx.dispatch.callbackUrl;
+  const probe = await ctx.methodScratch.put("authnrequest-scratch-probe", "1", 1000);
+  if (isErr(probe)) {
+    return {
+      kind: "error",
+      error: authError.internalError("saml-sp: the configured SessionStore adapter does not support " + "methodScratch (saveScratch/readScratch/deleteScratch), which " + "SAML SP requires for InResponseTo replay protection. Deploy " + "SAML against an adapter that implements the scratch trio.")
+    };
+  }
+  let redirectUrl;
+  try {
+    const saml = buildSamlInstance(config, {
+      spEntityId,
+      acsUrl,
+      scratch: ctx.methodScratch,
+      ...config.signAuthnRequest && config.signingKey ? {
+        signing: {
+          privateKeyPem: config.signingKey.privateKeyPem,
+          certPem: config.signingKey.certPem
+        }
+      } : {}
+    }, Date.now());
+    redirectUrl = await saml.getAuthorizeUrlAsync(ctx.dispatch.state, undefined, {});
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.internalError(`saml-sp: failed to build AuthnRequest: ${e instanceof Error ? e.message : String(e)}`, e)
+    };
+  }
+  return {
+    kind: "challenge",
+    response: new Response(null, {
+      status: 302,
+      headers: { location: redirectUrl }
+    }),
+    saveMethodState: {
+      relayState: ctx.dispatch.state,
+      issuedAt: Date.now(),
+      spEntityId,
+      acsUrl
+    }
+  };
+}
+export {
+  buildAuthnRequestRedirect
+};

package/dist/esm/methods/saml-sp/cache-provider.js

@@ -0,0 +1,33 @@
+// src/methods/saml-sp/cache-provider.ts
+import { isOk } from "../../types/result";
+var KEY_PREFIX = "saml-inresponseto:";
+function methodScratchCacheProvider(scratch, ttlMs) {
+  return {
+    async saveAsync(key, value) {
+      const createdAt = Date.now();
+      const item = { value, createdAt };
+      const r = await scratch.put(`${KEY_PREFIX}${key}`, JSON.stringify(item), ttlMs);
+      return isOk(r) ? item : null;
+    },
+    async getAsync(key) {
+      const r = await scratch.get(`${KEY_PREFIX}${key}`);
+      if (!isOk(r))
+        return null;
+      try {
+        const item = JSON.parse(r.value);
+        return item.value;
+      } catch {
+        return null;
+      }
+    },
+    async removeAsync(key) {
+      if (key === null)
+        return null;
+      const r = await scratch.delete(`${KEY_PREFIX}${key}`);
+      return isOk(r) ? key : null;
+    }
+  };
+}
+export {
+  methodScratchCacheProvider
+};

package/dist/esm/methods/saml-sp/cert-rotation.js

@@ -0,0 +1,13 @@
+// src/methods/saml-sp/cert-rotation.ts
+function selectActiveCertPems(certs, nowMs) {
+  return certs.filter((c) => {
+    if (c.notBefore !== undefined && nowMs < c.notBefore)
+      return false;
+    if (c.notAfter !== undefined && nowMs >= c.notAfter)
+      return false;
+    return true;
+  }).map((c) => c.pem);
+}
+export {
+  selectActiveCertPems
+};

package/dist/esm/methods/saml-sp/factory.js

@@ -0,0 +1,81 @@
+// src/methods/saml-sp/factory.ts
+import { z } from "zod";
+import { buildSamlSpMethod } from "./method";
+var attributeRefSchema = z.union([
+  z.object({ source: z.literal("nameId") }),
+  z.object({
+    source: z.literal("attribute"),
+    name: z.string().min(1),
+    format: z.string().optional()
+  })
+]);
+var attributeMappingSchema = z.object({
+  subject: attributeRefSchema.optional(),
+  email: attributeRefSchema.optional(),
+  emailVerified: z.object({ source: z.literal("literal"), value: z.boolean() }).optional(),
+  name: attributeRefSchema.optional(),
+  groups: attributeRefSchema.optional(),
+  custom: z.record(attributeRefSchema).optional()
+});
+var signingCertSchema = z.object({
+  pem: z.string().min(1),
+  notBefore: z.number().optional(),
+  notAfter: z.number().optional()
+});
+var idpSchema = z.object({
+  entityId: z.string().min(1),
+  ssoUrl: z.string().url(),
+  sloUrl: z.string().url().optional(),
+  nameIdFormat: z.enum(["persistent", "transient", "emailAddress", "unspecified"]).optional(),
+  signingCerts: z.array(signingCertSchema).min(1)
+});
+var idpInitiatedSchema = z.object({
+  defaultClientId: z.string().min(1),
+  defaultRedirectUri: z.string().url(),
+  defaultScopes: z.array(z.string()).optional()
+});
+var samlSpConfigSchema = z.object({
+  idp: idpSchema,
+  attributeMapping: attributeMappingSchema,
+  signAuthnRequest: z.boolean().optional(),
+  signingKey: z.object({
+    privateKeyPem: z.string().min(1),
+    certPem: z.string().min(1)
+  }).optional(),
+  allowEncryptedAssertions: z.boolean().optional(),
+  decryptionKey: z.object({
+    privateKeyPem: z.string().min(1),
+    certPem: z.string().min(1)
+  }).optional(),
+  idpInitiated: idpInitiatedSchema.optional(),
+  clockSkewSeconds: z.number().int().nonnegative().optional(),
+  spEntityId: z.string().min(1).optional(),
+  forceAuthn: z.boolean().optional(),
+  requestedAuthnContext: z.object({
+    classRefs: z.array(z.string().min(1)).min(1),
+    comparison: z.enum(["exact", "minimum", "maximum", "better"]).optional()
+  }).optional(),
+  requireSignedAssertion: z.boolean().optional(),
+  requireSignedResponse: z.boolean().optional()
+}).refine((c) => !c.signAuthnRequest || c.signingKey !== undefined, {
+  message: "signingKey is required when signAuthnRequest is true",
+  path: ["signingKey"]
+}).refine((c) => !c.allowEncryptedAssertions || c.decryptionKey !== undefined, {
+  message: "decryptionKey is required when allowEncryptedAssertions is true",
+  path: ["decryptionKey"]
+}).refine((c) => (c.requireSignedAssertion ?? true) || c.requireSignedResponse === true, {
+  message: "requireSignedAssertion may only be false when requireSignedResponse " + "is true — at least one signature is mandatory",
+  path: ["requireSignedAssertion"]
+});
+var samlSpFactory = {
+  kind: "saml-sp",
+  configSchema: samlSpConfigSchema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildSamlSpMethod(id, kind, config)
+};
+export {
+  samlSpFactory
+};

package/dist/esm/methods/saml-sp/index.js

@@ -0,0 +1,7 @@
+// src/methods/saml-sp/index.ts
+import { samlSpFactory } from "./factory";
+import { parseSamlIdpMetadata } from "./parse-idp-metadata";
+export {
+  parseSamlIdpMetadata,
+  samlSpFactory
+};