@_mustachio/openauth 0.11.0 → 0.13.0

package/dist/types/adapters/postgres/migrations.d.ts

@@ -12,7 +12,7 @@
  * comparisons are simple integer math.
  */
 import type { PostgresExecutor } from "./executor";
-export declare const INITIAL_SCHEMA_SQL = "\nCREATE TABLE IF NOT EXISTS openauth_tenants (\n  id text PRIMARY KEY,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_methods (\n  tenant_id text NOT NULL,\n  method_id text NOT NULL,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, method_id)\n);\n\nCREATE TABLE IF NOT EXISTS openauth_signing_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  crv text,\n  public_jwk jsonb NOT NULL,\n  private_jwk jsonb NOT NULL,\n  private_jwk_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_signing_keys\n  ADD COLUMN IF NOT EXISTS private_jwk_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_encryption_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  key_material bytea NOT NULL,\n  key_material_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_encryption_keys\n  ADD COLUMN IF NOT EXISTS key_material_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_codes (\n  code text PRIMARY KEY,\n  ciphertext text NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_refresh_tokens (\n  token text PRIMARY KEY,\n  tenant_id text NOT NULL,\n  client_id text NOT NULL,\n  subject_id text NOT NULL,\n  family text NOT NULL,\n  expires_at bigint NOT NULL,\n  consumed_at bigint,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_refresh_family_idx\n  ON openauth_refresh_tokens (family);\nCREATE INDEX IF NOT EXISTS openauth_refresh_subject_idx\n  ON openauth_refresh_tokens (tenant_id, subject_id);\n\nCREATE TABLE IF NOT EXISTS openauth_flows (\n  flow_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_sessions (\n  session_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_audit_events (\n  id bigserial PRIMARY KEY,\n  ts bigint NOT NULL,\n  kind text NOT NULL,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_audit_kind_idx\n  ON openauth_audit_events (kind);\nCREATE INDEX IF NOT EXISTS openauth_audit_ts_idx\n  ON openauth_audit_events (ts);\n\nCREATE TABLE IF NOT EXISTS openauth_passkey_credentials (\n  tenant_id text NOT NULL,\n  credential_id text NOT NULL,\n  user_id text NOT NULL,\n  public_key text NOT NULL,\n  counter bigint NOT NULL DEFAULT 0,\n  transports jsonb,\n  created_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, credential_id)\n);\nCREATE INDEX IF NOT EXISTS openauth_passkey_user_idx\n  ON openauth_passkey_credentials (tenant_id, user_id);\n";
+export declare const INITIAL_SCHEMA_SQL = "\nCREATE TABLE IF NOT EXISTS openauth_tenants (\n  id text PRIMARY KEY,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_methods (\n  tenant_id text NOT NULL,\n  method_id text NOT NULL,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, method_id)\n);\n\nCREATE TABLE IF NOT EXISTS openauth_signing_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  crv text,\n  public_jwk jsonb NOT NULL,\n  private_jwk jsonb NOT NULL,\n  private_jwk_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_signing_keys\n  ADD COLUMN IF NOT EXISTS private_jwk_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_encryption_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  key_material bytea NOT NULL,\n  key_material_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_encryption_keys\n  ADD COLUMN IF NOT EXISTS key_material_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_codes (\n  code text PRIMARY KEY,\n  ciphertext text NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_refresh_tokens (\n  token text PRIMARY KEY,\n  tenant_id text NOT NULL,\n  client_id text NOT NULL,\n  subject_id text NOT NULL,\n  family text NOT NULL,\n  expires_at bigint NOT NULL,\n  consumed_at bigint,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_refresh_family_idx\n  ON openauth_refresh_tokens (family);\nCREATE INDEX IF NOT EXISTS openauth_refresh_subject_idx\n  ON openauth_refresh_tokens (tenant_id, subject_id);\n\nCREATE TABLE IF NOT EXISTS openauth_flows (\n  flow_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_sessions (\n  session_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_scratch (\n  scratch_key text PRIMARY KEY,\n  value text NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_audit_events (\n  id bigserial PRIMARY KEY,\n  ts bigint NOT NULL,\n  kind text NOT NULL,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_audit_kind_idx\n  ON openauth_audit_events (kind);\nCREATE INDEX IF NOT EXISTS openauth_audit_ts_idx\n  ON openauth_audit_events (ts);\n\nCREATE TABLE IF NOT EXISTS openauth_passkey_credentials (\n  tenant_id text NOT NULL,\n  credential_id text NOT NULL,\n  user_id text NOT NULL,\n  public_key text NOT NULL,\n  counter bigint NOT NULL DEFAULT 0,\n  transports jsonb,\n  created_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, credential_id)\n);\nCREATE INDEX IF NOT EXISTS openauth_passkey_user_idx\n  ON openauth_passkey_credentials (tenant_id, user_id);\n";
 /**
  * Apply the initial schema. Idempotent — uses `CREATE TABLE IF NOT EXISTS`.
  * Deployments using a real migration tool can apply the SQL above directly

package/dist/types/adapters/postgres/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,eAAO,MAAM,kBAAkB,mwFAmG9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CASnE"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,eAAO,MAAM,kBAAkB,+4FAyG9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CASnE"}

package/dist/types/adapters/postgres/session-store.d.ts

@@ -16,5 +16,8 @@ export declare class PostgresSessionStore implements SessionStore {
     createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
     readSession(sessionId: string): Promise<Result<SessionRecord>>;
     revokeSession(sessionId: string): Promise<Result<void>>;
+    saveScratch(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    readScratch(key: string): Promise<Result<string>>;
+    deleteScratch(key: string): Promise<Result<void>>;
 }
 //# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/postgres/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/session-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,oBAAqB,YAAW,YAAY;;gBAI3C,IAAI,EAAE,2BAA2B;IAKvC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwBlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA6BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA4BxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA6B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAW9D"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/session-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,oBAAqB,YAAW,YAAY;;gBAI3C,IAAI,EAAE,2BAA2B;IAKvC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwBlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA6BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA4BxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA6B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYvD,WAAW,CACf,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IA8BjD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAWxD"}

package/dist/types/domain/callback.d.ts

@@ -26,7 +26,7 @@ import type { AuditLog } from "../ports/audit-log";
 import type { AuthError } from "../types/error";
 import type { SetCookie, CachePolicy } from "../types/method";
 import type { Result } from "../types/result";
-import type { StateKeyRing } from "../types/tenant";
+import type { StateKeyRing, TenantContext } from "../types/tenant";
 import { MethodCache } from "./method-cache";
 export type CallbackOutput = {
     kind: "issue-code";
@@ -47,6 +47,21 @@ export type HandleCallbackInput = {
     /** The raw `Request` for the upstream provider's redirect. */
     rawRequest: Request;
     cookies: ReadonlyMap<string, string>;
+    /**
+     * Resolved tenant for this request. The SP-initiated path derives
+     * the tenant from the consumed flow and ignores this. The
+     * **IdP-initiated** path (unsolicited POST, no flow) has nothing to
+     * derive from, so it uses this — populated by the HTTP layer from
+     * the tenant middleware. Absent ⇒ IdP-initiated is not attempted.
+     */
+    tenant?: TenantContext;
+    /**
+     * Per-request issuer URL (HTTP layer). Used only by the
+     * IdP-initiated path to derive the SP entityID / ACS — the same
+     * derivation the AuthnRequest and metadata paths use, so the values
+     * cannot drift.
+     */
+    issuerUrl?: string;
 };
 export type HandleCallbackDeps = {
     configStore: ConfigStore;

package/dist/types/domain/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/domain/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAgB,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAM5C,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,mBAAmB,GAAG;IAChC,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChE,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAiG5C"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/domain/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAgB,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAM5C,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,mBAAmB,GAAG;IAChC,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChE,CAAA;AA8BD,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAsH5C"}

package/dist/types/domain/method-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-dispatch.d.ts","sourceRoot":"","sources":["../../../src/domain/method-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,YAAY,EACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAEpD,MAAM,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAEpD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAgD5D"}
+{"version":3,"file":"method-dispatch.d.ts","sourceRoot":"","sources":["../../../src/domain/method-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,YAAY,EAEb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAA;AAE9D,MAAM,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAEpD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAqD5D"}

package/dist/types/domain/method-route.d.ts

@@ -31,10 +31,12 @@ import type { KeyStore } from "../ports/key-store";
 import type { SessionStore } from "../ports/session-store";
 import type { TokenStore } from "../ports/token-store";
 import { type AuthError } from "../types/error";
-import type { CachePolicy, SetCookie } from "../types/method";
+import type { LogoutEventInput, LogoutHookResult } from "../types/idp";
+import type { AuthMethod, CachePolicy, MethodDispatchData, SetCookie } from "../types/method";
 import type { Result } from "../types/result";
 import type { TenantContext } from "../types/tenant";
 import { MethodCache } from "./method-cache";
+import { type RouteKey } from "./method-dispatch";
 export type MethodRouteOutput = {
     kind: "issue-code";
     code: string;
@@ -74,4 +76,58 @@ export type HandleMethodRouteDeps = {
     newCodeId?: () => string;
 };
 export declare function handleMethodRoute(input: HandleMethodRouteInput, deps: HandleMethodRouteDeps): Promise<Result<MethodRouteOutput, AuthError>>;
+/**
+ * Anonymous public method route — the fourth, deliberately narrow,
+ * pipeline. Used only for route keys a method explicitly lists in
+ * `AuthMethod.publicRoutes` (today: SAML SP `GET /metadata`). No flow
+ * cookie, no flow record, no `SessionStore` read: the handler is a pure
+ * function of `tenant` + `dispatch` + captured config.
+ *
+ * Security: this re-checks `publicRoutes` membership against the
+ * resolved method. The HTTP layer also checks before routing here, but
+ * a domain function guarding a no-auth path must not trust its caller —
+ * the gate is enforced here too, fail-closed.
+ *
+ * Only `challenge` (the metadata document) and `denied` are sensible
+ * outcomes; `success` from a flowless route is a programming error
+ * (there is no flow to consume into an auth code) and surfaces as an
+ * internal error rather than silently authenticating.
+ */
+export type HandlePublicMethodRouteInput = {
+    rawRequest: Request;
+    tenant: TenantContext;
+    /** Pre-resolved by the HTTP layer (it needed it to detect the public route). */
+    method: AuthMethod;
+    route: RouteKey;
+    subPath: string;
+    /** Issuer/callback context so the handler can derive stable URLs. */
+    dispatch: MethodDispatchData;
+};
+export type HandlePublicMethodRouteDeps = {
+    sessionStore: SessionStore;
+    /**
+     * Required for the upstream-logout path: when a public route returns a
+     * `challenge` carrying `logout`, the framework runs
+     * `revokeAllForSubject` for the host-named subject. Anonymous read-only
+     * public routes (`/metadata`-style) never touch this.
+     */
+    tokenStore: TokenStore;
+    clock: () => number;
+    auditLog?: AuditLog;
+    /**
+     * See `IdPOptions.onLogout`. Absent ⇒ the framework still verifies +
+     * acknowledges the logout and audits it, but revokes nothing (it
+     * cannot resolve the upstream id to a subject without the host).
+     */
+    onLogout?: (input: LogoutEventInput) => Promise<LogoutHookResult> | LogoutHookResult;
+};
+export type PublicMethodRouteOutput = {
+    kind: "challenge";
+    response: Response;
+    cache?: CachePolicy;
+} | {
+    kind: "denied";
+    reason: string;
+};
+export declare function handlePublicMethodRoute(input: HandlePublicMethodRouteInput, deps: HandlePublicMethodRouteDeps): Promise<Result<PublicMethodRouteOutput, AuthError>>;
 //# sourceMappingURL=method-route.d.ts.map

package/dist/types/domain/method-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../src/domain/method-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,KAAK,EAAgB,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAI5C,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,GAAG,MAAM,CAAA;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;CACzB,CAAA;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAgD/C"}
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../src/domain/method-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAElB,SAAS,EACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAIjE,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,GAAG,MAAM,CAAA;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;CACzB,CAAA;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAgD/C;AA6ED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,gFAAgF;IAChF,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,QAAQ,EAAE,kBAAkB,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;CAClD,CAAA;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,EACnC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC,CAsDrD"}

package/dist/types/domain/scim/discovery.d.ts

@@ -0,0 +1,11 @@
+export declare function serviceProviderConfig(baseUrl: string, maxResults: number): Record<string, unknown>;
+/**
+ * `groups` reflects whether the host actually implemented the Group
+ * half of `ScimDirectory`. Advertising a resource type we answer 501 for
+ * would send a client straight into a failure it was told to expect to
+ * work — the same advertise-only-what-we-serve rule the SAML SP metadata
+ * endpoint follows.
+ */
+export declare function resourceTypes(baseUrl: string, groups: boolean): Record<string, unknown>;
+export declare function schemas(baseUrl: string, groups: boolean): Record<string, unknown>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/types/domain/scim/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../../src/domain/scim/discovery.ts"],"names":[],"mappings":"AA0BA,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBzB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmCzB;AA0CD,wBAAgB,OAAO,CACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmHzB"}

package/dist/types/domain/scim/filter.d.ts

@@ -0,0 +1,51 @@
+/**
+ * SCIM filter parsing — the deliberately narrow subset (`SCIM-AD3`).
+ *
+ * RFC 7644 §3.4.2.2 defines a full expression language: grouping,
+ * precedence, `co`/`sw`/`ew`/`pr`/`gt`/`ge`/`lt`/`le`, complex attribute
+ * paths, `not`, and arbitrary nesting. Okta and Entra emit a sliver of
+ * it — overwhelmingly `userName eq "…"` for the existence check before a
+ * create.
+ *
+ * Implementing the rest would mean either a large parser plus a query
+ * interface no host could reasonably satisfy, or quietly returning wrong
+ * results. We support the observed subset and reject everything else
+ * with a message naming what works, so a gap is visible on day one
+ * rather than becoming silent provisioning drift.
+ *
+ * Supported:
+ *
+ *     userName eq "alice@corp.example"
+ *     externalId eq "00u1abc"
+ *     id eq "usr_123"
+ *     active eq true
+ *     emails[type eq "work"].value eq "a@b.com"   (Entra's shape)
+ *     emails.value eq "a@b.com"
+ *     <term> and <term>                           (two terms, no nesting)
+ *
+ * Pure: no I/O, no port access. Returns a `Result` so the caller renders
+ * the SCIM error envelope.
+ */
+import type { ScimFilter, ScimFilterAttribute } from "../../types/scim";
+import { type Result } from "../../types/result";
+/** What we tell a client when their filter is outside the subset. */
+export declare const SUPPORTED_FILTER_HELP: string;
+export type ScimFilterError = {
+    detail: string;
+};
+/**
+ * Which attributes each resource type may be filtered on. Filtering a
+ * Group by `userName` is nonsense, and answering it with an empty list
+ * rather than a 400 would look like "no such group" — a wrong answer
+ * dressed as a valid one.
+ */
+export declare const USER_FILTER_ATTRIBUTES: ReadonlySet<ScimFilterAttribute>;
+export declare const GROUP_FILTER_ATTRIBUTES: ReadonlySet<ScimFilterAttribute>;
+/**
+ * Parse a SCIM `filter` query parameter.
+ *
+ * Returns `ok(undefined)` for an absent or blank filter — an unfiltered
+ * list is legal and is what Okta sends when importing all users.
+ */
+export declare function parseScimFilter(raw: string | null | undefined, allowed?: ReadonlySet<ScimFilterAttribute>): Result<ScimFilter | undefined, ScimFilterError>;
+//# sourceMappingURL=filter.d.ts.map

package/dist/types/domain/scim/filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.d.ts","sourceRoot":"","sources":["../../../../src/domain/scim/filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACvE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEzD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,QAGT,CAAA;AAEzB,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAWhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,mBAAmB,CAEnE,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,mBAAmB,CACvB,CAAA;AAoH9C;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,OAAO,GAAE,WAAW,CAAC,mBAAmB,CAA0B,GACjE,MAAM,CAAC,UAAU,GAAG,SAAS,EAAE,eAAe,CAAC,CAkDjD"}

package/dist/types/domain/scim/handle.d.ts

@@ -0,0 +1,35 @@
+import type { ScimDirectory } from "../../ports/scim-directory";
+import type { TenantContext } from "../../types/tenant";
+import { SUPPORTED_FILTER_HELP } from "./filter";
+export type ScimResponse = {
+    status: number;
+    /** `null` for 204. Serialized as `application/scim+json` by the caller. */
+    body: Record<string, unknown> | null;
+    /**
+     * Extra response headers the HTTP layer should set. Used for
+     * `Location` on a create, which RFC 7644 §3.1 requires and Okta's
+     * validator checks for.
+     */
+    headers?: Record<string, string>;
+};
+export type ScimRequestInput = {
+    tenant: TenantContext;
+    /** Upper-case HTTP method. */
+    method: string;
+    /** Path **within** the SCIM mount, e.g. `"/Users/abc"`. */
+    path: string;
+    query: URLSearchParams;
+    /** Parsed JSON body, or `null` for bodiless methods / unparseable input. */
+    body: unknown;
+    /** Raw `Authorization` header value. */
+    authorization: string | null;
+    /** Absolute base URL of the SCIM mount, e.g. `https://idp.example/scim/v2`. */
+    baseUrl: string;
+    directory: ScimDirectory;
+};
+/**
+ * Handle one SCIM request end to end.
+ */
+export declare function handleScimRequest(input: ScimRequestInput): Promise<ScimResponse>;
+export { SUPPORTED_FILTER_HELP };
+//# sourceMappingURL=handle.d.ts.map

package/dist/types/domain/scim/handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle.d.ts","sourceRoot":"","sources":["../../../../src/domain/scim/handle.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAQ/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAGvD,OAAO,EAGL,qBAAqB,EAEtB,MAAM,UAAU,CAAA;AAsBjB,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,eAAe,CAAA;IACtB,4EAA4E;IAC5E,IAAI,EAAE,OAAO,CAAA;IACb,wCAAwC;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,aAAa,CAAA;CACzB,CAAA;AAibD;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,YAAY,CAAC,CA2EvB;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAA"}

package/dist/types/domain/scim/patch.d.ts

@@ -0,0 +1,73 @@
+/**
+ * SCIM PATCH normalization (`SCIM-AD6`).
+ *
+ * `PATCH /Users/:id` carries a `PatchOp` whose `Operations` are the
+ * worst-specified part of SCIM, and Okta and Entra spell the same intent
+ * differently:
+ *
+ *     Okta:   { "op": "replace", "value": { "active": false } }
+ *     Entra:  { "op": "Replace", "path": "active", "value": "False" }
+ *     Entra:  { "op": "add", "path": "emails[type eq \"work\"].value", … }
+ *
+ * All three mean one thing to the host. This module resolves every
+ * supported shape — pathless object merges, dotted sub-attribute paths,
+ * multi-valued filter paths, the enterprise-extension URN prefix, and
+ * Entra's habit of sending booleans as the strings `"True"` / `"False"`
+ * — into a flat `ScimUserPatch` of fully resolved values.
+ *
+ * Resolution is done **against the current record**, which the caller
+ * has already fetched (it needs it for 404 semantics anyway). That means
+ * a targeted operation like `emails[type eq "work"].value` becomes a
+ * complete `emails` array, so the host implements exactly one semantic:
+ * present ⇒ set to this, `null` ⇒ clear, absent ⇒ leave alone. No merge
+ * logic and no path parsing ever reaches the host.
+ *
+ * Two kinds of "we can't do that" are treated very differently:
+ *
+ *   - An attribute this Service Provider does not model at all (`title`,
+ *     `nickName`, `locale`, …) is **skipped**. There is nowhere for it to
+ *     go — `ScimUserPatch` has no field for it — so nothing drifts, and
+ *     `parseUserWrite` already ignores the same attributes on POST/PUT.
+ *     Rejecting them here would fail the whole request over an attribute
+ *     we would have discarded anyway: Okta's default profile mappings
+ *     push `title` in the *same* `PatchOp` as `active`, so a fatal
+ *     unknown-attribute error takes the deactivation down with it, and
+ *     Okta retries the identical payload forever.
+ *   - A malformed operation on an attribute we **do** model (a
+ *     non-boolean `active`, an unparseable path shape) stays an error.
+ *     That one really would drift undetected.
+ *
+ * Pure: no I/O, no port access.
+ */
+import type { ScimGroupPatch, ScimUserPatch, ScimUserRecord } from "../../types/scim";
+import { type Result } from "../../types/result";
+import { type ScimValidationError } from "./resource";
+/**
+ * Normalize a `PatchOp` body into a `ScimUserPatch`, resolved against
+ * `current`.
+ */
+export declare function normalizePatch(body: unknown, current: ScimUserRecord): Result<ScimUserPatch, ScimValidationError>;
+/**
+ * Normalize a group `PatchOp`.
+ *
+ * Membership deliberately keeps the client's intent rather than being
+ * resolved to a final list (`SCIM-AD9`): "add one member" stays an add,
+ * so a host with a 20,000-member group issues one insert instead of
+ * rewriting the whole membership.
+ *
+ * A full replace still wins when one is present — subsequent
+ * adds/removes in the same request are folded into the replacement list,
+ * so the host never receives `members` alongside `addMembers` /
+ * `removeMembers` and needs no ordering rules of its own.
+ *
+ * Shapes handled:
+ *
+ *     Okta:  {op:"add",     path:"members", value:[{value:"u1"}]}
+ *     Okta:  {op:"remove",  path:"members[value eq \"u1\"]"}
+ *     Entra: {op:"remove",  path:"members", value:[{value:"u1"}]}
+ *     both:  {op:"replace", path:"members", value:[…]}
+ *     both:  {op:"replace", path:"displayName", value:"New"}
+ *     both:  {op:"replace", value:{displayName:"New"}}
+ */
+export declare function normalizeGroupPatch(body: unknown): Result<ScimGroupPatch, ScimValidationError>;
+//# sourceMappingURL=patch.d.ts.map

package/dist/types/domain/scim/patch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch.d.ts","sourceRoot":"","sources":["../../../../src/domain/scim/patch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAEV,cAAc,EAGd,aAAa,EACb,cAAc,EACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,YAAY,CAAA;AAqbnB;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,cAAc,GACtB,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAgF5C;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,CA4L7C"}

package/dist/types/domain/scim/resource.d.ts

@@ -0,0 +1,56 @@
+/**
+ * SCIM resource shapes — validation in, serialization out, and the
+ * error envelope.
+ *
+ * RFC 7643 defines the User schema; RFC 7644 defines the message
+ * envelopes. Both are picky in ways that are easy to get subtly wrong
+ * and that Okta's validator checks, so the details here are asserted in
+ * tests rather than assumed:
+ *
+ *   - `status` in an Error is a **string**, not a number.
+ *   - `ListResponse` uses `Resources` with a capital R.
+ *   - `startIndex` is **1-based**.
+ *   - `meta.location` must be an absolute URL; Okta reads it.
+ *
+ * Pure: no I/O, no port access.
+ */
+import type { ScimGroupMember, ScimGroupRecord, ScimGroupWrite, ScimUserRecord, ScimUserWrite } from "../../types/scim";
+import { type Result } from "../../types/result";
+export declare const SCIM_USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+export declare const SCIM_GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
+export declare const SCIM_ENTERPRISE_SCHEMA = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
+export declare const SCIM_LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+export declare const SCIM_ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
+export declare const SCIM_PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+/** RFC 7644 §3.12 `scimType` values we emit. */
+export type ScimErrorType = "invalidFilter" | "invalidPath" | "invalidSyntax" | "invalidValue" | "mutability" | "noTarget" | "uniqueness" | "tooMany";
+export type ScimValidationError = {
+    status: number;
+    detail: string;
+    scimType?: ScimErrorType;
+};
+/** RFC 7644 §3.12 error envelope. */
+export declare function scimErrorBody(status: number, detail: string, scimType?: ScimErrorType): Record<string, unknown>;
+/**
+ * Validate a `POST` / `PUT` user payload into a `ScimUserWrite`.
+ *
+ * Unknown attributes are ignored rather than rejected: SCIM clients send
+ * plenty the spec allows and we do not model, and failing the whole
+ * provisioning run over an extra field would be hostile. The two
+ * exceptions are hard errors — a missing `userName`, which leaves the
+ * record unidentifiable, and `password`, which we refuse to handle at
+ * all rather than accept and drop.
+ */
+export declare function parseUserWrite(body: unknown): Result<ScimUserWrite, ScimValidationError>;
+/** Serialize a host record into a SCIM User resource. */
+export declare function serializeUser(user: ScimUserRecord, baseUrl: string): Record<string, unknown>;
+/** RFC 7644 §3.4.2 ListResponse. */
+export declare function serializeList(users: ScimUserRecord[], totalResults: number, startIndex: number, baseUrl: string): Record<string, unknown>;
+declare function parseMembers(v: unknown): ScimGroupMember[] | undefined;
+export { parseMembers };
+/** Validate a `POST` / `PUT` group payload. */
+export declare function parseGroupWrite(body: unknown): Result<ScimGroupWrite, ScimValidationError>;
+/** Serialize a host group record into a SCIM Group resource. */
+export declare function serializeGroup(group: ScimGroupRecord, baseUrl: string): Record<string, unknown>;
+export declare function serializeGroupList(groups: ScimGroupRecord[], totalResults: number, startIndex: number, baseUrl: string): Record<string, unknown>;
+//# sourceMappingURL=resource.d.ts.map

package/dist/types/domain/scim/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../../src/domain/scim/resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EACf,cAAc,EAGd,cAAc,EACd,aAAa,EACd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEzD,eAAO,MAAM,gBAAgB,+CAA+C,CAAA;AAC5E,eAAO,MAAM,iBAAiB,gDAAgD,CAAA;AAC9E,eAAO,MAAM,sBAAsB,+DAC2B,CAAA;AAC9D,eAAO,MAAM,gBAAgB,uDACyB,CAAA;AACtD,eAAO,MAAM,iBAAiB,gDAAgD,CAAA;AAC9E,eAAO,MAAM,iBAAiB,kDAAkD,CAAA;AAEhF,gDAAgD;AAChD,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,aAAa,GACb,eAAe,GACf,cAAc,GACd,YAAY,GACZ,UAAU,GACV,YAAY,GACZ,SAAS,CAAA;AAEb,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,aAAa,CAAA;CACzB,CAAA;AAED,qCAAqC;AACrC,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,aAAa,GACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAsED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAyD5C;AAKD,yDAAyD;AACzD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+BzB;AAED,oCAAoC;AACpC,wBAAgB,aAAa,CAC3B,KAAK,EAAE,cAAc,EAAE,EACvB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,iBAAS,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,eAAe,EAAE,GAAG,SAAS,CAa/D;AAED,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB,+CAA+C;AAC/C,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAuB7C;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2BzB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,eAAe,EAAE,EACzB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB"}

package/dist/types/http/context.d.ts

@@ -10,11 +10,12 @@ import type { AuditLog } from "../ports/audit-log";
 import type { ConfigStore } from "../ports/config-store";
 import type { KeyStore } from "../ports/key-store";
 import type { MethodStore } from "../ports/method-store";
+import type { ScimDirectory } from "../ports/scim-directory";
 import type { SessionStore } from "../ports/session-store";
 import type { TokenStore } from "../ports/token-store";
 import type { MethodCache } from "../domain/method-cache";
 import type { AuthError } from "../types/error";
-import type { ExchangeAudience, PersistUpstreamTokens, RegisterClient, RenderPicker, SuccessMapInput } from "../types/idp";
+import type { ExchangeAudience, LogoutEventInput, LogoutHookResult, PersistUpstreamTokens, RegisterClient, RenderPicker, SuccessMapInput } from "../types/idp";
 import type { Result } from "../types/result";
 import type { SubjectClaim } from "../types/subject";
 import type { StateKeyRing, TenantContext, TenantId, TenantRecovery } from "../types/tenant";
@@ -27,6 +28,8 @@ export type HttpDeps = {
     keyStore: KeyStore;
     methodStore?: MethodStore;
     auditLog?: AuditLog;
+    /** See `IdPOptions.scimDirectory`. Absent ⇒ `/scim/v2/*` answers 501. */
+    scimDirectory?: ScimDirectory;
     methodCache: MethodCache;
     stateKeys: StateKeyRing;
     /** Resolves the issuer URL — string or per-request function. */
@@ -35,6 +38,8 @@ export type HttpDeps = {
     callbackHostFor?: (tenantId: TenantId) => string;
     resolveTenant: (req: Request) => Promise<Result<TenantId, AuthError>>;
     success: (input: SuccessMapInput) => Promise<SubjectClaim>;
+    /** See `IdPOptions.onLogout` — upstream Single Logout host hook. */
+    onLogout?: (input: LogoutEventInput) => Promise<LogoutHookResult> | LogoutHookResult;
     persistUpstreamTokens?: PersistUpstreamTokens;
     exchangeAudience?: ExchangeAudience;
     renderPicker?: RenderPicker;

package/dist/types/http/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IACjD,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}

package/dist/types/http/cookies.d.ts

@@ -7,7 +7,7 @@
  * strip method-returned `Set-Cookie` / security / `Cache-Control` headers so
  * methods cannot bypass policy.
  */
-import type { SetCookie } from "../types/method";
+import type { CachePolicy, SetCookie } from "../types/method";
 /** Parse an incoming `Cookie:` header into a read-only map. */
 export declare function parseCookieHeader(header: string | null): Map<string, string>;
 export type CookieDefaults = {
@@ -26,6 +26,14 @@ export type CookieDefaults = {
  *   - `null` value → `Max-Age=0` to clear.
  */
 export declare function serializeSetCookie(cookie: SetCookie, defaults?: CookieDefaults): string;
+/**
+ * Serialize a `MethodResult.challenge`'s `CachePolicy` into a
+ * `Cache-Control` header value. The framework owns this header (methods
+ * cannot set it directly — see `STRIPPED_HEADERS`); a method opts into
+ * caching via the typed `cache` field and this renders it. Absent /
+ * `maxAge: 0` ⇒ `no-store` (the safe default for auth UI).
+ */
+export declare function cacheControlHeader(cache: CachePolicy | undefined): string;
 export type ApplyOptions = {
     setCookies?: SetCookie[];
     cookieDefaults?: CookieDefaults;

package/dist/types/http/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAsB5E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,QAAQ,GAAE,cAAmB,GAC5B,MAAM,CA4BR;AAgBD,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,YAAiB,GACtB,QAAQ,CA4BV"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE7D,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAsB5E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,QAAQ,GAAE,cAAmB,GAC5B,MAAM,CA4BR;AAgBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CASzE;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,YAAiB,GACtB,QAAQ,CA4BV"}

package/dist/types/http/handlers/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/callback.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA2DjD"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/callback.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAmEjD"}

package/dist/types/http/handlers/method-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/method-route.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,OAClC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAqFjD"}
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/method-route.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,OAClC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAuJjD"}

package/dist/types/http/handlers/scim.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeScimHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=scim.d.ts.map

package/dist/types/http/handlers/scim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/scim.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAwBvD,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,OAC3B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAoEjD"}

package/dist/types/http/middleware/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAY7C,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAWnD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,GACb,iBAAiB,CAAC,OAAO,CAAC,CAS5B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAkD3E"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAY7C,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAmDnD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,GACb,iBAAiB,CAAC,OAAO,CAAC,CAS5B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAwD3E"}

package/dist/types/http/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAc3B,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAmDzD"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CA2DzD"}

package/dist/types/index.d.ts

@@ -20,12 +20,14 @@ export type { AuthMethod, AuthMethodFactory, CachePolicy, ClientFn, MethodContex
 export type { AuthorizationRequest, AuthorizationState, } from "./types/authorization";
 export type { AccessTokenClaims, AddressClaim, CodePayload, IdTokenClaims, RefreshTokenPayload, ScopedProfileClaims, TokenResponse, } from "./types/token";
 export type { SubjectClaim, SubjectPayload, SubjectSchema, } from "./types/subject";
-export type { ExchangeAudience, FailureEvent, IdP, IdPOptions, PersistUpstreamTokens, RegisterClient, RegisterClientRequest, RegisterClientResponse, RenderPicker, SuccessEvent, SuccessMapInput, } from "./types/idp";
+export type { ExchangeAudience, FailureEvent, IdP, IdPOptions, LogoutEventInput, LogoutHookResult, PersistUpstreamTokens, RegisterClient, RegisterClientRequest, RegisterClientResponse, RenderPicker, SuccessEvent, SuccessMapInput, } from "./types/idp";
 export type { PickerContext, PickerMethod } from "./types/picker";
 export type { AuditEvent, AuditLog } from "./ports/audit-log";
 export type { ConfigStore } from "./ports/config-store";
 export type { EncryptionKey, KeyStore, KeyWrapper, SigningKey, } from "./ports/key-store";
 export type { MethodStore } from "./ports/method-store";
+export type { ScimDirectory } from "./ports/scim-directory";
+export type { ScimConfig, ScimEnterpriseUser, ScimGroupMember, ScimGroupPatch, ScimGroupQuery, ScimGroupRecord, ScimGroupWrite, ScimFilter, ScimFilterAttribute, ScimMultiValue, ScimName, ScimPage, ScimUserPatch, ScimUserQuery, ScimUserRecord, ScimUserWrite, } from "./types/scim";
 export type { ParRecord, SessionRecord, SessionStore, } from "./ports/session-store";
 export type { TokenStore } from "./ports/token-store";
 /**

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAqF/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAuF/C"}

package/dist/types/methods/saml-sp/acs.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function consumeAssertion(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=acs.d.ts.map

package/dist/types/methods/saml-sp/acs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acs.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/acs.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AA4K1E,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CA8NtD"}