@_mustachio/openauth 0.12.0 → 0.13.0

package/dist/types/methods/saml-sp/factory.d.ts

@@ -14,7 +14,7 @@
 import { z } from "zod";
 import type { AuthMethodFactory } from "../../types/method";
 import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
-declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
+declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
     idp: z.ZodObject<{
         entityId: z.ZodString;
         ssoUrl: z.ZodString;
@@ -277,6 +277,20 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
         defaultScopes?: string[] | undefined;
     }>>;
     clockSkewSeconds: z.ZodOptional<z.ZodNumber>;
+    spEntityId: z.ZodOptional<z.ZodString>;
+    forceAuthn: z.ZodOptional<z.ZodBoolean>;
+    requestedAuthnContext: z.ZodOptional<z.ZodObject<{
+        classRefs: z.ZodArray<z.ZodString, "many">;
+        comparison: z.ZodOptional<z.ZodEnum<["exact", "minimum", "maximum", "better"]>>;
+    }, "strip", z.ZodTypeAny, {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    }, {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    }>>;
+    requireSignedAssertion: z.ZodOptional<z.ZodBoolean>;
+    requireSignedResponse: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     idp: {
         entityId: string;
@@ -330,6 +344,8 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
             source: "literal";
         } | undefined;
     };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
     idpInitiated?: {
         defaultClientId: string;
         defaultRedirectUri: string;
@@ -346,6 +362,12 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
         certPem: string;
     } | undefined;
     clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
 }, {
     idp: {
         entityId: string;
@@ -399,6 +421,8 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
             source: "literal";
         } | undefined;
     };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
     idpInitiated?: {
         defaultClientId: string;
         defaultRedirectUri: string;
@@ -415,6 +439,12 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
         certPem: string;
     } | undefined;
     clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
 }>, {
     idp: {
         entityId: string;
@@ -468,6 +498,8 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
             source: "literal";
         } | undefined;
     };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
     idpInitiated?: {
         defaultClientId: string;
         defaultRedirectUri: string;
@@ -484,6 +516,12 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
         certPem: string;
     } | undefined;
     clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
 }, {
     idp: {
         entityId: string;
@@ -537,6 +575,8 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
             source: "literal";
         } | undefined;
     };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
     idpInitiated?: {
         defaultClientId: string;
         defaultRedirectUri: string;
@@ -553,6 +593,12 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
         certPem: string;
     } | undefined;
     clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
 }>, {
     idp: {
         entityId: string;
@@ -606,6 +652,8 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
             source: "literal";
         } | undefined;
     };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
     idpInitiated?: {
         defaultClientId: string;
         defaultRedirectUri: string;
@@ -622,6 +670,12 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
         certPem: string;
     } | undefined;
     clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
 }, {
     idp: {
         entityId: string;
@@ -675,6 +729,8 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
             source: "literal";
         } | undefined;
     };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
     idpInitiated?: {
         defaultClientId: string;
         defaultRedirectUri: string;
@@ -691,6 +747,166 @@ declare const samlSpConfigSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
         certPem: string;
     } | undefined;
     clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
+}>, {
+    idp: {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    };
+    attributeMapping: {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
+    idpInitiated?: {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    } | undefined;
+    signAuthnRequest?: boolean | undefined;
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    allowEncryptedAssertions?: boolean | undefined;
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
+}, {
+    idp: {
+        entityId: string;
+        ssoUrl: string;
+        signingCerts: {
+            pem: string;
+            notBefore?: number | undefined;
+            notAfter?: number | undefined;
+        }[];
+        nameIdFormat?: "persistent" | "transient" | "emailAddress" | "unspecified" | undefined;
+        sloUrl?: string | undefined;
+    };
+    attributeMapping: {
+        subject?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        custom?: Record<string, {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        }> | undefined;
+        name?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        email?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        groups?: {
+            source: "nameId";
+        } | {
+            name: string;
+            source: "attribute";
+            format?: string | undefined;
+        } | undefined;
+        emailVerified?: {
+            value: boolean;
+            source: "literal";
+        } | undefined;
+    };
+    forceAuthn?: boolean | undefined;
+    spEntityId?: string | undefined;
+    idpInitiated?: {
+        defaultClientId: string;
+        defaultRedirectUri: string;
+        defaultScopes?: string[] | undefined;
+    } | undefined;
+    signAuthnRequest?: boolean | undefined;
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    allowEncryptedAssertions?: boolean | undefined;
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    } | undefined;
+    clockSkewSeconds?: number | undefined;
+    requestedAuthnContext?: {
+        classRefs: string[];
+        comparison?: "minimum" | "exact" | "maximum" | "better" | undefined;
+    } | undefined;
+    requireSignedAssertion?: boolean | undefined;
+    requireSignedResponse?: boolean | undefined;
 }>;
 export type SamlSpFactoryConfig = z.infer<typeof samlSpConfigSchema>;
 /**

package/dist/types/methods/saml-sp/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAGvE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AA4C1E,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCrB,CAAA;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,iBAAiB,CAC3C,gBAAgB,EAChB,WAAW,EACX,YAAY,CAUb,CAAA"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAGvE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AA4C1E,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqDrB,CAAA;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,iBAAiB,CAC3C,gBAAgB,EAChB,WAAW,EACX,YAAY,CAUb,CAAA"}

package/dist/types/methods/saml-sp/metadata.d.ts

@@ -27,6 +27,14 @@ export type SpMetadataInput = {
      * what-we-serve invariant as the signing cert.
      */
     encryptionCertPem?: string;
+    /**
+     * Whether we actually require a signed `<saml:Assertion>`
+     * (`config.requireSignedAssertion`, default `true`). Published as
+     * `WantAssertionsSigned` — same advertise-only-what-we-serve
+     * invariant as the certs: a connection relying on a signed
+     * `<Response>` instead must not claim otherwise in its metadata.
+     */
+    wantAssertionsSigned?: boolean;
 };
 /**
  * Pure SP metadata builder. Mirrors `parseSamlIdpMetadata`'s purity so

package/dist/types/methods/saml-sp/metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/metadata.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGrE,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAsBhB,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAUD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAiDjE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAgDtD"}
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/metadata.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGrE,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAqBhB,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAUD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAkDjE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAkDtD"}

package/dist/types/methods/saml-sp/parse-idp-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-idp-metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/parse-idp-metadata.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAMhD,OAAO,KAAK,EAAE,aAAa,EAAoB,MAAM,SAAS,CAAA;AA8C9D,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,GACV,MAAM,CAAC,aAAa,CAAC,CA6FvB"}
+{"version":3,"file":"parse-idp-metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/parse-idp-metadata.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAMhD,OAAO,KAAK,EAAE,aAAa,EAAoB,MAAM,SAAS,CAAA;AA8C9D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAyFvE"}

package/dist/types/methods/saml-sp/saml-instance.d.ts

@@ -76,6 +76,18 @@ export type SamlBindingContext = {
  * config doesn't churn.
  */
 export declare function deriveSpEntityId(issuerUrl: string, tenantId: string, methodId: string): string;
+/**
+ * The SP entityID this connection actually presents — the configured
+ * override if the operator set one (to adopt an entityID that already
+ * exists at the IdP), else the derived default.
+ *
+ * **Every** consumer must go through this one function: the
+ * `AuthnRequest` issuer, `AudienceRestriction` validation, SP metadata,
+ * and logout messages all have to agree, or the IdP rejects us. That
+ * shared-resolution property is what the metadata anti-drift test
+ * guards.
+ */
+export declare function resolveSpEntityId(config: SamlSpConfig, issuerUrl: string, tenantId: string, methodId: string): string;
 export declare function buildSamlInstance(config: SamlSpConfig, binding: SamlBindingContext, nowMs: number): SamlInstance;
 export {};
 //# sourceMappingURL=saml-instance.d.ts.map

package/dist/types/methods/saml-sp/saml-instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml-instance.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/saml-instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,QAAQ,MAAM,sBAAsB,CAAA;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7D,QAAA,MAAQ,IAAI,sBAAmC,CAAA;AAC/C,KAAK,YAAY,GAAG,YAAY,CAAC,OAAO,IAAI,CAAC,CAAA;AAE7C,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAK/D,CAAA;AAUD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,OAAO,EAAE,aAAa,CAAA;IACtB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,aAAa,EAAE,MAAM,CAAA;QACrB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAGR;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,GACZ,YAAY,CA6Dd"}
+{"version":3,"file":"saml-instance.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/saml-instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,QAAQ,MAAM,sBAAsB,CAAA;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7D,QAAA,MAAQ,IAAI,sBAAmC,CAAA;AAC/C,KAAK,YAAY,GAAG,YAAY,CAAC,OAAO,IAAI,CAAC,CAAA;AAE7C,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAK/D,CAAA;AAUD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,OAAO,EAAE,aAAa,CAAA;IACtB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,aAAa,EAAE,MAAM,CAAA;QACrB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAGR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAER;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,GACZ,YAAY,CA8Ed"}

package/dist/types/methods/saml-sp/slo-initiate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slo-initiate.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/slo-initiate.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOrE,OAAO,KAAK,EAEV,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAEhB,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAgItD"}
+{"version":3,"file":"slo-initiate.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/slo-initiate.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOrE,OAAO,KAAK,EAEV,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAEhB,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAmItD"}

package/dist/types/methods/saml-sp/sls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sls.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/sls.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAmB1E,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAsPtD"}
+{"version":3,"file":"sls.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/sls.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAmB1E,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAuPtD"}

package/dist/types/methods/saml-sp/types.d.ts

@@ -154,6 +154,80 @@ export type SamlSpConfig = {
     idpInitiated?: SamlIdpInitiatedConfig;
     /** Clock skew allowance for `NotBefore` / `NotOnOrAfter`. Seconds. */
     clockSkewSeconds?: number;
+    /**
+     * Override the derived SP entityID.
+     *
+     * By default the entityID is derived as
+     * `<issuerUrl>/<tenantId>/<methodId>` (SAML-AD5) — stable, no config
+     * required, and guaranteed to match what SP metadata publishes. Set
+     * this **only** to adopt an entityID that already exists at the IdP,
+     * so an existing SAML app can be migrated without the customer
+     * editing their production SSO config.
+     *
+     * The override flows through every consumer at once — `AuthnRequest`
+     * issuer, `AudienceRestriction` validation, SP metadata, and logout
+     * messages — so the anti-drift invariant holds either way. Changing
+     * it on a live connection invalidates the IdP-side trust config;
+     * treat it as an IdP-coordination event.
+     */
+    spEntityId?: string;
+    /**
+     * Set `ForceAuthn="true"` on the outbound `AuthnRequest`, asking the
+     * IdP to re-authenticate the user even if it has a live session.
+     * Default `false`.
+     *
+     * Note that this is a *request*: SAML gives the IdP no obligation to
+     * honour it, and there is no way to verify from the Response that it
+     * did. Do not treat a successful assertion as proof of fresh
+     * authentication.
+     */
+    forceAuthn?: boolean;
+    /**
+     * Request specific authentication context classes (e.g. MFA) from
+     * the IdP via `<RequestedAuthnContext>`.
+     *
+     * **Omitted ⇒ no `RequestedAuthnContext` element is sent at all**,
+     * which lets the IdP apply its own sign-on policy. That is the right
+     * default for nearly every deployment: a `RequestedAuthnContext` the
+     * IdP cannot satisfy exactly is answered with `NoAuthnContext`
+     * instead of a login, and an MFA policy at the IdP is a common way
+     * to *not* satisfy `PasswordProtectedTransport` under
+     * `Comparison="exact"`.
+     *
+     * Set it only when the IdP has told you which class refs it honours.
+     * `comparison` maps to the `Comparison` attribute and defaults to
+     * `"exact"`; `"minimum"` is usually the safer choice when requesting
+     * MFA.
+     *
+     * Requesting a context does **not** verify one was used — read
+     * `SamlSpProperties.authnContextClassRef` for what the IdP actually
+     * asserted.
+     */
+    requestedAuthnContext?: {
+        /** Full URNs, e.g. `urn:oasis:names:tc:SAML:2.0:ac:classes:MultiFactorAuthn`. */
+        classRefs: ReadonlyArray<string>;
+        comparison?: "exact" | "minimum" | "maximum" | "better";
+    };
+    /**
+     * Require the `<saml:Assertion>` itself to carry a valid XML-DSig.
+     * **Defaults to `true` and should stay that way** — the identity,
+     * conditions, and audience all live inside the assertion, so signing
+     * it is what actually binds them.
+     *
+     * Set `false` only for an IdP that signs the outer `<Response>` and
+     * nothing else, and only together with `requireSignedResponse: true`.
+     * The schema refuses to let both be off.
+     */
+    requireSignedAssertion?: boolean;
+    /**
+     * Require the outer `<samlp:Response>` to carry a valid XML-DSig.
+     * Default `false` — requiring it is stricter than the Okta / Entra
+     * default and would reject the majority of real IdPs. Enable it for
+     * an IdP that signs the Response, either as defence in depth
+     * alongside a signed assertion or (with
+     * `requireSignedAssertion: false`) as the only signature on offer.
+     */
+    requireSignedResponse?: boolean;
 };
 /**
  * Method-private state stashed in `FlowRecord.methodState` for the
@@ -197,6 +271,27 @@ export type SamlSpProperties = {
     sessionIndex?: string;
     /** Unix ms — the assertion's `AuthnInstant`. */
     authnInstant: number;
+    /**
+     * Unix ms — the `AuthnStatement/@SessionNotOnOrAfter` the IdP
+     * asserted, when it supplied one. This is the IdP's own view of when
+     * its session for this user expires.
+     *
+     * The library does **not** act on it: token and session lifetimes are
+     * host policy, and this library owns no session. Hosts that want
+     * "when their IdP session ends, ours ends" should clamp their own
+     * session/token TTL to this value in the `success` callback.
+     */
+    sessionNotOnOrAfter?: number;
+    /**
+     * The `AuthnContext/AuthnContextClassRef` the IdP actually asserted —
+     * i.e. how it says it authenticated the user. Absent when the
+     * assertion carries none.
+     *
+     * This is the value to check for step-up decisions ("was this really
+     * MFA?"). `SamlSpConfig.requestedAuthnContext` only *asks*; this is
+     * the answer, and the two can differ.
+     */
+    authnContextClassRef?: string;
     raw: {
         responseXml: string;
     };

package/dist/types/methods/saml-sp/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,WAAW,GACX,cAAc,GACd,aAAa,CAAA;AAEjB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,qEAAqE;IACrE,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAA;IACrD,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;CAC1C,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B,iEAAiE;IACjE,YAAY,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAChD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,aAAa,CAAA;IAClB,gBAAgB,EAAE,oBAAoB,CAAA;IACtC,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1D,YAAY,CAAC,EAAE,sBAAsB,CAAA;IACrC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,EAAE,gBAAgB,CAAA;KACzB,CAAA;IACD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;IAC7C,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE;QACH,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,WAAW,GACX,cAAc,GACd,aAAa,CAAA;AAEjB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,qEAAqE;IACrE,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAA;IACrD,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;CAC1C,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B,iEAAiE;IACjE,YAAY,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAChD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,aAAa,CAAA;IAClB,gBAAgB,EAAE,oBAAoB,CAAA;IACtC,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1D,YAAY,CAAC,EAAE,sBAAsB,CAAA;IACrC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qBAAqB,CAAC,EAAE;QACtB,iFAAiF;QACjF,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;QAChC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;KACxD,CAAA;IACD;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAChC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,EAAE,gBAAgB,CAAA;KACzB,CAAA;IACD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;IAC7C,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,GAAG,EAAE;QACH,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA"}

package/dist/types/ports/scim-directory.d.ts

@@ -0,0 +1,104 @@
+/**
+ * `ScimDirectory` — the host's user directory, as SCIM needs to see it.
+ *
+ * This is the boundary from `SCIM-AD2`: the library owns the SCIM
+ * protocol (routing, bearer auth, schema validation, PATCH
+ * normalization, error envelope, pagination, discovery docs) and the
+ * host owns every byte of persistence. The library stores no user data.
+ *
+ * That split is not a compromise — it is the same protocol-over-
+ * host-owned-state shape as `ConfigStore`, `MethodStore` and the
+ * `success` callback. The host's Users table is the host's.
+ *
+ * **Consistency:** read-your-writes is required. A SCIM client
+ * (notably Okta) will `GET /Users?filter=userName eq "…"` immediately
+ * after a `POST /Users` to confirm the create; an eventually-consistent
+ * read there produces duplicate users. See `ports/CONSISTENCY.md`.
+ *
+ * **Errors.** SCIM clients retry `5xx` and give up on `4xx`, so which
+ * error you return decides whether a failure is surfaced to an admin or
+ * retried forever:
+ *
+ *   - `authError.conflict(...)` → `409 uniqueness`. A collision only you
+ *     can detect, because only you store the rows.
+ *   - `authError.invalidRequest(...)` → `400 invalidValue`. A
+ *     **permanent** rejection — you understood the request and will
+ *     never accept it. Use it when `addMembers` names a user you do not
+ *     have (an IdP's group push can reference a member its user push
+ *     filtered out, or one deleted between operations), or when the data
+ *     violates a constraint you cannot satisfy.
+ *   - anything else → `500`, which the client retries. Correct for a
+ *     transient fault, and far better than reporting a success you did
+ *     not perform — but returning it for a permanent problem means the
+ *     IdP retries the same doomed request indefinitely.
+ *
+ * Your message is passed through on both `4xx` paths; it is what an IdP
+ * admin reads in the provisioning log, so make it specific.
+ */
+import type { Result } from "../types/result";
+import type { ScimGroupPatch, ScimGroupQuery, ScimGroupRecord, ScimGroupWrite, ScimPage, ScimUserPatch, ScimUserQuery, ScimUserRecord, ScimUserWrite } from "../types/scim";
+import type { TenantId } from "../types/tenant";
+export type ScimDirectory = {
+    /** `null` (not an error) when no user has that id in this tenant. */
+    getUser(tenantId: TenantId, id: string): Promise<Result<ScimUserRecord | null>>;
+    /**
+     * Query users. `query.startIndex` is 1-based and `query.count` is
+     * already clamped; `query.totalResults` in the response must be the
+     * full match count, not the page length.
+     */
+    findUsers(tenantId: TenantId, query: ScimUserQuery): Promise<Result<ScimPage<ScimUserRecord>>>;
+    /**
+     * Create a user. Return `conflict` if `userName` (or another
+     * uniqueness constraint of yours) is already taken — the library
+     * cannot check that for you.
+     */
+    createUser(tenantId: TenantId, user: ScimUserWrite): Promise<Result<ScimUserRecord>>;
+    /**
+     * Full replace (`PUT`). Attributes absent from `user` are cleared, per
+     * RFC 7644 §3.5.1 — this is a replace, not a merge. Use `patchUser`
+     * for partial updates.
+     */
+    replaceUser(tenantId: TenantId, id: string, user: ScimUserWrite): Promise<Result<ScimUserRecord>>;
+    /**
+     * Apply a normalized delta. Present key ⇒ set; absent ⇒ leave alone;
+     * `null` ⇒ clear. The library has already resolved SCIM path
+     * expressions, so no parsing is needed here.
+     *
+     * `{ active: false }` is the ordinary deprovisioning signal and is
+     * usually the single most important operation to implement correctly.
+     */
+    patchUser(tenantId: TenantId, id: string, patch: ScimUserPatch): Promise<Result<ScimUserRecord>>;
+    /**
+     * Hard delete (`DELETE`). Distinct from deactivation on purpose
+     * (`SCIM-AD8`): the library will not quietly turn a destructive
+     * request into a soft one. Hosts that do not want cascading deletes
+     * should implement this as a tombstone and say so in their runbook —
+     * but that decision is theirs to make explicitly, not the library's to
+     * make silently.
+     */
+    deleteUser(tenantId: TenantId, id: string): Promise<Result<void>>;
+    getGroup?(tenantId: TenantId, id: string): Promise<Result<ScimGroupRecord | null>>;
+    /**
+     * `query.excludeMembers` is set when the client asked for
+     * `excludedAttributes=members`. Honour it by not loading membership —
+     * Okta sets it while enumerating groups, and ignoring it turns a cheap
+     * listing into a fan-out read per group.
+     */
+    findGroups?(tenantId: TenantId, query: ScimGroupQuery): Promise<Result<ScimPage<ScimGroupRecord>>>;
+    createGroup?(tenantId: TenantId, group: ScimGroupWrite): Promise<Result<ScimGroupRecord>>;
+    /** Full replace, including membership. */
+    replaceGroup?(tenantId: TenantId, id: string, group: ScimGroupWrite): Promise<Result<ScimGroupRecord>>;
+    /**
+     * Apply a normalized group delta.
+     *
+     * Exactly one membership shape arrives at a time: `members` (replace
+     * everything) or `addMembers` / `removeMembers` (incremental). The
+     * incremental form exists so a 20,000-member group does not have to be
+     * read and rewritten to add one person — see `SCIM-AD9`. Adding an
+     * existing member or removing an absent one must succeed quietly;
+     * IdPs retry and expect idempotence.
+     */
+    patchGroup?(tenantId: TenantId, id: string, patch: ScimGroupPatch): Promise<Result<ScimGroupRecord>>;
+    deleteGroup?(tenantId: TenantId, id: string): Promise<Result<void>>;
+};
+//# sourceMappingURL=scim-directory.d.ts.map

package/dist/types/ports/scim-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-directory.d.ts","sourceRoot":"","sources":["../../../src/ports/scim-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,QAAQ,EACR,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACd,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,MAAM,MAAM,aAAa,GAAG;IAC1B,qEAAqE;IACrE,OAAO,CACL,QAAQ,EAAE,QAAQ,EAClB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,CAAA;IAEzC;;;;OAIG;IACH,SAAS,CACP,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;IAE5C;;;;OAIG;IACH,UAAU,CACR,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;IAElC;;;;OAIG;IACH,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;IAElC;;;;;;;OAOG;IACH,SAAS,CACP,QAAQ,EAAE,QAAQ,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;IAElC;;;;;;;OAOG;IACH,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IASjE,QAAQ,CAAC,CACP,QAAQ,EAAE,QAAQ,EAClB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,CAAA;IAE1C;;;;;OAKG;IACH,UAAU,CAAC,CACT,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IAE7C,WAAW,CAAC,CACV,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAA;IAEnC,0CAA0C;IAC1C,YAAY,CAAC,CACX,QAAQ,EAAE,QAAQ,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAA;IAEnC;;;;;;;;;OASG;IACH,UAAU,CAAC,CACT,QAAQ,EAAE,QAAQ,EAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAA;IAEnC,WAAW,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CACpE,CAAA"}

package/dist/types/ports/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../src/ports/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;OAKG;IACH,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;OAQG;IACH,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAErD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAExD;;;;OAIG;IACH,aAAa,CAAC,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,CACN,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,UAAU,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IAE3D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,CACV,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CACnD,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../src/ports/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;OAKG;IACH,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;OAQG;IACH,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAErD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAExD;;;;OAIG;IACH,aAAa,CAAC,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,CACN,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,UAAU,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IAE3D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9E,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CACnD,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA"}

package/dist/types/types/error.d.ts

@@ -64,6 +64,10 @@ export type AuthError = {
     code: "internal_error";
     description: string;
     cause?: unknown;
+} | {
+    code: "conflict";
+    description: string;
+    attribute?: string;
 } | {
     code: "invalid_dpop_proof";
     description: string;
@@ -93,6 +97,7 @@ export declare const authError: {
         methodKind?: string;
     }) => AuthError;
     invalidTarget: (description: string) => AuthError;
+    conflict: (description: string, attribute?: string) => AuthError;
     internalError: (description: string, cause?: unknown) => AuthError;
     invalidDpopProof: (description: string, replaySignal?: {
         jti: string;