@_mustachio/openauth 0.12.0 → 0.13.0

package/dist/types/types/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../src/types/error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AACjD;;;;;;GAMG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF,GACD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAI9C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAGnE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAG/C;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAID;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAWhE;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/B,CAAA;AAEL,MAAM,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAE7C,0EAA0E;AAC1E,eAAO,MAAM,SAAS;kCACU,MAAM,UAAU,MAAM,KAAG,SAAS;iCAKnC,MAAM,KAAG,SAAS;gCAKhC,MAAM,gBACL;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KACpE,SAAS;sCAKsB,MAAM,KAAG,SAAS;wCAIhB,MAAM,KAAG,SAAS;gCAI1B,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;+BAInB,MAAM,UAAU,OAAO,KAAG,SAAS;kCAKhC,MAAM,YAAY,MAAM,KAAG,SAAS;kCAMnD,MAAM,QACb;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC/C,SAAS;iCAMiB,MAAM,KAAG,SAAS;iCAIlB,MAAM,UAAU,OAAO,KAAG,SAAS;oCAMjD,MAAM,iBACJ;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAC7B,SAAS;CAKb,CAAA"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../src/types/error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AACjD;;;;;;GAMG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF,GACD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAI9C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAGnE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAG/C;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAID;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAMhE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAW7D;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/B,CAAA;AAEL,MAAM,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAE7C,0EAA0E;AAC1E,eAAO,MAAM,SAAS;kCACU,MAAM,UAAU,MAAM,KAAG,SAAS;iCAKnC,MAAM,KAAG,SAAS;gCAKhC,MAAM,gBACL;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KACpE,SAAS;sCAKsB,MAAM,KAAG,SAAS;wCAIhB,MAAM,KAAG,SAAS;gCAI1B,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;+BAInB,MAAM,UAAU,OAAO,KAAG,SAAS;kCAKhC,MAAM,YAAY,MAAM,KAAG,SAAS;kCAMnD,MAAM,QACb;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC/C,SAAS;iCAMiB,MAAM,KAAG,SAAS;4BAIvB,MAAM,cAAc,MAAM,KAAG,SAAS;iCAKjC,MAAM,UAAU,OAAO,KAAG,SAAS;oCAMjD,MAAM,iBACJ;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAC7B,SAAS;CAKb,CAAA"}

package/dist/types/types/idp.d.ts

@@ -7,6 +7,7 @@ import type { AuditLog } from "../ports/audit-log";
 import type { ConfigStore } from "../ports/config-store";
 import type { KeyStore } from "../ports/key-store";
 import type { MethodStore } from "../ports/method-store";
+import type { ScimDirectory } from "../ports/scim-directory";
 import type { SessionStore } from "../ports/session-store";
 import type { TokenStore } from "../ports/token-store";
 import type { AuthError } from "./error";
@@ -254,6 +255,17 @@ export type IdPOptions = {
     auditLog?: AuditLog;
     /** Optional — falls back to `ConfigStore` for `MethodConfig` lookups. */
     methodStore?: MethodStore;
+    /**
+     * The host's user directory, as SCIM needs to see it. Supply it to
+     * serve `/scim/v2/*`; omit it and those routes answer 501 regardless
+     * of per-tenant config.
+     *
+     * The library owns the SCIM protocol and stores no user data — every
+     * read and write goes through this port to the host's own tables. See
+     * `SCIM-AD2` in `docs/plans/claude/scim-plan.md` and
+     * `INTEGRATION.md` § SCIM.
+     */
+    scimDirectory?: ScimDirectory;
     /** Issuer URL. Function form lets multi-tenant deployments derive it per request. */
     issuerUrl: string | ((req: Request) => string);
     /**

package/dist/types/types/idp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAC3C,yDAAyD;IACzD,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,cAAc,CAAA;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAA;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,0BAA0B,CAAC,EACvB,MAAM,GACN,qBAAqB,GACrB,oBAAoB,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,sBAAsB;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,KAAK,CAAC,EAAE;QACN,yDAAyD;QACzD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAClD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACnD,CAAA;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAEjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,oCAAoC;IACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,8CAA8C;IAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9C,CAAA"}
+{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAC3C,yDAAyD;IACzD,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,cAAc,CAAA;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAA;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,0BAA0B,CAAC,EACvB,MAAM,GACN,qBAAqB,GACrB,oBAAoB,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,sBAAsB;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,KAAK,CAAC,EAAE;QACN,yDAAyD;QACzD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAClD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACnD,CAAA;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAEjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,oCAAoC;IACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,8CAA8C;IAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9C,CAAA"}

package/dist/types/types/scim.d.ts

@@ -0,0 +1,269 @@
+/**
+ * SCIM 2.0 — public types.
+ *
+ * The library is the SCIM **Service Provider** (the system being
+ * provisioned into); corporate IdPs are the SCIM clients. Inbound only —
+ * we never originate provisioning traffic. See `SCIM-AD1` in
+ * `docs/plans/claude/scim-plan.md`.
+ *
+ * These types are the whole contract between the library's protocol
+ * layer and the host's data layer. No SCIM JSON shape, path expression,
+ * or filter string reaches the host: it receives validated, normalized
+ * values and returns records. See `SCIM-AD2`.
+ *
+ * Plain TypeScript, no third-party types, no Node APIs — SCIM is JSON
+ * over HTTP, so unlike SAML this surface lives on the root entry and
+ * stays edge-clean.
+ */
+/** RFC 7643 §4.1.2 — a multi-valued attribute entry. */
+export type ScimMultiValue = {
+    value: string;
+    /** e.g. `"work"` / `"home"` / `"mobile"`. */
+    type?: string;
+    /** At most one entry per attribute should be primary. */
+    primary?: boolean;
+};
+/** RFC 7643 §4.1.1 — the `name` complex attribute. */
+export type ScimName = {
+    formatted?: string;
+    familyName?: string;
+    givenName?: string;
+    middleName?: string;
+    honorificPrefix?: string;
+    honorificSuffix?: string;
+};
+/**
+ * RFC 7643 §4.3 — the enterprise user extension
+ * (`urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`).
+ * Okta and Entra both populate parts of this; `department` and
+ * `manager` are the ones hosts usually care about.
+ */
+export type ScimEnterpriseUser = {
+    employeeNumber?: string;
+    costCenter?: string;
+    organization?: string;
+    division?: string;
+    department?: string;
+    /** `manager.value` is the manager's SCIM `id`. */
+    manager?: {
+        value?: string;
+        displayName?: string;
+    };
+};
+/**
+ * A user as the **host** stores it. Returned from every `ScimDirectory`
+ * read and write.
+ *
+ * `id` is the host's stable identifier and becomes the SCIM resource id
+ * in URLs — it must be opaque, stable, and URL-safe.
+ *
+ * `externalId` is the **IdP's** identifier for the same person. It is
+ * what reconciliation depends on in practice (a user can change
+ * `userName`; `externalId` survives), so hosts should persist and index
+ * it even though SCIM marks it optional.
+ */
+export type ScimUserRecord = {
+    id: string;
+    externalId?: string;
+    userName: string;
+    /** `false` is the normal deprovisioning signal — see `SCIM-AD8`. */
+    active: boolean;
+    name?: ScimName;
+    displayName?: string;
+    emails?: ScimMultiValue[];
+    phoneNumbers?: ScimMultiValue[];
+    enterprise?: ScimEnterpriseUser;
+    /** Unix ms. Surfaced as `meta.created` when present. */
+    createdAt?: number;
+    /** Unix ms. Surfaced as `meta.lastModified` when present. */
+    updatedAt?: number;
+};
+/**
+ * A validated create / replace payload. Same shape as a record minus
+ * the host-assigned `id` and timestamps.
+ *
+ * `active` is always present: SCIM defaults it to `true` on create, and
+ * resolving that default in the library rather than the host keeps the
+ * semantics in one place.
+ *
+ * Note there is no `password` field, deliberately — see `SCIM-AD1`
+ * non-goals. A `password` in the payload is refused, not silently
+ * dropped.
+ */
+export type ScimUserWrite = {
+    externalId?: string;
+    userName: string;
+    active: boolean;
+    name?: ScimName;
+    displayName?: string;
+    emails?: ScimMultiValue[];
+    phoneNumbers?: ScimMultiValue[];
+    enterprise?: ScimEnterpriseUser;
+};
+/**
+ * A **normalized** PATCH delta (`SCIM-AD6`).
+ *
+ * The library resolves `urn:ietf:params:scim:api:messages:2.0:PatchOp`
+ * operations — including path expressions like
+ * `emails[type eq "work"].value` and the different shapes Okta and Entra
+ * emit for the same intent — into this flat delta. The host never parses
+ * a SCIM path.
+ *
+ * Present key ⇒ set to that value. Absent key ⇒ leave untouched.
+ * `null` ⇒ the attribute was removed and should be cleared.
+ */
+export type ScimUserPatch = {
+    externalId?: string | null;
+    userName?: string;
+    active?: boolean;
+    name?: ScimName | null;
+    displayName?: string | null;
+    emails?: ScimMultiValue[] | null;
+    phoneNumbers?: ScimMultiValue[] | null;
+    enterprise?: ScimEnterpriseUser | null;
+};
+/**
+ * Attributes the filter subset may reference (`SCIM-AD3`).
+ *
+ * `emails.value` is the normalized form of the complex path Entra emits
+ * (`emails[type eq "work"].value`) — the host matches on any email
+ * value and need not model the `type` qualifier.
+ */
+export type ScimFilterAttribute = "id" | "userName" | "externalId" | "active" | "emails.value"
+/** Groups only. */
+ | "displayName";
+/**
+ * The parsed filter, as a small typed tree. The host never receives the
+ * raw filter string — parsing is the library's job, and an expression
+ * outside the supported subset is rejected with `400 invalidFilter`
+ * before the port is called.
+ */
+export type ScimFilter = {
+    op: "eq";
+    attribute: ScimFilterAttribute;
+    value: string | boolean;
+} | {
+    op: "and";
+    left: ScimFilter;
+    right: ScimFilter;
+};
+/** Input to `ScimDirectory.findUsers`. */
+export type ScimUserQuery = {
+    /** Absent ⇒ unfiltered list. */
+    filter?: ScimFilter;
+    /**
+     * **1-based**, per RFC 7644 §3.4.2.4 — not zero. Already clamped to
+     * `>= 1` by the library.
+     */
+    startIndex: number;
+    /** Page size, already clamped to the connection's configured maximum. */
+    count: number;
+};
+/**
+ * One page of results. `totalResults` is the count of everything
+ * matching the filter, not the size of `resources` — SCIM clients use it
+ * to drive pagination, so a host that returns the page size here will
+ * make Okta loop or stop early.
+ */
+export type ScimPage<T> = {
+    resources: T[];
+    totalResults: number;
+};
+/**
+ * One group membership entry. `value` is the member's SCIM `id` — for
+ * us always a User id, since we do not support nested groups.
+ */
+export type ScimGroupMember = {
+    value: string;
+    /** Human label the IdP supplied. Advisory; not authoritative. */
+    display?: string;
+};
+/** A group as the **host** stores it. */
+export type ScimGroupRecord = {
+    id: string;
+    externalId?: string;
+    displayName: string;
+    /**
+     * Omit when the caller asked for `excludedAttributes=members`, which
+     * Okta does while enumerating groups. Distinguish "not requested"
+     * (omit) from "no members" (`[]`) — returning `[]` for the former
+     * tells the client the group was emptied.
+     */
+    members?: ScimGroupMember[];
+    /** Unix ms → `meta.created`. */
+    createdAt?: number;
+    /** Unix ms → `meta.lastModified`. */
+    updatedAt?: number;
+};
+/** A validated group create / replace payload. */
+export type ScimGroupWrite = {
+    externalId?: string;
+    displayName: string;
+    /** Full membership for a create or replace. */
+    members?: ScimGroupMember[];
+};
+/**
+ * A normalized group PATCH.
+ *
+ * Membership is handled differently from every user attribute, and
+ * deliberately so (`SCIM-AD9`). For a user, the library resolves a
+ * targeted patch into the complete new value because the lists involved
+ * are small and bounded. Group membership is neither: resolving
+ * "add one member" against a 20,000-member group would mean reading all
+ * 20,000 rows and handing them back on every single change.
+ *
+ * So the client's *intent* is preserved instead. `addMembers` /
+ * `removeMembers` are incremental and let the host issue one insert or
+ * delete; `members` is a full replacement. They are mutually exclusive
+ * — the library never emits `members` alongside either incremental
+ * field, so a host can branch on which is present without ordering
+ * concerns.
+ */
+export type ScimGroupPatch = {
+    displayName?: string;
+    externalId?: string | null;
+    /** Replace the entire membership with exactly these members. */
+    members?: ScimGroupMember[];
+    /** Add these members, leaving existing ones alone. Idempotent. */
+    addMembers?: ScimGroupMember[];
+    /** Remove these member ids. Removing a non-member is not an error. */
+    removeMembers?: string[];
+};
+/** Input to `ScimDirectory.findGroups`. */
+export type ScimGroupQuery = {
+    filter?: ScimFilter;
+    /** 1-based. */
+    startIndex: number;
+    count: number;
+    /**
+     * `true` when the client sent `excludedAttributes=members`. The host
+     * may skip loading membership entirely — Okta sets this while
+     * enumerating groups, and honouring it is the difference between a
+     * cheap listing and a fan-out read per group.
+     */
+    excludeMembers: boolean;
+};
+/**
+ * Per-tenant SCIM connection config, carried on `TenantConfig.scim`.
+ *
+ * SCIM is not an `AuthMethod` — no `/authorize`, no flow, no user agent
+ * — so it is tenant-level config rather than a `MethodConfig`
+ * (`SCIM-AD5`).
+ */
+export type ScimConfig = {
+    /** `false` (or absent config) ⇒ `/scim/v2/*` responds 403 for this tenant. */
+    enabled: boolean;
+    /**
+     * Hash of the bearer token issued to the IdP, produced with
+     * `hashClientSecret` — the same treatment as
+     * `ClientConfig.secretHash`. Never store the raw token.
+     */
+    tokenHash: string;
+    /**
+     * Largest page this connection will return, whatever the client asks
+     * for. Defaults to 100; hard-capped at 500 so a hostile or
+     * misconfigured `count` cannot ask the host for an unbounded read.
+     */
+    maxPageSize?: number;
+};
+//# sourceMappingURL=scim.d.ts.map

package/dist/types/types/scim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.d.ts","sourceRoot":"","sources":["../../../src/types/scim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED,sDAAsD;AACtD,MAAM,MAAM,QAAQ,GAAG;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kDAAkD;IAClD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACnD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,YAAY,CAAC,EAAE,cAAc,EAAE,CAAA;IAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,YAAY,CAAC,EAAE,cAAc,EAAE,CAAA;IAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,MAAM,CAAC,EAAE,cAAc,EAAE,GAAG,IAAI,CAAA;IAChC,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,IAAI,CAAA;IACtC,UAAU,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACvC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B,IAAI,GACJ,UAAU,GACV,YAAY,GACZ,QAAQ,GACR,cAAc;AAChB,mBAAmB;GACjB,aAAa,CAAA;AAEjB;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACrE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAA;AAEtD,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG;IAC1B,gCAAgC;IAChC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI;IACxB,SAAS,EAAE,CAAC,EAAE,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;IAC3B,gCAAgC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;CAC5B,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,gEAAgE;IAChE,OAAO,CAAC,EAAE,eAAe,EAAE,CAAA;IAC3B,kEAAkE;IAClE,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;IAC9B,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB,CAAA;AAED,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,eAAe;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAA;CACxB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,8EAA8E;IAC9E,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA"}

package/dist/types/types/tenant.d.ts

@@ -11,6 +11,7 @@
  * providers carries only `{ tenantId, flowId, nonce, kid }`. Everything else
  * lives in the server-side `FlowRecord` (see `./flow.ts`).
  */
+import type { ScimConfig } from "./scim";
 /**
  * Branded tenant id — **opaque to the framework**.
  *
@@ -181,6 +182,15 @@ export type TenantConfig = {
     refreshTtl?: number;
     /** Override default access-token TTL (seconds). */
     accessTtl?: number;
+    /**
+     * SCIM 2.0 provisioning for this tenant. Absent or `enabled: false` ⇒
+     * `/scim/v2/*` answers 403 for this tenant.
+     *
+     * Tenant-level rather than a `MethodConfig` because SCIM is not an
+     * auth method — no `/authorize`, no flow, no user agent. See
+     * `SCIM-AD5` in `docs/plans/claude/scim-plan.md`.
+     */
+    scim?: ScimConfig;
 };
 /**
  * Per-request tenant context handed to methods and the user-supplied

package/dist/types/types/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/types/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,QAA6B,CAAA;AAExE,qFAAqF;AACrF,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8DAA8D;IAC9D,YAAY,EAAE,IAAI,CAAA;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAA;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,QAAQ,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,QAAQ,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE;QACP,GAAG,EAAE,OAAO,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,kFAAkF;IAClF,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/types/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,QAA6B,CAAA;AAExE,qFAAqF;AACrF,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8DAA8D;IAC9D,YAAY,EAAE,IAAI,CAAA;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAA;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,QAAQ,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,QAAQ,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE;QACP,GAAG,EAAE,OAAO,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,kFAAkF;IAClF,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@_mustachio/openauth",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/domain/scim/discovery.ts

@@ -0,0 +1,262 @@
+/**
+ * SCIM discovery documents — `/ServiceProviderConfig`, `/ResourceTypes`,
+ * `/Schemas`.
+ *
+ * Same advertise-only-what-we-serve invariant the SAML SP metadata
+ * endpoint holds: a capability we announce but do not implement is worse
+ * than one we never claimed, because the client will use it. So `bulk`,
+ * `sort`, `etag` and `changePassword` are all declared `false` — they
+ * are optional in RFC 7644 and deliberately out of scope
+ * (`SCIM-AD1` non-goals).
+ *
+ * `filter.supported` is `true` with a `maxResults`, which is honest: we
+ * do support filtering, on the documented subset (`SCIM-AD3`). SCIM has
+ * no way to advertise a partial filter grammar, so the narrowing is
+ * communicated where a client can actually act on it — the `400
+ * invalidFilter` response names exactly what works.
+ *
+ * Pure: no I/O.
+ */
+import {
+  SCIM_ENTERPRISE_SCHEMA,
+  SCIM_GROUP_SCHEMA,
+  SCIM_LIST_SCHEMA,
+  SCIM_USER_SCHEMA,
+} from "./resource"
+
+export function serviceProviderConfig(
+  baseUrl: string,
+  maxResults: number,
+): Record<string, unknown> {
+  return {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
+    documentationUri: "https://datatracker.ietf.org/doc/html/rfc7644",
+    patch: { supported: true },
+    bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
+    filter: { supported: true, maxResults },
+    changePassword: { supported: false },
+    sort: { supported: false },
+    etag: { supported: false },
+    authenticationSchemes: [
+      {
+        type: "oauthbearertoken",
+        name: "OAuth Bearer Token",
+        description:
+          "Authentication via the bearer token issued for this SCIM connection",
+        specUri: "https://datatracker.ietf.org/doc/html/rfc6750",
+        primary: true,
+      },
+    ],
+    meta: {
+      resourceType: "ServiceProviderConfig",
+      location: `${baseUrl}/ServiceProviderConfig`,
+    },
+  }
+}
+
+/**
+ * `groups` reflects whether the host actually implemented the Group
+ * half of `ScimDirectory`. Advertising a resource type we answer 501 for
+ * would send a client straight into a failure it was told to expect to
+ * work — the same advertise-only-what-we-serve rule the SAML SP metadata
+ * endpoint follows.
+ */
+export function resourceTypes(
+  baseUrl: string,
+  groups: boolean,
+): Record<string, unknown> {
+  const user = {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
+    id: "User",
+    name: "User",
+    endpoint: "/Users",
+    description: "User Account",
+    schema: SCIM_USER_SCHEMA,
+    schemaExtensions: [{ schema: SCIM_ENTERPRISE_SCHEMA, required: false }],
+    meta: {
+      resourceType: "ResourceType",
+      location: `${baseUrl}/ResourceTypes/User`,
+    },
+  }
+  const group = {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
+    id: "Group",
+    name: "Group",
+    endpoint: "/Groups",
+    description: "Group",
+    schema: SCIM_GROUP_SCHEMA,
+    meta: {
+      resourceType: "ResourceType",
+      location: `${baseUrl}/ResourceTypes/Group`,
+    },
+  }
+
+  const resources = groups ? [user, group] : [user]
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults: resources.length,
+    startIndex: 1,
+    itemsPerPage: resources.length,
+    Resources: resources,
+  }
+}
+
+type AttributeSpec = {
+  name: string
+  type: string
+  multiValued: boolean
+  required: boolean
+  caseExact?: boolean
+  mutability?: string
+  returned?: string
+  uniqueness?: string
+  subAttributes?: AttributeSpec[]
+}
+
+const str = (
+  name: string,
+  extra: Partial<AttributeSpec> = {},
+): AttributeSpec => ({
+  name,
+  type: "string",
+  multiValued: false,
+  required: false,
+  caseExact: false,
+  mutability: "readWrite",
+  returned: "default",
+  uniqueness: "none",
+  ...extra,
+})
+
+const multiValueSub: AttributeSpec[] = [
+  str("value"),
+  str("type"),
+  {
+    name: "primary",
+    type: "boolean",
+    multiValued: false,
+    required: false,
+    mutability: "readWrite",
+    returned: "default",
+  },
+]
+
+export function schemas(
+  baseUrl: string,
+  groups: boolean,
+): Record<string, unknown> {
+  const userSchema = {
+    id: SCIM_USER_SCHEMA,
+    name: "User",
+    description: "User Account",
+    attributes: [
+      str("userName", { required: true, uniqueness: "server" }),
+      {
+        name: "name",
+        type: "complex",
+        multiValued: false,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: [
+          str("formatted"),
+          str("familyName"),
+          str("givenName"),
+          str("middleName"),
+          str("honorificPrefix"),
+          str("honorificSuffix"),
+        ],
+      },
+      str("displayName"),
+      {
+        name: "active",
+        type: "boolean",
+        multiValued: false,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+      },
+      {
+        name: "emails",
+        type: "complex",
+        multiValued: true,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: multiValueSub,
+      },
+      {
+        name: "phoneNumbers",
+        type: "complex",
+        multiValued: true,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: multiValueSub,
+      },
+    ],
+    meta: {
+      resourceType: "Schema",
+      location: `${baseUrl}/Schemas/${SCIM_USER_SCHEMA}`,
+    },
+  }
+
+  const enterpriseSchema = {
+    id: SCIM_ENTERPRISE_SCHEMA,
+    name: "EnterpriseUser",
+    description: "Enterprise User Extension",
+    attributes: [
+      str("employeeNumber"),
+      str("costCenter"),
+      str("organization"),
+      str("division"),
+      str("department"),
+      {
+        name: "manager",
+        type: "complex",
+        multiValued: false,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: [str("value"), str("displayName")],
+      },
+    ],
+    meta: {
+      resourceType: "Schema",
+      location: `${baseUrl}/Schemas/${SCIM_ENTERPRISE_SCHEMA}`,
+    },
+  }
+
+  const groupSchema = {
+    id: SCIM_GROUP_SCHEMA,
+    name: "Group",
+    description: "Group",
+    attributes: [
+      str("displayName", { required: true }),
+      {
+        name: "members",
+        type: "complex",
+        multiValued: true,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: [str("value"), str("display"), str("type")],
+      },
+    ],
+    meta: {
+      resourceType: "Schema",
+      location: `${baseUrl}/Schemas/${SCIM_GROUP_SCHEMA}`,
+    },
+  }
+
+  const resources = groups
+    ? [userSchema, enterpriseSchema, groupSchema]
+    : [userSchema, enterpriseSchema]
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults: resources.length,
+    startIndex: 1,
+    itemsPerPage: resources.length,
+    Resources: resources,
+  }
+}