@_mustachio/openauth 0.12.0 → 0.13.1

package/dist/esm/methods/saml-sp/sls.js

@@ -1,8 +1,15 @@
 // src/methods/saml-sp/sls.ts
 import { authError } from "../../types/error";
 import { isErr } from "../../types/result";
-import { buildSamlInstance, deriveSpEntityId } from "./saml-instance";
+import { buildSamlInstance, resolveSpEntityId } from "./saml-instance";
 var SLO_REPLAY_HORIZON_MS = 10 * 60000;
+function rawQueryString(requestUrl) {
+  const start = requestUrl.indexOf("?");
+  if (start < 0)
+    return "";
+  const fragment = requestUrl.indexOf("#", start);
+  return fragment < 0 ? requestUrl.slice(start + 1) : requestUrl.slice(start + 1, fragment);
+}
 async function consumeSls(ctx, methodId, config) {
   if (!ctx.dispatch) {
     return {
@@ -16,9 +23,9 @@ async function consumeSls(ctx, methodId, config) {
       error: authError.internalError("saml-sp: /sls reached with no idp.sloUrl configured")
     };
   }
-  const spEntityId = deriveSpEntityId(ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
+  const spEntityId = resolveSpEntityId(config, ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
   const url = new URL(ctx.request.url);
-  const originalQuery = url.search.replace(/^\?/, "");
+  const originalQuery = rawQueryString(ctx.request.url);
   let samlRequest;
   let samlResponse;
   let relayState;
@@ -150,5 +157,6 @@ async function consumeSls(ctx, methodId, config) {
   };
 }
 export {
-  consumeSls
+  consumeSls,
+  rawQueryString
 };

package/dist/esm/types/error.js

@@ -54,6 +54,11 @@ var authError = {
     code: "invalid_target",
     description
   }),
+  conflict: (description, attribute) => ({
+    code: "conflict",
+    description,
+    ...attribute !== undefined ? { attribute } : {}
+  }),
   internalError: (description, cause) => ({
     code: "internal_error",
     description,

package/dist/types/domain/scim/discovery.d.ts

@@ -0,0 +1,11 @@
+export declare function serviceProviderConfig(baseUrl: string, maxResults: number): Record<string, unknown>;
+/**
+ * `groups` reflects whether the host actually implemented the Group
+ * half of `ScimDirectory`. Advertising a resource type we answer 501 for
+ * would send a client straight into a failure it was told to expect to
+ * work — the same advertise-only-what-we-serve rule the SAML SP metadata
+ * endpoint follows.
+ */
+export declare function resourceTypes(baseUrl: string, groups: boolean): Record<string, unknown>;
+export declare function schemas(baseUrl: string, groups: boolean): Record<string, unknown>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/types/domain/scim/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../../src/domain/scim/discovery.ts"],"names":[],"mappings":"AA0BA,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBzB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmCzB;AA0CD,wBAAgB,OAAO,CACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmHzB"}

package/dist/types/domain/scim/filter.d.ts

@@ -0,0 +1,51 @@
+/**
+ * SCIM filter parsing — the deliberately narrow subset (`SCIM-AD3`).
+ *
+ * RFC 7644 §3.4.2.2 defines a full expression language: grouping,
+ * precedence, `co`/`sw`/`ew`/`pr`/`gt`/`ge`/`lt`/`le`, complex attribute
+ * paths, `not`, and arbitrary nesting. Okta and Entra emit a sliver of
+ * it — overwhelmingly `userName eq "…"` for the existence check before a
+ * create.
+ *
+ * Implementing the rest would mean either a large parser plus a query
+ * interface no host could reasonably satisfy, or quietly returning wrong
+ * results. We support the observed subset and reject everything else
+ * with a message naming what works, so a gap is visible on day one
+ * rather than becoming silent provisioning drift.
+ *
+ * Supported:
+ *
+ *     userName eq "alice@corp.example"
+ *     externalId eq "00u1abc"
+ *     id eq "usr_123"
+ *     active eq true
+ *     emails[type eq "work"].value eq "a@b.com"   (Entra's shape)
+ *     emails.value eq "a@b.com"
+ *     <term> and <term>                           (two terms, no nesting)
+ *
+ * Pure: no I/O, no port access. Returns a `Result` so the caller renders
+ * the SCIM error envelope.
+ */
+import type { ScimFilter, ScimFilterAttribute } from "../../types/scim";
+import { type Result } from "../../types/result";
+/** What we tell a client when their filter is outside the subset. */
+export declare const SUPPORTED_FILTER_HELP: string;
+export type ScimFilterError = {
+    detail: string;
+};
+/**
+ * Which attributes each resource type may be filtered on. Filtering a
+ * Group by `userName` is nonsense, and answering it with an empty list
+ * rather than a 400 would look like "no such group" — a wrong answer
+ * dressed as a valid one.
+ */
+export declare const USER_FILTER_ATTRIBUTES: ReadonlySet<ScimFilterAttribute>;
+export declare const GROUP_FILTER_ATTRIBUTES: ReadonlySet<ScimFilterAttribute>;
+/**
+ * Parse a SCIM `filter` query parameter.
+ *
+ * Returns `ok(undefined)` for an absent or blank filter — an unfiltered
+ * list is legal and is what Okta sends when importing all users.
+ */
+export declare function parseScimFilter(raw: string | null | undefined, allowed?: ReadonlySet<ScimFilterAttribute>): Result<ScimFilter | undefined, ScimFilterError>;
+//# sourceMappingURL=filter.d.ts.map

package/dist/types/domain/scim/filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.d.ts","sourceRoot":"","sources":["../../../../src/domain/scim/filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACvE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEzD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,QAGT,CAAA;AAEzB,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAWhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,mBAAmB,CAEnE,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,mBAAmB,CACvB,CAAA;AAoH9C;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,OAAO,GAAE,WAAW,CAAC,mBAAmB,CAA0B,GACjE,MAAM,CAAC,UAAU,GAAG,SAAS,EAAE,eAAe,CAAC,CAkDjD"}

package/dist/types/domain/scim/handle.d.ts

@@ -0,0 +1,35 @@
+import type { ScimDirectory } from "../../ports/scim-directory";
+import type { TenantContext } from "../../types/tenant";
+import { SUPPORTED_FILTER_HELP } from "./filter";
+export type ScimResponse = {
+    status: number;
+    /** `null` for 204. Serialized as `application/scim+json` by the caller. */
+    body: Record<string, unknown> | null;
+    /**
+     * Extra response headers the HTTP layer should set. Used for
+     * `Location` on a create, which RFC 7644 §3.1 requires and Okta's
+     * validator checks for.
+     */
+    headers?: Record<string, string>;
+};
+export type ScimRequestInput = {
+    tenant: TenantContext;
+    /** Upper-case HTTP method. */
+    method: string;
+    /** Path **within** the SCIM mount, e.g. `"/Users/abc"`. */
+    path: string;
+    query: URLSearchParams;
+    /** Parsed JSON body, or `null` for bodiless methods / unparseable input. */
+    body: unknown;
+    /** Raw `Authorization` header value. */
+    authorization: string | null;
+    /** Absolute base URL of the SCIM mount, e.g. `https://idp.example/scim/v2`. */
+    baseUrl: string;
+    directory: ScimDirectory;
+};
+/**
+ * Handle one SCIM request end to end.
+ */
+export declare function handleScimRequest(input: ScimRequestInput): Promise<ScimResponse>;
+export { SUPPORTED_FILTER_HELP };
+//# sourceMappingURL=handle.d.ts.map

package/dist/types/domain/scim/handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle.d.ts","sourceRoot":"","sources":["../../../../src/domain/scim/handle.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAQ/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAGvD,OAAO,EAGL,qBAAqB,EAEtB,MAAM,UAAU,CAAA;AAsBjB,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,eAAe,CAAA;IACtB,4EAA4E;IAC5E,IAAI,EAAE,OAAO,CAAA;IACb,wCAAwC;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,aAAa,CAAA;CACzB,CAAA;AAibD;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,YAAY,CAAC,CA2EvB;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAA"}

package/dist/types/domain/scim/patch.d.ts

@@ -0,0 +1,73 @@
+/**
+ * SCIM PATCH normalization (`SCIM-AD6`).
+ *
+ * `PATCH /Users/:id` carries a `PatchOp` whose `Operations` are the
+ * worst-specified part of SCIM, and Okta and Entra spell the same intent
+ * differently:
+ *
+ *     Okta:   { "op": "replace", "value": { "active": false } }
+ *     Entra:  { "op": "Replace", "path": "active", "value": "False" }
+ *     Entra:  { "op": "add", "path": "emails[type eq \"work\"].value", … }
+ *
+ * All three mean one thing to the host. This module resolves every
+ * supported shape — pathless object merges, dotted sub-attribute paths,
+ * multi-valued filter paths, the enterprise-extension URN prefix, and
+ * Entra's habit of sending booleans as the strings `"True"` / `"False"`
+ * — into a flat `ScimUserPatch` of fully resolved values.
+ *
+ * Resolution is done **against the current record**, which the caller
+ * has already fetched (it needs it for 404 semantics anyway). That means
+ * a targeted operation like `emails[type eq "work"].value` becomes a
+ * complete `emails` array, so the host implements exactly one semantic:
+ * present ⇒ set to this, `null` ⇒ clear, absent ⇒ leave alone. No merge
+ * logic and no path parsing ever reaches the host.
+ *
+ * Two kinds of "we can't do that" are treated very differently:
+ *
+ *   - An attribute this Service Provider does not model at all (`title`,
+ *     `nickName`, `locale`, …) is **skipped**. There is nowhere for it to
+ *     go — `ScimUserPatch` has no field for it — so nothing drifts, and
+ *     `parseUserWrite` already ignores the same attributes on POST/PUT.
+ *     Rejecting them here would fail the whole request over an attribute
+ *     we would have discarded anyway: Okta's default profile mappings
+ *     push `title` in the *same* `PatchOp` as `active`, so a fatal
+ *     unknown-attribute error takes the deactivation down with it, and
+ *     Okta retries the identical payload forever.
+ *   - A malformed operation on an attribute we **do** model (a
+ *     non-boolean `active`, an unparseable path shape) stays an error.
+ *     That one really would drift undetected.
+ *
+ * Pure: no I/O, no port access.
+ */
+import type { ScimGroupPatch, ScimUserPatch, ScimUserRecord } from "../../types/scim";
+import { type Result } from "../../types/result";
+import { type ScimValidationError } from "./resource";
+/**
+ * Normalize a `PatchOp` body into a `ScimUserPatch`, resolved against
+ * `current`.
+ */
+export declare function normalizePatch(body: unknown, current: ScimUserRecord): Result<ScimUserPatch, ScimValidationError>;
+/**
+ * Normalize a group `PatchOp`.
+ *
+ * Membership deliberately keeps the client's intent rather than being
+ * resolved to a final list (`SCIM-AD9`): "add one member" stays an add,
+ * so a host with a 20,000-member group issues one insert instead of
+ * rewriting the whole membership.
+ *
+ * A full replace still wins when one is present — subsequent
+ * adds/removes in the same request are folded into the replacement list,
+ * so the host never receives `members` alongside `addMembers` /
+ * `removeMembers` and needs no ordering rules of its own.
+ *
+ * Shapes handled:
+ *
+ *     Okta:  {op:"add",     path:"members", value:[{value:"u1"}]}
+ *     Okta:  {op:"remove",  path:"members[value eq \"u1\"]"}
+ *     Entra: {op:"remove",  path:"members", value:[{value:"u1"}]}
+ *     both:  {op:"replace", path:"members", value:[…]}
+ *     both:  {op:"replace", path:"displayName", value:"New"}
+ *     both:  {op:"replace", value:{displayName:"New"}}
+ */
+export declare function normalizeGroupPatch(body: unknown): Result<ScimGroupPatch, ScimValidationError>;
+//# sourceMappingURL=patch.d.ts.map

package/dist/types/domain/scim/patch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch.d.ts","sourceRoot":"","sources":["../../../../src/domain/scim/patch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAEV,cAAc,EAGd,aAAa,EACb,cAAc,EACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEzD,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,YAAY,CAAA;AAqbnB;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,cAAc,GACtB,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAgF5C;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,CA4L7C"}

package/dist/types/domain/scim/resource.d.ts

@@ -0,0 +1,56 @@
+/**
+ * SCIM resource shapes — validation in, serialization out, and the
+ * error envelope.
+ *
+ * RFC 7643 defines the User schema; RFC 7644 defines the message
+ * envelopes. Both are picky in ways that are easy to get subtly wrong
+ * and that Okta's validator checks, so the details here are asserted in
+ * tests rather than assumed:
+ *
+ *   - `status` in an Error is a **string**, not a number.
+ *   - `ListResponse` uses `Resources` with a capital R.
+ *   - `startIndex` is **1-based**.
+ *   - `meta.location` must be an absolute URL; Okta reads it.
+ *
+ * Pure: no I/O, no port access.
+ */
+import type { ScimGroupMember, ScimGroupRecord, ScimGroupWrite, ScimUserRecord, ScimUserWrite } from "../../types/scim";
+import { type Result } from "../../types/result";
+export declare const SCIM_USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
+export declare const SCIM_GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
+export declare const SCIM_ENTERPRISE_SCHEMA = "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";
+export declare const SCIM_LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
+export declare const SCIM_ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
+export declare const SCIM_PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
+/** RFC 7644 §3.12 `scimType` values we emit. */
+export type ScimErrorType = "invalidFilter" | "invalidPath" | "invalidSyntax" | "invalidValue" | "mutability" | "noTarget" | "uniqueness" | "tooMany";
+export type ScimValidationError = {
+    status: number;
+    detail: string;
+    scimType?: ScimErrorType;
+};
+/** RFC 7644 §3.12 error envelope. */
+export declare function scimErrorBody(status: number, detail: string, scimType?: ScimErrorType): Record<string, unknown>;
+/**
+ * Validate a `POST` / `PUT` user payload into a `ScimUserWrite`.
+ *
+ * Unknown attributes are ignored rather than rejected: SCIM clients send
+ * plenty the spec allows and we do not model, and failing the whole
+ * provisioning run over an extra field would be hostile. The two
+ * exceptions are hard errors — a missing `userName`, which leaves the
+ * record unidentifiable, and `password`, which we refuse to handle at
+ * all rather than accept and drop.
+ */
+export declare function parseUserWrite(body: unknown): Result<ScimUserWrite, ScimValidationError>;
+/** Serialize a host record into a SCIM User resource. */
+export declare function serializeUser(user: ScimUserRecord, baseUrl: string): Record<string, unknown>;
+/** RFC 7644 §3.4.2 ListResponse. */
+export declare function serializeList(users: ScimUserRecord[], totalResults: number, startIndex: number, baseUrl: string): Record<string, unknown>;
+declare function parseMembers(v: unknown): ScimGroupMember[] | undefined;
+export { parseMembers };
+/** Validate a `POST` / `PUT` group payload. */
+export declare function parseGroupWrite(body: unknown): Result<ScimGroupWrite, ScimValidationError>;
+/** Serialize a host group record into a SCIM Group resource. */
+export declare function serializeGroup(group: ScimGroupRecord, baseUrl: string): Record<string, unknown>;
+export declare function serializeGroupList(groups: ScimGroupRecord[], totalResults: number, startIndex: number, baseUrl: string): Record<string, unknown>;
+//# sourceMappingURL=resource.d.ts.map

package/dist/types/domain/scim/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../../../src/domain/scim/resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EACf,cAAc,EAGd,cAAc,EACd,aAAa,EACd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEzD,eAAO,MAAM,gBAAgB,+CAA+C,CAAA;AAC5E,eAAO,MAAM,iBAAiB,gDAAgD,CAAA;AAC9E,eAAO,MAAM,sBAAsB,+DAC2B,CAAA;AAC9D,eAAO,MAAM,gBAAgB,uDACyB,CAAA;AACtD,eAAO,MAAM,iBAAiB,gDAAgD,CAAA;AAC9E,eAAO,MAAM,iBAAiB,kDAAkD,CAAA;AAEhF,gDAAgD;AAChD,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,aAAa,GACb,eAAe,GACf,cAAc,GACd,YAAY,GACZ,UAAU,GACV,YAAY,GACZ,SAAS,CAAA;AAEb,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,aAAa,CAAA;CACzB,CAAA;AAED,qCAAqC;AACrC,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,aAAa,GACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAsED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAyD5C;AAKD,yDAAyD;AACzD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+BzB;AAED,oCAAoC;AACpC,wBAAgB,aAAa,CAC3B,KAAK,EAAE,cAAc,EAAE,EACvB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,iBAAS,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,eAAe,EAAE,GAAG,SAAS,CAa/D;AAED,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB,+CAA+C;AAC/C,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,GACZ,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAuB7C;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2BzB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,eAAe,EAAE,EACzB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB"}

package/dist/types/http/context.d.ts

@@ -10,6 +10,7 @@ import type { AuditLog } from "../ports/audit-log";
 import type { ConfigStore } from "../ports/config-store";
 import type { KeyStore } from "../ports/key-store";
 import type { MethodStore } from "../ports/method-store";
+import type { ScimDirectory } from "../ports/scim-directory";
 import type { SessionStore } from "../ports/session-store";
 import type { TokenStore } from "../ports/token-store";
 import type { MethodCache } from "../domain/method-cache";
@@ -27,6 +28,8 @@ export type HttpDeps = {
     keyStore: KeyStore;
     methodStore?: MethodStore;
     auditLog?: AuditLog;
+    /** See `IdPOptions.scimDirectory`. Absent ⇒ `/scim/v2/*` answers 501. */
+    scimDirectory?: ScimDirectory;
     methodCache: MethodCache;
     stateKeys: StateKeyRing;
     /** Resolves the issuer URL — string or per-request function. */

package/dist/types/http/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IACjD,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IACjD,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}

package/dist/types/http/handlers/method-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/method-route.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,OAClC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA0JjD"}
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/method-route.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,OAClC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAuJjD"}

package/dist/types/http/handlers/scim.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeScimHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=scim.d.ts.map

package/dist/types/http/handlers/scim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/scim.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAwBvD,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,OAC3B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAoEjD"}

package/dist/types/http/middleware/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAY7C,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAWnD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,GACb,iBAAiB,CAAC,OAAO,CAAC,CAS5B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAkD3E"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAY7C,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAmDnD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,GACb,iBAAiB,CAAC,OAAO,CAAC,CAS5B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAwD3E"}

package/dist/types/http/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAc3B,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAmDzD"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CA2DzD"}

package/dist/types/index.d.ts

@@ -26,6 +26,8 @@ export type { AuditEvent, AuditLog } from "./ports/audit-log";
 export type { ConfigStore } from "./ports/config-store";
 export type { EncryptionKey, KeyStore, KeyWrapper, SigningKey, } from "./ports/key-store";
 export type { MethodStore } from "./ports/method-store";
+export type { ScimDirectory } from "./ports/scim-directory";
+export type { ScimConfig, ScimEnterpriseUser, ScimGroupMember, ScimGroupPatch, ScimGroupQuery, ScimGroupRecord, ScimGroupWrite, ScimFilter, ScimFilterAttribute, ScimMultiValue, ScimName, ScimPage, ScimUserPatch, ScimUserQuery, ScimUserRecord, ScimUserWrite, } from "./types/scim";
 export type { ParRecord, SessionRecord, SessionStore, } from "./ports/session-store";
 export type { TokenStore } from "./ports/token-store";
 /**

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAsF/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAuF/C"}

package/dist/types/methods/saml-sp/acs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acs.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/acs.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAmI1E,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAqNtD"}
+{"version":3,"file":"acs.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/acs.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AA2K1E,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CA8NtD"}

package/dist/types/methods/saml-sp/attributes.d.ts

@@ -21,7 +21,12 @@ export type VerifiedProfile = {
     nameIDFormat: string;
     sessionIndex?: string;
     attributes: Record<string, unknown>;
+    /** `AuthnStatement/@AuthnInstant`, raw XSD dateTime. */
     authnInstant?: string;
+    /** `AuthnStatement/@SessionNotOnOrAfter`, already parsed to Unix ms. */
+    sessionNotOnOrAfter?: number;
+    /** `AuthnContext/AuthnContextClassRef` — what the IdP actually asserted. */
+    authnContextClassRef?: string;
     responseXml: string;
 };
 export type MappedSubject = {

package/dist/types/methods/saml-sp/attributes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attributes.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EACV,oBAAoB,EAGpB,gBAAgB,EACjB,MAAM,SAAS,CAAA;AAEhB,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAwCD,MAAM,MAAM,aAAa,GAAG;IAC1B,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,gBAAgB,CAAA;CAC7B,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,oBAAoB,GAC5B,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAmDnC"}
+{"version":3,"file":"attributes.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EACV,oBAAoB,EAGpB,gBAAgB,EACjB,MAAM,SAAS,CAAA;AAEhB,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wEAAwE;IACxE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAwCD,MAAM,MAAM,aAAa,GAAG;IAC1B,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,gBAAgB,CAAA;CAC7B,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,oBAAoB,GAC5B,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAuDnC"}

package/dist/types/methods/saml-sp/authnrequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authnrequest.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/authnrequest.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1E,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAyGtD"}
+{"version":3,"file":"authnrequest.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/authnrequest.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1E,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CA0GtD"}