@kindgi/api 0.1.4-rc.5 → 0.1.5-rc.0

package/dist/hitl-binding.d.ts

@@ -50,16 +50,39 @@ export interface ListApprovalsBindingInput {
     readonly status?: ApprovalStatus;
     readonly requiredRole?: ReviewerRole;
     readonly since?: Timestamp;
+    /** A bare time: approvals created before it. Milliseconds, no tie-breaker; `after` replaces it. */
     readonly cursor?: Cursor;
     /**
      * Only approvals whose `waitTokenId` is one of these: the approvals a
      * run's open waits belong to (T272). Absent: no filter.
      */
     readonly waitTokenIds?: readonly string[];
+    /**
+     * Only approvals after this one in the list's order (`createdAt` desc,
+     * then `id` desc): where a page that ended on it continues. Its
+     * `createdAt` is the binding's `exactCreatedAt` for it.
+     */
+    readonly after?: ApprovalPosition;
+}
+/**
+ * Where a page of approvals ends: an approval's `createdAt` as stored
+ * (Postgres keeps microseconds), and its id. A JS `Date` keeps
+ * milliseconds: a position built from one skips the approvals created
+ * earlier in the same millisecond.
+ */
+export interface ApprovalPosition {
+    readonly createdAt: string;
+    readonly id: ApprovalId;
 }
 export interface ListApprovalsBindingResult {
     readonly approvals: readonly Approval[];
     readonly nextCursor?: Cursor;
+    /**
+     * Each listed approval's `createdAt` as stored (microseconds), by id:
+     * with the id, the `after` that continues past it. Absent from a binding
+     * that doesn't give it; a caller then continues by `cursor`.
+     */
+    readonly exactCreatedAt?: Readonly<Record<string, string>>;
 }
 export interface SubmitReviewBindingInput {
     readonly tenantId: TenantId;

package/dist/hitl-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hitl-binding.d.ts","sourceRoot":"","sources":["../src/hitl-binding.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,UAAU,EACV,MAAM,EACN,SAAS,EACT,SAAS,EACT,YAAY,EACZ,MAAM,EACN,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACV,MAAM,eAAe,CAAC;AAIvB,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,UAAU,GACV,WAAW,GACX,UAAU,GACV,UAAU,GACV,WAAW,GACX,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAEhF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,sBAAsB,EAAE,YAAY,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAID,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,GAC7F;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,YAAY,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAID;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE/C,aAAa,CACX,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,MAAM,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEjE,YAAY,CACV,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,kBAAkB,CAChB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,oBAAoB,GAAG,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;CACnE"}
+{"version":3,"file":"hitl-binding.d.ts","sourceRoot":"","sources":["../src/hitl-binding.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,UAAU,EACV,MAAM,EACN,SAAS,EACT,SAAS,EACT,YAAY,EACZ,MAAM,EACN,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACV,MAAM,eAAe,CAAC;AAIvB,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,UAAU,GACV,WAAW,GACX,UAAU,GACV,UAAU,GACV,WAAW,GACX,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAEhF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,sBAAsB,EAAE,YAAY,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAID,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,mGAAmG;IACnG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,GAC7F;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,YAAY,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAID;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE/C,aAAa,CACX,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,MAAM,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEjE,YAAY,CACV,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,kBAAkB,CAChB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,oBAAoB,GAAG,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;CACnE"}

package/dist/identity-directory-binding.d.ts

@@ -9,16 +9,16 @@ import type { Cursor, TenantId, Timestamp, UserId } from '@kindgi/types';
  * tenant" / "show me a user's profile" / "revoke all a user's active
  * sessions" question this binding covers.
  *
- * Registry-only over HTTP — the framework does NOT own user
- * persistence. Deployments plug in an LDAP / SCIM / IdP-mirror /
- * bespoke store behind this binding.
+ * The framework does NOT own user persistence. Deployments plug in an
+ * LDAP / SCIM / IdP-mirror / bespoke store behind this binding.
  *
  * Same caller-plugged pattern as every other admin-plane binding
  * (`PolicyRegistryBinding`, `ProviderRegistryBinding`, ...).
  *
  * The directory is flat. Groups / roles / RBAC / invitations /
  * audit history / LDAP+SCIM sync / impersonation are not part of this
- * binding.
+ * binding. Adding a person (`createUser`) is optional: a directory that
+ * mirrors an identity provider leaves it out.
  */
 export interface IdentityDirectoryBinding {
     /**
@@ -26,6 +26,14 @@ export interface IdentityDirectoryBinding {
      * the route surfaces `null` as `404 identity-user-not-found`.
      */
     getUser(input: IdentityGetUserInput): Promise<UserRecord | null>;
+    /**
+     * Optional. The person still in the tenant whose `primaryEmail` is
+     * `email`, compared as the directory compares emails when it adds a
+     * person (case-insensitively, for the runtime's); `null` when none.
+     * When present, `POST /v1/projects/{projectId}/memberships` takes an
+     * `email` as well as a `userId`.
+     */
+    findUserByEmail?(input: IdentityFindUserByEmailInput): Promise<UserRecord | null>;
     /**
      * Cursor-paginated list of users in the tenant. Optional `query`
      * is a prefix match on `displayName` — the natural filter shape
@@ -51,17 +59,83 @@ export interface IdentityDirectoryBinding {
      * delegate to `SessionStoreBinding.revokeAllForUser`.
      */
     revokeAllSessions(input: IdentityRevokeSessionsInput): Promise<RevokeSessionsResult>;
+    /**
+     * Optional. Add a person to the tenant as a tenant member, written to
+     * the authorization store before it returns: they can read the
+     * tenant's settings, not its projects. A tenant admin then gives them a
+     * role and mints their first API key. When present,
+     * `POST /v1/identity/users` mounts (tenant admins only). An email
+     * another person of the tenant has is refused.
+     */
+    createUser?(input: IdentityCreateUserInput): Promise<IdentityCreateUserResult>;
+    /**
+     * Optional. Unregister a person (remove them from the tenant), in one
+     * step: they're marked unregistered (their record stays, with
+     * `unregisteredAt`, so their history still says who they were), every
+     * API key and session of theirs is revoked, and every grant and
+     * membership they hold is taken from the authorization store, all before
+     * it returns. Their email is then free: adding it again makes a new
+     * person. Unregistering someone already unregistered changes nothing.
+     * Refused for yourself, the deployment's seed user, and the tenant's
+     * only tenant admin. When present,
+     * `POST /v1/identity/users/{userId}/unregister` mounts (tenant admins
+     * only).
+     */
+    unregisterUser?(input: IdentityUnregisterUserInput): Promise<IdentityUnregisterUserResult>;
 }
+export interface IdentityUnregisterUserInput {
+    readonly tenantId: TenantId;
+    readonly userId: UserId;
+    /** Who unregisters them: `user:<id>` or `service_account:<id>`. */
+    readonly unregisteredBy?: string;
+}
+/** Why a person can't be unregistered. */
+export type IdentityUnregisterUserRefusal = 'yourself' | 'seed-user' | 'last-tenant-admin';
+export type IdentityUnregisterUserResult = {
+    readonly kind: 'unregistered';
+    /** The person, with `unregisteredAt`. */
+    readonly user: UserRecord;
+    /** What unregistering took away (each 0 when they were already unregistered). */
+    readonly keysRevoked: number;
+    readonly sessionsRevoked: number;
+    readonly grantsRemoved: number;
+} | {
+    readonly kind: 'not-found';
+} | {
+    readonly kind: 'refused';
+    readonly reason: IdentityUnregisterUserRefusal;
+    readonly message: string;
+};
+export interface IdentityCreateUserInput {
+    readonly tenantId: TenantId;
+    readonly displayName: string;
+    readonly primaryEmail?: string;
+    /** Who added them: `user:<id>` or `service_account:<id>`. */
+    readonly createdBy?: string;
+}
+export type IdentityCreateUserResult = {
+    readonly kind: 'created';
+    readonly user: UserRecord;
+} | {
+    readonly kind: 'email-taken';
+    readonly userId: UserId;
+};
 export interface IdentityGetUserInput {
     readonly tenantId: TenantId;
     readonly userId: UserId;
 }
+export interface IdentityFindUserByEmailInput {
+    readonly tenantId: TenantId;
+    readonly email: string;
+}
 export interface IdentityListUsersInput {
     readonly tenantId: TenantId;
     readonly limit: number;
     readonly cursor?: Cursor;
     /** Prefix match on `UserRecord.displayName`. Undefined = no filter. */
     readonly query?: string;
+    /** Unregistered people too (`unregisteredAt` set). Default: only the people still here. */
+    readonly includeUnregistered?: boolean;
 }
 export interface IdentityListSessionsInput {
     readonly tenantId: TenantId;
@@ -70,6 +144,8 @@ export interface IdentityListSessionsInput {
 export interface IdentityRevokeSessionsInput {
     readonly tenantId: TenantId;
     readonly userId: UserId;
+    /** Who asked (`user:<id>`, `service_account:<id>`), for the audit trail. */
+    readonly revokedBy?: string;
 }
 /**
  * The tenant-scoped user record on the wire. `primaryEmail` may be
@@ -85,6 +161,8 @@ export interface UserRecord {
     readonly displayName?: string;
     readonly createdAt: Timestamp;
     readonly lastActiveAt?: Timestamp;
+    /** When they were removed from the tenant (`unregisterUser`); absent while they're here. */
+    readonly unregisteredAt?: Timestamp;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface UserCollectionPage {

package/dist/identity-directory-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-directory-binding.d.ts","sourceRoot":"","sources":["../src/identity-directory-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjE;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtE;;;;;;;;;OASG;IACH,YAAY,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5E;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}
+{"version":3,"file":"identity-directory-binding.d.ts","sourceRoot":"","sources":["../src/identity-directory-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjE;;;;;;OAMG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAClF;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtE;;;;;;;;;OASG;IACH,YAAY,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5E;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrF;;;;;;;OAOG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC/E;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;CAC5F;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,0CAA0C;AAC1C,MAAM,MAAM,6BAA6B,GAAG,UAAU,GAAG,WAAW,GAAG,mBAAmB,CAAC;AAE3F,MAAM,MAAM,4BAA4B,GACpC;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC;IAClC,4FAA4F;IAC5F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}

package/dist/identity-provider-binding.d.ts

@@ -1,32 +1,200 @@
 import type { TenantId } from '@kindgi/types';
 /**
- * Caller-plugged catalog of OAuth 2.0 / OIDC identity providers the
- * deployment offers to its tenants. Same pattern as
- * `ProviderRegistryBinding` (model providers) — the API package does
- * NOT own provider persistence, and secrets never cross the wire.
+ * Caller-plugged catalog of the identity providers a tenant signs in
+ * with: OIDC and SAML identity providers (sign-in), and plain OAuth 2.0
+ * providers. Same pattern as `ProviderRegistryBinding` (model providers):
+ * the API package does NOT own provider persistence, and secrets never
+ * cross the wire.
  *
- * A `ProviderConfig` carries ONLY a `clientSecretRef` — an opaque
- * pointer that the deployment resolves server-side (env-var lookup,
- * secrets-manager path, KMS handle, etc.). The plaintext client secret
- * is exchanged with the identity provider inside the deployment's
- * boundary during the code→token exchange in `/v1/auth/callback` and
- * never surfaces on any HTTP response.
+ * A provider carries only REFERENCES to its secrets (`clientSecretRef`,
+ * `spSigningKeyRef`, `spDecryptionKeyRef`): opaque pointers the deployment
+ * resolves server-side (env-var lookup, secrets-manager path, KMS handle,
+ * etc.). The secrets themselves are used inside the deployment's boundary
+ * and never surface on any HTTP response.
  *
- * PKCE is mandatory (S256). Providers that don't support PKCE are
- * rejected at boot; the framework does NOT emit `code_challenge_method`
- * negotiation.
+ * PKCE is mandatory (S256) for the OAuth flows.
  */
 export interface IdentityProviderBinding {
     list(input: IdentityProviderListInput): Promise<IdentityProviderPage>;
     get(input: IdentityProviderGetInput): Promise<ProviderConfig | null>;
     register(input: IdentityProviderRegisterInput): Promise<IdentityProviderRegisterOutcome>;
     unregister(input: IdentityProviderUnregisterInput): Promise<IdentityProviderUnregisterOutcome>;
+    /**
+     * The ways a person can sign in, before anyone is signed in
+     * (`GET /v1/auth/sign-in-options`, unauthenticated). Answer by the email
+     * DOMAIN only, never by whether a person exists:
+     * - with `emailDomain`: the providers whose `domains` include it, from
+     *   the one tenant the domain is verified for (the deployment decides
+     *   how: e.g. the only tenant it serves, or one its operator named);
+     *   none when the domain isn't verified for any tenant;
+     * - without: the route doesn't ask. Sign-in is email first, so nothing
+     *   is offered before an email.
+     * Absent → the route answers an empty list.
+     */
+    readonly signInOptions?: (input: SignInOptionsInput) => Promise<readonly SignInOption[]>;
+    /**
+     * What to give the identity provider so it can send people back
+     * (`signIn`), for a provider registered now or later under this
+     * `providerId`: the same before registration, after it, and after an
+     * unregister and a new registration, so an admin can set up the
+     * identity provider's side first. `undefined` when this deployment
+     * doesn't sign in with that `kind`.
+     * Absent → `GET /v1/auth/providers/:providerId/sign-in` isn't mounted.
+     */
+    readonly signInUrls?: (input: IdentityProviderSignInUrlsInput) => Promise<ProviderSignIn | undefined>;
+    /**
+     * Replace a registered provider's configuration, keeping its `signIn`
+     * (the identity provider's side doesn't change). Validated as a new
+     * registration is.
+     * Absent → `PATCH /v1/auth/providers/:providerId` isn't mounted.
+     */
+    readonly update?: (input: IdentityProviderUpdateInput) => Promise<IdentityProviderUpdateOutcome>;
+}
+export interface IdentityProviderSignInUrlsInput {
+    readonly tenantId: TenantId;
+    readonly providerId: string;
+    readonly kind: IdentityProviderKind;
+}
+export interface IdentityProviderUpdateInput {
+    readonly tenantId: TenantId;
+    /** The whole new configuration (the route merges the changes in). */
+    readonly config: ProviderConfig;
+}
+export type IdentityProviderUpdateOutcome = {
+    readonly kind: 'ok';
+    readonly provider: ProviderConfig;
+} | {
+    /** As on registration: 422 `identity-provider-invalid`, with `message`. */
+    readonly kind: 'invalid';
+    readonly message: string;
+} | {
+    readonly kind: 'not-found';
+};
+export interface SignInOptionsInput {
+    /** Lowercase, from the email the person typed. */
+    readonly emailDomain?: string;
 }
-export type IdentityProviderKind = 'oauth2' | 'oidc';
-export interface ProviderConfig {
-    /** Stable string chosen by the deployment (e.g. `acme-sso`, `globex-oidc`). */
+/** One way to sign in, as a sign-in page shows it. */
+export interface SignInOption {
+    readonly providerId: string;
+    /** "Sign in with …". */
+    readonly displayName: string;
+    /** Where the browser goes to start signing in with this provider. */
+    readonly signInUrl: string;
+    /**
+     * Whose it is: a workspace's own identity provider (`tenant`), or one
+     * the deployment offers everyone it has added ("Continue with Google",
+     * `deployment`). A sign-in page shows a workspace's own first. Absent:
+     * `tenant`.
+     */
+    readonly owner?: 'tenant' | 'deployment';
+}
+/**
+ * - `oidc`: an OpenID Connect identity provider people sign in with
+ *   (Okta, Entra ID, Google, Keycloak…): an `issuer`, the endpoints come
+ *   from its discovery document.
+ * - `saml`: a SAML 2.0 identity provider people sign in with.
+ * - `oauth2`: a plain OAuth 2.0 provider that isn't OpenID Connect (e.g.
+ *   GitHub), with its endpoints given. Pick `oidc` for any provider that
+ *   speaks OpenID Connect.
+ */
+export type IdentityProviderKind = 'oauth2' | 'oidc' | 'saml';
+/**
+ * An identity provider's configuration: one shape per `kind`. Narrow on
+ * `kind` before reading kind-specific fields (`clientId`,
+ * `tokenEndpoint`, `idpMetadataXml`…).
+ */
+export type ProviderConfig = OAuth2ProviderConfig | OidcProviderConfig | SamlProviderConfig;
+/** What every kind of identity provider has. */
+export interface ProviderConfigBase {
+    /** Stable string chosen by the tenant (e.g. `acme-sso`, `globex-oidc`). */
     readonly providerId: string;
     readonly kind: IdentityProviderKind;
+    /** The name a sign-in page shows ("Sign in with …"). Default: `providerId`. */
+    readonly displayName?: string;
+    /**
+     * The email domains whose people sign in with this provider (lowercase,
+     * e.g. `acme.com`): how an email-first sign-in page finds it.
+     */
+    readonly domains?: readonly string[];
+    /**
+     * Who may sign in the first time: `invite` (default) only people a
+     * tenant admin added; `domain` also anyone from one of `domains`, once
+     * the deployment has verified them.
+     */
+    readonly join?: 'invite' | 'domain';
+    /**
+     * What to give the identity provider so it can send people back: set
+     * by the deployment on what it returns; ignored on registration.
+     */
+    readonly signIn?: ProviderSignIn;
+    readonly metadata?: Record<string, unknown>;
+}
+/** Where the identity provider sends people back to. */
+export type ProviderSignIn = {
+    /** OIDC / OAuth 2.0: the redirect URI to allow on the provider's client. */
+    readonly redirectUri: string;
+} | {
+    /** SAML: the service provider's entity ID, as the IdP knows it. */
+    readonly spEntityId: string;
+    /** SAML: the assertion consumer service URL (HTTP-POST binding). */
+    readonly acsUrl: string;
+    /** SAML: the service provider's metadata, for IdPs that import it. */
+    readonly spMetadataUrl: string;
+};
+/** An OpenID Connect identity provider (sign-in). */
+export interface OidcProviderConfig extends ProviderConfigBase {
+    readonly kind: 'oidc';
+    /** The issuer; its `/.well-known/openid-configuration` gives the endpoints. */
+    readonly issuer: string;
+    readonly clientId: string;
+    /** Opaque pointer resolved server-side. Never a plaintext secret. */
+    readonly clientSecretRef: string;
+    /** Default `openid email profile`. */
+    readonly scopes?: readonly string[];
+    /** From discovery when absent; returned once the deployment has them. */
+    readonly authorizationEndpoint?: string;
+    readonly tokenEndpoint?: string;
+    readonly userinfoEndpoint?: string;
+    readonly jwksEndpoint?: string;
+    readonly allowedRedirectUris?: readonly string[];
+    readonly claimMapping?: ClaimMappingSpec;
+}
+/** A SAML 2.0 identity provider (sign-in). */
+export interface SamlProviderConfig extends ProviderConfigBase {
+    readonly kind: 'saml';
+    /** The IdP's metadata XML. Or give `idpEntityId` + `idpSsoUrl` + `idpCertificates`. */
+    readonly idpMetadataXml?: string;
+    readonly idpEntityId?: string;
+    /** The IdP's single sign-on URL (HTTP-Redirect binding). */
+    readonly idpSsoUrl?: string;
+    /** The IdP's signing certificates (PEM); several during a rollover. */
+    readonly idpCertificates?: readonly string[];
+    /**
+     * Opaque pointer to the service provider's signing key (PEM), for IdPs
+     * that require signed AuthnRequests. Never a plaintext key.
+     */
+    readonly spSigningKeyRef?: string;
+    /** Opaque pointer to the key that decrypts encrypted assertions. Never a plaintext key. */
+    readonly spDecryptionKeyRef?: string;
+    /** Require signed assertions. Default `true`. */
+    readonly wantAssertionsSigned?: boolean;
+    /** Assertion attribute names. Defaults: `userId` = the NameID, `email` = `email`. */
+    readonly attributeMapping?: SamlAttributeMapping;
+}
+export interface SamlAttributeMapping {
+    readonly userId?: string;
+    readonly email?: string;
+    readonly displayName?: string;
+}
+/**
+ * A plain OAuth 2.0 provider that isn't OpenID Connect (e.g. GitHub), run
+ * by this package's own OAuth flow (`/v1/auth/login` + callback, with the
+ * deployment's `exchangeCode`). For a provider that speaks OpenID Connect,
+ * use `oidc`.
+ */
+export interface OAuth2ProviderConfig extends ProviderConfigBase {
+    readonly kind: 'oauth2';
     readonly clientId: string;
     /**
      * Opaque pointer resolved server-side. Never a plaintext secret. The
@@ -63,7 +231,6 @@ export interface ProviderConfig {
      * own `ExchangeCodeFn` MAY honor this field the same way.
      */
     readonly claimMapping?: ClaimMappingSpec;
-    readonly metadata?: Record<string, unknown>;
 }
 /**
  * How provider claims map into Kindgi's session shape. All fields
@@ -130,6 +297,19 @@ export interface IdentityProviderRegisterInput {
 export type IdentityProviderRegisterOutcome = {
     readonly kind: 'ok';
     readonly providerId: string;
+    /**
+     * The provider as stored: discovered endpoints, `signIn`. Absent from
+     * older bindings; the route then answers with `providerId` alone.
+     */
+    readonly provider?: ProviderConfig;
+} | {
+    /**
+     * The deployment couldn't use the configuration: the issuer's
+     * discovery failed, the SAML metadata didn't parse, a host it may
+     * not reach. 422 `identity-provider-invalid`, with `message`.
+     */
+    readonly kind: 'invalid';
+    readonly message: string;
 };
 export interface IdentityProviderUnregisterInput {
     readonly tenantId: TenantId;

package/dist/identity-provider-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-provider-binding.d.ts","sourceRoot":"","sources":["../src/identity-provider-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACtE,GAAG,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACzF,UAAU,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;CAChG;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"identity-provider-binding.d.ts","sourceRoot":"","sources":["../src/identity-provider-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACtE,GAAG,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACzF,UAAU,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC/F;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IACzF;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CACpB,KAAK,EAAE,+BAA+B,KACnC,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,2BAA2B,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAClG;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;CACrC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,GAC1D;IACE,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAEnC,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wBAAwB;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC1C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAE9D;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAE5F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,wDAAwD;AACxD,MAAM,MAAM,cAAc,GACtB;IACE,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IACE,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,CAAC;AAEN,qDAAqD;AACrD,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;CAC1C;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,iDAAiD;IACjD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,qFAAqF;IACrF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,MAAM,+BAA+B,GACvC;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACpC,GACD;IACE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC"}