@mcp-abap-adt/auth-broker 4.1.0 → 5.0.0

package/dist/binding.js

@@ -1,200 +1,373 @@
 "use strict";
 /**
- * A secret is bound to the resource it was obtained for and to who issued it.
+ * A secret is bound to the resource it was obtained for and to everything that
+ * decides where it goes and whose it is.
  *
- * The session store keeps two strings beside the secret — `issuedFor`, the
- * resource, and `issuedBy`, the issuer and its client — and the broker uses a
- * stored secret only when both equal what this destination's means give. The
- * store keeps them as given; the broker canonicalises **both sides** before it
- * compares, with the one function here (the broker's only, decided), so a store
- * need not canonicalise and a legacy file's composed URI compares equal.
+ * The session store keeps two strings beside the secret, and the broker uses a
+ * stored secret only when both equal what this destination's means give:
  *
- * The canonical URI:
- * - scheme and host lower-cased (by `URL`, for http and https);
- * - the port explicit — `443` for `https`, `80` for `http` when the URL has
- *   none; another scheme keeps the port it states;
- * - the path without a trailing `/` (the root path is empty), its case kept;
- * - one query parameter at most — `sap-client=<n>` for a resource,
- *   `client_id=<id>` for an issuer, none for a SAML ACS — parsed and
- *   re-encoded with `URLSearchParams`, so a value percent-encoded on one side
- *   and plain on the other compares equal;
- * - no user info, no other parameter, no fragment.
+ * - **`issuedFor`**, the resource: `serviceUrl` with the SAP client, in the
+ *   canonical form 4.x wrote (`resourceUri`). Both sides are canonicalised
+ *   before they are compared, so a stored value written by any 4.x-era
+ *   consumer compares equal.
+ * - **`issuedBy`**, a versioned record only the broker produces
+ *   (`bindingRecord`):
  *
- * A URL that does not parse, or has no host, has no canonical form: the
- * binding is then absent, never guessed.
+ *   ```
+ *   mcp-abap-adt-binding/2;<row>;<eleven address fields>;<trust>
+ *   ```
+ *
+ *   `row` is `authType/grantType` (or `provider/…` for the token API's
+ *   consumer provider); each address field is the exact string the row hands
+ *   its provider — `encodeURIComponent`-encoded, `""` when it hands none, never
+ *   canonicalised — in the fixed order of `RECORD_FIELDS`; `trust` is the
+ *   SHA-256 of the row's non-secret trust input (`trustDigest`), or `""`.
+ *   The record is compared by exact equality and never parsed, split or
+ *   matched; no regular expression touches it.
+ *
+ * No secret takes part in either string, nor a hash of one: a hash in a
+ * session file can be checked offline against guesses.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECORD_FIELDS = void 0;
+exports.bindingRecord = bindingRecord;
+exports.trustDigest = trustDigest;
 exports.resourceUri = resourceUri;
-exports.issuerUri = issuerUri;
-exports.acsUri = acsUri;
 exports.uaaBinding = uaaBinding;
 exports.oidcBinding = oidcBinding;
 exports.samlPureBinding = samlPureBinding;
+exports.samlBearerBinding = samlBearerBinding;
+exports.handedOverBinding = handedOverBinding;
 exports.consumerBinding = consumerBinding;
 exports.strategyBinding = strategyBinding;
-exports.handedOverBinding = handedOverBinding;
 exports.sameResource = sameResource;
-exports.sameIssuer = sameIssuer;
+exports.sameRecord = sameRecord;
+exports.couldBeSeeded = couldBeSeeded;
 exports.boundHere = boundHere;
+const node_crypto_1 = require("node:crypto");
+/** The record's version tag; a later format is `mcp-abap-adt-binding/3`. */
+const RECORD_VERSION = 'mcp-abap-adt-binding/2';
+/** What the trust input is hashed under, before its JSON. */
+const TRUST_PREFIX = 'mcp-abap-adt-binding/2/trust\n';
+/** The eleven address fields of the record, in their fixed order. */
+exports.RECORD_FIELDS = [
+    'clientId',
+    'uaaUrl',
+    'oidcIssuerUrl',
+    'oidcTokenEndpoint',
+    'oidcAuthorizationEndpoint',
+    'oidcDeviceAuthorizationEndpoint',
+    'oidcAudience',
+    'samlIdpSsoUrl',
+    'samlAcsUrl',
+    'samlTokenUrl',
+    'certUrl',
+];
+function present(value) {
+    return typeof value === 'string' && value !== '';
+}
+const HIGH_SURROGATE_FIRST = 0xd800;
+const LOW_SURROGATE_FIRST = 0xdc00;
+const SURROGATE_LAST = 0xdfff;
+/**
+ * `encodeURIComponent(value)`, total: a lone surrogate — on which the
+ * platform function throws — is written `%uXXXX`, which no
+ * `encodeURIComponent` output contains (its `%` is always followed by two hex
+ * digits), so two different strings never encode equal. Linear in the length.
+ */
+function encodeField(value) {
+    try {
+        return encodeURIComponent(value);
+    }
+    catch {
+        // A lone surrogate: encode unit by unit below.
+    }
+    let out = '';
+    for (let i = 0; i < value.length; i += 1) {
+        const unit = value.charCodeAt(i);
+        if (unit >= HIGH_SURROGATE_FIRST && unit < LOW_SURROGATE_FIRST) {
+            const next = i + 1 < value.length ? value.charCodeAt(i + 1) : 0;
+            if (next >= LOW_SURROGATE_FIRST && next <= SURROGATE_LAST) {
+                out += encodeURIComponent(value.slice(i, i + 2));
+                i += 1;
+                continue;
+            }
+        }
+        if (unit >= HIGH_SURROGATE_FIRST && unit <= SURROGATE_LAST) {
+            out += `%u${unit.toString(16).toUpperCase()}`;
+            continue;
+        }
+        out += encodeURIComponent(value.charAt(i));
+    }
+    return out;
+}
+/**
+ * The `issuedBy` record: the version, the row, the eleven address fields in
+ * their fixed order — each the exact string, encoded, `""` when absent or
+ * `''` — and the trust digest. Every field is always present, and none holds
+ * `;`, so the string is unambiguous without being parsed.
+ */
+function bindingRecord(row, fields, trust) {
+    const parts = [RECORD_VERSION, row];
+    for (const name of exports.RECORD_FIELDS) {
+        const value = fields[name];
+        parts.push(present(value) ? encodeField(value) : '');
+    }
+    parts.push(trust);
+    return parts.join(';');
+}
+/**
+ * A value of the trust input as the means state it — a string, a number, a
+ * boolean, an array of strings — or `null` for an absent one. A row refuses a
+ * trust input of any other shape before it builds (`trustShaped`,
+ * `samlRefusal`, the certificate check in `getProvider`), so `null` never
+ * stands for a malformed value a built provider received; only `bindingOf`,
+ * whose means `getProvider` would refuse, can reach it.
+ */
+function trustValue(value) {
+    if (typeof value === 'string' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : null;
+    if (Array.isArray(value)) {
+        const copy = [];
+        for (const element of value) {
+            if (typeof element !== 'string')
+                return null;
+            copy.push(element);
+        }
+        return copy;
+    }
+    return null;
+}
+/**
+ * The trust digest: lower-case hex SHA-256 of the UTF-8 bytes of
+ * `"mcp-abap-adt-binding/2/trust\n"` and the JSON of the `[name, value]` pairs
+ * in the row's fixed order — no trimming, no canonicalisation. JSON of arrays
+ * and primitives has one output (lone surrogates escaped), so equal inputs
+ * give equal bytes.
+ */
+function trustDigest(pairs) {
+    const serialised = JSON.stringify(pairs.map(([name, value]) => [name, trustValue(value)]));
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(`${TRUST_PREFIX}${serialised}`, 'utf8')
+        .digest('hex');
+}
 /** The default port a URL without one is taken to mean. */
 const DEFAULT_PORTS = {
     'https:': '443',
     'http:': '80',
 };
-function present(value) {
-    return typeof value === 'string' && value !== '';
+/** `value` without the slashes it ends with, in one backwards pass. */
+function withoutTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 0x2f)
+        end -= 1;
+    return value.slice(0, end);
 }
 /**
- * The canonical URI of `raw`, keeping only the query parameter `param` — its
- * value `override` when given, else the one `raw` carries.
+ * The canonical resource URI, as 4.x wrote it: scheme and host lower-cased
+ * (by `URL`, for http and https); the port explicit (`443` / `80` by
+ * default); the path without a trailing `/`, its case kept; one query
+ * parameter, `sap-client=<n>` — `sapClient` when given, else the one the URL
+ * carries — re-encoded with `URLSearchParams`; no user info, no other
+ * parameter, no fragment. A URL that does not parse, or has no host, has no
+ * canonical form: `undefined`, never guessed. For a stored value, call it
+ * without `sapClient`.
  */
-function canonical(raw, param, override) {
-    if (!present(raw))
+function resourceUri(serviceUrl, sapClient) {
+    if (!present(serviceUrl))
         return undefined;
     let url;
     try {
-        url = new URL(raw);
+        url = new URL(serviceUrl);
     }
     catch {
         return undefined;
     }
-    // `URL` lower-cases the scheme, and the host of an http(s) URL. Another
-    // scheme's host is kept as written: no form beyond http(s) is defined yet.
     const host = url.hostname;
     if (host === '')
         return undefined;
     const scheme = url.protocol;
     const port = url.port || DEFAULT_PORTS[scheme] || '';
-    const path = url.pathname.replace(/\/+$/, '');
-    let query = '';
-    if (param) {
-        const value = present(override) ? override : url.searchParams.get(param);
-        if (present(value)) {
-            query = `?${new URLSearchParams([[param, value]]).toString()}`;
-        }
-    }
+    const path = withoutTrailingSlashes(url.pathname);
+    const client = present(sapClient)
+        ? sapClient
+        : url.searchParams.get('sap-client');
+    const query = present(client)
+        ? `?${new URLSearchParams([['sap-client', client]]).toString()}`
+        : '';
     return `${scheme}//${host}${port ? `:${port}` : ''}${path}${query}`;
 }
-/**
- * The resource: `serviceUrl` with the SAP client as `sap-client` — the
- * destination's `sapClient` when it states one, over a `sap-client` already in
- * the URL. For a stored value, call it without `sapClient`.
- */
-function resourceUri(serviceUrl, sapClient) {
-    return canonical(serviceUrl, 'sap-client', sapClient);
-}
-/**
- * The issuer and its client: the authorization server's base URL with
- * `client_id`. For a stored value, call it without `clientId`.
- */
-function issuerUri(issuerUrl, clientId) {
-    return canonical(issuerUrl, 'client_id', clientId);
-}
-/** The ACS of the system that set SAML session cookies: origin and path. */
-function acsUri(acsUrl) {
-    return canonical(acsUrl, undefined);
-}
 /** The resource the means name: `serviceUrl` with `sapClient`. */
 function resourceOf(means) {
     return resourceUri(means.serviceUrl, present(means.sapClient) ? means.sapClient : undefined);
 }
+/** The certificate client's public certificate, for the trust input. */
+function certificateOf(certificate) {
+    return certificate ? certificate.certificate : null;
+}
+/** `certUrl` is stated whenever the build read a certificate client. */
+function certificateStated(certificate) {
+    return !certificate || present(certificate.certUrl);
+}
 /**
- * The UAA grants (`authorization_code`, `client_credentials`, `passcode`) and
- * `saml2_bearer`, whose token UAA issues to its client: the resource, and `uaaUrl` with `uaaClientId` — both required to match.
+ * The UAA grants (`authorization_code`, `client_credentials`, `passcode`):
+ * the client id and `uaaUrl` as the provider receives them, and `certUrl`
+ * when the build read the certificate client; trust is the client
+ * certificate. Fully stated with the client, `uaaUrl` and — when read —
+ * `certUrl`.
  */
-function uaaBinding(means, client) {
-    const stated = present(client?.uaaUrl) && present(client?.uaaClientId);
+function uaaBinding(grant, means, client, certificate) {
     return {
         issuedFor: resourceOf(means),
-        issuedBy: stated
-            ? issuerUri(client?.uaaUrl, client?.uaaClientId)
-            : undefined,
-        issuerKind: 'issuer',
-        issuerStated: stated,
+        issuedBy: bindingRecord(`jwt/${grant}`, {
+            clientId: client?.uaaClientId,
+            uaaUrl: client?.uaaUrl,
+            certUrl: certificate?.certUrl,
+        }, trustDigest([['clientCertificate', certificateOf(certificate)]])),
+        fullyStated: present(client?.uaaClientId) &&
+            present(client?.uaaUrl) &&
+            certificateStated(certificate),
     };
 }
 /**
- * The OIDC grants: the resource, and the issuer — `oidcIssuerUrl`, else
- * `uaaUrl` — with `uaaClientId`; both required to match. Means that state
- * neither issuer (explicit endpoints alone) bind no stored secret: one is then
- * never seeded.
+ * The OIDC grants: the client id, `oidcIssuerUrl`, `oidcTokenEndpoint`, and
+ * the grant's own endpoint (`oidcAuthorizationEndpoint`,
+ * `oidcDeviceAuthorizationEndpoint`) or audience (`oidcAudience`), and
+ * `certUrl` when read; trust is the scopes, the `password` grant's
+ * `username`, the token-exchange token types, and the client certificate.
+ *
+ * Fully stated with the client, each endpoint the grant sends to — explicit,
+ * or the issuer it is discovered from — and `certUrl` when read;
+ * `token_exchange` never: its subject token, a secret, decides whose
+ * credential it obtains.
  */
-function oidcBinding(means, client) {
-    const issuer = present(means.oidcIssuerUrl)
-        ? means.oidcIssuerUrl
-        : client?.uaaUrl;
-    const stated = present(issuer) && present(client?.uaaClientId);
+function oidcBinding(grant, means, client, certificate) {
+    const issuer = present(means.oidcIssuerUrl);
+    const reaches = (endpoint) => issuer || present(endpoint);
+    const trust = [['oidcScopes', means.oidcScopes]];
+    if (grant === 'password')
+        trust.push(['username', means.username]);
+    if (grant === 'token_exchange') {
+        trust.push(['oidcSubjectTokenType', means.oidcSubjectTokenType], ['oidcActorTokenType', means.oidcActorTokenType]);
+    }
+    trust.push(['clientCertificate', certificateOf(certificate)]);
     return {
         issuedFor: resourceOf(means),
-        issuedBy: stated ? issuerUri(issuer, client?.uaaClientId) : undefined,
-        issuerKind: 'issuer',
-        issuerStated: stated,
+        issuedBy: bindingRecord(`jwt/${grant}`, {
+            clientId: client?.uaaClientId,
+            oidcIssuerUrl: means.oidcIssuerUrl,
+            oidcTokenEndpoint: means.oidcTokenEndpoint,
+            oidcAuthorizationEndpoint: grant === 'oidc_authorization_code'
+                ? means.oidcAuthorizationEndpoint
+                : undefined,
+            oidcDeviceAuthorizationEndpoint: grant === 'device_code'
+                ? means.oidcDeviceAuthorizationEndpoint
+                : undefined,
+            oidcAudience: grant === 'token_exchange' ? means.oidcAudience : undefined,
+            certUrl: certificate?.certUrl,
+        }, trustDigest(trust)),
+        fullyStated: grant !== 'token_exchange' &&
+            present(client?.uaaClientId) &&
+            reaches(means.oidcTokenEndpoint) &&
+            (grant !== 'oidc_authorization_code' ||
+                reaches(means.oidcAuthorizationEndpoint)) &&
+            (grant !== 'device_code' ||
+                reaches(means.oidcDeviceAuthorizationEndpoint)) &&
+            certificateStated(certificate),
     };
 }
+/** The SAML trust input both SAML grants share, in order. */
+function samlTrust(means) {
+    return [
+        ['samlIdpCertificates', means.samlIdpCertificates],
+        ['samlIdpEntityId', means.samlIdpEntityId],
+        ['samlSpEntityId', means.samlSpEntityId],
+        ['samlClockSkewMs', means.samlClockSkewMs],
+        ['samlIdpInitiated', means.samlIdpInitiated],
+    ];
+}
 /**
- * `saml2_pure`: the resource, and the ACS of the system that sets the
- * cookies — `samlAcsUrl`, origin and path; both required to match.
+ * `saml2_pure`: the IdP's SSO URL and the ACS of the system that sets the
+ * cookies; trust is the SAML trust. Fully stated with both.
  */
 function samlPureBinding(means) {
     return {
         issuedFor: resourceOf(means),
-        issuedBy: acsUri(means.samlAcsUrl),
-        issuerKind: 'acs',
-        issuerStated: present(means.samlAcsUrl),
+        issuedBy: bindingRecord('saml/saml2_pure', { samlIdpSsoUrl: means.samlIdpSsoUrl, samlAcsUrl: means.samlAcsUrl }, trustDigest(samlTrust(means))),
+        fullyStated: present(means.samlIdpSsoUrl) && present(means.samlAcsUrl),
     };
 }
 /**
- * The token API with a consumer's provider: what the broker handed
- * that provider — the `serviceUrl` it resolved, with the SAP client, and for a
- * factory the client it resolved (`uaaUrl` with `uaaClientId`). An instance is
- * handed no client, so no issuer is claimed for what it obtains: `issuedBy` is
- * then absent, and `getProvider` never seeds from that secret.
+ * `saml2_bearer`: the client id, `uaaUrl`, the IdP's SSO URL, the ACS,
+ * `samlTokenUrl`, and `certUrl` when read; trust is the SAML trust and the
+ * client certificate. Fully stated with the client, the IdP, the token
+ * endpoint (`samlTokenUrl`, or `uaaUrl`) and — when read — `certUrl`.
  */
-function consumerBinding(serviceUrl, sapClient, client) {
-    return uaaBinding({ serviceUrl, sapClient }, client);
+function samlBearerBinding(means, client, certificate) {
+    return {
+        issuedFor: resourceOf(means),
+        issuedBy: bindingRecord('saml/saml2_bearer', {
+            clientId: client?.uaaClientId,
+            uaaUrl: client?.uaaUrl,
+            samlIdpSsoUrl: means.samlIdpSsoUrl,
+            samlAcsUrl: means.samlAcsUrl,
+            samlTokenUrl: means.samlTokenUrl,
+            certUrl: certificate?.certUrl,
+        }, trustDigest([
+            ...samlTrust(means),
+            ['clientCertificate', certificateOf(certificate)],
+        ])),
+        fullyStated: present(client?.uaaClientId) &&
+            present(means.samlIdpSsoUrl) &&
+            (present(means.samlTokenUrl) || present(client?.uaaUrl)) &&
+            certificateStated(certificate),
+    };
 }
 /**
- * A binding on the `clientAuthentication` strategy path: a resource that
- * neither the means nor the stored session state matches, so the issuer and
- * client alone decide (`Binding.unstatedResourceMatches`).
+ * A `none` row: the resource, and the record — for `jwt` the client id,
+ * `uaaUrl` and `oidcIssuerUrl` as the means state them, for `saml` the ACS;
+ * no trust. A handed-over credential is compared by exact equality of the
+ * whole record; it is never seeded into a renewal, so it is not
+ * "fully stated".
  */
-function strategyBinding(binding) {
-    return { ...binding, unstatedResourceMatches: true };
+function handedOverBinding(authType, means, client) {
+    const fields = authType === 'saml'
+        ? { samlAcsUrl: means.samlAcsUrl }
+        : {
+            clientId: client?.uaaClientId,
+            uaaUrl: client?.uaaUrl,
+            oidcIssuerUrl: means.oidcIssuerUrl,
+        };
+    return {
+        issuedFor: resourceOf(means),
+        issuedBy: bindingRecord(`${authType}/none`, fields, ''),
+        fullyStated: false,
+    };
 }
 /**
- * A `none` row: the resource always; the issuer only when the means state one
- * — `oidcIssuerUrl` (with `uaaClientId` when stated) or the client (`uaaUrl`
- * and `uaaClientId`) for `jwt`, `samlAcsUrl` for `saml`.
+ * The token API with a consumer's provider: the `serviceUrl` it resolved,
+ * with the SAP client, and the record `provider/<row>` — for a factory the
+ * client id and `uaaUrl` of the client it was handed, for an instance (handed
+ * no client) none; no trust. Never fully stated: the broker cannot know what
+ * the factory composes, and an instance is handed no client.
  */
-function handedOverBinding(authType, means, client) {
-    const issuedFor = resourceOf(means);
-    if (authType === 'saml') {
-        return {
-            issuedFor,
-            issuedBy: acsUri(means.samlAcsUrl),
-            issuerKind: 'acs',
-            issuerStated: present(means.samlAcsUrl),
-        };
-    }
-    const clientId = present(client?.uaaClientId)
-        ? client.uaaClientId
-        : undefined;
-    if (present(means.oidcIssuerUrl)) {
-        return {
-            issuedFor,
-            issuedBy: issuerUri(means.oidcIssuerUrl, clientId),
-            issuerKind: 'issuer',
-            issuerStated: true,
-        };
-    }
-    const stated = present(client?.uaaUrl) && clientId !== undefined;
+function consumerBinding(row, serviceUrl, sapClient, client) {
     return {
-        issuedFor,
-        issuedBy: stated ? issuerUri(client?.uaaUrl, clientId) : undefined,
-        issuerKind: 'issuer',
-        issuerStated: stated,
+        issuedFor: resourceUri(serviceUrl, sapClient),
+        issuedBy: bindingRecord(row, { clientId: client?.uaaClientId, uaaUrl: client?.uaaUrl }, ''),
+        fullyStated: false,
     };
 }
+/**
+ * A binding on the `clientAuthentication` strategy path: a resource that
+ * neither the means nor the stored session state matches
+ * (`Binding.unstatedResourceMatches`).
+ */
+function strategyBinding(binding) {
+    return { ...binding, unstatedResourceMatches: true };
+}
 /**
  * The stored `issuedFor`, canonicalised, equals the destination's — or, with
  * `unstatedResourceMatches`, neither states one.
@@ -205,19 +378,29 @@ function sameResource(stored, binding) {
     }
     return resourceUri(stored?.issuedFor) === binding.issuedFor;
 }
-/** The stored `issuedBy`, canonicalised as the destination's kind, equals it. */
-function sameIssuer(stored, binding) {
-    if (binding.issuedBy === undefined)
-        return false;
-    const read = binding.issuerKind === 'acs' ? acsUri : issuerUri;
-    return read(stored?.issuedBy) === binding.issuedBy;
+/** The stored `issuedBy` is exactly this binding's record. */
+function sameRecord(stored, binding) {
+    return stored?.issuedBy === binding.issuedBy;
+}
+/**
+ * Whether any stored secret could ever seed this binding's provider: the
+ * binding is fully stated and its resource can match — stated, or matching
+ * when neither side states one (`unstatedResourceMatches`). The condition
+ * `boundHere` needs beside the stored values.
+ */
+function couldBeSeeded(binding) {
+    return (binding.fullyStated &&
+        (binding.issuedFor !== undefined ||
+            binding.unstatedResourceMatches === true));
 }
 /**
- * An obtained secret is this destination's only when **both** stored values
- * equal the computed ones; either absent, on either side, is not a match —
- * save a resource absent on both sides of a strategy-path binding
- * (`unstatedResourceMatches`).
+ * A stored secret may seed this binding's provider — or have its refresh
+ * token carried — only when the binding is fully stated, the resource
+ * matches, and the stored `issuedBy` is exactly the record. A session with no
+ * `issuedBy`, or a 4.x one, never matches.
  */
 function boundHere(stored, binding) {
-    return sameResource(stored, binding) && sameIssuer(stored, binding);
+    return (binding.fullyStated &&
+        sameResource(stored, binding) &&
+        sameRecord(stored, binding));
 }

package/dist/bindingOf.d.ts

@@ -6,15 +6,20 @@
  */
 import type { DestinationGrant, IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-broker';
 import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
-import type { BoundClient } from './binding';
-import { type Binding } from './binding';
+import { type Binding, type BoundCertificate, type BoundClient } from './binding';
 /**
- * The binding of a `jwt` or `saml` destination with the grant it states: the
- * UAA grants and `saml2_bearer` by `uaaUrl` and the client, the OIDC grants by
- * the issuer and the client, `saml2_pure` by its ACS, and `none` by what the
- * means state.
+ * The binding of a `jwt` or `saml` destination with the grant it states — a
+ * pair of the closed list, checked before (`statedGrant`): the UAA grants,
+ * the OIDC grants, `saml2_pure`, `saml2_bearer` and `none`, each with the
+ * fields of its row. `certificate` is the certificate client the build
+ * read for the `clientAuthentication` strategy, or `null` when it read none.
  */
-export declare function destinationBinding(authType: 'jwt' | 'saml', grant: DestinationGrant, means: IConnectionConfig, client: BoundClient | null): Binding;
+export declare function destinationBinding(authType: 'jwt' | 'saml', grant: DestinationGrant, means: IConnectionConfig, client: BoundClient | null, certificate?: BoundCertificate | null): Binding;
+/**
+ * The row of the token API's consumer provider: `provider/<authType>/<grant>`
+ * when the means state a pair of the closed list, else `provider/-`.
+ */
+export declare function consumerRow(means: IConnectionConfig | null): string;
 /** The two strings a session store keeps beside a secret; absent where the means cannot say. */
 export interface SecretBinding {
     issuedFor?: string;
@@ -22,16 +27,29 @@ export interface SecretBinding {
 }
 /**
  * The binding the broker writes beside a secret for a destination with these
- * means and this client — canonical, exactly what `getProvider` compares a
- * stored secret against. For a consumer that hands over a credential the
- * broker cannot obtain (a `none` destination: a token or cookies it was
- * given) and writes it to the session store itself: written with this binding,
- * `getProvider` presents it; written with any other, it refuses.
+ * means and this client: `issuedFor` the canonical resource, `issuedBy` the
+ * version-2 record of the row the means state, built from `means` and
+ * `client` alone.
+ *
+ * It is exactly what `getProvider` compares for a `none` row — its use: a
+ * consumer that hands over a credential the broker cannot obtain (a token or
+ * cookies it was given) writes it with this binding, and `getProvider`
+ * presents it; written with any other — a 4.x `bindingOf`'s included — it
+ * refuses. It is also exactly what `getProvider` writes for a token row built
+ * without a `clientAuthentication` strategy.
+ *
+ * It is **not** what a token row writes beside a `clientAuthentication`
+ * strategy: there the row's record also holds what the build read of the
+ * certificate client — its `certUrl`, and its certificate in the trust
+ * digest — and its client identity may be the certificate client's, none of
+ * which `bindingOf` is given. Nor is it the token API's record for a
+ * consumer's provider (`provider/…`).
  *
  * `means` are the key store's (`authType`, `grantType`, `serviceUrl`,
- * `sapClient`, the issuer or ACS); `client` is the key store's client, when the
- * destination has one. A destination that states no `jwt` / `saml` type or no
- * grant binds nothing: `{}`. Never logs, never throws.
+ * `sapClient`, the addresses and trust the row reads); `client` is the key
+ * store's client, when the destination has one. A destination that states no
+ * `jwt` / `saml` type, no grant, or a pair outside the closed list binds
+ * nothing: `{}`. Never logs, never throws.
  */
 export declare function bindingOf(means: IConnectionConfig, client?: IAuthorizationConfig | null): SecretBinding;
 //# sourceMappingURL=bindingOf.d.ts.map

package/dist/bindingOf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bindingOf.d.ts","sourceRoot":"","sources":["../src/bindingOf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,KAAK,OAAO,EAKb,MAAM,WAAW,CAAC;AAGnB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,WAAW,GAAG,IAAI,GACzB,OAAO,CAKT;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,iBAAiB,EACxB,MAAM,GAAE,oBAAoB,GAAG,IAAW,GACzC,aAAa,CAcf"}
+{"version":3,"file":"bindingOf.d.ts","sourceRoot":"","sources":["../src/bindingOf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAMjB,MAAM,WAAW,CAAC;AAGnB;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,WAAW,GAAE,gBAAgB,GAAG,IAAW,GAC1C,OAAO,CAUT;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,MAAM,CAMnE;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,iBAAiB,EACxB,MAAM,GAAE,oBAAoB,GAAG,IAAW,GACzC,aAAa,CAcf"}