Security · Package reference

@wrnexus/identity

Portable identity records, claims, and account linking.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/identity@0.8.7

Request preview access. Never put registry tokens in source control.

Enterprise identity and governance for WRNexusJS: OIDC discovery, signed SAML adapter flows, LDAP/Active Directory synchronization adapters, SCIM provisioning, scoped API keys, service accounts, approval workflows, consent history, retention, subject export/deletion and audit.

The package complements @wrnexus/auth (passkeys, MFA, devices, sessions, OAuth and audited impersonation) and @wrnexus/authz (RBAC, ABAC and policy decisions). Protocol-specific SAML and directory parsing is supplied through adapters so applications can select a maintained vendor SDK without weakening framework validation, replay protection or governance auditing.

Complete TypeScript API

Generated from the exact installed package declarations.

interface OidcMetadata {
    issuer: string;
    authorization_endpoint: string;
    token_endpoint: string;
    userinfo_endpoint?: string;
    jwks_uri: string;
    scopes_supported?: string[];
}
declare function discoverOidc(issuer: string, options?: {
    fetch?: typeof fetch;
}): Promise<OidcMetadata>;
declare function oidcAuthorizationUrl(metadata: OidcMetadata, input: {
    clientId: string;
    redirectUri: string;
    state: string;
    nonce: string;
    codeChallenge: string;
    scopes?: string[];
}): string;
interface EnterpriseIdentity {
    externalId: string;
    username: string;
    displayName?: string;
    email?: string;
    groups: string[];
    active: boolean;
    attributes?: Record<string, unknown>;
}
interface SamlAssertion {
    id: string;
    issuer: string;
    audience: string;
    recipient: string;
    expiresAt: number;
    identity: EnterpriseIdentity;
}
interface SamlAdapter {
    createLoginRequest(input: {
        requestId: string;
        callbackUrl: string;
        relayState: string;
    }): Promise<string> | string;
    verifySignedResponse(response: string): Promise<SamlAssertion>;
}
interface ReplayStore {
    consume(id: string, expiresAt: number): Promise<boolean>;
}
declare function memoryReplayStore(now?: () => number): ReplayStore;
declare function createSamlFederation(options: {
    adapter: SamlAdapter;
    issuer: string;
    audience: string;
    recipient: string;
    replayStore?: ReplayStore;
    now?: () => number;
}): {
    login: (input: {
        requestId: string;
        callbackUrl: string;
        relayState: string;
    }) => Promise<string> | string;
    callback(encodedResponse: string): Promise<EnterpriseIdentity>;
};
interface DirectoryAdapter {
    kind: "ldap" | "active-directory";
    search(input: {
        baseDn: string;
        filter: string;
        attributes: string[];
        signal?: AbortSignal;
    }): Promise<EnterpriseIdentity[]>;
    authenticate?(username: string, password: string, signal?: AbortSignal): Promise<EnterpriseIdentity | null>;
}
declare function syncDirectory(adapter: DirectoryAdapter, options: {
    baseDn: string;
    filter?: string;
    attributes?: string[];
    signal?: AbortSignal;
    upsert: (identity: EnterpriseIdentity) => void | Promise<void>;
    disableMissing?: (externalIds: string[]) => void | Promise<void>;
}): Promise<{
    provider: "ldap" | "active-directory";
    synchronized: number;
}>;
interface ScimUser extends EnterpriseIdentity {
    id: string;
    /** RFC 7643 field accepted at the HTTP boundary. */
    userName?: string;
    schemas?: string[];
}
interface ScimStore {
    list(): Promise<ScimUser[]>;
    get(id: string): Promise<ScimUser | null>;
    create(user: Omit<ScimUser, "id">): Promise<ScimUser>;
    update(id: string, user: Partial<ScimUser>): Promise<ScimUser | null>;
    delete(id: string): Promise<boolean>;
}
declare function memoryScimStore(): ScimStore;
declare function createScimHandler(options: {
    store: ScimStore;
    bearerToken: string;
    basePath?: string;
    maxBodyBytes?: number;
}): (request: Request) => Promise<Response>;
interface MachineCredential {
    id: string;
    ownerId: string;
    kind: "api-key" | "service-account";
    name: string;
    scopes: string[];
    secretHash: string;
    createdAt: number;
    expiresAt?: number;
    revokedAt?: number;
}
declare function createMachineIdentityManager(now?: () => number): {
    issue(input: {
        ownerId: string;
        name: string;
        scopes: string[];
        kind?: MachineCredential["kind"];
        expiresAt?: number;
    }): Promise<{
        secret: string;
        credential: {
            secretHash: string;
            id: string;
            ownerId: string;
            kind: "api-key" | "service-account";
            name: string;
            scopes: string[];
            createdAt: number;
            expiresAt?: number;
            revokedAt?: number;
        };
    }>;
    authenticate(secret: string, requiredScope?: string): Promise<{
        secretHash: string;
        id: string;
        ownerId: string;
        kind: "api-key" | "service-account";
        name: string;
        scopes: string[];
        createdAt: number;
        expiresAt?: number;
        revokedAt?: number;
    } | null>;
    revoke(id: string): boolean;
    list(ownerId: string): {
        secretHash: string;
        id: string;
        ownerId: string;
        kind: "api-key" | "service-account";
        name: string;
        scopes: string[];
        createdAt: number;
        expiresAt?: number;
        revokedAt?: number;
    }[];
};
interface GovernanceEvent {
    id: string;
    type: string;
    subjectId: string;
    actorId?: string;
    createdAt: number;
    data?: Record<string, unknown>;
}
declare function createGovernance(options?: {
    now?: () => number;
    audit?: (event: GovernanceEvent) => void | Promise<void>;
    exportSubject?: (subjectId: string) => unknown | Promise<unknown>;
    deleteSubject?: (subjectId: string) => void | Promise<void>;
}): {
    consent(subjectId: string, purpose: string, granted: boolean, version: string): Promise<{
        granted: boolean;
        version: string;
        at: number;
    }>;
    consents(subjectId: string): {
        [k: string]: {
            granted: boolean;
            version: string;
            at: number;
        };
    };
    request(subjectId: string, action: "export" | "delete"): Promise<{
        id: `${string}-${string}-${string}-${string}-${string}`;
        subjectId: string;
        action: "export" | "delete";
        status: "pending";
        requestedAt: number;
    }>;
    decide(id: string, actorId: string, approved: boolean): Promise<{
        decision: {
            status: "approved" | "rejected";
            decidedAt: number;
            decidedBy: string;
            id: string;
            subjectId: string;
            action: "export" | "delete";
            requestedAt: number;
        };
        result: unknown;
    }>;
    enforceRetention(records: Array<{
        subjectId: string;
        createdAt: number;
    }>, maxAgeMs: number, remove: (record: {
        subjectId: string;
        createdAt: number;
    }) => void | Promise<void>): Promise<number>;
};

export { type DirectoryAdapter, type EnterpriseIdentity, type GovernanceEvent, type MachineCredential, type OidcMetadata, type ReplayStore, type SamlAdapter, type SamlAssertion, type ScimStore, type ScimUser, createGovernance, createMachineIdentityManager, createSamlFederation, createScimHandler, discoverOidc, memoryReplayStore, memoryScimStore, oidcAuthorizationUrl, syncDirectory };

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/identity

bun add @wrnexus/identity

Import @wrnexus/identity

import * as identity from "@wrnexus/identity";