@_mustachio/openauth 0.10.0 → 0.12.0

package/dist/types/methods/saml-sp/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `@_mustachio/openauth/methods/saml-sp` — SAML 2.0 Service Provider
+ * method family.
+ *
+ * **Node-only.** This entry depends transitively on
+ * `@node-saml/node-saml` and `xml-crypto`, which require `node:crypto`
+ * and the `@xmldom/xmldom` DOM. Cloudflare Workers, browsers, and
+ * other edge runtimes cannot load this module; use the root
+ * `@_mustachio/openauth` entry (OIDC / OAuth methods) on those
+ * platforms.
+ *
+ * The library's root entry is verified edge-clean by
+ * `test/types/public-api-no-thirdparty-leaks.test.ts` and the
+ * complementary `saml-sp-no-thirdparty-leaks.test.ts` — neither this
+ * subpath's third-party deps nor its public types are reachable from
+ * `@_mustachio/openauth`.
+ *
+ * See `docs/plans/claude/saml-sp-plan.md` for the architectural
+ * decisions backing this surface (SAML-AD1–AD7) and the phase plan.
+ */
+export { samlSpFactory } from "./factory";
+export { parseSamlIdpMetadata } from "./parse-idp-metadata";
+export type { SamlAttributeMapping, SamlAttributeRef, SamlIdpConfig, SamlIdpInitiatedConfig, SamlIdpSigningCert, SamlNameIdFormat, SamlSpConfig, SamlSpProperties, SamlSpState, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/methods/saml-sp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,GACZ,MAAM,SAAS,CAAA"}

package/dist/types/methods/saml-sp/metadata.d.ts

@@ -0,0 +1,42 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlNameIdFormat, SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export type SpMetadataInput = {
+    spEntityId: string;
+    acsUrl: string;
+    /**
+     * The SP's own Single Logout Service URL (`/m/<methodId>/sls`).
+     * Present ⇒ front-channel SLO is served, so the metadata advertises
+     * `SingleLogoutService` for both bindings we accept. Same
+     * advertise-only-what-we-serve invariant as the ACS / signing cert.
+     */
+    slsUrl?: string;
+    nameIdFormat?: SamlNameIdFormat;
+    /**
+     * SP signing cert (PEM). Present ⇒ we sign AuthnRequests, so the
+     * metadata advertises `AuthnRequestsSigned="true"` and a
+     * `KeyDescriptor use="signing"`. Keeping this in lockstep with the
+     * runtime (the same `config.signingKey.certPem` that actually signs)
+     * is the same anti-drift invariant as the entityID/ACS.
+     */
+    signingCertPem?: string;
+    /**
+     * SP encryption cert (PEM). Present ⇒ the connection accepts
+     * encrypted assertions, so the metadata advertises a
+     * `KeyDescriptor use="encryption"` (the cert the IdP encrypts to —
+     * `config.decryptionKey.certPem`). Same anti-drift / advertise-only-
+     * what-we-serve invariant as the signing cert.
+     */
+    encryptionCertPem?: string;
+};
+/**
+ * Pure SP metadata builder. Mirrors `parseSamlIdpMetadata`'s purity so
+ * it is trivially unit-testable and reusable.
+ */
+export declare function buildSpMetadataXml(input: SpMetadataInput): string;
+/**
+ * `GET /metadata` route handler. Anonymous (declared in the method's
+ * `publicRoutes`): `ctx.flow` / `ctx.methodState` are null; everything
+ * comes from `ctx.tenant` + `ctx.dispatch` + captured config.
+ */
+export declare function buildSpMetadata(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/types/methods/saml-sp/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/metadata.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGrE,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAsBhB,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAUD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAiDjE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAgDtD"}

package/dist/types/methods/saml-sp/method.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `buildSamlSpMethod` — assembles the `AuthMethod` for a SAML SP
+ * instance. Mirrors `buildOauth2Method`: data + handler functions, no
+ * framework imports beyond `types/`.
+ *
+ * Routes:
+ *   - `GET /authorize`  → SP-initiated AuthnRequest redirect (implemented).
+ *   - `GET /callback`   → ACS verification gauntlet (next increment).
+ *
+ * The framework's universal callback (`/cb/<methodId>`, both GET and
+ * POST) always dispatches the `"GET /callback"` route key, so the ACS
+ * lives there rather than at a bespoke `/acs` sub-path.
+ */
+import type { AuthMethod } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function buildSamlSpMethod(id: string, kind: string, config: SamlSpConfig): AuthMethod<SamlSpProperties, SamlSpState>;
+//# sourceMappingURL=method.d.ts.map

package/dist/types/methods/saml-sp/method.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,oBAAoB,CAAA;AAOnE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1E,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,GACnB,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAsC3C"}

package/dist/types/methods/saml-sp/parse-idp-metadata.d.ts

@@ -0,0 +1,4 @@
+import type { Result } from "../../types/result";
+import type { SamlIdpConfig } from "./types";
+export declare function parseSamlIdpMetadata(xml: string): Result<SamlIdpConfig>;
+//# sourceMappingURL=parse-idp-metadata.d.ts.map

package/dist/types/methods/saml-sp/parse-idp-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-idp-metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/parse-idp-metadata.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAMhD,OAAO,KAAK,EAAE,aAAa,EAAoB,MAAM,SAAS,CAAA;AA8C9D,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,GACV,MAAM,CAAC,aAAa,CAAC,CA6FvB"}

package/dist/types/methods/saml-sp/saml-instance.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Construct a `@node-saml/node-saml` `SAML` instance from validated
+ * `SamlSpConfig` plus the per-request binding context (SP entityID +
+ * ACS URL, both derived at dispatch time per SAML-AD5).
+ *
+ * CJS interop: node-saml is CommonJS-only. Per the SAML house-style
+ * note, default-import then destructure rather than relying on the
+ * named-export heuristic.
+ */
+import nodeSaml from "@node-saml/node-saml";
+import type { MethodScratch } from "../../types/method";
+import type { SamlNameIdFormat, SamlSpConfig } from "./types";
+declare const SAML: typeof nodeSaml.SAML;
+type SamlInstance = InstanceType<typeof SAML>;
+/** Standard SAML 2.0 NameID format URNs. */
+export declare const NAME_ID_FORMAT_URN: Record<SamlNameIdFormat, string>;
+export type SamlBindingContext = {
+    /** SP entityID — `<issuerUrl>/<tenantId>/<methodId>` (SAML-AD5). */
+    spEntityId: string;
+    /** ACS URL — the framework's `/cb/<methodId>` universal callback. */
+    acsUrl: string;
+    /** Per-request scratch backing the `InResponseTo` cache. */
+    scratch: MethodScratch;
+    /**
+     * IdP-initiated mode. An unsolicited Response has no `InResponseTo`
+     * (there was no AuthnRequest), so `validateInResponseTo` must be
+     * `ifPresent` rather than `always` — otherwise node-saml throws
+     * "InResponseTo is missing". Signature / Issuer / Audience /
+     * Conditions are still fully enforced; assertion-ID replay dedup is
+     * layered on top by the caller (node-saml does not dedup unsolicited
+     * assertion IDs). Default `false` ⇒ SP-initiated, `always`
+     * (unchanged).
+     */
+    idpInitiated?: boolean;
+    /**
+     * Logout-binding instance (the `/sls` + `/logout` paths). node-saml's
+     * `InResponseTo` machinery only reads the attribute off a `Response`
+     * root, never a `LogoutResponse`, so with the default `always` it
+     * throws "InResponseTo is missing" on every inbound `LogoutResponse`.
+     * Front-channel logout correlation is out of that scope — we
+     * replay-dedup the inbound `LogoutRequest @ID` via `methodScratch`
+     * instead — so logout instances use `never`. Overrides `idpInitiated`.
+     */
+    logout?: boolean;
+    /**
+     * Per-connection SP signing material (SAML-AD: O3 — decoupled from
+     * the OIDC `KeyStore`; the IdP pins this cert, rotation is an
+     * IdP-coordination event). Present ⇒ node-saml signs the outbound
+     * `AuthnRequest` (HTTP-Redirect binding) **and** outbound logout
+     * messages (`LogoutRequest` / `LogoutResponse`) with it.
+     */
+    signing?: {
+        privateKeyPem: string;
+        certPem: string;
+    };
+    /**
+     * IdP Single Logout endpoint (`SamlSpConfig.idp.sloUrl`). Destination
+     * for SP-emitted `LogoutResponse` (front-channel SLO, Phase 3) and
+     * SP-initiated `LogoutRequest`. Only needed on the `/sls` path; the
+     * SSO paths leave it unset.
+     */
+    logoutUrl?: string;
+    /**
+     * SP decryption private key PEM (`SamlSpConfig.decryptionKey`),
+     * passed through to node-saml's `decryptionPvk`. Present ⇒ node-saml
+     * decrypts `<saml:EncryptedAssertion>` (the decrypted assertion's
+     * XML-DSig is still fully enforced). Set only when the connection
+     * opted into `allowEncryptedAssertions`; absent ⇒ an encrypted
+     * assertion is rejected.
+     */
+    decryptionPvk?: string;
+};
+/**
+ * Derive the per-instance SP entityID. Stable across deploys for a
+ * given `(issuerUrl, tenantId, methodId)` triple so IdP-side trust
+ * config doesn't churn.
+ */
+export declare function deriveSpEntityId(issuerUrl: string, tenantId: string, methodId: string): string;
+export declare function buildSamlInstance(config: SamlSpConfig, binding: SamlBindingContext, nowMs: number): SamlInstance;
+export {};
+//# sourceMappingURL=saml-instance.d.ts.map

package/dist/types/methods/saml-sp/saml-instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-instance.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/saml-instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,QAAQ,MAAM,sBAAsB,CAAA;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7D,QAAA,MAAQ,IAAI,sBAAmC,CAAA;AAC/C,KAAK,YAAY,GAAG,YAAY,CAAC,OAAO,IAAI,CAAC,CAAA;AAE7C,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAK/D,CAAA;AAUD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,OAAO,EAAE,aAAa,CAAA;IACtB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,aAAa,EAAE,MAAM,CAAA;QACrB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAGR;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,GACZ,YAAY,CA6Dd"}

package/dist/types/methods/saml-sp/slo-initiate.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function initiateSpLogout(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=slo-initiate.d.ts.map

package/dist/types/methods/saml-sp/slo-initiate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slo-initiate.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/slo-initiate.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOrE,OAAO,KAAK,EAEV,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAEhB,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAgItD"}

package/dist/types/methods/saml-sp/sls.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function consumeSls(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=sls.d.ts.map

package/dist/types/methods/saml-sp/sls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sls.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/sls.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAmB1E,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAsPtD"}

package/dist/types/methods/saml-sp/types.d.ts

@@ -0,0 +1,204 @@
+/**
+ * SAML SP — public types.
+ *
+ * These types are the locked contract for the SAML SP method family and
+ * are intentionally introduced ahead of the runtime implementation so
+ * downstream callers can import them today, and so the public-API
+ * leak guard
+ * (`test/types/saml-sp-no-thirdparty-leaks.test.ts`) can verify
+ * the shapes before any `@node-saml/*` or `xml-crypto` code lands.
+ *
+ * No third-party types appear here. `@node-saml/node-saml`'s `Profile`
+ * is mapped onto `SamlSpProperties` at the wrapper boundary; consumers
+ * never see node-saml's surface.
+ *
+ * See `docs/plans/claude/saml-sp-plan.md` for the architectural
+ * decisions (SAML-AD1–AD7) backing this shape.
+ */
+/**
+ * Standard SAML 2.0 NameID formats we support.
+ *
+ *   - `persistent`     — opaque, stable per user/SP pair; preferred.
+ *   - `transient`      — opaque, single-session.
+ *   - `emailAddress`   — RFC 822 email; common with legacy IdPs.
+ *   - `unspecified`    — IdP picks; pass through verbatim.
+ */
+export type SamlNameIdFormat = "persistent" | "transient" | "emailAddress" | "unspecified";
+/**
+ * One field's source. Either the assertion's NameID or a named
+ * attribute. `format` narrows attribute lookup when an IdP issues
+ * multiple attributes with the same `Name` but different `NameFormat`.
+ */
+export type SamlAttributeRef = {
+    source: "nameId";
+} | {
+    source: "attribute";
+    name: string;
+    format?: string;
+};
+/**
+ * How the SAML method translates a verified assertion into the
+ * `providerSubject` + per-claim fields that flow into the host's
+ * `success` callback. Mirrors the OIDC method's claim-mapping
+ * configuration — the host owns the final `SubjectClaim`; this map
+ * just normalises the SAML side.
+ */
+export type SamlAttributeMapping = {
+    /** Which attribute becomes `providerSubject`. Defaults to NameID. */
+    subject?: SamlAttributeRef;
+    email?: SamlAttributeRef;
+    /** SAML assertions are typically issued only after IdP-side verification. */
+    emailVerified?: {
+        source: "literal";
+        value: boolean;
+    };
+    name?: SamlAttributeRef;
+    /** Multi-valued — the mapper preserves array shape. */
+    groups?: SamlAttributeRef;
+    /** Pass-through map for additional claims hosts want surfaced. */
+    custom?: Record<string, SamlAttributeRef>;
+};
+/**
+ * A single PEM-encoded IdP signing certificate, optionally bounded by a
+ * validity window. The runtime verifier accepts any cert whose window
+ * covers `now` — supports overlapping hot rotation without re-deploys.
+ */
+export type SamlIdpSigningCert = {
+    pem: string;
+    /** Inclusive lower bound. Unix ms. Omit for no lower bound. */
+    notBefore?: number;
+    /** Exclusive upper bound. Unix ms. Omit for no upper bound. */
+    notAfter?: number;
+};
+/**
+ * Identity-Provider-side configuration the host paste/imports from the
+ * IdP's metadata XML (or uploads a metadata URL we fetch once). Stable
+ * across deploys — keyed by `(tenantId, methodId)` in `MethodStore`.
+ */
+export type SamlIdpConfig = {
+    entityId: string;
+    /** SSO endpoint URL. HTTP-Redirect binding is the default. */
+    ssoUrl: string;
+    /** Single Logout endpoint URL. Optional; Phase 3 deliverable. */
+    sloUrl?: string;
+    /** Preferred NameID format requested in `AuthnRequest`. */
+    nameIdFormat?: SamlNameIdFormat;
+    /** One or more IdP signing certs. ≥1 required. Hot-rotatable. */
+    signingCerts: ReadonlyArray<SamlIdpSigningCert>;
+};
+/**
+ * IdP-initiated SSO binding. When set, the ACS endpoint accepts
+ * unsolicited SAML Responses (no `InResponseTo`) and synthesizes a
+ * flow record using these defaults so the existing
+ * `MethodResult.success` path can run end-to-end.
+ *
+ * Documented in plan SAML-AD7 — this is the one architectural carve-out
+ * SAML imposes on the framework. Omit to reject unsolicited Responses
+ * with `invalid_request` (the conservative default).
+ */
+export type SamlIdpInitiatedConfig = {
+    defaultClientId: string;
+    defaultRedirectUri: string;
+    defaultScopes?: string[];
+};
+/**
+ * Tenant-supplied configuration for a SAML SP method instance.
+ * Validated by `samlSpFactory.configSchema` (Standard Schema v1).
+ */
+export type SamlSpConfig = {
+    idp: SamlIdpConfig;
+    attributeMapping: SamlAttributeMapping;
+    /** Whether to sign outbound `AuthnRequest`. Default `false`. */
+    signAuthnRequest?: boolean;
+    /**
+     * Per-connection SP signing keypair (SAML-AD: O3). **Decoupled from
+     * the OIDC `KeyStore` on purpose** — the SP signing cert is pinned at
+     * the IdP and rotated as an IdP-coordination event, not on the OIDC
+     * token-key schedule; this also keeps the design KMS-agnostic.
+     * `privateKeyPem` signs the `AuthnRequest`; `certPem` is what the IdP
+     * pins and what SP metadata advertises. Required iff
+     * `signAuthnRequest` is `true`. Treat `privateKeyPem` as a secret:
+     * the host should encrypt the `MethodStore` at rest (or supply it via
+     * its own resolver) — same handling as any per-tenant credential.
+     */
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    };
+    /**
+     * Accept `<saml:EncryptedAssertion>` responses. **Off by default** —
+     * a connection only opts in when its IdP is configured to encrypt.
+     * When `false`, an encrypted assertion is rejected (the SP advertises
+     * no decryption cert and node-saml has no `decryptionPvk`). Requires
+     * `decryptionKey` when `true` (enforced by `configSchema`).
+     */
+    allowEncryptedAssertions?: boolean;
+    /**
+     * Per-connection SP **decryption** keypair — the private half the IdP
+     * encrypts assertions to. Same SAML-AD O3 rationale as `signingKey`:
+     * decoupled from the OIDC `KeyStore` (the IdP pins the matching cert
+     * via SP metadata; rotation is an IdP-coordination event;
+     * KMS-agnostic). Required iff `allowEncryptedAssertions` is `true`.
+     * Treat `privateKeyPem` as a secret: the host should encrypt the
+     * `MethodStore` at rest (or supply it via its own resolver) — same
+     * handling as `signingKey.privateKeyPem` and any per-tenant
+     * credential. `certPem` is the matching X.509 cert the IdP encrypts
+     * to; SP metadata advertises it as a `use="encryption"`
+     * `KeyDescriptor` (same advertise-only-what-we-serve invariant as
+     * `signingKey`).
+     */
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    };
+    idpInitiated?: SamlIdpInitiatedConfig;
+    /** Clock skew allowance for `NotBefore` / `NotOnOrAfter`. Seconds. */
+    clockSkewSeconds?: number;
+};
+/**
+ * Method-private state stashed in `FlowRecord.methodState` for the
+ * duration of an SP-initiated flow.
+ *
+ * `InResponseTo` correlation is handled out-of-band by node-saml's
+ * `CacheProvider` (backed by `methodScratch`), so the outstanding
+ * request id does **not** live here — only the framework state
+ * envelope echoed as RelayState and the issuance timestamp.
+ */
+export type SamlSpState = {
+    relayState: string;
+    issuedAt: number;
+    /**
+     * SP entityID + ACS URL computed at AuthnRequest time, where the
+     * framework's dispatch context is available. The ACS dispatch has
+     * no dispatch context, so these are read back from here to validate
+     * the assertion's `AudienceRestriction` / `Recipient` against the
+     * exact values the IdP saw in the request.
+     */
+    spEntityId: string;
+    acsUrl: string;
+};
+/**
+ * Properties handed to the host's `IdPOptions.success` callback on a
+ * successful SAML authentication. The host translates these into the
+ * final `SubjectClaim` it owns.
+ *
+ * `raw.responseXml` is provided as an escape hatch for hosts that want
+ * to inspect the verified Response themselves; the wrapper has already
+ * run the full signature gauntlet by the time these properties leave
+ * the method.
+ */
+export type SamlSpProperties = {
+    nameId: {
+        value: string;
+        format: SamlNameIdFormat;
+    };
+    attributes: Record<string, string | string[]>;
+    /** Used for Single Logout correlation (Phase 3). */
+    sessionIndex?: string;
+    /** Unix ms — the assertion's `AuthnInstant`. */
+    authnInstant: number;
+    raw: {
+        responseXml: string;
+    };
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/methods/saml-sp/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,WAAW,GACX,cAAc,GACd,aAAa,CAAA;AAEjB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,qEAAqE;IACrE,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAA;IACrD,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;CAC1C,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B,iEAAiE;IACjE,YAAY,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAChD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,aAAa,CAAA;IAClB,gBAAgB,EAAE,oBAAoB,CAAA;IACtC,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1D,YAAY,CAAC,EAAE,sBAAsB,CAAA;IACrC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,EAAE,gBAAgB,CAAA;KACzB,CAAA;IACD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;IAC7C,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE;QACH,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA"}

package/dist/types/ports/audit-log.d.ts

@@ -49,6 +49,10 @@ export type AuditEvent = {
     subjectId: string;
     /** Hash of the issued refresh token id — never the token itself. */
     refreshTokenIdHash?: string;
+    /** OIDC Core §2 — set when the response carried an `id_token`. */
+    idTokenIssued?: boolean;
+    /** RFC 9449 — set when the access token is DPoP-bound. */
+    dpopBound?: boolean;
 } | {
     kind: "token_refreshed";
     tenantId: TenantId;
@@ -77,6 +81,42 @@ export type AuditEvent = {
     tenantId: TenantId;
     clientId: string;
     family: string;
+} | {
+    /**
+     * Emitted after a logout is processed. Two channels, discriminated
+     * by `via`:
+     *
+     *  - `rp_initiated` (or absent — the default): `/end_session`
+     *    (OIDC RP-Initiated Logout 1.0 §2), regardless of whether a
+     *    `post_logout_redirect_uri` was supplied. `subjectId` present
+     *    when an `id_token_hint` verified; absent otherwise.
+     *  - `upstream_slo`: an upstream IdP notified us a federated
+     *    session ended (SAML front-channel Single Logout). `methodId`
+     *    / `methodKind` identify the federation connection;
+     *    `subjectId` present only when the host's `onLogout` returned
+     *    a subject to revoke.
+     *
+     * `via` is general (OIDC back-channel logout would reuse
+     * `upstream_slo`), not SAML-specific surface.
+     */
+    kind: "session_logout";
+    tenantId: TenantId;
+    clientId?: string;
+    subjectId?: string;
+    via?: "rp_initiated" | "upstream_slo";
+    methodId?: string;
+    methodKind?: string;
+} | {
+    /**
+     * Emitted when a DPoP proof's `jti` is presented within the replay
+     * window (RFC 9449 §11.1). The request was rejected with
+     * `invalid_dpop_proof`. Operators / SIEM use this to spot
+     * stolen-key replay attempts.
+     */
+    kind: "dpop_replay_detected";
+    tenantId: TenantId | null;
+    /** First-half of the offending jti so logs can correlate without storing it. */
+    jtiPrefix: string;
 } | {
     kind: "flow_replay_attempt";
     tenantId: TenantId | null;

package/dist/types/ports/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/ports/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,0DAA0D;IAC1D,YAAY,EAAE,QAAQ,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,QAAQ,CAAA;IACvB,YAAY,EAAE,QAAQ,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAEL,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,CAAA"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/ports/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,0DAA0D;IAC1D,YAAY,EAAE,QAAQ,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,EAAE,gBAAgB,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,cAAc,GAAG,cAAc,CAAA;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,QAAQ,CAAA;IACvB,YAAY,EAAE,QAAQ,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAEL,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,CAAA"}

package/dist/types/ports/session-store.d.ts

@@ -67,6 +67,56 @@ export type SessionStore = {
     createSession?(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
     readSession?(sessionId: string): Promise<Result<SessionRecord>>;
     revokeSession?(sessionId: string): Promise<Result<void>>;
+    /**
+     * Optional: Pushed Authorization Request (RFC 9126) storage. Persists the
+     * pre-parsed `/authorize` parameters under an opaque `request_uri` for
+     * one-shot retrieval at `/authorize` time. Strong consistency + atomic
+     * delete-on-read — same semantics as `saveFlow` / `consumeFlow`.
+     *
+     * Adapters without these methods cannot satisfy `/par`; the framework's
+     * `/par` handler returns `invalid_request` when called against such a
+     * store. Implement both methods together (the framework only exposes
+     * the endpoint when both are present).
+     */
+    savePar?(requestUri: string, payload: ParRecord, ttl: number): Promise<Result<void>>;
+    consumePar?(requestUri: string): Promise<Result<ParRecord>>;
+    /**
+     * Optional: per-method-instance scratch storage. Survives across flows
+     * (unlike `methodState`, which is per-flow). Use cases include cross-flow
+     * deduplication state — e.g., a SAML SP method remembering recently-seen
+     * assertion IDs for replay protection.
+     *
+     * The framework scopes keys per `(tenantId, methodId)` before calling
+     * these — adapters see opaque, already-namespaced keys and store the
+     * UTF-8 string value verbatim. Methods JSON-encode if they want object
+     * state.
+     *
+     * Strong consistency + TTL respect (same semantics as flow records).
+     * `readScratch` returns `unknown_state` if the key is missing or
+     * expired. `deleteScratch` is idempotent.
+     *
+     * Adapters without these methods cannot host methods that depend on
+     * scratch; the framework surfaces a clear `unsupported` error through
+     * `MethodContext.methodScratch` at call time. Implement all three
+     * methods together — partial implementations are not supported.
+     */
+    saveScratch?(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    readScratch?(key: string): Promise<Result<string>>;
+    deleteScratch?(key: string): Promise<Result<void>>;
+};
+/**
+ * Stored PAR payload. The `params` blob is the raw form/query record from
+ * `POST /par`, kept verbatim so the `/authorize` rehydrate path can feed
+ * it through the same Zod parser the direct path uses.
+ */
+export type ParRecord = {
+    requestUri: string;
+    /** Raw key/value record as posted to `/par` (excluding auth fields). */
+    params: Record<string, string>;
+    clientId: string;
+    /** Wall-clock issuance + absolute expiry (ms). */
+    issuedAt: number;
+    expiresAt: number;
 };
 /** Optional long-lived session payload (used by `createSession` family). */
 export type SessionRecord = {

package/dist/types/ports/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../src/ports/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;OAKG;IACH,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;OAQG;IACH,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAErD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAExD;;;;OAIG;IACH,aAAa,CAAC,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CACzD,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../src/ports/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;OAKG;IACH,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;OAQG;IACH,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAErD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAExD;;;;OAIG;IACH,aAAa,CAAC,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,CACN,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,UAAU,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IAE3D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,CACV,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CACnD,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA"}

package/dist/types/ports/token-store.d.ts

@@ -89,5 +89,17 @@ export type TokenStore = {
      * preferred; documented eventual lag acceptable.
      */
     revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+    /**
+     * Optional: DPoP proof replay protection (RFC 9449 §11.1). Atomically
+     * record the proof's `jti` and reject if it's been seen within the TTL
+     * window. Returns `invalid_grant` (with `reuseSignal` omitted) when a
+     * `jti` is already present.
+     *
+     * Adapters without this method cannot satisfy DPoP at the token /
+     * userinfo endpoints; the framework's DPoP verifier returns
+     * `invalid_dpop_proof` when called against such a store. Memory adapter
+     * implements; production adapters follow in subsequent commits.
+     */
+    recordDpopJti?(jti: string, ttlMs: number): Promise<Result<void>>;
 };
 //# sourceMappingURL=token-store.d.ts.map

package/dist/types/ports/token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../src/ports/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAE9E;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAElD;;;OAGG;IACH,WAAW,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;;;;;;;;OAkBG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAEvC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAElE;;;;OAIG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAEnD;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAC9E,CAAA"}
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../src/ports/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAE9E;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAElD;;;OAGG;IACH,WAAW,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;;;;;;;;OAkBG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAEvC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAElE;;;;OAIG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAEnD;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAE7E;;;;;;;;;;OAUG;IACH,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAClE,CAAA"}

package/dist/types/types/authorization.d.ts

@@ -36,6 +36,29 @@ export type AuthorizationRequest = {
     uiLocales?: string[];
     /** Standard OIDC. */
     nonce?: string;
+    /**
+     * OIDC Core §5.5 — RP-requested claims, parsed from the `claims`
+     * parameter's JSON value. The library currently honors claim **names**
+     * (additive, bypasses scope gating) but does not enforce the
+     * `essential` / `value` / `values` qualifiers.
+     */
+    claimsRequest?: ClaimsRequest;
+};
+/**
+ * OIDC Core §5.5 `claims` parameter. Each section maps claim name to an
+ * optional qualifier object (`{essential, value, values}`) or `null`
+ * meaning "just request the claim without qualifiers".
+ */
+export type ClaimsRequest = {
+    /** Claims to include in the `/userinfo` response. */
+    userinfo?: Record<string, ClaimRequestEntry | null>;
+    /** Claims to include in the `id_token`. */
+    id_token?: Record<string, ClaimRequestEntry | null>;
+};
+export type ClaimRequestEntry = {
+    essential?: boolean;
+    value?: unknown;
+    values?: unknown[];
 };
 /**
  * In-memory authorization state produced by `domain/authorize.startAuthorize`

package/dist/types/types/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../src/types/authorization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,qBAAqB;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../src/types/authorization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,qBAAqB;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;CAC9B,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACnD,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAA;CACpD,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,EAAE,CAAA;CACnB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA"}