@_mustachio/openauth 0.10.0 → 0.12.0

package/dist/types/http/handlers/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/token.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,OAC5B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA6KjD"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/token.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,OAC5B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAoOjD"}

package/dist/types/http/handlers/userinfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/userinfo.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAEvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAiDjD"}
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/userinfo.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAEvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAgDjD"}

package/dist/types/http/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAW3B,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAmCzD"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAc3B,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAmDzD"}

package/dist/types/http/schemas/authorize.d.ts

@@ -8,6 +8,12 @@
  * requirement, etc.).
  */
 import { z } from "zod";
+/**
+ * Standard `/authorize` query schema. Used both for direct calls and as
+ * the validation target after a PAR record is rehydrated — the PAR'd
+ * params are passed through this same parser so semantic checks stay in
+ * a single place.
+ */
 export declare const authorizeQuerySchema: z.ZodObject<{
     response_type: z.ZodString;
     client_id: z.ZodString;
@@ -21,6 +27,12 @@ export declare const authorizeQuerySchema: z.ZodObject<{
     prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     nonce: z.ZodOptional<z.ZodString>;
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.ZodOptional<z.ZodString>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     response_type: z.ZodString;
     client_id: z.ZodString;
@@ -34,6 +46,12 @@ export declare const authorizeQuerySchema: z.ZodObject<{
     prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     nonce: z.ZodOptional<z.ZodString>;
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.ZodOptional<z.ZodString>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     response_type: z.ZodString;
     client_id: z.ZodString;
@@ -47,6 +65,28 @@ export declare const authorizeQuerySchema: z.ZodObject<{
     prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     nonce: z.ZodOptional<z.ZodString>;
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * RFC 9126 §4: when `request_uri` is presented, the user-agent's
+ * `/authorize` URL is allowed to carry only `client_id` and
+ * `request_uri`; the rest of the parameter set must come from the
+ * stored PAR record.
+ */
+export declare const authorizeRequestUriQuerySchema: z.ZodObject<{
+    client_id: z.ZodString;
+    request_uri: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    client_id: z.ZodString;
+    request_uri: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    client_id: z.ZodString;
+    request_uri: z.ZodString;
 }, z.ZodTypeAny, "passthrough">>;
 export type AuthorizeQuery = z.infer<typeof authorizeQuerySchema>;
 //# sourceMappingURL=authorize.d.ts.map

package/dist/types/http/schemas/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAyBvB,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAqBjB,CAAA;AAEhB,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAyBvB;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;IAoB7B;;;;OAIG;;;;;;;;;;;;;;;IAJH;;;;OAIG;;;;;;;;;;;;;;;IAJH;;;;OAIG;;gCAGS,CAAA;AAEhB;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;gCAO3B,CAAA;AAEhB,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/types/http/schemas/end-session.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Zod schema for `/end_session` (OIDC RP-Initiated Logout 1.0 §2).
+ *
+ * Every parameter is optional per spec. The domain layer enforces the
+ * "needs identifying client to honor post_logout_redirect_uri" rule.
+ */
+import { z } from "zod";
+export declare const endSessionParamsSchema: z.ZodObject<{
+    id_token_hint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    logout_hint: z.ZodOptional<z.ZodString>;
+    ui_locales: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id_token_hint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    logout_hint: z.ZodOptional<z.ZodString>;
+    ui_locales: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id_token_hint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    logout_hint: z.ZodOptional<z.ZodString>;
+    ui_locales: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export type EndSessionParams = z.infer<typeof endSessionParamsSchema>;
+//# sourceMappingURL=end-session.d.ts.map

package/dist/types/http/schemas/end-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-session.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/end-session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;gCAYnB,CAAA;AAEhB,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA"}

package/dist/types/http/schemas/par.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Zod schema for the `POST /par` body (RFC 9126 §2).
+ *
+ * The shape is identical to `/authorize` query parameters; we just need
+ * `client_id` to identify the authenticating client. `client_secret` is
+ * accepted in-body for `client_secret_post` auth.
+ */
+import { z } from "zod";
+export declare const parBodySchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodString, z.objectOutputType<{
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.ZodString, "strip">, z.objectInputType<{
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.ZodString, "strip">>;
+export type ParBody = z.infer<typeof parBodySchema>;
+//# sourceMappingURL=par.d.ts.map

package/dist/types/http/schemas/par.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"par.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/par.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,aAAa;;;;;;;;;yBAWH,CAAA;AAEvB,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA"}

package/dist/types/http/schemas/register.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Zod schema for `POST /register` (RFC 7591 §2).
+ *
+ * The body is `application/json`. We surface invalid structure as
+ * `invalid_request` rather than the spec's `invalid_client_metadata` /
+ * `invalid_redirect_uri` codes — the library collapses all wire-format
+ * problems to the OAuth-2.0 `invalid_request` family for consistency.
+ */
+import { z } from "zod";
+export declare const registerBodySchema: z.ZodObject<{
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString, "many">;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<["none", "client_secret_basic", "client_secret_post"]>>;
+    scope: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sector_identifier_uri: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString, "many">;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<["none", "client_secret_basic", "client_secret_post"]>>;
+    scope: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sector_identifier_uri: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString, "many">;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<["none", "client_secret_basic", "client_secret_post"]>>;
+    scope: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sector_identifier_uri: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, z.ZodTypeAny, "passthrough">>;
+export type RegisterBody = z.infer<typeof registerBodySchema>;
+//# sourceMappingURL=register.d.ts.map

package/dist/types/http/schemas/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/register.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAgBf,CAAA;AAEhB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA"}

package/dist/types/index.d.ts

@@ -18,15 +18,15 @@ export { asTenantId } from "./types/tenant";
 export type { FlowRecord } from "./types/flow";
 export type { AuthMethod, AuthMethodFactory, CachePolicy, ClientFn, MethodContext, MethodDispatchData, MethodHandler, MethodResult, SetCookie, } from "./types/method";
 export type { AuthorizationRequest, AuthorizationState, } from "./types/authorization";
-export type { AccessTokenClaims, CodePayload, RefreshTokenPayload, TokenResponse, } from "./types/token";
+export type { AccessTokenClaims, AddressClaim, CodePayload, IdTokenClaims, RefreshTokenPayload, ScopedProfileClaims, TokenResponse, } from "./types/token";
 export type { SubjectClaim, SubjectPayload, SubjectSchema, } from "./types/subject";
-export type { ExchangeAudience, FailureEvent, IdP, IdPOptions, PersistUpstreamTokens, RenderPicker, SuccessEvent, SuccessMapInput, } from "./types/idp";
+export type { ExchangeAudience, FailureEvent, IdP, IdPOptions, LogoutEventInput, LogoutHookResult, PersistUpstreamTokens, RegisterClient, RegisterClientRequest, RegisterClientResponse, RenderPicker, SuccessEvent, SuccessMapInput, } from "./types/idp";
 export type { PickerContext, PickerMethod } from "./types/picker";
 export type { AuditEvent, AuditLog } from "./ports/audit-log";
 export type { ConfigStore } from "./ports/config-store";
 export type { EncryptionKey, KeyStore, KeyWrapper, SigningKey, } from "./ports/key-store";
 export type { MethodStore } from "./ports/method-store";
-export type { SessionRecord, SessionStore } from "./ports/session-store";
+export type { ParRecord, SessionRecord, SessionStore, } from "./ports/session-store";
 export type { TokenStore } from "./ports/token-store";
 /**
  * Host-callable primitive for "log me out of all devices" UX. Wraps

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACxE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CA8E/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAsF/C"}

package/dist/types/methods/saml-sp/acs.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function consumeAssertion(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=acs.d.ts.map

package/dist/types/methods/saml-sp/acs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acs.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/acs.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAmI1E,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAqNtD"}

package/dist/types/methods/saml-sp/attributes.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Attribute mapping — translate a node-saml `Profile` (already
+ * cryptographically verified by the time it reaches here) into our
+ * `SamlSpProperties`.
+ *
+ * node-saml flattens the assertion's `AttributeStatement` onto the
+ * `Profile` object as arbitrary top-level keys (single value → string,
+ * multi-valued → array), plus the structural `nameID` /
+ * `nameIDFormat` / `sessionIndex`. The host's `success` callback owns
+ * the final `SubjectClaim`; this layer just normalises the SAML side
+ * per the tenant's configured `SamlAttributeMapping`.
+ *
+ * Pure: no node-saml import, no I/O. `Profile` is modelled here as the
+ * minimal structural shape we read, so this file stays free of the
+ * third-party type (the public-API leak guard depends on that).
+ */
+import type { SamlAttributeMapping, SamlSpProperties } from "./types";
+/** The slice of node-saml's `Profile` we actually consume. */
+export type VerifiedProfile = {
+    nameID: string;
+    nameIDFormat: string;
+    sessionIndex?: string;
+    attributes: Record<string, unknown>;
+    authnInstant?: string;
+    responseXml: string;
+};
+export type MappedSubject = {
+    providerSubject: string;
+    properties: SamlSpProperties;
+};
+/**
+ * Build `(providerSubject, properties)` from a verified profile.
+ * Returns a string describing the failure when the configured subject
+ * source resolves to nothing — the caller turns that into a `denied`
+ * result rather than minting a subject-less success.
+ */
+export declare function mapProfile(profile: VerifiedProfile, mapping: SamlAttributeMapping): MappedSubject | {
+    error: string;
+};
+//# sourceMappingURL=attributes.d.ts.map

package/dist/types/methods/saml-sp/attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attributes.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EACV,oBAAoB,EAGpB,gBAAgB,EACjB,MAAM,SAAS,CAAA;AAEhB,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAwCD,MAAM,MAAM,aAAa,GAAG;IAC1B,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,gBAAgB,CAAA;CAC7B,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,oBAAoB,GAC5B,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAmDnC"}

package/dist/types/methods/saml-sp/authnrequest.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function buildAuthnRequestRedirect(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=authnrequest.d.ts.map

package/dist/types/methods/saml-sp/authnrequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authnrequest.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/authnrequest.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1E,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAyGtD"}

package/dist/types/methods/saml-sp/cache-provider.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `@node-saml/node-saml` `CacheProvider` backed by `methodScratch`.
+ *
+ * node-saml tracks outstanding `AuthnRequest` IDs through a
+ * `CacheProvider`: `saveAsync(requestId, marker)` when the request is
+ * generated, then `getAsync` + `removeAsync` during response
+ * validation to enforce `InResponseTo` (defeats unsolicited /
+ * replayed Responses on the SP-initiated path).
+ *
+ * The default in-memory provider is single-process only. We back it
+ * with `MethodContext.methodScratch`, which is already scoped per
+ * `(tenantId, methodId)` and shared across instances via the
+ * `SessionStore` adapter — so an AuthnRequest minted on one node
+ * validates on another.
+ *
+ * `methodScratch.get` returning `unknown_state` (missing / expired)
+ * maps to `null`, which is exactly node-saml's "unknown request id"
+ * signal.
+ */
+import type { MethodScratch } from "../../types/method";
+type CacheItem = {
+    value: string;
+    createdAt: number;
+};
+type NodeSamlCacheProvider = {
+    saveAsync(key: string, value: string): Promise<CacheItem | null>;
+    getAsync(key: string): Promise<string | null>;
+    removeAsync(key: string | null): Promise<string | null>;
+};
+/**
+ * @param scratch  Per-request `MethodContext.methodScratch`.
+ * @param ttlMs    How long an outstanding request id stays valid. Should
+ *                  comfortably exceed the slowest realistic IdP login
+ *                  (the flow record itself expires independently).
+ */
+export declare function methodScratchCacheProvider(scratch: MethodScratch, ttlMs: number): NodeSamlCacheProvider;
+export {};
+//# sourceMappingURL=cache-provider.d.ts.map

package/dist/types/methods/saml-sp/cache-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-provider.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/cache-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,KAAK,SAAS,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AACrD,KAAK,qBAAqB,GAAG;IAC3B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC7C,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACxD,CAAA;AAKD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,GACZ,qBAAqB,CAiCvB"}

package/dist/types/methods/saml-sp/cert-rotation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Cert-rotation shim.
+ *
+ * `@node-saml/node-saml`'s `idpCert` accepts a single PEM, an array of
+ * PEMs, or a callback. Our config models hot rotation as an array of
+ * `{ pem, notBefore?, notAfter? }`. This pure function filters that
+ * array to the certs whose validity window covers `now`, producing the
+ * PEM list node-saml verifies against.
+ *
+ * A cert with no `notBefore` has no lower bound; no `notAfter` has no
+ * upper bound. `notBefore` is inclusive, `notAfter` is exclusive — a
+ * cert is active while `notBefore <= now < notAfter`. Overlapping
+ * windows are the whole point: during rotation both the outgoing and
+ * incoming cert are active so in-flight assertions from either key
+ * still verify.
+ *
+ * Returns `[]` when nothing is in window — the caller surfaces a
+ * configuration error rather than handing node-saml an empty cert set
+ * (which it would treat as "accept nothing").
+ */
+import type { SamlIdpSigningCert } from "./types";
+export declare function selectActiveCertPems(certs: ReadonlyArray<SamlIdpSigningCert>, nowMs: number): string[];
+//# sourceMappingURL=cert-rotation.d.ts.map

package/dist/types/methods/saml-sp/cert-rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-rotation.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/cert-rotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAEjD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,aAAa,CAAC,kBAAkB,CAAC,EACxC,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAQV"}