@_mustachio/openauth 0.11.0 → 0.12.0

package/dist/types/adapters/postgres/session-store.d.ts

@@ -16,5 +16,8 @@ export declare class PostgresSessionStore implements SessionStore {
     createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
     readSession(sessionId: string): Promise<Result<SessionRecord>>;
     revokeSession(sessionId: string): Promise<Result<void>>;
+    saveScratch(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    readScratch(key: string): Promise<Result<string>>;
+    deleteScratch(key: string): Promise<Result<void>>;
 }
 //# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/postgres/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/session-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,oBAAqB,YAAW,YAAY;;gBAI3C,IAAI,EAAE,2BAA2B;IAKvC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwBlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA6BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA4BxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA6B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAW9D"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/session-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,oBAAqB,YAAW,YAAY;;gBAI3C,IAAI,EAAE,2BAA2B;IAKvC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwBlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA6BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA4BxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA6B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYvD,WAAW,CACf,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAuBlB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IA8BjD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAWxD"}

package/dist/types/domain/callback.d.ts

@@ -26,7 +26,7 @@ import type { AuditLog } from "../ports/audit-log";
 import type { AuthError } from "../types/error";
 import type { SetCookie, CachePolicy } from "../types/method";
 import type { Result } from "../types/result";
-import type { StateKeyRing } from "../types/tenant";
+import type { StateKeyRing, TenantContext } from "../types/tenant";
 import { MethodCache } from "./method-cache";
 export type CallbackOutput = {
     kind: "issue-code";
@@ -47,6 +47,21 @@ export type HandleCallbackInput = {
     /** The raw `Request` for the upstream provider's redirect. */
     rawRequest: Request;
     cookies: ReadonlyMap<string, string>;
+    /**
+     * Resolved tenant for this request. The SP-initiated path derives
+     * the tenant from the consumed flow and ignores this. The
+     * **IdP-initiated** path (unsolicited POST, no flow) has nothing to
+     * derive from, so it uses this — populated by the HTTP layer from
+     * the tenant middleware. Absent ⇒ IdP-initiated is not attempted.
+     */
+    tenant?: TenantContext;
+    /**
+     * Per-request issuer URL (HTTP layer). Used only by the
+     * IdP-initiated path to derive the SP entityID / ACS — the same
+     * derivation the AuthnRequest and metadata paths use, so the values
+     * cannot drift.
+     */
+    issuerUrl?: string;
 };
 export type HandleCallbackDeps = {
     configStore: ConfigStore;

package/dist/types/domain/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/domain/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAgB,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAM5C,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,mBAAmB,GAAG;IAChC,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChE,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAiG5C"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/domain/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAgB,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAM5C,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,mBAAmB,GAAG;IAChC,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChE,CAAA;AA8BD,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAsH5C"}

package/dist/types/domain/method-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-dispatch.d.ts","sourceRoot":"","sources":["../../../src/domain/method-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,YAAY,EACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAEpD,MAAM,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAEpD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAgD5D"}
+{"version":3,"file":"method-dispatch.d.ts","sourceRoot":"","sources":["../../../src/domain/method-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,YAAY,EAEb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAA;AAE9D,MAAM,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAEpD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAqD5D"}

package/dist/types/domain/method-route.d.ts

@@ -31,10 +31,12 @@ import type { KeyStore } from "../ports/key-store";
 import type { SessionStore } from "../ports/session-store";
 import type { TokenStore } from "../ports/token-store";
 import { type AuthError } from "../types/error";
-import type { CachePolicy, SetCookie } from "../types/method";
+import type { LogoutEventInput, LogoutHookResult } from "../types/idp";
+import type { AuthMethod, CachePolicy, MethodDispatchData, SetCookie } from "../types/method";
 import type { Result } from "../types/result";
 import type { TenantContext } from "../types/tenant";
 import { MethodCache } from "./method-cache";
+import { type RouteKey } from "./method-dispatch";
 export type MethodRouteOutput = {
     kind: "issue-code";
     code: string;
@@ -74,4 +76,58 @@ export type HandleMethodRouteDeps = {
     newCodeId?: () => string;
 };
 export declare function handleMethodRoute(input: HandleMethodRouteInput, deps: HandleMethodRouteDeps): Promise<Result<MethodRouteOutput, AuthError>>;
+/**
+ * Anonymous public method route — the fourth, deliberately narrow,
+ * pipeline. Used only for route keys a method explicitly lists in
+ * `AuthMethod.publicRoutes` (today: SAML SP `GET /metadata`). No flow
+ * cookie, no flow record, no `SessionStore` read: the handler is a pure
+ * function of `tenant` + `dispatch` + captured config.
+ *
+ * Security: this re-checks `publicRoutes` membership against the
+ * resolved method. The HTTP layer also checks before routing here, but
+ * a domain function guarding a no-auth path must not trust its caller —
+ * the gate is enforced here too, fail-closed.
+ *
+ * Only `challenge` (the metadata document) and `denied` are sensible
+ * outcomes; `success` from a flowless route is a programming error
+ * (there is no flow to consume into an auth code) and surfaces as an
+ * internal error rather than silently authenticating.
+ */
+export type HandlePublicMethodRouteInput = {
+    rawRequest: Request;
+    tenant: TenantContext;
+    /** Pre-resolved by the HTTP layer (it needed it to detect the public route). */
+    method: AuthMethod;
+    route: RouteKey;
+    subPath: string;
+    /** Issuer/callback context so the handler can derive stable URLs. */
+    dispatch: MethodDispatchData;
+};
+export type HandlePublicMethodRouteDeps = {
+    sessionStore: SessionStore;
+    /**
+     * Required for the upstream-logout path: when a public route returns a
+     * `challenge` carrying `logout`, the framework runs
+     * `revokeAllForSubject` for the host-named subject. Anonymous read-only
+     * public routes (`/metadata`-style) never touch this.
+     */
+    tokenStore: TokenStore;
+    clock: () => number;
+    auditLog?: AuditLog;
+    /**
+     * See `IdPOptions.onLogout`. Absent ⇒ the framework still verifies +
+     * acknowledges the logout and audits it, but revokes nothing (it
+     * cannot resolve the upstream id to a subject without the host).
+     */
+    onLogout?: (input: LogoutEventInput) => Promise<LogoutHookResult> | LogoutHookResult;
+};
+export type PublicMethodRouteOutput = {
+    kind: "challenge";
+    response: Response;
+    cache?: CachePolicy;
+} | {
+    kind: "denied";
+    reason: string;
+};
+export declare function handlePublicMethodRoute(input: HandlePublicMethodRouteInput, deps: HandlePublicMethodRouteDeps): Promise<Result<PublicMethodRouteOutput, AuthError>>;
 //# sourceMappingURL=method-route.d.ts.map

package/dist/types/domain/method-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../src/domain/method-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,KAAK,EAAgB,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAI5C,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,GAAG,MAAM,CAAA;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;CACzB,CAAA;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAgD/C"}
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../src/domain/method-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAElB,SAAS,EACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAIjE,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,GAAG,MAAM,CAAA;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;CACzB,CAAA;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAgD/C;AA6ED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,gFAAgF;IAChF,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,QAAQ,EAAE,kBAAkB,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;CAClD,CAAA;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,EACnC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC,CAsDrD"}

package/dist/types/http/context.d.ts

@@ -14,7 +14,7 @@ import type { SessionStore } from "../ports/session-store";
 import type { TokenStore } from "../ports/token-store";
 import type { MethodCache } from "../domain/method-cache";
 import type { AuthError } from "../types/error";
-import type { ExchangeAudience, PersistUpstreamTokens, RegisterClient, RenderPicker, SuccessMapInput } from "../types/idp";
+import type { ExchangeAudience, LogoutEventInput, LogoutHookResult, PersistUpstreamTokens, RegisterClient, RenderPicker, SuccessMapInput } from "../types/idp";
 import type { Result } from "../types/result";
 import type { SubjectClaim } from "../types/subject";
 import type { StateKeyRing, TenantContext, TenantId, TenantRecovery } from "../types/tenant";
@@ -35,6 +35,8 @@ export type HttpDeps = {
     callbackHostFor?: (tenantId: TenantId) => string;
     resolveTenant: (req: Request) => Promise<Result<TenantId, AuthError>>;
     success: (input: SuccessMapInput) => Promise<SubjectClaim>;
+    /** See `IdPOptions.onLogout` — upstream Single Logout host hook. */
+    onLogout?: (input: LogoutEventInput) => Promise<LogoutHookResult> | LogoutHookResult;
     persistUpstreamTokens?: PersistUpstreamTokens;
     exchangeAudience?: ExchangeAudience;
     renderPicker?: RenderPicker;

package/dist/types/http/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IACjD,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}

package/dist/types/http/cookies.d.ts

@@ -7,7 +7,7 @@
  * strip method-returned `Set-Cookie` / security / `Cache-Control` headers so
  * methods cannot bypass policy.
  */
-import type { SetCookie } from "../types/method";
+import type { CachePolicy, SetCookie } from "../types/method";
 /** Parse an incoming `Cookie:` header into a read-only map. */
 export declare function parseCookieHeader(header: string | null): Map<string, string>;
 export type CookieDefaults = {
@@ -26,6 +26,14 @@ export type CookieDefaults = {
  *   - `null` value → `Max-Age=0` to clear.
  */
 export declare function serializeSetCookie(cookie: SetCookie, defaults?: CookieDefaults): string;
+/**
+ * Serialize a `MethodResult.challenge`'s `CachePolicy` into a
+ * `Cache-Control` header value. The framework owns this header (methods
+ * cannot set it directly — see `STRIPPED_HEADERS`); a method opts into
+ * caching via the typed `cache` field and this renders it. Absent /
+ * `maxAge: 0` ⇒ `no-store` (the safe default for auth UI).
+ */
+export declare function cacheControlHeader(cache: CachePolicy | undefined): string;
 export type ApplyOptions = {
     setCookies?: SetCookie[];
     cookieDefaults?: CookieDefaults;

package/dist/types/http/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAsB5E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,QAAQ,GAAE,cAAmB,GAC5B,MAAM,CA4BR;AAgBD,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,YAAiB,GACtB,QAAQ,CA4BV"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE7D,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAsB5E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,QAAQ,GAAE,cAAmB,GAC5B,MAAM,CA4BR;AAgBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CASzE;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,YAAiB,GACtB,QAAQ,CA4BV"}

package/dist/types/http/handlers/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/callback.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA2DjD"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/callback.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAmEjD"}

package/dist/types/http/handlers/method-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/method-route.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,OAClC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAqFjD"}
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/method-route.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,OAClC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA0JjD"}

package/dist/types/index.d.ts

@@ -20,7 +20,7 @@ export type { AuthMethod, AuthMethodFactory, CachePolicy, ClientFn, MethodContex
 export type { AuthorizationRequest, AuthorizationState, } from "./types/authorization";
 export type { AccessTokenClaims, AddressClaim, CodePayload, IdTokenClaims, RefreshTokenPayload, ScopedProfileClaims, TokenResponse, } from "./types/token";
 export type { SubjectClaim, SubjectPayload, SubjectSchema, } from "./types/subject";
-export type { ExchangeAudience, FailureEvent, IdP, IdPOptions, PersistUpstreamTokens, RegisterClient, RegisterClientRequest, RegisterClientResponse, RenderPicker, SuccessEvent, SuccessMapInput, } from "./types/idp";
+export type { ExchangeAudience, FailureEvent, IdP, IdPOptions, LogoutEventInput, LogoutHookResult, PersistUpstreamTokens, RegisterClient, RegisterClientRequest, RegisterClientResponse, RenderPicker, SuccessEvent, SuccessMapInput, } from "./types/idp";
 export type { PickerContext, PickerMethod } from "./types/picker";
 export type { AuditEvent, AuditLog } from "./ports/audit-log";
 export type { ConfigStore } from "./ports/config-store";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAqF/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAsF/C"}

package/dist/types/methods/saml-sp/acs.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function consumeAssertion(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=acs.d.ts.map

package/dist/types/methods/saml-sp/acs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acs.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/acs.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAmI1E,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAqNtD"}

package/dist/types/methods/saml-sp/attributes.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Attribute mapping — translate a node-saml `Profile` (already
+ * cryptographically verified by the time it reaches here) into our
+ * `SamlSpProperties`.
+ *
+ * node-saml flattens the assertion's `AttributeStatement` onto the
+ * `Profile` object as arbitrary top-level keys (single value → string,
+ * multi-valued → array), plus the structural `nameID` /
+ * `nameIDFormat` / `sessionIndex`. The host's `success` callback owns
+ * the final `SubjectClaim`; this layer just normalises the SAML side
+ * per the tenant's configured `SamlAttributeMapping`.
+ *
+ * Pure: no node-saml import, no I/O. `Profile` is modelled here as the
+ * minimal structural shape we read, so this file stays free of the
+ * third-party type (the public-API leak guard depends on that).
+ */
+import type { SamlAttributeMapping, SamlSpProperties } from "./types";
+/** The slice of node-saml's `Profile` we actually consume. */
+export type VerifiedProfile = {
+    nameID: string;
+    nameIDFormat: string;
+    sessionIndex?: string;
+    attributes: Record<string, unknown>;
+    authnInstant?: string;
+    responseXml: string;
+};
+export type MappedSubject = {
+    providerSubject: string;
+    properties: SamlSpProperties;
+};
+/**
+ * Build `(providerSubject, properties)` from a verified profile.
+ * Returns a string describing the failure when the configured subject
+ * source resolves to nothing — the caller turns that into a `denied`
+ * result rather than minting a subject-less success.
+ */
+export declare function mapProfile(profile: VerifiedProfile, mapping: SamlAttributeMapping): MappedSubject | {
+    error: string;
+};
+//# sourceMappingURL=attributes.d.ts.map

package/dist/types/methods/saml-sp/attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attributes.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EACV,oBAAoB,EAGpB,gBAAgB,EACjB,MAAM,SAAS,CAAA;AAEhB,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAwCD,MAAM,MAAM,aAAa,GAAG;IAC1B,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,gBAAgB,CAAA;CAC7B,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,oBAAoB,GAC5B,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAmDnC"}

package/dist/types/methods/saml-sp/authnrequest.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function buildAuthnRequestRedirect(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=authnrequest.d.ts.map

package/dist/types/methods/saml-sp/authnrequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authnrequest.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/authnrequest.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1E,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAyGtD"}

package/dist/types/methods/saml-sp/cache-provider.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `@node-saml/node-saml` `CacheProvider` backed by `methodScratch`.
+ *
+ * node-saml tracks outstanding `AuthnRequest` IDs through a
+ * `CacheProvider`: `saveAsync(requestId, marker)` when the request is
+ * generated, then `getAsync` + `removeAsync` during response
+ * validation to enforce `InResponseTo` (defeats unsolicited /
+ * replayed Responses on the SP-initiated path).
+ *
+ * The default in-memory provider is single-process only. We back it
+ * with `MethodContext.methodScratch`, which is already scoped per
+ * `(tenantId, methodId)` and shared across instances via the
+ * `SessionStore` adapter — so an AuthnRequest minted on one node
+ * validates on another.
+ *
+ * `methodScratch.get` returning `unknown_state` (missing / expired)
+ * maps to `null`, which is exactly node-saml's "unknown request id"
+ * signal.
+ */
+import type { MethodScratch } from "../../types/method";
+type CacheItem = {
+    value: string;
+    createdAt: number;
+};
+type NodeSamlCacheProvider = {
+    saveAsync(key: string, value: string): Promise<CacheItem | null>;
+    getAsync(key: string): Promise<string | null>;
+    removeAsync(key: string | null): Promise<string | null>;
+};
+/**
+ * @param scratch  Per-request `MethodContext.methodScratch`.
+ * @param ttlMs    How long an outstanding request id stays valid. Should
+ *                  comfortably exceed the slowest realistic IdP login
+ *                  (the flow record itself expires independently).
+ */
+export declare function methodScratchCacheProvider(scratch: MethodScratch, ttlMs: number): NodeSamlCacheProvider;
+export {};
+//# sourceMappingURL=cache-provider.d.ts.map

package/dist/types/methods/saml-sp/cache-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-provider.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/cache-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,KAAK,SAAS,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AACrD,KAAK,qBAAqB,GAAG;IAC3B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC7C,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACxD,CAAA;AAKD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,MAAM,GACZ,qBAAqB,CAiCvB"}

package/dist/types/methods/saml-sp/cert-rotation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Cert-rotation shim.
+ *
+ * `@node-saml/node-saml`'s `idpCert` accepts a single PEM, an array of
+ * PEMs, or a callback. Our config models hot rotation as an array of
+ * `{ pem, notBefore?, notAfter? }`. This pure function filters that
+ * array to the certs whose validity window covers `now`, producing the
+ * PEM list node-saml verifies against.
+ *
+ * A cert with no `notBefore` has no lower bound; no `notAfter` has no
+ * upper bound. `notBefore` is inclusive, `notAfter` is exclusive — a
+ * cert is active while `notBefore <= now < notAfter`. Overlapping
+ * windows are the whole point: during rotation both the outgoing and
+ * incoming cert are active so in-flight assertions from either key
+ * still verify.
+ *
+ * Returns `[]` when nothing is in window — the caller surfaces a
+ * configuration error rather than handing node-saml an empty cert set
+ * (which it would treat as "accept nothing").
+ */
+import type { SamlIdpSigningCert } from "./types";
+export declare function selectActiveCertPems(certs: ReadonlyArray<SamlIdpSigningCert>, nowMs: number): string[];
+//# sourceMappingURL=cert-rotation.d.ts.map

package/dist/types/methods/saml-sp/cert-rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-rotation.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/cert-rotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAEjD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,aAAa,CAAC,kBAAkB,CAAC,EACxC,KAAK,EAAE,MAAM,GACZ,MAAM,EAAE,CAQV"}