@_mustachio/openauth 0.11.0 → 0.12.0

package/dist/types/methods/saml-sp/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `@_mustachio/openauth/methods/saml-sp` — SAML 2.0 Service Provider
+ * method family.
+ *
+ * **Node-only.** This entry depends transitively on
+ * `@node-saml/node-saml` and `xml-crypto`, which require `node:crypto`
+ * and the `@xmldom/xmldom` DOM. Cloudflare Workers, browsers, and
+ * other edge runtimes cannot load this module; use the root
+ * `@_mustachio/openauth` entry (OIDC / OAuth methods) on those
+ * platforms.
+ *
+ * The library's root entry is verified edge-clean by
+ * `test/types/public-api-no-thirdparty-leaks.test.ts` and the
+ * complementary `saml-sp-no-thirdparty-leaks.test.ts` — neither this
+ * subpath's third-party deps nor its public types are reachable from
+ * `@_mustachio/openauth`.
+ *
+ * See `docs/plans/claude/saml-sp-plan.md` for the architectural
+ * decisions backing this surface (SAML-AD1–AD7) and the phase plan.
+ */
+export { samlSpFactory } from "./factory";
+export { parseSamlIdpMetadata } from "./parse-idp-metadata";
+export type { SamlAttributeMapping, SamlAttributeRef, SamlIdpConfig, SamlIdpInitiatedConfig, SamlIdpSigningCert, SamlNameIdFormat, SamlSpConfig, SamlSpProperties, SamlSpState, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/methods/saml-sp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,GACZ,MAAM,SAAS,CAAA"}

package/dist/types/methods/saml-sp/metadata.d.ts

@@ -0,0 +1,42 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlNameIdFormat, SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export type SpMetadataInput = {
+    spEntityId: string;
+    acsUrl: string;
+    /**
+     * The SP's own Single Logout Service URL (`/m/<methodId>/sls`).
+     * Present ⇒ front-channel SLO is served, so the metadata advertises
+     * `SingleLogoutService` for both bindings we accept. Same
+     * advertise-only-what-we-serve invariant as the ACS / signing cert.
+     */
+    slsUrl?: string;
+    nameIdFormat?: SamlNameIdFormat;
+    /**
+     * SP signing cert (PEM). Present ⇒ we sign AuthnRequests, so the
+     * metadata advertises `AuthnRequestsSigned="true"` and a
+     * `KeyDescriptor use="signing"`. Keeping this in lockstep with the
+     * runtime (the same `config.signingKey.certPem` that actually signs)
+     * is the same anti-drift invariant as the entityID/ACS.
+     */
+    signingCertPem?: string;
+    /**
+     * SP encryption cert (PEM). Present ⇒ the connection accepts
+     * encrypted assertions, so the metadata advertises a
+     * `KeyDescriptor use="encryption"` (the cert the IdP encrypts to —
+     * `config.decryptionKey.certPem`). Same anti-drift / advertise-only-
+     * what-we-serve invariant as the signing cert.
+     */
+    encryptionCertPem?: string;
+};
+/**
+ * Pure SP metadata builder. Mirrors `parseSamlIdpMetadata`'s purity so
+ * it is trivially unit-testable and reusable.
+ */
+export declare function buildSpMetadataXml(input: SpMetadataInput): string;
+/**
+ * `GET /metadata` route handler. Anonymous (declared in the method's
+ * `publicRoutes`): `ctx.flow` / `ctx.methodState` are null; everything
+ * comes from `ctx.tenant` + `ctx.dispatch` + captured config.
+ */
+export declare function buildSpMetadata(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/types/methods/saml-sp/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/metadata.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGrE,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAsBhB,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAUD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAiDjE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAgDtD"}

package/dist/types/methods/saml-sp/method.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `buildSamlSpMethod` — assembles the `AuthMethod` for a SAML SP
+ * instance. Mirrors `buildOauth2Method`: data + handler functions, no
+ * framework imports beyond `types/`.
+ *
+ * Routes:
+ *   - `GET /authorize`  → SP-initiated AuthnRequest redirect (implemented).
+ *   - `GET /callback`   → ACS verification gauntlet (next increment).
+ *
+ * The framework's universal callback (`/cb/<methodId>`, both GET and
+ * POST) always dispatches the `"GET /callback"` route key, so the ACS
+ * lives there rather than at a bespoke `/acs` sub-path.
+ */
+import type { AuthMethod } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function buildSamlSpMethod(id: string, kind: string, config: SamlSpConfig): AuthMethod<SamlSpProperties, SamlSpState>;
+//# sourceMappingURL=method.d.ts.map

package/dist/types/methods/saml-sp/method.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,oBAAoB,CAAA;AAOnE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1E,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,GACnB,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAsC3C"}

package/dist/types/methods/saml-sp/parse-idp-metadata.d.ts

@@ -0,0 +1,4 @@
+import type { Result } from "../../types/result";
+import type { SamlIdpConfig } from "./types";
+export declare function parseSamlIdpMetadata(xml: string): Result<SamlIdpConfig>;
+//# sourceMappingURL=parse-idp-metadata.d.ts.map

package/dist/types/methods/saml-sp/parse-idp-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-idp-metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/parse-idp-metadata.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAMhD,OAAO,KAAK,EAAE,aAAa,EAAoB,MAAM,SAAS,CAAA;AA8C9D,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,GACV,MAAM,CAAC,aAAa,CAAC,CA6FvB"}

package/dist/types/methods/saml-sp/saml-instance.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Construct a `@node-saml/node-saml` `SAML` instance from validated
+ * `SamlSpConfig` plus the per-request binding context (SP entityID +
+ * ACS URL, both derived at dispatch time per SAML-AD5).
+ *
+ * CJS interop: node-saml is CommonJS-only. Per the SAML house-style
+ * note, default-import then destructure rather than relying on the
+ * named-export heuristic.
+ */
+import nodeSaml from "@node-saml/node-saml";
+import type { MethodScratch } from "../../types/method";
+import type { SamlNameIdFormat, SamlSpConfig } from "./types";
+declare const SAML: typeof nodeSaml.SAML;
+type SamlInstance = InstanceType<typeof SAML>;
+/** Standard SAML 2.0 NameID format URNs. */
+export declare const NAME_ID_FORMAT_URN: Record<SamlNameIdFormat, string>;
+export type SamlBindingContext = {
+    /** SP entityID — `<issuerUrl>/<tenantId>/<methodId>` (SAML-AD5). */
+    spEntityId: string;
+    /** ACS URL — the framework's `/cb/<methodId>` universal callback. */
+    acsUrl: string;
+    /** Per-request scratch backing the `InResponseTo` cache. */
+    scratch: MethodScratch;
+    /**
+     * IdP-initiated mode. An unsolicited Response has no `InResponseTo`
+     * (there was no AuthnRequest), so `validateInResponseTo` must be
+     * `ifPresent` rather than `always` — otherwise node-saml throws
+     * "InResponseTo is missing". Signature / Issuer / Audience /
+     * Conditions are still fully enforced; assertion-ID replay dedup is
+     * layered on top by the caller (node-saml does not dedup unsolicited
+     * assertion IDs). Default `false` ⇒ SP-initiated, `always`
+     * (unchanged).
+     */
+    idpInitiated?: boolean;
+    /**
+     * Logout-binding instance (the `/sls` + `/logout` paths). node-saml's
+     * `InResponseTo` machinery only reads the attribute off a `Response`
+     * root, never a `LogoutResponse`, so with the default `always` it
+     * throws "InResponseTo is missing" on every inbound `LogoutResponse`.
+     * Front-channel logout correlation is out of that scope — we
+     * replay-dedup the inbound `LogoutRequest @ID` via `methodScratch`
+     * instead — so logout instances use `never`. Overrides `idpInitiated`.
+     */
+    logout?: boolean;
+    /**
+     * Per-connection SP signing material (SAML-AD: O3 — decoupled from
+     * the OIDC `KeyStore`; the IdP pins this cert, rotation is an
+     * IdP-coordination event). Present ⇒ node-saml signs the outbound
+     * `AuthnRequest` (HTTP-Redirect binding) **and** outbound logout
+     * messages (`LogoutRequest` / `LogoutResponse`) with it.
+     */
+    signing?: {
+        privateKeyPem: string;
+        certPem: string;
+    };
+    /**
+     * IdP Single Logout endpoint (`SamlSpConfig.idp.sloUrl`). Destination
+     * for SP-emitted `LogoutResponse` (front-channel SLO, Phase 3) and
+     * SP-initiated `LogoutRequest`. Only needed on the `/sls` path; the
+     * SSO paths leave it unset.
+     */
+    logoutUrl?: string;
+    /**
+     * SP decryption private key PEM (`SamlSpConfig.decryptionKey`),
+     * passed through to node-saml's `decryptionPvk`. Present ⇒ node-saml
+     * decrypts `<saml:EncryptedAssertion>` (the decrypted assertion's
+     * XML-DSig is still fully enforced). Set only when the connection
+     * opted into `allowEncryptedAssertions`; absent ⇒ an encrypted
+     * assertion is rejected.
+     */
+    decryptionPvk?: string;
+};
+/**
+ * Derive the per-instance SP entityID. Stable across deploys for a
+ * given `(issuerUrl, tenantId, methodId)` triple so IdP-side trust
+ * config doesn't churn.
+ */
+export declare function deriveSpEntityId(issuerUrl: string, tenantId: string, methodId: string): string;
+export declare function buildSamlInstance(config: SamlSpConfig, binding: SamlBindingContext, nowMs: number): SamlInstance;
+export {};
+//# sourceMappingURL=saml-instance.d.ts.map

package/dist/types/methods/saml-sp/saml-instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-instance.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/saml-instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,QAAQ,MAAM,sBAAsB,CAAA;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7D,QAAA,MAAQ,IAAI,sBAAmC,CAAA;AAC/C,KAAK,YAAY,GAAG,YAAY,CAAC,OAAO,IAAI,CAAC,CAAA;AAE7C,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAK/D,CAAA;AAUD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,OAAO,EAAE,aAAa,CAAA;IACtB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,aAAa,EAAE,MAAM,CAAA;QACrB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAGR;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,GACZ,YAAY,CA6Dd"}

package/dist/types/methods/saml-sp/slo-initiate.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function initiateSpLogout(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=slo-initiate.d.ts.map

package/dist/types/methods/saml-sp/slo-initiate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slo-initiate.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/slo-initiate.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOrE,OAAO,KAAK,EAEV,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAEhB,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAgItD"}

package/dist/types/methods/saml-sp/sls.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function consumeSls(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=sls.d.ts.map

package/dist/types/methods/saml-sp/sls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sls.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/sls.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAmB1E,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAsPtD"}

package/dist/types/methods/saml-sp/types.d.ts

@@ -0,0 +1,204 @@
+/**
+ * SAML SP — public types.
+ *
+ * These types are the locked contract for the SAML SP method family and
+ * are intentionally introduced ahead of the runtime implementation so
+ * downstream callers can import them today, and so the public-API
+ * leak guard
+ * (`test/types/saml-sp-no-thirdparty-leaks.test.ts`) can verify
+ * the shapes before any `@node-saml/*` or `xml-crypto` code lands.
+ *
+ * No third-party types appear here. `@node-saml/node-saml`'s `Profile`
+ * is mapped onto `SamlSpProperties` at the wrapper boundary; consumers
+ * never see node-saml's surface.
+ *
+ * See `docs/plans/claude/saml-sp-plan.md` for the architectural
+ * decisions (SAML-AD1–AD7) backing this shape.
+ */
+/**
+ * Standard SAML 2.0 NameID formats we support.
+ *
+ *   - `persistent`     — opaque, stable per user/SP pair; preferred.
+ *   - `transient`      — opaque, single-session.
+ *   - `emailAddress`   — RFC 822 email; common with legacy IdPs.
+ *   - `unspecified`    — IdP picks; pass through verbatim.
+ */
+export type SamlNameIdFormat = "persistent" | "transient" | "emailAddress" | "unspecified";
+/**
+ * One field's source. Either the assertion's NameID or a named
+ * attribute. `format` narrows attribute lookup when an IdP issues
+ * multiple attributes with the same `Name` but different `NameFormat`.
+ */
+export type SamlAttributeRef = {
+    source: "nameId";
+} | {
+    source: "attribute";
+    name: string;
+    format?: string;
+};
+/**
+ * How the SAML method translates a verified assertion into the
+ * `providerSubject` + per-claim fields that flow into the host's
+ * `success` callback. Mirrors the OIDC method's claim-mapping
+ * configuration — the host owns the final `SubjectClaim`; this map
+ * just normalises the SAML side.
+ */
+export type SamlAttributeMapping = {
+    /** Which attribute becomes `providerSubject`. Defaults to NameID. */
+    subject?: SamlAttributeRef;
+    email?: SamlAttributeRef;
+    /** SAML assertions are typically issued only after IdP-side verification. */
+    emailVerified?: {
+        source: "literal";
+        value: boolean;
+    };
+    name?: SamlAttributeRef;
+    /** Multi-valued — the mapper preserves array shape. */
+    groups?: SamlAttributeRef;
+    /** Pass-through map for additional claims hosts want surfaced. */
+    custom?: Record<string, SamlAttributeRef>;
+};
+/**
+ * A single PEM-encoded IdP signing certificate, optionally bounded by a
+ * validity window. The runtime verifier accepts any cert whose window
+ * covers `now` — supports overlapping hot rotation without re-deploys.
+ */
+export type SamlIdpSigningCert = {
+    pem: string;
+    /** Inclusive lower bound. Unix ms. Omit for no lower bound. */
+    notBefore?: number;
+    /** Exclusive upper bound. Unix ms. Omit for no upper bound. */
+    notAfter?: number;
+};
+/**
+ * Identity-Provider-side configuration the host paste/imports from the
+ * IdP's metadata XML (or uploads a metadata URL we fetch once). Stable
+ * across deploys — keyed by `(tenantId, methodId)` in `MethodStore`.
+ */
+export type SamlIdpConfig = {
+    entityId: string;
+    /** SSO endpoint URL. HTTP-Redirect binding is the default. */
+    ssoUrl: string;
+    /** Single Logout endpoint URL. Optional; Phase 3 deliverable. */
+    sloUrl?: string;
+    /** Preferred NameID format requested in `AuthnRequest`. */
+    nameIdFormat?: SamlNameIdFormat;
+    /** One or more IdP signing certs. ≥1 required. Hot-rotatable. */
+    signingCerts: ReadonlyArray<SamlIdpSigningCert>;
+};
+/**
+ * IdP-initiated SSO binding. When set, the ACS endpoint accepts
+ * unsolicited SAML Responses (no `InResponseTo`) and synthesizes a
+ * flow record using these defaults so the existing
+ * `MethodResult.success` path can run end-to-end.
+ *
+ * Documented in plan SAML-AD7 — this is the one architectural carve-out
+ * SAML imposes on the framework. Omit to reject unsolicited Responses
+ * with `invalid_request` (the conservative default).
+ */
+export type SamlIdpInitiatedConfig = {
+    defaultClientId: string;
+    defaultRedirectUri: string;
+    defaultScopes?: string[];
+};
+/**
+ * Tenant-supplied configuration for a SAML SP method instance.
+ * Validated by `samlSpFactory.configSchema` (Standard Schema v1).
+ */
+export type SamlSpConfig = {
+    idp: SamlIdpConfig;
+    attributeMapping: SamlAttributeMapping;
+    /** Whether to sign outbound `AuthnRequest`. Default `false`. */
+    signAuthnRequest?: boolean;
+    /**
+     * Per-connection SP signing keypair (SAML-AD: O3). **Decoupled from
+     * the OIDC `KeyStore` on purpose** — the SP signing cert is pinned at
+     * the IdP and rotated as an IdP-coordination event, not on the OIDC
+     * token-key schedule; this also keeps the design KMS-agnostic.
+     * `privateKeyPem` signs the `AuthnRequest`; `certPem` is what the IdP
+     * pins and what SP metadata advertises. Required iff
+     * `signAuthnRequest` is `true`. Treat `privateKeyPem` as a secret:
+     * the host should encrypt the `MethodStore` at rest (or supply it via
+     * its own resolver) — same handling as any per-tenant credential.
+     */
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    };
+    /**
+     * Accept `<saml:EncryptedAssertion>` responses. **Off by default** —
+     * a connection only opts in when its IdP is configured to encrypt.
+     * When `false`, an encrypted assertion is rejected (the SP advertises
+     * no decryption cert and node-saml has no `decryptionPvk`). Requires
+     * `decryptionKey` when `true` (enforced by `configSchema`).
+     */
+    allowEncryptedAssertions?: boolean;
+    /**
+     * Per-connection SP **decryption** keypair — the private half the IdP
+     * encrypts assertions to. Same SAML-AD O3 rationale as `signingKey`:
+     * decoupled from the OIDC `KeyStore` (the IdP pins the matching cert
+     * via SP metadata; rotation is an IdP-coordination event;
+     * KMS-agnostic). Required iff `allowEncryptedAssertions` is `true`.
+     * Treat `privateKeyPem` as a secret: the host should encrypt the
+     * `MethodStore` at rest (or supply it via its own resolver) — same
+     * handling as `signingKey.privateKeyPem` and any per-tenant
+     * credential. `certPem` is the matching X.509 cert the IdP encrypts
+     * to; SP metadata advertises it as a `use="encryption"`
+     * `KeyDescriptor` (same advertise-only-what-we-serve invariant as
+     * `signingKey`).
+     */
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    };
+    idpInitiated?: SamlIdpInitiatedConfig;
+    /** Clock skew allowance for `NotBefore` / `NotOnOrAfter`. Seconds. */
+    clockSkewSeconds?: number;
+};
+/**
+ * Method-private state stashed in `FlowRecord.methodState` for the
+ * duration of an SP-initiated flow.
+ *
+ * `InResponseTo` correlation is handled out-of-band by node-saml's
+ * `CacheProvider` (backed by `methodScratch`), so the outstanding
+ * request id does **not** live here — only the framework state
+ * envelope echoed as RelayState and the issuance timestamp.
+ */
+export type SamlSpState = {
+    relayState: string;
+    issuedAt: number;
+    /**
+     * SP entityID + ACS URL computed at AuthnRequest time, where the
+     * framework's dispatch context is available. The ACS dispatch has
+     * no dispatch context, so these are read back from here to validate
+     * the assertion's `AudienceRestriction` / `Recipient` against the
+     * exact values the IdP saw in the request.
+     */
+    spEntityId: string;
+    acsUrl: string;
+};
+/**
+ * Properties handed to the host's `IdPOptions.success` callback on a
+ * successful SAML authentication. The host translates these into the
+ * final `SubjectClaim` it owns.
+ *
+ * `raw.responseXml` is provided as an escape hatch for hosts that want
+ * to inspect the verified Response themselves; the wrapper has already
+ * run the full signature gauntlet by the time these properties leave
+ * the method.
+ */
+export type SamlSpProperties = {
+    nameId: {
+        value: string;
+        format: SamlNameIdFormat;
+    };
+    attributes: Record<string, string | string[]>;
+    /** Used for Single Logout correlation (Phase 3). */
+    sessionIndex?: string;
+    /** Unix ms — the assertion's `AuthnInstant`. */
+    authnInstant: number;
+    raw: {
+        responseXml: string;
+    };
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/methods/saml-sp/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,WAAW,GACX,cAAc,GACd,aAAa,CAAA;AAEjB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,qEAAqE;IACrE,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAA;IACrD,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;CAC1C,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B,iEAAiE;IACjE,YAAY,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAChD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,aAAa,CAAA;IAClB,gBAAgB,EAAE,oBAAoB,CAAA;IACtC,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1D,YAAY,CAAC,EAAE,sBAAsB,CAAA;IACrC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,EAAE,gBAAgB,CAAA;KACzB,CAAA;IACD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;IAC7C,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE;QACH,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA"}

package/dist/types/ports/audit-log.d.ts

@@ -83,16 +83,29 @@ export type AuditEvent = {
     family: string;
 } | {
     /**
-     * Emitted by `/end_session` (OIDC RP-Initiated Logout 1.0 §2) after
-     * processing the logout request — regardless of whether a
-     * `post_logout_redirect_uri` was supplied. `subjectId` is present
-     * when the request carried an `id_token_hint` that successfully
-     * verified; absent otherwise.
+     * Emitted after a logout is processed. Two channels, discriminated
+     * by `via`:
+     *
+     *  - `rp_initiated` (or absent — the default): `/end_session`
+     *    (OIDC RP-Initiated Logout 1.0 §2), regardless of whether a
+     *    `post_logout_redirect_uri` was supplied. `subjectId` present
+     *    when an `id_token_hint` verified; absent otherwise.
+     *  - `upstream_slo`: an upstream IdP notified us a federated
+     *    session ended (SAML front-channel Single Logout). `methodId`
+     *    / `methodKind` identify the federation connection;
+     *    `subjectId` present only when the host's `onLogout` returned
+     *    a subject to revoke.
+     *
+     * `via` is general (OIDC back-channel logout would reuse
+     * `upstream_slo`), not SAML-specific surface.
      */
     kind: "session_logout";
     tenantId: TenantId;
     clientId?: string;
     subjectId?: string;
+    via?: "rp_initiated" | "upstream_slo";
+    methodId?: string;
+    methodKind?: string;
 } | {
     /**
      * Emitted when a DPoP proof's `jti` is presented within the replay

package/dist/types/ports/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/ports/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,0DAA0D;IAC1D,YAAY,EAAE,QAAQ,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE;;;;;;OAMG;IACH,IAAI,EAAE,gBAAgB,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,QAAQ,CAAA;IACvB,YAAY,EAAE,QAAQ,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAEL,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,CAAA"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/ports/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,0DAA0D;IAC1D,YAAY,EAAE,QAAQ,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,EAAE,gBAAgB,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,cAAc,GAAG,cAAc,CAAA;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,QAAQ,CAAA;IACvB,YAAY,EAAE,QAAQ,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAEL,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,CAAA"}

package/dist/types/ports/session-store.d.ts

@@ -80,6 +80,29 @@ export type SessionStore = {
      */
     savePar?(requestUri: string, payload: ParRecord, ttl: number): Promise<Result<void>>;
     consumePar?(requestUri: string): Promise<Result<ParRecord>>;
+    /**
+     * Optional: per-method-instance scratch storage. Survives across flows
+     * (unlike `methodState`, which is per-flow). Use cases include cross-flow
+     * deduplication state — e.g., a SAML SP method remembering recently-seen
+     * assertion IDs for replay protection.
+     *
+     * The framework scopes keys per `(tenantId, methodId)` before calling
+     * these — adapters see opaque, already-namespaced keys and store the
+     * UTF-8 string value verbatim. Methods JSON-encode if they want object
+     * state.
+     *
+     * Strong consistency + TTL respect (same semantics as flow records).
+     * `readScratch` returns `unknown_state` if the key is missing or
+     * expired. `deleteScratch` is idempotent.
+     *
+     * Adapters without these methods cannot host methods that depend on
+     * scratch; the framework surfaces a clear `unsupported` error through
+     * `MethodContext.methodScratch` at call time. Implement all three
+     * methods together — partial implementations are not supported.
+     */
+    saveScratch?(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    readScratch?(key: string): Promise<Result<string>>;
+    deleteScratch?(key: string): Promise<Result<void>>;
 };
 /**
  * Stored PAR payload. The `params` blob is the raw form/query record from

package/dist/types/ports/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../src/ports/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;OAKG;IACH,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;OAQG;IACH,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAErD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAExD;;;;OAIG;IACH,aAAa,CAAC,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,CACN,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,UAAU,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;CAC5D,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../src/ports/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;OAKG;IACH,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;OAQG;IACH,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAErD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAExD;;;;OAIG;IACH,aAAa,CAAC,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,CACN,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,UAAU,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IAE3D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,CACV,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CACnD,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA"}

package/dist/types/types/idp.d.ts

@@ -58,6 +58,56 @@ export type FailureEvent = {
     flowId?: string;
     error: AuthError;
 };
+/**
+ * Input to the optional `IdPOptions.onLogout` hook.
+ *
+ * Fires when an upstream provider notifies this IdP that a federated
+ * session has ended — today, a SAML front-channel `LogoutRequest`
+ * delivered to the SP's SLS endpoint. By the time this runs the library
+ * has already cryptographically verified the upstream logout message
+ * (XML-DSig via the SAML method), so the hook is purely the host's
+ * teardown point.
+ *
+ * The library deliberately does **not** know which OIDC `subject` an
+ * upstream identifier (`nameId`) maps to — that mapping lives in the
+ * host's `success` callback, not the library. So the host clears its
+ * own session and returns the subject (if any) whose library-issued
+ * tokens should be revoked; the library then runs the same
+ * `revokeAllForSubject` primitive `/end_session` uses. Returning
+ * nothing skips library-side revocation (the host handled everything,
+ * or there is nothing to revoke).
+ *
+ * Method-agnostic on purpose: any federation method that can verify an
+ * upstream logout signal reuses this. SAML SLO is the first caller;
+ * OIDC back-channel logout would be the next.
+ */
+export type LogoutEventInput = {
+    tenant: TenantContext;
+    methodId: string;
+    methodKind: string;
+    /** What kind of upstream logout this is. Extensible discriminant. */
+    reason: "upstream_slo";
+    /**
+     * Upstream subject identifier from the verified logout message
+     * (SAML `LogoutRequest/NameID`). Absent if the message omitted it.
+     */
+    nameId?: string;
+    /**
+     * Upstream session index from the verified logout message
+     * (SAML `SessionIndex`), when present. Lets a host that tracks
+     * per-session state scope its teardown.
+     */
+    sessionIndex?: string;
+};
+/**
+ * Return of `IdPOptions.onLogout`. `revokeSubject` names the OIDC
+ * subject whose library-issued refresh tokens the library should
+ * revoke (the host resolves it from `nameId` — only the host has that
+ * map). Omit / return nothing to skip library-side revocation.
+ */
+export type LogoutHookResult = {
+    revokeSubject?: string;
+} | void;
 /**
  * Optional hook called at `/token` time, after PKCE has succeeded and
  * after the `success` callback has produced a `SubjectClaim`, but
@@ -226,6 +276,27 @@ export type IdPOptions = {
         onSuccess?: (event: SuccessEvent) => Promise<void>;
         onFailure?: (event: FailureEvent) => Promise<void>;
     };
+    /**
+     * Optional hook fired when an upstream provider signals that a
+     * federated session ended — SAML front-channel Single Logout today.
+     * The library has already verified the signed logout message; this
+     * hook is where the host tears down its own session and names the
+     * OIDC subject (if any) whose library-issued tokens to revoke. See
+     * the `LogoutEventInput` / `LogoutHookResult` type docs.
+     *
+     * Unlike `hooks.onSuccess`/`onFailure` (observation only) this hook
+     * **influences** library behaviour — its return drives token
+     * revocation — so it sits at the top level alongside `success`.
+     *
+     * Absent ⇒ the library still verifies the logout, emits a
+     * `session_logout` audit event, and returns the protocol
+     * `LogoutResponse`, but performs no token revocation (it cannot map
+     * the upstream id to a subject without the host).
+     *
+     * If it throws, the SLS endpoint fails closed with an internal error
+     * rather than acknowledging a logout it could not fully process.
+     */
+    onLogout?: (input: LogoutEventInput) => Promise<LogoutHookResult> | LogoutHookResult;
     /**
      * Optional escape hatch for high-sensitivity deployments — see the
      * `PersistUpstreamTokens` type doc.

package/dist/types/types/idp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAC3C,yDAAyD;IACzD,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,0BAA0B,CAAC,EACvB,MAAM,GACN,qBAAqB,GACrB,oBAAoB,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,sBAAsB;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,KAAK,CAAC,EAAE;QACN,yDAAyD;QACzD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAClD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACnD,CAAA;IAED;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,oCAAoC;IACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,8CAA8C;IAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9C,CAAA"}
+{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAC3C,yDAAyD;IACzD,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,cAAc,CAAA;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAA;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,0BAA0B,CAAC,EACvB,MAAM,GACN,qBAAqB,GACrB,oBAAoB,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,sBAAsB;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,KAAK,CAAC,EAAE;QACN,yDAAyD;QACzD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAClD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACnD,CAAA;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAEjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,oCAAoC;IACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,8CAA8C;IAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9C,CAAA"}