@_mustachio/openauth 0.11.0 → 0.13.0

package/dist/types/methods/saml-sp/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAGvE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AA4C1E,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqDrB,CAAA;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,iBAAiB,CAC3C,gBAAgB,EAChB,WAAW,EACX,YAAY,CAUb,CAAA"}

package/dist/types/methods/saml-sp/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `@_mustachio/openauth/methods/saml-sp` — SAML 2.0 Service Provider
+ * method family.
+ *
+ * **Node-only.** This entry depends transitively on
+ * `@node-saml/node-saml` and `xml-crypto`, which require `node:crypto`
+ * and the `@xmldom/xmldom` DOM. Cloudflare Workers, browsers, and
+ * other edge runtimes cannot load this module; use the root
+ * `@_mustachio/openauth` entry (OIDC / OAuth methods) on those
+ * platforms.
+ *
+ * The library's root entry is verified edge-clean by
+ * `test/types/public-api-no-thirdparty-leaks.test.ts` and the
+ * complementary `saml-sp-no-thirdparty-leaks.test.ts` — neither this
+ * subpath's third-party deps nor its public types are reachable from
+ * `@_mustachio/openauth`.
+ *
+ * See `docs/plans/claude/saml-sp-plan.md` for the architectural
+ * decisions backing this surface (SAML-AD1–AD7) and the phase plan.
+ */
+export { samlSpFactory } from "./factory";
+export { parseSamlIdpMetadata } from "./parse-idp-metadata";
+export type { SamlAttributeMapping, SamlAttributeRef, SamlIdpConfig, SamlIdpInitiatedConfig, SamlIdpSigningCert, SamlNameIdFormat, SamlSpConfig, SamlSpProperties, SamlSpState, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/methods/saml-sp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,GACZ,MAAM,SAAS,CAAA"}

package/dist/types/methods/saml-sp/metadata.d.ts

@@ -0,0 +1,50 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlNameIdFormat, SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export type SpMetadataInput = {
+    spEntityId: string;
+    acsUrl: string;
+    /**
+     * The SP's own Single Logout Service URL (`/m/<methodId>/sls`).
+     * Present ⇒ front-channel SLO is served, so the metadata advertises
+     * `SingleLogoutService` for both bindings we accept. Same
+     * advertise-only-what-we-serve invariant as the ACS / signing cert.
+     */
+    slsUrl?: string;
+    nameIdFormat?: SamlNameIdFormat;
+    /**
+     * SP signing cert (PEM). Present ⇒ we sign AuthnRequests, so the
+     * metadata advertises `AuthnRequestsSigned="true"` and a
+     * `KeyDescriptor use="signing"`. Keeping this in lockstep with the
+     * runtime (the same `config.signingKey.certPem` that actually signs)
+     * is the same anti-drift invariant as the entityID/ACS.
+     */
+    signingCertPem?: string;
+    /**
+     * SP encryption cert (PEM). Present ⇒ the connection accepts
+     * encrypted assertions, so the metadata advertises a
+     * `KeyDescriptor use="encryption"` (the cert the IdP encrypts to —
+     * `config.decryptionKey.certPem`). Same anti-drift / advertise-only-
+     * what-we-serve invariant as the signing cert.
+     */
+    encryptionCertPem?: string;
+    /**
+     * Whether we actually require a signed `<saml:Assertion>`
+     * (`config.requireSignedAssertion`, default `true`). Published as
+     * `WantAssertionsSigned` — same advertise-only-what-we-serve
+     * invariant as the certs: a connection relying on a signed
+     * `<Response>` instead must not claim otherwise in its metadata.
+     */
+    wantAssertionsSigned?: boolean;
+};
+/**
+ * Pure SP metadata builder. Mirrors `parseSamlIdpMetadata`'s purity so
+ * it is trivially unit-testable and reusable.
+ */
+export declare function buildSpMetadataXml(input: SpMetadataInput): string;
+/**
+ * `GET /metadata` route handler. Anonymous (declared in the method's
+ * `publicRoutes`): `ctx.flow` / `ctx.methodState` are null; everything
+ * comes from `ctx.tenant` + `ctx.dispatch` + captured config.
+ */
+export declare function buildSpMetadata(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/types/methods/saml-sp/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/metadata.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGrE,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAqBhB,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAUD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAkDjE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAkDtD"}

package/dist/types/methods/saml-sp/method.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `buildSamlSpMethod` — assembles the `AuthMethod` for a SAML SP
+ * instance. Mirrors `buildOauth2Method`: data + handler functions, no
+ * framework imports beyond `types/`.
+ *
+ * Routes:
+ *   - `GET /authorize`  → SP-initiated AuthnRequest redirect (implemented).
+ *   - `GET /callback`   → ACS verification gauntlet (next increment).
+ *
+ * The framework's universal callback (`/cb/<methodId>`, both GET and
+ * POST) always dispatches the `"GET /callback"` route key, so the ACS
+ * lives there rather than at a bespoke `/acs` sub-path.
+ */
+import type { AuthMethod } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function buildSamlSpMethod(id: string, kind: string, config: SamlSpConfig): AuthMethod<SamlSpProperties, SamlSpState>;
+//# sourceMappingURL=method.d.ts.map

package/dist/types/methods/saml-sp/method.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,oBAAoB,CAAA;AAOnE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1E,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,GACnB,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAsC3C"}

package/dist/types/methods/saml-sp/parse-idp-metadata.d.ts

@@ -0,0 +1,4 @@
+import type { Result } from "../../types/result";
+import type { SamlIdpConfig } from "./types";
+export declare function parseSamlIdpMetadata(xml: string): Result<SamlIdpConfig>;
+//# sourceMappingURL=parse-idp-metadata.d.ts.map

package/dist/types/methods/saml-sp/parse-idp-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-idp-metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/parse-idp-metadata.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAMhD,OAAO,KAAK,EAAE,aAAa,EAAoB,MAAM,SAAS,CAAA;AA8C9D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAyFvE"}

package/dist/types/methods/saml-sp/saml-instance.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Construct a `@node-saml/node-saml` `SAML` instance from validated
+ * `SamlSpConfig` plus the per-request binding context (SP entityID +
+ * ACS URL, both derived at dispatch time per SAML-AD5).
+ *
+ * CJS interop: node-saml is CommonJS-only. Per the SAML house-style
+ * note, default-import then destructure rather than relying on the
+ * named-export heuristic.
+ */
+import nodeSaml from "@node-saml/node-saml";
+import type { MethodScratch } from "../../types/method";
+import type { SamlNameIdFormat, SamlSpConfig } from "./types";
+declare const SAML: typeof nodeSaml.SAML;
+type SamlInstance = InstanceType<typeof SAML>;
+/** Standard SAML 2.0 NameID format URNs. */
+export declare const NAME_ID_FORMAT_URN: Record<SamlNameIdFormat, string>;
+export type SamlBindingContext = {
+    /** SP entityID — `<issuerUrl>/<tenantId>/<methodId>` (SAML-AD5). */
+    spEntityId: string;
+    /** ACS URL — the framework's `/cb/<methodId>` universal callback. */
+    acsUrl: string;
+    /** Per-request scratch backing the `InResponseTo` cache. */
+    scratch: MethodScratch;
+    /**
+     * IdP-initiated mode. An unsolicited Response has no `InResponseTo`
+     * (there was no AuthnRequest), so `validateInResponseTo` must be
+     * `ifPresent` rather than `always` — otherwise node-saml throws
+     * "InResponseTo is missing". Signature / Issuer / Audience /
+     * Conditions are still fully enforced; assertion-ID replay dedup is
+     * layered on top by the caller (node-saml does not dedup unsolicited
+     * assertion IDs). Default `false` ⇒ SP-initiated, `always`
+     * (unchanged).
+     */
+    idpInitiated?: boolean;
+    /**
+     * Logout-binding instance (the `/sls` + `/logout` paths). node-saml's
+     * `InResponseTo` machinery only reads the attribute off a `Response`
+     * root, never a `LogoutResponse`, so with the default `always` it
+     * throws "InResponseTo is missing" on every inbound `LogoutResponse`.
+     * Front-channel logout correlation is out of that scope — we
+     * replay-dedup the inbound `LogoutRequest @ID` via `methodScratch`
+     * instead — so logout instances use `never`. Overrides `idpInitiated`.
+     */
+    logout?: boolean;
+    /**
+     * Per-connection SP signing material (SAML-AD: O3 — decoupled from
+     * the OIDC `KeyStore`; the IdP pins this cert, rotation is an
+     * IdP-coordination event). Present ⇒ node-saml signs the outbound
+     * `AuthnRequest` (HTTP-Redirect binding) **and** outbound logout
+     * messages (`LogoutRequest` / `LogoutResponse`) with it.
+     */
+    signing?: {
+        privateKeyPem: string;
+        certPem: string;
+    };
+    /**
+     * IdP Single Logout endpoint (`SamlSpConfig.idp.sloUrl`). Destination
+     * for SP-emitted `LogoutResponse` (front-channel SLO, Phase 3) and
+     * SP-initiated `LogoutRequest`. Only needed on the `/sls` path; the
+     * SSO paths leave it unset.
+     */
+    logoutUrl?: string;
+    /**
+     * SP decryption private key PEM (`SamlSpConfig.decryptionKey`),
+     * passed through to node-saml's `decryptionPvk`. Present ⇒ node-saml
+     * decrypts `<saml:EncryptedAssertion>` (the decrypted assertion's
+     * XML-DSig is still fully enforced). Set only when the connection
+     * opted into `allowEncryptedAssertions`; absent ⇒ an encrypted
+     * assertion is rejected.
+     */
+    decryptionPvk?: string;
+};
+/**
+ * Derive the per-instance SP entityID. Stable across deploys for a
+ * given `(issuerUrl, tenantId, methodId)` triple so IdP-side trust
+ * config doesn't churn.
+ */
+export declare function deriveSpEntityId(issuerUrl: string, tenantId: string, methodId: string): string;
+/**
+ * The SP entityID this connection actually presents — the configured
+ * override if the operator set one (to adopt an entityID that already
+ * exists at the IdP), else the derived default.
+ *
+ * **Every** consumer must go through this one function: the
+ * `AuthnRequest` issuer, `AudienceRestriction` validation, SP metadata,
+ * and logout messages all have to agree, or the IdP rejects us. That
+ * shared-resolution property is what the metadata anti-drift test
+ * guards.
+ */
+export declare function resolveSpEntityId(config: SamlSpConfig, issuerUrl: string, tenantId: string, methodId: string): string;
+export declare function buildSamlInstance(config: SamlSpConfig, binding: SamlBindingContext, nowMs: number): SamlInstance;
+export {};
+//# sourceMappingURL=saml-instance.d.ts.map

package/dist/types/methods/saml-sp/saml-instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-instance.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/saml-instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,QAAQ,MAAM,sBAAsB,CAAA;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7D,QAAA,MAAQ,IAAI,sBAAmC,CAAA;AAC/C,KAAK,YAAY,GAAG,YAAY,CAAC,OAAO,IAAI,CAAC,CAAA;AAE7C,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAK/D,CAAA;AAUD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,OAAO,EAAE,aAAa,CAAA;IACtB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,aAAa,EAAE,MAAM,CAAA;QACrB,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAGR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAER;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,GACZ,YAAY,CA8Ed"}

package/dist/types/methods/saml-sp/slo-initiate.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function initiateSpLogout(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=slo-initiate.d.ts.map

package/dist/types/methods/saml-sp/slo-initiate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slo-initiate.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/slo-initiate.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOrE,OAAO,KAAK,EAEV,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAEhB,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAmItD"}

package/dist/types/methods/saml-sp/sls.d.ts

@@ -0,0 +1,4 @@
+import type { MethodContext, MethodResult } from "../../types/method";
+import type { SamlSpConfig, SamlSpProperties, SamlSpState } from "./types";
+export declare function consumeSls(ctx: MethodContext<SamlSpState>, methodId: string, config: SamlSpConfig): Promise<MethodResult<SamlSpProperties, SamlSpState>>;
+//# sourceMappingURL=sls.d.ts.map

package/dist/types/methods/saml-sp/sls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sls.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/sls.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAmB1E,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAuPtD"}

package/dist/types/methods/saml-sp/types.d.ts

@@ -0,0 +1,299 @@
+/**
+ * SAML SP — public types.
+ *
+ * These types are the locked contract for the SAML SP method family and
+ * are intentionally introduced ahead of the runtime implementation so
+ * downstream callers can import them today, and so the public-API
+ * leak guard
+ * (`test/types/saml-sp-no-thirdparty-leaks.test.ts`) can verify
+ * the shapes before any `@node-saml/*` or `xml-crypto` code lands.
+ *
+ * No third-party types appear here. `@node-saml/node-saml`'s `Profile`
+ * is mapped onto `SamlSpProperties` at the wrapper boundary; consumers
+ * never see node-saml's surface.
+ *
+ * See `docs/plans/claude/saml-sp-plan.md` for the architectural
+ * decisions (SAML-AD1–AD7) backing this shape.
+ */
+/**
+ * Standard SAML 2.0 NameID formats we support.
+ *
+ *   - `persistent`     — opaque, stable per user/SP pair; preferred.
+ *   - `transient`      — opaque, single-session.
+ *   - `emailAddress`   — RFC 822 email; common with legacy IdPs.
+ *   - `unspecified`    — IdP picks; pass through verbatim.
+ */
+export type SamlNameIdFormat = "persistent" | "transient" | "emailAddress" | "unspecified";
+/**
+ * One field's source. Either the assertion's NameID or a named
+ * attribute. `format` narrows attribute lookup when an IdP issues
+ * multiple attributes with the same `Name` but different `NameFormat`.
+ */
+export type SamlAttributeRef = {
+    source: "nameId";
+} | {
+    source: "attribute";
+    name: string;
+    format?: string;
+};
+/**
+ * How the SAML method translates a verified assertion into the
+ * `providerSubject` + per-claim fields that flow into the host's
+ * `success` callback. Mirrors the OIDC method's claim-mapping
+ * configuration — the host owns the final `SubjectClaim`; this map
+ * just normalises the SAML side.
+ */
+export type SamlAttributeMapping = {
+    /** Which attribute becomes `providerSubject`. Defaults to NameID. */
+    subject?: SamlAttributeRef;
+    email?: SamlAttributeRef;
+    /** SAML assertions are typically issued only after IdP-side verification. */
+    emailVerified?: {
+        source: "literal";
+        value: boolean;
+    };
+    name?: SamlAttributeRef;
+    /** Multi-valued — the mapper preserves array shape. */
+    groups?: SamlAttributeRef;
+    /** Pass-through map for additional claims hosts want surfaced. */
+    custom?: Record<string, SamlAttributeRef>;
+};
+/**
+ * A single PEM-encoded IdP signing certificate, optionally bounded by a
+ * validity window. The runtime verifier accepts any cert whose window
+ * covers `now` — supports overlapping hot rotation without re-deploys.
+ */
+export type SamlIdpSigningCert = {
+    pem: string;
+    /** Inclusive lower bound. Unix ms. Omit for no lower bound. */
+    notBefore?: number;
+    /** Exclusive upper bound. Unix ms. Omit for no upper bound. */
+    notAfter?: number;
+};
+/**
+ * Identity-Provider-side configuration the host paste/imports from the
+ * IdP's metadata XML (or uploads a metadata URL we fetch once). Stable
+ * across deploys — keyed by `(tenantId, methodId)` in `MethodStore`.
+ */
+export type SamlIdpConfig = {
+    entityId: string;
+    /** SSO endpoint URL. HTTP-Redirect binding is the default. */
+    ssoUrl: string;
+    /** Single Logout endpoint URL. Optional; Phase 3 deliverable. */
+    sloUrl?: string;
+    /** Preferred NameID format requested in `AuthnRequest`. */
+    nameIdFormat?: SamlNameIdFormat;
+    /** One or more IdP signing certs. ≥1 required. Hot-rotatable. */
+    signingCerts: ReadonlyArray<SamlIdpSigningCert>;
+};
+/**
+ * IdP-initiated SSO binding. When set, the ACS endpoint accepts
+ * unsolicited SAML Responses (no `InResponseTo`) and synthesizes a
+ * flow record using these defaults so the existing
+ * `MethodResult.success` path can run end-to-end.
+ *
+ * Documented in plan SAML-AD7 — this is the one architectural carve-out
+ * SAML imposes on the framework. Omit to reject unsolicited Responses
+ * with `invalid_request` (the conservative default).
+ */
+export type SamlIdpInitiatedConfig = {
+    defaultClientId: string;
+    defaultRedirectUri: string;
+    defaultScopes?: string[];
+};
+/**
+ * Tenant-supplied configuration for a SAML SP method instance.
+ * Validated by `samlSpFactory.configSchema` (Standard Schema v1).
+ */
+export type SamlSpConfig = {
+    idp: SamlIdpConfig;
+    attributeMapping: SamlAttributeMapping;
+    /** Whether to sign outbound `AuthnRequest`. Default `false`. */
+    signAuthnRequest?: boolean;
+    /**
+     * Per-connection SP signing keypair (SAML-AD: O3). **Decoupled from
+     * the OIDC `KeyStore` on purpose** — the SP signing cert is pinned at
+     * the IdP and rotated as an IdP-coordination event, not on the OIDC
+     * token-key schedule; this also keeps the design KMS-agnostic.
+     * `privateKeyPem` signs the `AuthnRequest`; `certPem` is what the IdP
+     * pins and what SP metadata advertises. Required iff
+     * `signAuthnRequest` is `true`. Treat `privateKeyPem` as a secret:
+     * the host should encrypt the `MethodStore` at rest (or supply it via
+     * its own resolver) — same handling as any per-tenant credential.
+     */
+    signingKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    };
+    /**
+     * Accept `<saml:EncryptedAssertion>` responses. **Off by default** —
+     * a connection only opts in when its IdP is configured to encrypt.
+     * When `false`, an encrypted assertion is rejected (the SP advertises
+     * no decryption cert and node-saml has no `decryptionPvk`). Requires
+     * `decryptionKey` when `true` (enforced by `configSchema`).
+     */
+    allowEncryptedAssertions?: boolean;
+    /**
+     * Per-connection SP **decryption** keypair — the private half the IdP
+     * encrypts assertions to. Same SAML-AD O3 rationale as `signingKey`:
+     * decoupled from the OIDC `KeyStore` (the IdP pins the matching cert
+     * via SP metadata; rotation is an IdP-coordination event;
+     * KMS-agnostic). Required iff `allowEncryptedAssertions` is `true`.
+     * Treat `privateKeyPem` as a secret: the host should encrypt the
+     * `MethodStore` at rest (or supply it via its own resolver) — same
+     * handling as `signingKey.privateKeyPem` and any per-tenant
+     * credential. `certPem` is the matching X.509 cert the IdP encrypts
+     * to; SP metadata advertises it as a `use="encryption"`
+     * `KeyDescriptor` (same advertise-only-what-we-serve invariant as
+     * `signingKey`).
+     */
+    decryptionKey?: {
+        privateKeyPem: string;
+        certPem: string;
+    };
+    idpInitiated?: SamlIdpInitiatedConfig;
+    /** Clock skew allowance for `NotBefore` / `NotOnOrAfter`. Seconds. */
+    clockSkewSeconds?: number;
+    /**
+     * Override the derived SP entityID.
+     *
+     * By default the entityID is derived as
+     * `<issuerUrl>/<tenantId>/<methodId>` (SAML-AD5) — stable, no config
+     * required, and guaranteed to match what SP metadata publishes. Set
+     * this **only** to adopt an entityID that already exists at the IdP,
+     * so an existing SAML app can be migrated without the customer
+     * editing their production SSO config.
+     *
+     * The override flows through every consumer at once — `AuthnRequest`
+     * issuer, `AudienceRestriction` validation, SP metadata, and logout
+     * messages — so the anti-drift invariant holds either way. Changing
+     * it on a live connection invalidates the IdP-side trust config;
+     * treat it as an IdP-coordination event.
+     */
+    spEntityId?: string;
+    /**
+     * Set `ForceAuthn="true"` on the outbound `AuthnRequest`, asking the
+     * IdP to re-authenticate the user even if it has a live session.
+     * Default `false`.
+     *
+     * Note that this is a *request*: SAML gives the IdP no obligation to
+     * honour it, and there is no way to verify from the Response that it
+     * did. Do not treat a successful assertion as proof of fresh
+     * authentication.
+     */
+    forceAuthn?: boolean;
+    /**
+     * Request specific authentication context classes (e.g. MFA) from
+     * the IdP via `<RequestedAuthnContext>`.
+     *
+     * **Omitted ⇒ no `RequestedAuthnContext` element is sent at all**,
+     * which lets the IdP apply its own sign-on policy. That is the right
+     * default for nearly every deployment: a `RequestedAuthnContext` the
+     * IdP cannot satisfy exactly is answered with `NoAuthnContext`
+     * instead of a login, and an MFA policy at the IdP is a common way
+     * to *not* satisfy `PasswordProtectedTransport` under
+     * `Comparison="exact"`.
+     *
+     * Set it only when the IdP has told you which class refs it honours.
+     * `comparison` maps to the `Comparison` attribute and defaults to
+     * `"exact"`; `"minimum"` is usually the safer choice when requesting
+     * MFA.
+     *
+     * Requesting a context does **not** verify one was used — read
+     * `SamlSpProperties.authnContextClassRef` for what the IdP actually
+     * asserted.
+     */
+    requestedAuthnContext?: {
+        /** Full URNs, e.g. `urn:oasis:names:tc:SAML:2.0:ac:classes:MultiFactorAuthn`. */
+        classRefs: ReadonlyArray<string>;
+        comparison?: "exact" | "minimum" | "maximum" | "better";
+    };
+    /**
+     * Require the `<saml:Assertion>` itself to carry a valid XML-DSig.
+     * **Defaults to `true` and should stay that way** — the identity,
+     * conditions, and audience all live inside the assertion, so signing
+     * it is what actually binds them.
+     *
+     * Set `false` only for an IdP that signs the outer `<Response>` and
+     * nothing else, and only together with `requireSignedResponse: true`.
+     * The schema refuses to let both be off.
+     */
+    requireSignedAssertion?: boolean;
+    /**
+     * Require the outer `<samlp:Response>` to carry a valid XML-DSig.
+     * Default `false` — requiring it is stricter than the Okta / Entra
+     * default and would reject the majority of real IdPs. Enable it for
+     * an IdP that signs the Response, either as defence in depth
+     * alongside a signed assertion or (with
+     * `requireSignedAssertion: false`) as the only signature on offer.
+     */
+    requireSignedResponse?: boolean;
+};
+/**
+ * Method-private state stashed in `FlowRecord.methodState` for the
+ * duration of an SP-initiated flow.
+ *
+ * `InResponseTo` correlation is handled out-of-band by node-saml's
+ * `CacheProvider` (backed by `methodScratch`), so the outstanding
+ * request id does **not** live here — only the framework state
+ * envelope echoed as RelayState and the issuance timestamp.
+ */
+export type SamlSpState = {
+    relayState: string;
+    issuedAt: number;
+    /**
+     * SP entityID + ACS URL computed at AuthnRequest time, where the
+     * framework's dispatch context is available. The ACS dispatch has
+     * no dispatch context, so these are read back from here to validate
+     * the assertion's `AudienceRestriction` / `Recipient` against the
+     * exact values the IdP saw in the request.
+     */
+    spEntityId: string;
+    acsUrl: string;
+};
+/**
+ * Properties handed to the host's `IdPOptions.success` callback on a
+ * successful SAML authentication. The host translates these into the
+ * final `SubjectClaim` it owns.
+ *
+ * `raw.responseXml` is provided as an escape hatch for hosts that want
+ * to inspect the verified Response themselves; the wrapper has already
+ * run the full signature gauntlet by the time these properties leave
+ * the method.
+ */
+export type SamlSpProperties = {
+    nameId: {
+        value: string;
+        format: SamlNameIdFormat;
+    };
+    attributes: Record<string, string | string[]>;
+    /** Used for Single Logout correlation (Phase 3). */
+    sessionIndex?: string;
+    /** Unix ms — the assertion's `AuthnInstant`. */
+    authnInstant: number;
+    /**
+     * Unix ms — the `AuthnStatement/@SessionNotOnOrAfter` the IdP
+     * asserted, when it supplied one. This is the IdP's own view of when
+     * its session for this user expires.
+     *
+     * The library does **not** act on it: token and session lifetimes are
+     * host policy, and this library owns no session. Hosts that want
+     * "when their IdP session ends, ours ends" should clamp their own
+     * session/token TTL to this value in the `success` callback.
+     */
+    sessionNotOnOrAfter?: number;
+    /**
+     * The `AuthnContext/AuthnContextClassRef` the IdP actually asserted —
+     * i.e. how it says it authenticated the user. Absent when the
+     * assertion carries none.
+     *
+     * This is the value to check for step-up decisions ("was this really
+     * MFA?"). `SamlSpConfig.requestedAuthnContext` only *asks*; this is
+     * the answer, and the two can differ.
+     */
+    authnContextClassRef?: string;
+    raw: {
+        responseXml: string;
+    };
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/methods/saml-sp/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,WAAW,GACX,cAAc,GACd,aAAa,CAAA;AAEjB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,qEAAqE;IACrE,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAA;IACrD,IAAI,CAAC,EAAE,gBAAgB,CAAA;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;CAC1C,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B,iEAAiE;IACjE,YAAY,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAChD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,eAAe,EAAE,MAAM,CAAA;IACvB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,aAAa,CAAA;IAClB,gBAAgB,EAAE,oBAAoB,CAAA;IACtC,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1D,YAAY,CAAC,EAAE,sBAAsB,CAAA;IACrC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qBAAqB,CAAC,EAAE;QACtB,iFAAiF;QACjF,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;QAChC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;KACxD,CAAA;IACD;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAChC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,EAAE,gBAAgB,CAAA;KACzB,CAAA;IACD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;IAC7C,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,GAAG,EAAE;QACH,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF,CAAA"}

package/dist/types/ports/audit-log.d.ts

@@ -83,16 +83,29 @@ export type AuditEvent = {
     family: string;
 } | {
     /**
-     * Emitted by `/end_session` (OIDC RP-Initiated Logout 1.0 §2) after
-     * processing the logout request — regardless of whether a
-     * `post_logout_redirect_uri` was supplied. `subjectId` is present
-     * when the request carried an `id_token_hint` that successfully
-     * verified; absent otherwise.
+     * Emitted after a logout is processed. Two channels, discriminated
+     * by `via`:
+     *
+     *  - `rp_initiated` (or absent — the default): `/end_session`
+     *    (OIDC RP-Initiated Logout 1.0 §2), regardless of whether a
+     *    `post_logout_redirect_uri` was supplied. `subjectId` present
+     *    when an `id_token_hint` verified; absent otherwise.
+     *  - `upstream_slo`: an upstream IdP notified us a federated
+     *    session ended (SAML front-channel Single Logout). `methodId`
+     *    / `methodKind` identify the federation connection;
+     *    `subjectId` present only when the host's `onLogout` returned
+     *    a subject to revoke.
+     *
+     * `via` is general (OIDC back-channel logout would reuse
+     * `upstream_slo`), not SAML-specific surface.
      */
     kind: "session_logout";
     tenantId: TenantId;
     clientId?: string;
     subjectId?: string;
+    via?: "rp_initiated" | "upstream_slo";
+    methodId?: string;
+    methodKind?: string;
 } | {
     /**
      * Emitted when a DPoP proof's `jti` is presented within the replay

package/dist/types/ports/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/ports/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,0DAA0D;IAC1D,YAAY,EAAE,QAAQ,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE;;;;;;OAMG;IACH,IAAI,EAAE,gBAAgB,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,QAAQ,CAAA;IACvB,YAAY,EAAE,QAAQ,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAEL,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,CAAA"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/ports/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,0DAA0D;IAC1D,YAAY,EAAE,QAAQ,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,EAAE,gBAAgB,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,cAAc,GAAG,cAAc,CAAA;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,QAAQ,CAAA;IACvB,YAAY,EAAE,QAAQ,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAEL,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,CAAA"}