@atlasauth/js 0.16.0 → 0.17.0

package/dist/email-code-check.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emailCodeCheckRequest = emailCodeCheckRequest;
+exports.checkEmailCode = checkEmailCode;
+exports.emailCodeTargetForAttempt = emailCodeTargetForAttempt;
+const attempt_1 = require("./attempt");
+/** The check endpoint and body for a target. */
+function emailCodeCheckRequest(target, code) {
+    const id = (v) => encodeURIComponent(v);
+    switch (target.kind) {
+        case 'sign_in_first_factor':
+            return { path: `/v1/client/sign_ins/${id(target.attemptId)}/check_first_factor`, body: { strategy: 'email_code', code } };
+        case 'sign_in_second_factor':
+            return { path: `/v1/client/sign_ins/${id(target.attemptId)}/check_second_factor`, body: { strategy: 'email_code', code } };
+        case 'sign_up_verification':
+            return { path: `/v1/client/sign_ups/${id(target.attemptId)}/check_verification`, body: { strategy: 'email_code', code } };
+        case 'step_up':
+            return { path: '/v1/client/me/step_up/check', body: { strategy: 'email_code', code } };
+        case 'email_address':
+            return { path: `/v1/client/me/email_addresses/${id(target.emailAddressId)}/check_verification`, body: { code } };
+    }
+}
+/**
+ * Check a code. `ok` with `data` for a right, live code; otherwise the server's
+ * errors — `VERIFICATION_FAILED` (wrong, expired or unknown) or
+ * `TOO_MANY_ATTEMPTS` (the code is locked; request a new one).
+ */
+function checkEmailCode(client, target, code) {
+    const { path, body } = emailCodeCheckRequest(target, code);
+    return client.post(path, body);
+}
+/**
+ * The check target for the code step a flow is on, or null when the current
+ * step takes no emailed code. An emailed code on the first-factor step, the
+ * email second factor, and sign-up verification are covered.
+ */
+function emailCodeTargetForAttempt(attempt) {
+    if (!attempt?.id)
+        return null;
+    switch ((0, attempt_1.nextStep)(attempt).kind) {
+        case 'collect_first_factor':
+            return { kind: 'sign_in_first_factor', attemptId: attempt.id };
+        case 'collect_second_factor':
+            return { kind: 'sign_in_second_factor', attemptId: attempt.id };
+        case 'collect_email_code':
+            return { kind: 'sign_up_verification', attemptId: attempt.id };
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=email-code-check.js.map

package/dist/email-code-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-code-check.js","sourceRoot":"","sources":["../src/email-code-check.ts"],"names":[],"mappings":";;AAsCA,sDAcC;AAOD,wCAGC;AAOD,8DAYC;AAhED,uCAAuD;AAoBvD,gDAAgD;AAChD,SAAgB,qBAAqB,CAAC,MAAuB,EAAE,IAAY;IACzE,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5H,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7H,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5H,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QACzF,KAAK,eAAe;YAClB,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IACrH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,MAAkB,EAAE,MAAuB,EAAE,IAAY;IACtF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAiB,IAAI,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CAAC,OAAuC;IAC/E,IAAI,CAAC,OAAO,EAAE,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,QAAQ,IAAA,kBAAQ,EAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,KAAK,sBAAsB;YACzB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACjE,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAClE,KAAK,oBAAoB;YACvB,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACjE;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/frontchannel-logout.d.ts

@@ -29,6 +29,42 @@ export interface SignOutOptions {
      * Honoured by every framework provider.
      */
     strict?: boolean;
+    /**
+     * Follow the upstream provider's end-session URL after signing out locally,
+     * when the session came from a custom OAuth/OIDC provider or enterprise OIDC
+     * connection with RP-initiated logout on. Default `true`; `false` leaves it
+     * to you (`result.upstreamLogoutUrl`).
+     */
+    upstreamLogout?: boolean;
+    /**
+     * Where the user lands after that upstream logout. Must be on an allowed
+     * origin of the instance; otherwise the provider's configured post-logout
+     * page is used. Also used for SAML Single Logout when
+     * `samlLogoutRedirectUrl` is not set.
+     */
+    returnUrl?: string;
+    /**
+     * SAML Single Logout. When the session came from a SAML connection with
+     * Single Logout on, the sign-out response carries a `saml_logout_url`; by
+     * default the browser is then sent there (after the local sign-out) so the
+     * identity provider's session ends too. Pass `false` to stay on the page and
+     * handle `SignOutResult.samlLogoutUrl` yourself.
+     *
+     * A browser can follow only one logout redirect. In the (unusual) case that
+     * the response carries both `upstream_logout_url` and `saml_logout_url`, the
+     * upstream OpenID provider's URL is followed (it has no server-to-server
+     * fallback) and the SAML identity provider is told server-to-server through
+     * SOAP back-channel logout when its connection has a SOAP endpoint;
+     * `samlLogoutUrl` is still reported. With `upstreamLogout: false`, the SAML
+     * URL is followed instead.
+     */
+    samlLogout?: boolean;
+    /**
+     * SAML Single Logout: where the identity provider returns the browser once it
+     * has signed the user out. Must be on one of the instance's allowed origins.
+     * Defaults to `returnUrl`, else the page that signed out.
+     */
+    samlLogoutRedirectUrl?: string;
 }
 /** The default wait for front-channel logout frames. */
 export declare const FRONTCHANNEL_LOGOUT_TIMEOUT_MS = 5000;

package/dist/frontchannel-logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontchannel-logout.js","sourceRoot":"","sources":["../src/frontchannel-logout.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAiCH,wDAgBC;AAOD,sDAuDC;AAOD,8EAaC;AA5GD,wDAAwD;AAC3C,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAEnD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAAa;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,MAAM,IAAI,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,IAAa,EACb,UAAqC,EAAE;IAEvC,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sCAA8B,CAAC;IAEtE,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,KAAgD,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;gBAC7B,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBAC1C,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACrC,iEAAiE;gBACjE,iEAAiE;gBACjE,qEAAqE;gBACrE,kEAAkE;gBAClE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;gBACnD,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iCAAiC,CACrD,QAAqC,EACrC,UAAqC,EAAE;IAEvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO;IACtC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAI,IAAsD,EAAE,wBAAwB,CAAC;IAC/F,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"frontchannel-logout.js","sourceRoot":"","sources":["../src/frontchannel-logout.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAqEH,wDAgBC;AAOD,sDAuDC;AAOD,8EAaC;AA5GD,wDAAwD;AAC3C,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAEnD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAAa;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,MAAM,IAAI,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,IAAa,EACb,UAAqC,EAAE;IAEvC,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sCAA8B,CAAC;IAEtE,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,KAAgD,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;gBAC7B,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBAC1C,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACrC,iEAAiE;gBACjE,iEAAiE;gBACjE,qEAAqE;gBACrE,kEAAkE;gBAClE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;gBACnD,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iCAAiC,CACrD,QAAqC,EACrC,UAAqC,EAAE;IAEvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO;IACtC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAI,IAAsD,EAAE,wBAAwB,CAAC;IAC/F,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/index.d.ts

@@ -24,11 +24,13 @@ export * from './passkey';
 export * from './mfa-enrollment';
 export * from './passkey-sign-in';
 export * from './passkey-sign-up';
+export * from './email-code-check';
 export * from './telegram';
 export * from './siwe';
 export * from './telemetry';
 export * from './reauth';
 export * from './api-keys';
+export * from './device-authorization';
 export * from './organizations';
 export * from './phone-numbers';
 export * from './account-hints';
@@ -37,6 +39,7 @@ export * from './connect';
 export * from './password-reset';
 export * from './check-session';
 export * from './frontchannel-logout';
+export * from './upstream-logout';
 export * from './captcha';
 export * from './captcha-widget';
 export * from './atlas-captcha';

package/dist/index.js

@@ -64,12 +64,15 @@ __exportStar(require("./mfa-enrollment"), exports);
 __exportStar(require("./passkey-sign-in"), exports);
 // Passkey-only sign-up (the account is created when its passkey registers).
 __exportStar(require("./passkey-sign-up"), exports);
+// Check an emailed one-time code without using it up (sign-in, sign-up, step-up, email verification).
+__exportStar(require("./email-code-check"), exports);
 __exportStar(require("./telegram"), exports);
 __exportStar(require("./siwe"), exports);
 __exportStar(require("./telemetry"), exports);
 __exportStar(require("./reauth"), exports);
 // End-user API key self-service (`/v1/client/me/api_keys`).
 __exportStar(require("./api-keys"), exports);
+__exportStar(require("./device-authorization"), exports);
 __exportStar(require("./organizations"), exports);
 __exportStar(require("./phone-numbers"), exports);
 // Username availability + the "Last used" sign-in method hint.
@@ -81,6 +84,8 @@ __exportStar(require("./password-reset"), exports);
 __exportStar(require("./check-session"), exports);
 // OIDC Front-Channel Logout after a browser sign-out.
 __exportStar(require("./frontchannel-logout"), exports);
+// RP-initiated logout at an upstream OpenID provider after a browser sign-out.
+__exportStar(require("./upstream-logout"), exports);
 // §5 "captcha anywhere" — fetch the central widget config, render the provider
 // widget, and verify a solved token, all without hardcoding provider keys.
 __exportStar(require("./captcha"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,mGAAmG;AACnG,2DAAyC;AACzC,+EAA+E;AAC/E,6CAA2B;AAC3B,gGAAgG;AAChG,6CAA0G;AAAjG,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClF,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,0GAA0G;AAC1G,mDAAiC;AACjC,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,kDAAgC;AAChC,kDAAgC;AAChC,+DAA+D;AAC/D,kDAAgC;AAChC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,mGAAmG;AACnG,2DAAyC;AACzC,+EAA+E;AAC/E,6CAA2B;AAC3B,gGAAgG;AAChG,6CAA0G;AAAjG,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClF,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,0GAA0G;AAC1G,mDAAiC;AACjC,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,yDAAuC;AACvC,kDAAgC;AAChC,kDAAgC;AAChC,+DAA+D;AAC/D,kDAAgC;AAChC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}

package/dist/passkey-sign-up.d.ts

@@ -17,7 +17,7 @@
  */
 import { type FapiClient, type FlowState } from './fapi';
 import type { AttemptView } from './attempt';
-import { type WebAuthnHost } from './passkey';
+import { type PasskeyExtensionOptions, type WebAuthnHost } from './passkey';
 export interface PasskeySignUpInput {
     /** Collected when the instance's `account.passkeySignUp.email` is not `off`. */
     email?: string;
@@ -43,4 +43,4 @@ export declare function awaitingPasskey(attempt: AttemptView | null | undefined)
 export declare function registerSignUpPasskey(client: FapiClient, state: FlowState, opts?: {
     name?: string;
     host?: WebAuthnHost;
-}): Promise<FlowState>;
+} & PasskeyExtensionOptions): Promise<FlowState>;

package/dist/passkey-sign-up.js

@@ -66,7 +66,13 @@ async function registerSignUpPasskey(client, state, opts = {}) {
         return { ...state, busy: false, errors: begin.errors };
     let body;
     try {
-        body = await (0, passkey_1.createPasskey)(begin.data, { host: opts.host, ...(opts.name ? { name: opts.name } : {}) });
+        body = await (0, passkey_1.createPasskey)(begin.data, {
+            host: opts.host,
+            ...(opts.name ? { name: opts.name } : {}),
+            // PRF (client-side keys): the salts go to the authenticator, the outputs to the app only.
+            ...(opts.prf ? { prf: opts.prf } : {}),
+            ...(opts.onExtensionResults ? { onExtensionResults: opts.onExtensionResults } : {}),
+        });
     }
     catch (error) {
         return {

package/dist/passkey-sign-up.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-sign-up.js","sourceRoot":"","sources":["../src/passkey-sign-up.ts"],"names":[],"mappings":";;AAmCA,gDAgBC;AAGD,0CAOC;AAQD,sDA2CC;AAhHD;;;;;;;;;;;;;;;;GAgBG;AACH,iCAAsE;AAEtE,uCAA6D;AAe7D,uFAAuF;AAChF,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,KAAyB;IACpF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0D,6BAA6B,EAAE;QACzH,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,kBAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO;QACL,GAAG,kBAAW;QACd,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,0EAA0E;QAC1E,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;KAC9C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,eAAe,CAAC,OAAuC;IACrE,OAAO,CACL,CAAC,CAAC,OAAO;QACT,OAAO,CAAC,MAAM,KAAK,iBAAiB;QACpC,OAAO,CAAC,MAAM,KAAK,oBAAoB;QACvC,CAAC,OAAO,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CACzC,MAAkB,EAClB,KAAgB,EAChB,OAA+C,EAAE;IAEjD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAAE,CAAC;IAC1H,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0B,uBAAuB,EAAE,gBAAgB,EAAE;QAClG,WAAW,EAAE,KAAK,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAErF,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAA,uBAAa,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,GAAG,KAAK;YACR,IAAI,EAAE,KAAK;YACX,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,mBAAmB;oBACzB,gFAAgF;oBAChF,OAAO,EAAE,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;iBAClG;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoC,uBAAuB,EAAE,iBAAiB,EAAE;QAC9G,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,GAAG,IAAI;KACR,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACxF,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"passkey-sign-up.js","sourceRoot":"","sources":["../src/passkey-sign-up.ts"],"names":[],"mappings":";;AAmCA,gDAgBC;AAGD,0CAOC;AAQD,sDAiDC;AAtHD;;;;;;;;;;;;;;;;GAgBG;AACH,iCAAsE;AAEtE,uCAA2F;AAe3F,uFAAuF;AAChF,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,KAAyB;IACpF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0D,6BAA6B,EAAE;QACzH,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,kBAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO;QACL,GAAG,kBAAW;QACd,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,0EAA0E;QAC1E,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI;KAC9C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,eAAe,CAAC,OAAuC;IACrE,OAAO,CACL,CAAC,CAAC,OAAO;QACT,OAAO,CAAC,MAAM,KAAK,iBAAiB;QACpC,OAAO,CAAC,MAAM,KAAK,oBAAoB;QACvC,CAAC,OAAO,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CACzC,MAAkB,EAClB,KAAgB,EAChB,OAAyE,EAAE;IAE3E,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,EAAE,CAAC;IAC1H,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0B,uBAAuB,EAAE,gBAAgB,EAAE;QAClG,WAAW,EAAE,KAAK,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAErF,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAA,uBAAa,EAAC,KAAK,CAAC,IAAI,EAAE;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,0FAA0F;YAC1F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,GAAG,KAAK;YACR,IAAI,EAAE,KAAK;YACX,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,mBAAmB;oBACzB,gFAAgF;oBAChF,OAAO,EAAE,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;iBAClG;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoC,uBAAuB,EAAE,iBAAiB,EAAE;QAC9G,WAAW,EAAE,KAAK,CAAC,UAAU;QAC7B,GAAG,IAAI;KACR,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACxF,OAAO;QACL,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC"}

package/dist/passkey.d.ts

@@ -34,6 +34,62 @@ export declare function base64UrlToBuffer(value: string): ArrayBuffer;
 export declare function passkeysSupported(host?: unknown): boolean;
 /** Whether conditional-UI (autofill) discovery is available (best-effort). */
 export declare function conditionalUiAvailable(): Promise<boolean>;
+/**
+ * A PRF salt: bytes, or a string (encoded as UTF-8). Use a fixed, app-chosen
+ * salt per purpose (for example `"myapp:vault-key:v1"`), so the same passkey
+ * always yields the same secret for that purpose.
+ */
+export type PasskeyPrfSalt = ArrayBuffer | ArrayBufferView | string;
+/** The salts for one PRF evaluation (`second` asks for a second, independent output). */
+export interface PasskeyPrfValues {
+    first: PasskeyPrfSalt;
+    second?: PasskeyPrfSalt;
+}
+/**
+ * Ask the authenticator for the WebAuthn `prf` extension: a secret derived from
+ * the passkey and your salt, which never leaves the browser. Use it to derive a
+ * client-side encryption key. `eval` applies to any credential;
+ * `evalByCredential` (sign-in only) gives per-credential salts keyed by
+ * base64url credential id.
+ */
+export interface PasskeyPrfRequest {
+    eval?: PasskeyPrfValues;
+    evalByCredential?: Record<string, PasskeyPrfValues>;
+}
+/** What the browser answered for `prf`. */
+export interface PasskeyPrfResult {
+    /** Registration: whether the new passkey supports PRF. */
+    enabled?: boolean;
+    /** The PRF outputs (32 bytes each), when the authenticator evaluated them. */
+    results?: {
+        first: Uint8Array;
+        second?: Uint8Array;
+    };
+}
+/**
+ * The client extension results of a ceremony — returned to YOUR code only. They
+ * are never sent to Atlas: the `finish` body is unchanged.
+ */
+export interface PasskeyExtensionResults {
+    /** The credential the ceremony used (base64url). */
+    credentialId: string;
+    prf?: PasskeyPrfResult;
+    /** Registration: whether a discoverable credential (passkey) was created, when the browser says. */
+    credProps?: {
+        rk?: boolean;
+    };
+}
+/** Options shared by both ceremonies for client extensions. */
+export interface PasskeyExtensionOptions {
+    /** Request the `prf` extension (the salts are sent to the authenticator, not to Atlas). */
+    prf?: PasskeyPrfRequest;
+    /** Receives the client extension results (PRF outputs) after a successful ceremony. */
+    onExtensionResults?: (results: PasskeyExtensionResults) => void;
+}
+/** The `extensions` member for a ceremony, or undefined when nothing is requested. */
+export declare function passkeyExtensionsInput(prf: PasskeyPrfRequest | undefined, ceremony: 'create' | 'get'): Record<string, unknown> | undefined;
+/** Read (and normalise) a credential's client extension results. */
+export declare function readExtensionResults(credential: PublicKeyCredential): PasskeyExtensionResults;
 /** The POST body for /v1/client/me/passkeys/finish. */
 export interface PasskeyRegistrationBody {
     challenge: string;
@@ -49,7 +105,7 @@ export interface PasskeyRegistrationBody {
 export declare function createPasskey(begin: Record<string, unknown>, opts?: {
     name?: string;
     host?: WebAuthnHost;
-}): Promise<PasskeyRegistrationBody>;
+} & PasskeyExtensionOptions): Promise<PasskeyRegistrationBody>;
 /** The POST body for /v1/client/sign_ins/passkey/finish. */
 export interface PasskeyAssertionBody {
     handle: string;
@@ -67,4 +123,4 @@ export declare function getPasskeyAssertion(begin: Record<string, unknown>, opts
     host?: WebAuthnHost;
     mediation?: 'optional' | 'conditional';
     signal?: AbortSignal;
-}): Promise<PasskeyAssertionBody>;
+} & PasskeyExtensionOptions): Promise<PasskeyAssertionBody>;

package/dist/passkey.js

@@ -18,6 +18,8 @@ exports.bufferToBase64Url = bufferToBase64Url;
 exports.base64UrlToBuffer = base64UrlToBuffer;
 exports.passkeysSupported = passkeysSupported;
 exports.conditionalUiAvailable = conditionalUiAvailable;
+exports.passkeyExtensionsInput = passkeyExtensionsInput;
+exports.readExtensionResults = readExtensionResults;
 exports.createPasskey = createPasskey;
 exports.getPasskeyAssertion = getPasskeyAssertion;
 const defaultHost = () => {
@@ -61,6 +63,47 @@ async function conditionalUiAvailable() {
         return false;
     }
 }
+function saltBytes(salt) {
+    if (typeof salt === 'string')
+        return new TextEncoder().encode(salt);
+    if (salt instanceof ArrayBuffer)
+        return new Uint8Array(salt);
+    return new Uint8Array(salt.buffer, salt.byteOffset, salt.byteLength);
+}
+function prfValues(v) {
+    return { first: saltBytes(v.first), ...(v.second !== undefined ? { second: saltBytes(v.second) } : {}) };
+}
+/** The `extensions` member for a ceremony, or undefined when nothing is requested. */
+function passkeyExtensionsInput(prf, ceremony) {
+    if (!prf)
+        return undefined;
+    const out = {};
+    if (prf.eval)
+        out.eval = prfValues(prf.eval);
+    if (ceremony === 'get' && prf.evalByCredential) {
+        out.evalByCredential = Object.fromEntries(Object.entries(prf.evalByCredential).map(([id, v]) => [id, prfValues(v)]));
+    }
+    return { prf: out };
+}
+const toBytes = (v) => v instanceof ArrayBuffer ? new Uint8Array(v) : ArrayBuffer.isView(v) ? new Uint8Array(v.buffer, v.byteOffset, v.byteLength) : undefined;
+/** Read (and normalise) a credential's client extension results. */
+function readExtensionResults(credential) {
+    const raw = credential.getClientExtensionResults?.() ?? {};
+    const out = { credentialId: bufferToBase64Url(credential.rawId) };
+    const prf = raw.prf;
+    if (prf && typeof prf === 'object') {
+        const first = toBytes(prf.results?.first);
+        const second = toBytes(prf.results?.second);
+        out.prf = {
+            ...(typeof prf.enabled === 'boolean' ? { enabled: prf.enabled } : {}),
+            ...(first ? { results: { first, ...(second ? { second } : {}) } } : {}),
+        };
+    }
+    const credProps = raw.credProps;
+    if (credProps && typeof credProps === 'object')
+        out.credProps = typeof credProps.rk === 'boolean' ? { rk: credProps.rk } : {};
+    return out;
+}
 /**
  * Run navigator.credentials.create from a `/passkeys/begin` response and return
  * the `/finish` body. `begin` is the JSON the server sent (challenge, rp, user,
@@ -79,11 +122,16 @@ async function createPasskey(begin, opts = {}) {
         authenticatorSelection: begin.authenticatorSelection,
         timeout: begin.timeout,
         attestation: begin.attestation,
+        ...extensionsMember(passkeyExtensionsInput(opts.prf, 'create'), begin.extensions),
     };
     const credential = (await host.credentials.create({ publicKey }));
     if (!credential)
         throw new Error('Passkey registration was cancelled.');
     const response = credential.response;
+    // Client extension results (PRF outputs) go to the app's callback only —
+    // never into the finish body, so Atlas never sees them.
+    if (opts.onExtensionResults)
+        opts.onExtensionResults(readExtensionResults(credential));
     return {
         // Echo the server's challenge string — the server matched/stored it.
         challenge: begin.challenge,
@@ -105,6 +153,7 @@ async function getPasskeyAssertion(begin, opts = {}) {
         allowCredentials: allow.map((c) => ({ type: c.type, id: base64UrlToBuffer(c.id) })),
         userVerification: begin.userVerification,
         timeout: begin.timeout,
+        ...extensionsMember(passkeyExtensionsInput(opts.prf, 'get'), begin.extensions),
     };
     const credential = (await host.credentials.get({
         publicKey,
@@ -114,6 +163,8 @@ async function getPasskeyAssertion(begin, opts = {}) {
     if (!credential)
         throw new Error('Passkey sign-in was cancelled.');
     const response = credential.response;
+    if (opts.onExtensionResults)
+        opts.onExtensionResults(readExtensionResults(credential));
     return {
         handle: begin.handle,
         challenge: begin.challenge,
@@ -123,4 +174,14 @@ async function getPasskeyAssertion(begin, opts = {}) {
         signature: bufferToBase64Url(response.signature),
     };
 }
+/**
+ * The ceremony's `extensions`: what the server's begin response asked for
+ * (when it asks for any), with the app's PRF request merged in.
+ */
+function extensionsMember(app, server) {
+    const fromServer = server && typeof server === 'object' && !Array.isArray(server) ? server : undefined;
+    if (!app && !fromServer)
+        return {};
+    return { extensions: { ...(fromServer ?? {}), ...(app ?? {}) } };
+}
 //# sourceMappingURL=passkey.js.map

package/dist/passkey.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../src/passkey.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAuBH,8CAKC;AAGD,8CAOC;AAGD,8CAGC;AAGD,wDAQC;AAeD,sCA8BC;AAgBD,kDA+BC;AArID,MAAM,WAAW,GAAG,GAAiB,EAAE;IACrC,MAAM,GAAG,GAAI,UAAsC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,GAAG,IAAI,CAAE,GAAiC,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAA8B,CAAC;AACxC,CAAC,CAAC;AAEF,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,GAA6B;IAC7D,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,CAAC,GAAG,IAAI,IAAK,UAAgD,CAAC,mBAAmB,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,WAAW,CAAC;AAClC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,sBAAsB;IAC1C,MAAM,EAAE,GAAI,UAAqG;SAC9G,mBAAmB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,+BAA+B,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,KAA8B,EAC9B,OAA+C,EAAE;IAEjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAyD,CAAC;IAC7E,MAAM,OAAO,GAAI,KAAK,CAAC,kBAAiE,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACjD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;KACkB,CAAC;IAEnD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAA+B,CAAC;IAChG,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IAEzE,OAAO;QACL,qEAAqE;QACrE,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAA8B,EAC9B,OAA8F,EAAE;IAEhG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAI,KAAK,CAAC,gBAA+D,IAAI,EAAE,CAAC;IAE3F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;KACyB,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA0C,CAAC;IAEvE,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAgB;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../src/passkey.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAuBH,8CAKC;AAGD,8CAOC;AAGD,8CAGC;AAGD,wDAQC;AAkED,wDAaC;AAMD,oDAeC;AAeD,sCAkCC;AAgBD,kDAiCC;AA/OD,MAAM,WAAW,GAAG,GAAiB,EAAE;IACrC,MAAM,GAAG,GAAI,UAAsC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,GAAG,IAAI,CAAE,GAAiC,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAA8B,CAAC;AACxC,CAAC,CAAC;AAEF,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,GAA6B;IAC7D,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+CAA+C;AAC/C,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,uDAAuD;AACvD,SAAgB,iBAAiB,CAAC,IAAc;IAC9C,MAAM,CAAC,GAAG,IAAI,IAAK,UAAgD,CAAC,mBAAmB,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,WAAW,CAAC;AAClC,CAAC;AAED,8EAA8E;AACvE,KAAK,UAAU,sBAAsB;IAC1C,MAAM,EAAE,GAAI,UAAqG;SAC9G,mBAAmB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,EAAE,+BAA+B,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAuDD,SAAS,SAAS,CAAC,IAAoB;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,IAAI,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,CAAmB;IACpC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED,sFAAsF;AACtF,SAAgB,sBAAsB,CACpC,GAAkC,EAClC,QAA0B;IAE1B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC/C,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAA0B,EAAE,CACrD,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE1I,oEAAoE;AACpE,SAAgB,oBAAoB,CAAC,UAA+B;IAClE,MAAM,GAAG,GAAI,UAAuF,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC;IACzI,MAAM,GAAG,GAA4B,EAAE,YAAY,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3F,MAAM,GAAG,GAAG,GAAG,CAAC,GAAyF,CAAC;IAC1G,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,GAAG;YACR,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAyC,CAAC;IAChE,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,OAAO,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9H,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,KAA8B,EAC9B,OAAyE,EAAE;IAE3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAyD,CAAC;IAC7E,MAAM,OAAO,GAAI,KAAK,CAAC,kBAAiE,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACjD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KACjC,CAAC;IAEnD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAA+B,CAAC;IAChG,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA4C,CAAC;IACzE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,qEAAqE;QACrE,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,KAA8B,EAC9B,OAAwH,EAAE;IAE1H,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IACxC,MAAM,KAAK,GAAI,KAAK,CAAC,gBAA+D,IAAI,EAAE,CAAC;IAE3F,MAAM,SAAS,GAAG;QAChB,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAmB,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnF,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;KAC/B,CAAC;IAElD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAC7C,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAA+B,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAA0C,CAAC;IACvE,IAAI,IAAI,CAAC,kBAAkB;QAAE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAgB;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAmB;QACpC,aAAa,EAAE,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QAClD,kBAAkB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5D,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,GAAwC,EACxC,MAAe;IAEf,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpI,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;AACnE,CAAC"}

package/dist/sign-out-guard.d.ts

@@ -43,6 +43,12 @@ export interface SignOutGuardOptions {
     retryDelaysMs?: number[];
     /** Skip front-channel logout entirely (runtimes without a DOM). */
     frontChannelLogout?: boolean;
+    /**
+     * How to open the upstream end-session URL or the SAML Single Logout URL
+     * (default: `window.location.assign`).
+     * Native SDKs pass their system-browser opener.
+     */
+    navigate?: (href: string) => void;
 }
 /** What {@link SignOutGuard.revoke} did on the server. */
 export interface SignOutAttempt {
@@ -60,6 +66,7 @@ export declare class SignOutGuard {
     private readonly request;
     private readonly retryDelaysMs;
     private readonly frontChannelLogout;
+    private readonly navigate?;
     /** Sessions with a background revoke in flight or scheduled. */
     private readonly retrying;
     private readonly timers;

package/dist/sign-out-guard.js

@@ -24,6 +24,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SignOutGuard = void 0;
 const frontchannel_logout_1 = require("./frontchannel-logout");
+const upstream_logout_1 = require("./upstream-logout");
 const impersonation_1 = require("./impersonation");
 const sign_out_1 = require("./sign-out");
 const DEFAULT_RETRY_DELAYS_MS = [15_000, 60_000, 300_000];
@@ -33,6 +34,7 @@ class SignOutGuard {
     request;
     retryDelaysMs;
     frontChannelLogout;
+    navigate;
     /** Sessions with a background revoke in flight or scheduled. */
     retrying = new Set();
     timers = new Set();
@@ -43,6 +45,7 @@ class SignOutGuard {
                 new sign_out_1.SessionTombstones({ frontendApi: options.frontendApi, ...(options.store ? { store: options.store } : {}) });
         this.retryDelaysMs = options.retryDelaysMs ?? DEFAULT_RETRY_DELAYS_MS;
         this.frontChannelLogout = options.frontChannelLogout !== false;
+        this.navigate = options.navigate;
     }
     /** Settles once persisted tombstones are loaded — await it before the first boot. */
     get ready() {
@@ -90,7 +93,14 @@ class SignOutGuard {
         if (id) {
             // Remember it first: from here on nothing may re-adopt it.
             this.tombstones.add(id);
-            outcome = await (0, sign_out_1.revokeSession)(request, id);
+            // The upstream (RP-initiated) logout lands on `returnUrl`; SAML Single
+            // Logout returns the browser to `samlLogoutRedirectUrl` once the IdP is
+            // done (else `returnUrl`, else the page that signed out — the server reads
+            // it from the request's Referer / Origin).
+            outcome = await (0, sign_out_1.revokeSession)(request, id, {
+                ...(options.returnUrl ? { returnUrl: options.returnUrl } : {}),
+                ...(options.samlLogoutRedirectUrl ? { samlLogoutRedirectUrl: options.samlLogoutRedirectUrl } : {}),
+            });
             // OIDC Front-Channel Logout: let the apps signed in through this session
             // clear theirs in this browser (hidden iframes, capped at 5 s). Best-effort.
             if (this.frontChannelLogout && options.frontchannel !== false && typeof document !== 'undefined') {
@@ -129,9 +139,33 @@ class SignOutGuard {
         const { outcome, sessionId } = attempt;
         if (!outcome.revoked && options.strict)
             throw new sign_out_1.SignOutError(sessionId ?? '', outcome.status);
-        return outcome.activeSessionId
-            ? { revoked: outcome.revoked, activeSessionId: outcome.activeSessionId }
-            : { revoked: outcome.revoked };
+        // A browser follows one logout redirect. Upstream (RP-initiated) logout
+        // first: the local sign-out is done, so the browser can now be sent to the
+        // provider's end-session URL (an OpenID provider has no server-to-server
+        // fallback; a SAML IdP is told through SOAP back-channel logout when the
+        // server returned both).
+        const followedUpstream = outcome.upstreamLogoutUrl && options.upstreamLogout !== false
+            ? (0, upstream_logout_1.followUpstreamLogout)(outcome.upstreamLogoutUrl, this.navigate)
+            : false;
+        // SAML Single Logout: send the browser to the IdP so its session ends too.
+        // Not when another account was promoted (the user is still signed in here),
+        // and never outside a browser (unless the host supplied `navigate`).
+        if (!followedUpstream &&
+            outcome.samlLogoutUrl &&
+            options.samlLogout !== false &&
+            !outcome.activeSessionId) {
+            if (this.navigate)
+                this.navigate(outcome.samlLogoutUrl);
+            else if (typeof window !== 'undefined' && typeof window.location?.assign === 'function') {
+                window.location.assign(outcome.samlLogoutUrl);
+            }
+        }
+        return {
+            revoked: outcome.revoked,
+            ...(outcome.activeSessionId ? { activeSessionId: outcome.activeSessionId } : {}),
+            ...(outcome.upstreamLogoutUrl ? { upstreamLogoutUrl: outcome.upstreamLogoutUrl } : {}),
+            ...(outcome.samlLogoutUrl ? { samlLogoutUrl: outcome.samlLogoutUrl } : {}),
+        };
     }
     /** The cross-tab message announcing a sign-out (`{}` when there was no session). */
     signal(attempt) {

package/dist/sign-out-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-out-guard.js","sourceRoot":"","sources":["../src/sign-out-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAGH,+DAA0E;AAC1E,mDAAgF;AAChF,yCAOoB;AAqCpB,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAa,YAAY;IACvB,wDAAwD;IAC/C,UAAU,CAAoB;IACtB,OAAO,CAAc;IACrB,aAAa,CAAW;IACxB,kBAAkB,CAAU;IAC7C,gEAAgE;IAC/C,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEnE,YAAY,OAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,UAAU;YACb,OAAO,CAAC,UAAU;gBAClB,IAAI,4BAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACtE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC;IACjE,CAAC;IAED,qFAAqF;IACrF,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,SAAoC;QAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAoC,EAAE,OAAqB;QAChE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,SAAmB,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,SAAoC,EACpC,UAAsD,EAAE;QAExD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAChD,IAAI,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC;QAC3B,IAAI,OAAO,GAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACnE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACrF,EAAE,GAAG,OAAO,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,IAAI,EAAE,EAAE,CAAC;YACP,2DAA2D;YAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxB,OAAO,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,yEAAyE;YACzE,6EAA6E;YAC7E,IAAI,IAAI,CAAC,kBAAkB,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjG,MAAM,IAAA,uDAAiC,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CACpB,SAAoC,EACpC,OAAqB;QAErB,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAgB,EAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,KAAK;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,OAAuB;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAC3C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAuB,EAAE,UAA0B,EAAE;QAC1D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,uBAAY,CAAC,SAAS,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChG,OAAO,OAAO,CAAC,eAAe;YAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;YACxE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IAED,oFAAoF;IACpF,MAAM,CAAC,OAAuB;QAC5B,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAgB;QACpB,MAAM,IAAI,GAAI,OAAkC,EAAE,SAAS,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAwC,EAAE,WAAuB;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;YACvC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YACrB,IAAI,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,WAAW,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,OAAO;QACL,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,SAAiB,EAAE,OAAoB,EAAE,MAAgB;QACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAAiB,EAAE;YACrD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,CAAC,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjB,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;;YACpC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;CACF;AAzLD,oCAyLC"}
+{"version":3,"file":"sign-out-guard.js","sourceRoot":"","sources":["../src/sign-out-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAGH,+DAA0E;AAC1E,uDAAyD;AACzD,mDAAgF;AAChF,yCAOoB;AA2CpB,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAa,YAAY;IACvB,wDAAwD;IAC/C,UAAU,CAAoB;IACtB,OAAO,CAAc;IACrB,aAAa,CAAW;IACxB,kBAAkB,CAAU;IAC5B,QAAQ,CAA0B;IACnD,gEAAgE;IAC/C,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEnE,YAAY,OAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,UAAU;YACb,OAAO,CAAC,UAAU;gBAClB,IAAI,4BAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACtE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC;QAC/D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACnC,CAAC;IAED,qFAAqF;IACrF,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,SAAoC;QAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAoC,EAAE,OAAqB;QAChE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,SAAmB,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,SAAoC,EACpC,UAAsD,EAAE;QAExD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAChD,IAAI,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC;QAC3B,IAAI,OAAO,GAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACnE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACrF,EAAE,GAAG,OAAO,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,IAAI,EAAE,EAAE,CAAC;YACP,2DAA2D;YAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxB,uEAAuE;YACvE,wEAAwE;YACxE,2EAA2E;YAC3E,2CAA2C;YAC3C,OAAO,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,EAAE,EAAE;gBACzC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG,CAAC,CAAC;YACH,yEAAyE;YACzE,6EAA6E;YAC7E,IAAI,IAAI,CAAC,kBAAkB,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjG,MAAM,IAAA,uDAAiC,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CACpB,SAAoC,EACpC,OAAqB;QAErB,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAgB,EAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,KAAK;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,OAAuB;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAC3C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAuB,EAAE,UAA0B,EAAE;QAC1D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,uBAAY,CAAC,SAAS,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChG,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,yBAAyB;QACzB,MAAM,gBAAgB,GACpB,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK;YAC3D,CAAC,CAAC,IAAA,sCAAoB,EAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC;YAChE,CAAC,CAAC,KAAK,CAAC;QACZ,2EAA2E;QAC3E,4EAA4E;QAC5E,qEAAqE;QACrE,IACE,CAAC,gBAAgB;YACjB,OAAO,CAAC,aAAa;YACrB,OAAO,CAAC,UAAU,KAAK,KAAK;YAC5B,CAAC,OAAO,CAAC,eAAe,EACxB,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;iBACnD,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;gBACxF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,MAAM,CAAC,OAAuB;QAC5B,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAgB;QACpB,MAAM,IAAI,GAAI,OAAkC,EAAE,SAAS,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAwC,EAAE,WAAuB;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;YACvC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YACrB,IAAI,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,WAAW,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,OAAO;QACL,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,SAAiB,EAAE,OAAoB,EAAE,MAAgB;QACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAAiB,EAAE;YACrD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,CAAC,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjB,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;;YACpC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;CACF;AA5ND,oCA4NC"}

package/dist/sign-out.d.ts

@@ -27,6 +27,19 @@ export interface SignOutResult {
      * (multi-session). The SDK adopts it, so the user stays signed in as it.
      */
     activeSessionId?: string;
+    /**
+     * Set when the session came from an upstream OpenID provider with
+     * RP-initiated logout on: its end-session URL. The SDKs navigate there after
+     * the local sign-out unless `signOut({ upstreamLogout: false })`.
+     */
+    upstreamLogoutUrl?: string;
+    /**
+     * SAML Single Logout: the URL that ends the identity provider's session too.
+     * Present only when the revoked session came from a SAML connection with
+     * Single Logout on. Unless `signOut({ samlLogout: false })`, the browser has
+     * already been sent there.
+     */
+    samlLogoutUrl?: string;
 }
 /** The error `signOut({ strict: true })` rejects with when the revoke fails. */
 export declare class SignOutError extends Error {
@@ -46,6 +59,10 @@ export interface RevokeSessionOutcome {
     response?: Response;
     /** A parked session the server promoted to active, if any. */
     activeSessionId?: string;
+    /** The upstream provider's end-session URL, when it has RP-initiated logout on. */
+    upstreamLogoutUrl?: string;
+    /** SAML Single Logout: the URL that completes logout at the identity provider. */
+    samlLogoutUrl?: string;
 }
 /**
  * `POST /v1/client/sessions/:id/revoke`, retried once on a network failure or a
@@ -57,7 +74,13 @@ export interface RevokeSessionOutcome {
  */
 export declare function revokeSession(request: (path: string, init?: RequestInit) => Promise<Response>, sessionId: string, options?: {
     retries?: number;
+    /** Where an upstream (RP-initiated) logout returns the user — an allowed origin of the instance. */
+    returnUrl?: string;
+    /** SAML Single Logout: where the IdP returns the browser (an allowed origin). */
+    samlLogoutRedirectUrl?: string;
 }): Promise<RevokeSessionOutcome>;
+/** Only an absolute https URL (or http on loopback, for local development) is followed. */
+export declare function safeSamlLogoutUrl(raw: unknown): string | undefined;
 /** Options for {@link SessionTombstones}. */
 export interface SessionTombstonesOptions {
     /**