@_mustachio/openauth 0.10.0 → 0.11.0

package/dist/esm/http/handlers/token.js

@@ -1,5 +1,6 @@
 // src/http/handlers/token.ts
 import { clientCredentialsGrant } from "../../domain/client-credentials";
+import { canonicalHtu, verifyDpopProof } from "../../domain/dpop";
 import { exchangeCode } from "../../domain/token";
 import { exchangeToken } from "../../domain/token-exchange";
 import { refreshTokens } from "../../domain/refresh";
@@ -19,6 +20,29 @@ function makeTokenHandler(deps) {
       body.set("client_id", basic.id);
       body.set("client_secret", basic.secret);
     }
+    const dpopHeader = c.req.header("dpop") ?? null;
+    let dpopJkt;
+    if (dpopHeader) {
+      const dpopRes = await verifyDpopProof({
+        proofJwt: dpopHeader,
+        htu: canonicalHtu(c.req.url),
+        htm: "POST",
+        nowSec: Math.floor(deps.clock() / 1000)
+      }, { tokenStore: deps.tokenStore });
+      if (isErr(dpopRes)) {
+        const errVal = dpopRes.error;
+        if (errVal.code === "invalid_dpop_proof" && errVal.replaySignal && deps.auditLog) {
+          await deps.auditLog.log({
+            kind: "dpop_replay_detected",
+            tenantId: null,
+            jtiPrefix: errVal.replaySignal.jti.slice(0, 16),
+            timestamp: deps.clock()
+          });
+        }
+        return tokenEndpointErrorResponse(errVal);
+      }
+      dpopJkt = dpopRes.value.jkt;
+    }
     const parsed = tokenRequestSchema.safeParse(Object.fromEntries(body.entries()));
     if (!parsed.success) {
       const first = parsed.error.issues[0];
@@ -35,7 +59,8 @@ function makeTokenHandler(deps) {
         redirectUri: req.redirect_uri,
         clientId: req.client_id,
         ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {},
-        ...req.code_verifier !== undefined ? { codeVerifier: req.code_verifier } : {}
+        ...req.code_verifier !== undefined ? { codeVerifier: req.code_verifier } : {},
+        ...dpopJkt !== undefined ? { dpopJkt } : {}
       }, {
         configStore: deps.configStore,
         tokenStore: deps.tokenStore,
@@ -44,7 +69,8 @@ function makeTokenHandler(deps) {
         success: deps.success,
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
-        clock: deps.clock
+        clock: deps.clock,
+        ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       });
       if (isErr(result))
         return tokenEndpointErrorResponse(result.error);
@@ -75,7 +101,8 @@ function makeTokenHandler(deps) {
         success: deps.success,
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
-        clock: deps.clock
+        clock: deps.clock,
+        ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       }, tenantRes.value);
       if (isErr(result))
         return tokenEndpointErrorResponse(result.error);
@@ -87,14 +114,16 @@ function makeTokenHandler(deps) {
         refreshToken: req.refresh_token,
         ...req.scope !== undefined ? { scope: req.scope } : {},
         ...req.client_id !== undefined ? { clientId: req.client_id } : {},
-        ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {}
+        ...req.client_secret !== undefined ? { clientSecret: req.client_secret } : {},
+        ...dpopJkt !== undefined ? { dpopJkt } : {}
       }, {
         configStore: deps.configStore,
         tokenStore: deps.tokenStore,
         keyStore: deps.keyStore,
         ...deps.auditLog ? { auditLog: deps.auditLog } : {},
         issuerUrl: c.get("issuerUrl"),
-        clock: deps.clock
+        clock: deps.clock,
+        ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       });
       if (isErr(refreshResult))
         return tokenEndpointErrorResponse(refreshResult.error);
@@ -117,7 +146,8 @@ function makeTokenHandler(deps) {
       ...deps.auditLog ? { auditLog: deps.auditLog } : {},
       ...deps.exchangeAudience ? { exchangeAudience: deps.exchangeAudience } : {},
       issuerUrl: c.get("issuerUrl"),
-      clock: deps.clock
+      clock: deps.clock,
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
     });
     if (isErr(exchangeResult)) {
       return tokenEndpointErrorResponse(exchangeResult.error);

package/dist/esm/http/handlers/userinfo.js

@@ -1,38 +1,32 @@
 // src/http/handlers/userinfo.ts
+import { canonicalHtu } from "../../domain/dpop";
 import { userinfo } from "../../domain/userinfo";
 import { isErr } from "../../types/result";
 function makeUserinfoHandler(deps) {
   return async (c) => {
-    const bearer = extractBearer(c.req.header("authorization") ?? null);
-    if (!bearer) {
-      const r = new Response(JSON.stringify({
-        error: "invalid_token",
-        error_description: "missing bearer token"
-      }), {
-        status: 401,
-        headers: {
-          "content-type": "application/json",
-          "www-authenticate": 'Bearer realm="userinfo"'
-        }
-      });
-      return r;
+    const auth = extractAuthorization(c.req.header("authorization") ?? null);
+    if (!auth) {
+      return wwwAuthenticateResponse("Bearer", "invalid_token", "missing bearer / DPoP token", 401);
     }
-    const res = await userinfo(bearer, {
+    const dpopProof = c.req.header("dpop") ?? undefined;
+    const res = await userinfo({
+      accessToken: auth.token,
+      scheme: auth.scheme,
+      ...dpopProof !== undefined ? { dpopProof } : {},
+      htu: canonicalHtu(c.req.url),
+      htm: c.req.method.toUpperCase(),
+      nowSec: Math.floor(deps.clock() / 1000)
+    }, {
       keyStore: deps.keyStore,
-      issuerUrl: c.get("issuerUrl")
+      tokenStore: deps.tokenStore,
+      issuerUrl: c.get("issuerUrl"),
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
     });
     if (isErr(res)) {
-      const err = res.error;
-      return new Response(JSON.stringify({
-        error: "invalid_token",
-        error_description: err.description
-      }), {
-        status: 401,
-        headers: {
-          "content-type": "application/json",
-          "www-authenticate": `Bearer error="invalid_token"`
-        }
-      });
+      const error = res.error;
+      const scheme = auth.scheme;
+      const wireError = error.code === "invalid_dpop_proof" ? "invalid_dpop_proof" : "invalid_token";
+      return wwwAuthenticateResponse(scheme, wireError, error.description, 401);
     }
     return new Response(JSON.stringify(res.value), {
       status: 200,
@@ -43,11 +37,23 @@ function makeUserinfoHandler(deps) {
     });
   };
 }
-function extractBearer(header) {
+function extractAuthorization(header) {
   if (!header)
     return null;
-  const m = /^Bearer\s+(.+)$/i.exec(header);
-  return m?.[1] ?? null;
+  const m = /^(Bearer|DPoP)\s+(.+)$/i.exec(header);
+  if (!m || !m[1] || !m[2])
+    return null;
+  const scheme = m[1].toLowerCase() === "dpop" ? "DPoP" : "Bearer";
+  return { scheme, token: m[2] };
+}
+function wwwAuthenticateResponse(scheme, error, description, status) {
+  return new Response(JSON.stringify({ error, error_description: description }), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "www-authenticate": `${scheme} error="${error}"`
+    }
+  });
 }
 export {
   makeUserinfoHandler

package/dist/esm/http/router.js

@@ -2,8 +2,11 @@
 import { Hono } from "hono";
 import { makeAuthorizeHandler } from "./handlers/authorize";
 import { makeCallbackHandler } from "./handlers/callback";
+import { makeEndSessionHandler } from "./handlers/end-session";
 import { makeDiscoveryHandler, makeJwksHandler } from "./handlers/metadata";
 import { makeMethodRouteHandler } from "./handlers/method-route";
+import { makeParHandler } from "./handlers/par";
+import { makeRegisterHandler } from "./handlers/register";
 import { makeIntrospectHandler, makeRevokeHandler } from "./handlers/revocation";
 import { makeTokenHandler } from "./handlers/token";
 import { makeUserinfoHandler } from "./handlers/userinfo";
@@ -28,6 +31,13 @@ function buildRouter(deps) {
   app.post("/userinfo", makeUserinfoHandler(deps));
   app.post("/revoke", makeRevokeHandler(deps));
   app.post("/introspect", makeIntrospectHandler(deps));
+  app.use("/end_session", tenantMiddleware(deps));
+  app.get("/end_session", makeEndSessionHandler(deps));
+  app.post("/end_session", makeEndSessionHandler(deps));
+  app.use("/par", tenantMiddleware(deps));
+  app.post("/par", makeParHandler(deps));
+  app.use("/register", tenantMiddleware(deps));
+  app.post("/register", makeRegisterHandler(deps));
   return app;
 }
 export {

package/dist/esm/http/schemas/authorize.js

@@ -17,8 +17,14 @@ var authorizeQuerySchema = z.object({
   code_challenge_method: z.literal("S256").optional(),
   prompt: csv.optional(),
   ui_locales: csv.optional(),
-  nonce: z.string().optional()
+  nonce: z.string().optional(),
+  claims: z.string().min(1).optional()
+}).passthrough();
+var authorizeRequestUriQuerySchema = z.object({
+  client_id: z.string({ required_error: "missing client_id" }).min(1, "empty client_id"),
+  request_uri: z.string({ required_error: "missing request_uri" }).min(1)
 }).passthrough();
 export {
+  authorizeRequestUriQuerySchema,
   authorizeQuerySchema
 };

package/dist/esm/http/schemas/end-session.js

@@ -0,0 +1,13 @@
+// src/http/schemas/end-session.ts
+import { z } from "zod";
+var endSessionParamsSchema = z.object({
+  id_token_hint: z.string().optional(),
+  client_id: z.string().min(1).optional(),
+  post_logout_redirect_uri: z.string().url("post_logout_redirect_uri must be a valid URL").optional(),
+  state: z.string().optional(),
+  logout_hint: z.string().optional(),
+  ui_locales: z.string().optional()
+}).passthrough();
+export {
+  endSessionParamsSchema
+};

package/dist/esm/http/schemas/par.js

@@ -0,0 +1,9 @@
+// src/http/schemas/par.ts
+import { z } from "zod";
+var parBodySchema = z.object({
+  client_id: z.string({ required_error: "missing client_id" }).min(1, "empty client_id"),
+  client_secret: z.string().optional()
+}).catchall(z.string());
+export {
+  parBodySchema
+};

package/dist/esm/http/schemas/register.js

@@ -0,0 +1,16 @@
+// src/http/schemas/register.ts
+import { z } from "zod";
+var registerBodySchema = z.object({
+  client_name: z.string().min(1).optional(),
+  redirect_uris: z.array(z.string().url("redirect_uri must be a valid URL")).min(1, "redirect_uris must be a non-empty array"),
+  grant_types: z.array(z.string()).optional(),
+  response_types: z.array(z.string()).optional(),
+  token_endpoint_auth_method: z.enum(["none", "client_secret_basic", "client_secret_post"]).optional(),
+  scope: z.string().optional(),
+  post_logout_redirect_uris: z.array(z.string().url()).optional(),
+  sector_identifier_uri: z.string().url().optional(),
+  contacts: z.array(z.string()).optional()
+}).passthrough();
+export {
+  registerBodySchema
+};

package/dist/esm/index.js

@@ -68,13 +68,15 @@ function createIdP(opts) {
     ...opts.persistUpstreamTokens ? { persistUpstreamTokens: opts.persistUpstreamTokens } : {},
     ...opts.exchangeAudience ? { exchangeAudience: opts.exchangeAudience } : {},
     ...opts.renderPicker ? { renderPicker: opts.renderPicker } : {},
+    ...opts.registerClient ? { registerClient: opts.registerClient } : {},
     ...opts.buildCustomContext ? { buildCustomContext: opts.buildCustomContext } : {},
     clock,
     cookieDefaults: {
       secure: opts.cookies?.secure ?? true,
       ...opts.cookies?.domain !== undefined ? { domain: opts.cookies.domain } : {},
       ...opts.cookies?.path !== undefined ? { path: opts.cookies.path } : {}
-    }
+    },
+    ...opts.customScopeClaims !== undefined ? { customScopeClaims: opts.customScopeClaims } : {}
   };
   const app = buildRouter(deps);
   const fetch = async (req) => await app.fetch(req);
@@ -86,7 +88,10 @@ function createIdP(opts) {
     jwks: fetch,
     discovery: fetch,
     revoke: fetch,
-    introspect: fetch
+    introspect: fetch,
+    endSession: fetch,
+    par: fetch,
+    register: fetch
   };
 }
 export {

package/dist/esm/types/error.js

@@ -58,6 +58,11 @@ var authError = {
     code: "internal_error",
     description,
     ...cause !== undefined ? { cause } : {}
+  }),
+  invalidDpopProof: (description, replaySignal) => ({
+    code: "invalid_dpop_proof",
+    description,
+    ...replaySignal !== undefined ? { replaySignal } : {}
   })
 };
 export {

package/dist/types/adapters/memory/session-store.d.ts

@@ -1,5 +1,5 @@
 import type { FlowRecord } from "../../types/flow";
-import type { SessionRecord, SessionStore } from "../../ports/session-store";
+import type { ParRecord, SessionRecord, SessionStore } from "../../ports/session-store";
 import type { Result } from "../../types/result";
 import type { Clock } from "./clock";
 export type MemorySessionStoreOptions = {
@@ -15,5 +15,7 @@ export declare class MemorySessionStore implements SessionStore {
     createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
     readSession(sessionId: string): Promise<Result<SessionRecord>>;
     revokeSession(sessionId: string): Promise<Result<void>>;
+    savePar(requestUri: string, payload: ParRecord, ttl: number): Promise<Result<void>>;
+    consumePar(requestUri: string): Promise<Result<ParRecord>>;
 }
 //# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/memory/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAQpC,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,kBAAmB,YAAW,YAAY;;gBAKzC,IAAI,GAAE,yBAA8B;IAI1C,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAYrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAgBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAY9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAI9D"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/session-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EACV,SAAS,EACT,aAAa,EACb,YAAY,EACb,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAapC,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,kBAAmB,YAAW,YAAY;;gBAMzC,IAAI,GAAE,yBAA8B;IAI1C,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAYrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAgBxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAY9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKvD,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;CAejE"}

package/dist/types/adapters/memory/token-store.d.ts

@@ -24,5 +24,6 @@ export declare class MemoryTokenStore implements TokenStore {
     peekRefresh(refresh: string): Promise<Result<RefreshTokenPayload>>;
     revokeFamily(family: string): Promise<Result<void>>;
     revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+    recordDpopJti(jti: string, ttlMs: number): Promise<Result<void>>;
 }
 //# sourceMappingURL=token-store.d.ts.map

package/dist/types/adapters/memory/token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/token-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAapC,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,gBAAiB,YAAW,UAAU;;gBAKrC,IAAI,GAAE,uBAA4B;IAIxC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAgBlD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKlB,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAqCjC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAWlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASnD,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAWzB"}
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/token-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAapC,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,qBAAa,gBAAiB,YAAW,UAAU;;gBAOrC,IAAI,GAAE,uBAA4B;IAIxC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAgBlD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKlB,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAqCjC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAWlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASnD,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYlB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAavE"}

package/dist/types/client.d.ts

@@ -35,6 +35,13 @@ export interface Tokens {
      * The number of seconds until the access token expires.
      */
     expiresIn: number;
+    /**
+     * The OIDC `id_token` (signed JWT), present when `scope=openid` was granted.
+     *
+     * Refresh-grant rotation reissues this with a stable `auth_time` per
+     * OIDC Core §12 and deliberately omits the original `nonce`.
+     */
+    idToken?: string;
 }
 interface ResponseLike {
     json(): Promise<unknown>;
@@ -118,6 +125,18 @@ export interface AuthorizeOptions {
      * If there's only one provider configured, the user will be redirected to that.
      */
     provider?: string;
+    /**
+     * OAuth scopes to request, e.g. `["openid", "email", "profile"]`.
+     *
+     * Pass `openid` to request an `id_token` at `/token` (OIDC Core §2). Pass
+     * `email` / `profile` / `phone` / `address` to opt into the standard §5.4
+     * profile claim sets on the id_token and `/userinfo` response.
+     *
+     * Accepts an array or a pre-joined space-separated string. When omitted,
+     * no `scope` is sent — the IdP's default grant applies, which typically
+     * does NOT include `openid` and therefore does NOT issue an id_token.
+     */
+    scope?: string | string[];
 }
 export interface AuthorizeResult {
     /**

package/dist/types/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EAEzB,MAAM,YAAY,CAAA;AAGnB;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,UAAU,YAAY;IACpB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;CACnB;AACD,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAE1D;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,CAAA;IACpB;;;;;;;;OAQG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,GAAG,EAAE,6BAA6B,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,aAAa;IACnD;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,OAAO,EAAE;SACN,IAAI,IAAI,MAAM,CAAC,GAAG;YAAE,IAAI,EAAE,IAAI,CAAC;YAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;KACvE,CAAC,MAAM,CAAC,CAAC,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GAAG,OAAO,EAC1B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,GAAG,aAAa,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,cAAc,GAAG,YAAY,CAAC,CAAA;IACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,MAAM,CAAC,CAAC,SAAS,aAAa,EAC5B,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA4OvD"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EAEzB,MAAM,YAAY,CAAA;AAGnB;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,UAAU,YAAY;IACpB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;CACnB;AACD,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAE1D;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,CAAA;IACpB;;;;;;;;OAQG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,GAAG,EAAE,6BAA6B,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,aAAa;IACnD;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,OAAO,EAAE;SACN,IAAI,IAAI,MAAM,CAAC,GAAG;YAAE,IAAI,EAAE,IAAI,CAAC;YAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;KACvE,CAAC,MAAM,CAAC,CAAC,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GAAG,OAAO,EAC1B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,GAAG,aAAa,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,cAAc,GAAG,YAAY,CAAC,CAAA;IACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,MAAM,CAAC,CAAC,SAAS,aAAa,EAC5B,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAwPvD"}

package/dist/types/domain/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/domain/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EACV,oBAAoB,EAGpB,SAAS,EACT,WAAW,EACZ,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIhF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAK5C,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAiB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAY,CAAA;AAEzC,MAAM,MAAM,eAAe;AACzB;;;;;;GAMG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AACH,6DAA6D;GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE;AAC7D;;;GAGG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D,CAAA;AAEL,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAA;IACvB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAmI7C;AAuID,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/domain/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EACV,oBAAoB,EAGpB,SAAS,EACT,WAAW,EACZ,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIhF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAK5C,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAiB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAY,CAAA;AAEzC,MAAM,MAAM,eAAe;AACzB;;;;;;GAMG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AACH,6DAA6D;GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE;AAC7D;;;GAGG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D,CAAA;AAEL,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAA;IACvB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAuI7C;AA4ID,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA"}

package/dist/types/domain/client-credentials.d.ts

@@ -47,6 +47,8 @@ export type ClientCredentialsDeps = {
     issuerUrl: string;
     clock: () => number;
     newRefreshFamily?: () => string;
+    /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
 };
 export declare function clientCredentialsGrant(req: ClientCredentialsRequest, deps: ClientCredentialsDeps, tenantId: TenantId): Promise<Result<TokenResponse, AuthError>>;
 //# sourceMappingURL=client-credentials.d.ts.map

package/dist/types/domain/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../src/domain/client-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAKnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5C,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;CAChC,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,wBAAwB,EAC7B,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmH3C"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../src/domain/client-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAKnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5C,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,wBAAwB,EAC7B,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmH3C"}

package/dist/types/domain/discovery.d.ts

@@ -16,11 +16,37 @@ export type DiscoveryDocument = {
     jwks_uri: string;
     revocation_endpoint: string;
     introspection_endpoint: string;
+    /** OIDC RP-Initiated Logout 1.0 §2. */
+    end_session_endpoint: string;
+    /** RFC 7591 §3.1. */
+    registration_endpoint: string;
+    /** RFC 9126 §5. */
+    pushed_authorization_request_endpoint: string;
+    /**
+     * RFC 9126 §5. True iff every client on this tenant is required to use
+     * PAR. We advertise `false` at the tenant level — the per-client toggle
+     * is read at request time.
+     */
+    require_pushed_authorization_requests: boolean;
+    /** RFC 9449 §5.1 — DPoP algorithms accepted on proof JWTs. */
+    dpop_signing_alg_values_supported: string[];
     response_types_supported: string[];
     grant_types_supported: string[];
     subject_types_supported: string[];
     id_token_signing_alg_values_supported: string[];
     scopes_supported: string[];
+    /** OIDC Core §3 — registered claim names the IdP can return. */
+    claims_supported: string[];
+    /** OIDC Core §5.5 — `claims` request parameter is honored. */
+    claims_parameter_supported: boolean;
+    /** OIDC Core §6.1 — JAR (`request` parameter). Not implemented. */
+    request_parameter_supported: boolean;
+    /** OIDC Core §6.2 — JAR (`request_uri` parameter). Not implemented. */
+    request_uri_parameter_supported: boolean;
+    /** OIDC Core §6.2 — whether `request_uri` values must be pre-registered. */
+    require_request_uri_registration: boolean;
+    /** OIDC Core §3.1.2.1 — UI locales the OP can render. */
+    ui_locales_supported?: string[];
     token_endpoint_auth_methods_supported: string[];
     code_challenge_methods_supported: string[];
 };
@@ -34,9 +60,20 @@ export type DiscoveryDeps = {
         jwks: string;
         revoke: string;
         introspect: string;
+        endSession: string;
+        par: string;
+        register: string;
     }>;
     /** Advertised scopes. Defaults to `["openid", "email", "profile"]`. */
     scopes?: string[];
+    /** Advertised UI locales. Defaults to `["en"]`. */
+    uiLocales?: string[];
+    /**
+     * Host-supplied scope → claim-names map. Each key adds a scope to
+     * `scopes_supported`; the union of values augments `claims_supported`.
+     * Mirrors `IdPOptions.customScopeClaims`.
+     */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
 };
 export declare function buildDiscoveryDocument(deps: DiscoveryDeps): DiscoveryDocument;
 export type JwksDoc = ReturnType<typeof buildJwksDocument>;

package/dist/types/domain/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/domain/discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAA;AAEzC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClC,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,uBAAuB,EAAE,MAAM,EAAE,CAAA;IACjC,qCAAqC,EAAE,MAAM,EAAE,CAAA;IAC/C,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,qCAAqC,EAAE,MAAM,EAAE,CAAA;IAC/C,gCAAgC,EAAE,MAAM,EAAE,CAAA;CAC3C,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,CAAC;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,MAAM,CAAA;KACnB,CAAC,CAAA;IACF,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB,CAAA;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CA2B7E;AAED,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE1D,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAIrC"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/domain/discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAA;AAEzC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,sBAAsB,EAAE,MAAM,CAAA;IAC9B,uCAAuC;IACvC,oBAAoB,EAAE,MAAM,CAAA;IAC5B,qBAAqB;IACrB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,mBAAmB;IACnB,qCAAqC,EAAE,MAAM,CAAA;IAC7C;;;;OAIG;IACH,qCAAqC,EAAE,OAAO,CAAA;IAC9C,8DAA8D;IAC9D,iCAAiC,EAAE,MAAM,EAAE,CAAA;IAC3C,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClC,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,uBAAuB,EAAE,MAAM,EAAE,CAAA;IACjC,qCAAqC,EAAE,MAAM,EAAE,CAAA;IAC/C,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,8DAA8D;IAC9D,0BAA0B,EAAE,OAAO,CAAA;IACnC,mEAAmE;IACnE,2BAA2B,EAAE,OAAO,CAAA;IACpC,uEAAuE;IACvE,+BAA+B,EAAE,OAAO,CAAA;IACxC,4EAA4E;IAC5E,gCAAgC,EAAE,OAAO,CAAA;IACzC,yDAAyD;IACzD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,qCAAqC,EAAE,MAAM,EAAE,CAAA;IAC/C,gCAAgC,EAAE,MAAM,EAAE,CAAA;CAC3C,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,CAAC;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,MAAM,CAAA;QAClB,UAAU,EAAE,MAAM,CAAA;QAClB,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAC,CAAA;IACF,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CAoE7E;AAED,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE1D,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAIrC"}

package/dist/types/domain/dpop.d.ts

@@ -0,0 +1,61 @@
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+/** RFC 9449 §4.2 — fixed 60-second tolerance is the conventional default. */
+export declare const DEFAULT_DPOP_IAT_TOLERANCE_SEC = 60;
+/** Replay-window TTL for `jti` tracking. Matches `iat` tolerance × 2. */
+export declare const DEFAULT_DPOP_JTI_TTL_MS: number;
+export type DpopProofPayload = {
+    htu: string;
+    htm: string;
+    iat: number;
+    jti: string;
+    ath?: string;
+    nonce?: string;
+};
+export type VerifiedDpopProof = {
+    /** RFC 7638 JWK thumbprint of the proof's public key. */
+    jkt: string;
+    /** The decoded + signature-verified proof payload. */
+    payload: DpopProofPayload;
+};
+export type VerifyDpopProofInput = {
+    proofJwt: string;
+    /** Actual request URI (scheme + host + port + path; query/frag stripped). */
+    htu: string;
+    /** Actual HTTP method, uppercase. */
+    htm: string;
+    /** Wall clock seconds. */
+    nowSec: number;
+    /** Optional skew allowance. */
+    iatToleranceSec?: number;
+    /**
+     * Required at resource servers when the proof must bind to a presented
+     * access token. The verifier checks the proof's `ath` equals
+     * base64url(SHA-256(access_token ASCII)). Omit at the AS `/token`
+     * endpoint — no access token exists yet there.
+     */
+    expectedAth?: string;
+};
+export type VerifyDpopProofDeps = {
+    tokenStore: TokenStore;
+    jtiTtlMs?: number;
+};
+/**
+ * Verify a DPoP proof JWT and return its `jkt` + payload. Side-effect:
+ * records the `jti` in `TokenStore` so a replay within the TTL window
+ * is rejected.
+ */
+export declare function verifyDpopProof(input: VerifyDpopProofInput, deps: VerifyDpopProofDeps): Promise<Result<VerifiedDpopProof, AuthError>>;
+/**
+ * Canonicalize a request URL for `htu` comparison (RFC 9449 §4.3).
+ * Strips query string and fragment; preserves scheme, host, port, path.
+ * Default port for the scheme is removed.
+ */
+export declare function canonicalHtu(rawUrl: string): string;
+/**
+ * Compute the `ath` value (RFC 9449 §4.2): base64url(SHA-256(access_token ASCII)).
+ * Resource servers compare the presented DPoP proof's `ath` to this.
+ */
+export declare function computeAth(accessToken: string): Promise<string>;
+//# sourceMappingURL=dpop.d.ts.map

package/dist/types/domain/dpop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../../src/domain/dpop.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAQ7C,6EAA6E;AAC7E,eAAO,MAAM,8BAA8B,KAAK,CAAA;AAEhD,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,QAA4C,CAAA;AAEhF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAA;IACX,sDAAsD;IACtD,OAAO,EAAE,gBAAgB,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAA;IACX,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAA;IACX,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,+BAA+B;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAwK/C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMnD;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE"}