@_mustachio/openauth 0.10.0 → 0.11.0

package/dist/types/domain/id-token.d.ts

@@ -0,0 +1,83 @@
+import type { ClaimsRequest } from "../types/authorization";
+import type { IdTokenClaims, ScopedProfileClaims } from "../types/token";
+import type { SubjectClaim } from "../types/subject";
+/**
+ * Derive `amr` from the originating `methodKind`. Values are RFC 8176
+ * registered AMR codes. Returns `undefined` when no clean mapping exists
+ * — `amr` is an OPTIONAL id_token claim, so omission is spec-compliant.
+ */
+export declare function deriveAmr(methodKind: string): string[] | undefined;
+/**
+ * `at_hash` per OIDC Core §3.1.3.6: left-half of SHA-256(access_token
+ * ASCII), base64url. Always 16 bytes → 22 base64url characters for
+ * SHA-256 (256-bit → 128-bit half → 16 bytes → 22 chars).
+ */
+export declare function computeAtHash(accessToken: string): Promise<string>;
+/**
+ * Filter a `SubjectClaim.properties` record down to claims granted by the
+ * requested OIDC scopes, then optionally augment with claim names the RP
+ * specifically requested via the OIDC Core §5.5 `claims` parameter.
+ * Returns a typed `ScopedProfileClaims` ready to spread into the id_token
+ * or `/userinfo` response. Properties not named by any granted scope or
+ * explicit claim request are dropped.
+ *
+ * `extra` is the set of claim names the RP requested via `claims`
+ * parameter for THIS surface (id_token vs userinfo). Listing a name in
+ * `extra` bypasses scope gating per §5.5 ("works without the requestor
+ * having to include the scope value").
+ *
+ * `customMappings` is a host-supplied scope → claim-names map merged on
+ * top of the OIDC Core §5.4 table. Lets the host expose vendor-specific
+ * identity fields (e.g. `tenant_id`, `org_role`) via a custom scope
+ * (`scope=foo` granting `[tenant_id, …]`). Reserved §5.4 names cannot be
+ * shadowed — the standard mapping always wins on collision so an
+ * `email` scope can't accidentally start meaning something else.
+ *
+ * Host-supplied values are trusted to match their declared OIDC types
+ * — schemas live on `IdPOptions.subjects`, not here. The narrowing cast
+ * is the boundary between "host's responsibility" and "framework's
+ * responsibility."
+ */
+export declare function pickScopedClaims(claim: SubjectClaim, scopes: ReadonlyArray<string>, extra?: ReadonlyArray<string>, customMappings?: Record<string, ReadonlyArray<string>>): ScopedProfileClaims;
+export type BuildIdTokenInput = {
+    issuerUrl: string;
+    /** RP `client_id` — the id_token's `aud`. */
+    audience: string;
+    /** Stable subject identifier (same value as the access token's `sub`). */
+    subjectId: string;
+    claim: SubjectClaim;
+    scopes: ReadonlyArray<string>;
+    /** Seconds-since-epoch the user authenticated. */
+    authTime: number;
+    /** RP-supplied OIDC nonce, when present. */
+    appNonce?: string;
+    /** Wall clock (ms). */
+    now: number;
+    /** id_token TTL (ms). Default 5 minutes. */
+    ttlMs?: number;
+    /** Method kind for `amr` derivation. */
+    methodKind: string;
+    /** Pre-signed access token whose `at_hash` is bound into the id_token. */
+    accessToken: string;
+    /** OIDC Core §5.5 — RP-requested claims (this drives only id_token here). */
+    claimsRequest?: ClaimsRequest;
+    /**
+     * Host-supplied vendor scope → claim-names map. Merged on top of OIDC
+     * Core §5.4 at scope-gating time. See `pickScopedClaims`.
+     */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
+};
+export declare const DEFAULT_ID_TOKEN_TTL_MS: number;
+/**
+ * Assemble an `IdTokenClaims` object. Pure — no crypto except `at_hash`.
+ * Caller signs the result via `signIdToken`.
+ *
+ * Composition is via spread so the type stays narrow: the base claim set
+ * (REQUIRED OIDC §2 + auth_time + at_hash + optional nonce/amr) is built
+ * first; the scope-gated §5.1 profile claims merge over the top via
+ * `...pickScopedClaims(...)`. No dynamic index assignment, no cast.
+ */
+export declare function buildIdTokenClaims(input: BuildIdTokenInput): Promise<IdTokenClaims>;
+/** Predicate: does this token request warrant an `id_token` being issued? */
+export declare function shouldIssueIdToken(scopes: ReadonlyArray<string>): boolean;
+//# sourceMappingURL=id-token.d.ts.map

package/dist/types/domain/id-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token.d.ts","sourceRoot":"","sources":["../../../src/domain/id-token.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AA6BpD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAiBlE;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAC7B,KAAK,GAAE,aAAa,CAAC,MAAM,CAAM,EACjC,cAAc,GAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAM,GACzD,mBAAmB,CAqBrB;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC7B,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAA;IACnB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAgB,CAAA;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,aAAa,CAAC,CAqBxB;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAEzE"}

package/dist/types/domain/introspect.d.ts

@@ -43,9 +43,17 @@ export type IntrospectResponse = {
     iat: number;
     scope?: string;
     client_id?: string;
+    /** RFC 7662 §2.2 — the token's type indicator. */
+    token_type: "Bearer" | "DPoP";
     tid: string;
     mid?: string;
     mkind?: string;
+    /** Library-specific — subject schema discriminator (e.g. "user", "admin"). */
+    subject_type?: string;
+    /** RFC 9449 §6 — present when the access token is DPoP-bound. */
+    cnf?: {
+        jkt: string;
+    };
 };
 export type IntrospectRequest = {
     token: string;

package/dist/types/domain/introspect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"introspect.d.ts","sourceRoot":"","sources":["../../../src/domain/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAK/C,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GACjB;IACE,MAAM,EAAE,IAAI,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAEL,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAA;IAChD,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,iBAAiB,EAAE,QAAQ,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,EAAE,WAAW,CAAA;IACxB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,CA8DhD"}
+{"version":3,"file":"introspect.d.ts","sourceRoot":"","sources":["../../../src/domain/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAK/C,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GACjB;IACE,MAAM,EAAE,IAAI,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kDAAkD;IAClD,UAAU,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iEAAiE;IACjE,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CACtB,CAAA;AAEL,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAA;IAChD,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,iBAAiB,EAAE,QAAQ,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,EAAE,WAAW,CAAA;IACxB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAkEhD"}

package/dist/types/domain/jwt.d.ts

@@ -7,7 +7,7 @@
  * this module.
  */
 import type { JWK, KeyLike } from "jose";
-import type { AccessTokenClaims } from "../types/token";
+import type { AccessTokenClaims, IdTokenClaims } from "../types/token";
 import type { SigningKey } from "../ports/key-store";
 /**
  * Sign an access-token claim set under the supplied private key. `kid` is
@@ -15,6 +15,32 @@ import type { SigningKey } from "../ports/key-store";
  * key from JWKS.
  */
 export declare function signAccessToken(claims: AccessTokenClaims, privateKey: KeyLike, alg: string, kid: string): Promise<string>;
+/**
+ * Sign an OIDC `id_token` claim set (OIDC Core §2). Header `typ` is
+ * `"JWT"` per common practice; OIDC Core does not mandate `"id_token"`.
+ * The claims object is verified by the caller to include `iss`, `sub`,
+ * `aud`, `exp`, `iat` (REQUIRED per §2).
+ */
+export declare function signIdToken(claims: IdTokenClaims, privateKey: KeyLike, alg: string, kid: string): Promise<string>;
+/**
+ * Verify an OIDC `id_token` against the IdP's published signing keys.
+ * Used at `/end_session` to validate `id_token_hint` and by adjacent
+ * domain code that needs to introspect a previously-issued id_token.
+ *
+ * Same algorithm-confusion defenses as `verifyAccessToken`: only the
+ * asymmetric allow-list (`ES256`, `EdDSA`) accepted; `alg: "none"`
+ * rejected explicitly.
+ *
+ * `acceptExpired` relaxes the `exp` check — required at `/end_session`
+ * per OIDC RP-Initiated Logout 1.0 §2, where logout often follows token
+ * expiry and the spec permits accepting an expired hint. The signature
+ * + issuer + audience checks remain strict.
+ */
+export declare function verifyIdToken(token: string, keys: ReadonlyArray<SigningKey>, options?: {
+    issuer?: string;
+    audience?: string;
+    acceptExpired?: boolean;
+}): Promise<IdTokenClaims>;
 /**
  * Verify a JWT access token using a list of trusted signing keys (from
  * `KeyStore.signingKeys()`). Looks up by `kid` in the JWT header.

package/dist/types/domain/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/domain/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAGxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,OAAO,EACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAIjB;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,EAC/B,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACnD,OAAO,CAAC,iBAAiB,CAAC,CAgC5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG;IAClE,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ,CASA"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/domain/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAGxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,OAAO,EACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,OAAO,EACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,EAC/B,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,OAAO,CAAA;CACnB,GACL,OAAO,CAAC,aAAa,CAAC,CAsCxB;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,EAC/B,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACnD,OAAO,CAAC,iBAAiB,CAAC,CAgC5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG;IAClE,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ,CASA"}

package/dist/types/domain/logout.d.ts

@@ -0,0 +1,69 @@
+/**
+ * `/end_session` endpoint logic — OIDC RP-Initiated Logout 1.0.
+ *
+ * The OP validates the optional `id_token_hint`, validates the optional
+ * `post_logout_redirect_uri` against the client's registered list,
+ * revokes the subject's refresh tokens (when a subject is identified),
+ * and either redirects the user-agent back to the RP with `state` echoed
+ * or returns a generic "logged out" acknowledgement.
+ *
+ * Per §2:
+ *  - `id_token_hint` (RECOMMENDED): a previously-issued id_token. The
+ *    OP MUST verify the signature; expiry MAY be tolerated because
+ *    logout commonly follows token expiry. We accept expired hints but
+ *    enforce signature + issuer.
+ *  - `client_id` (OPTIONAL): when both this and `id_token_hint` are
+ *    present, the OP MUST verify the client_id matches the hint's `aud`.
+ *  - `post_logout_redirect_uri` (OPTIONAL): MUST be exact-match against
+ *    the resolved client's `postLogoutRedirectUris`. If the URI is not
+ *    registered, the OP MUST NOT redirect — surface a non-redirecting
+ *    error instead, otherwise the endpoint becomes an open redirector.
+ *  - `state` (OPTIONAL): echoed back in the redirect.
+ *
+ * Front-channel / back-channel logout (RP notification of OP-initiated
+ * logout) is out of scope for this minimal endpoint. Hosts that need it
+ * can layer their own notification fan-out on top of `session_logout`
+ * audit events.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { TenantContext } from "../types/tenant";
+export type EndSessionRequest = {
+    idTokenHint?: string;
+    clientId?: string;
+    postLogoutRedirectUri?: string;
+    state?: string;
+};
+export type EndSessionDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    issuerUrl: string;
+    clock: () => number;
+};
+export type EndSessionOutput = 
+/** Redirect the user-agent back to the RP. */
+{
+    kind: "redirect";
+    url: string;
+}
+/**
+ * No `post_logout_redirect_uri` was supplied (or it wasn't registered).
+ * Caller should render a minimal "logged out" page or return 200.
+ */
+ | {
+    kind: "ok";
+    subjectId?: string;
+};
+/**
+ * Process an `/end_session` request and return an outcome the HTTP
+ * adapter can translate into a `Response`. Pure domain — no Hono types,
+ * no `Response` construction here.
+ */
+export declare function endSession(req: EndSessionRequest, tenant: TenantContext, deps: EndSessionDeps): Promise<Result<EndSessionOutput, AuthError>>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/types/domain/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/domain/logout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAMlE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,gBAAgB;AAC1B,8CAA8C;AAC5C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnC;;;GAGG;GACD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAyG9C"}

package/dist/types/domain/par.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Pushed Authorization Requests (RFC 9126).
+ *
+ * The RP submits the full `/authorize` parameter set to `POST /par` along
+ * with its client credentials. The OP authenticates the client, stores
+ * the payload under an opaque `request_uri`, and returns it with an
+ * `expires_in`. The RP then redirects the user-agent to
+ * `GET /authorize?client_id=...&request_uri=...` and the OP rehydrates
+ * the original parameter set.
+ *
+ * Per RFC 9126 §3:
+ *  - Response is HTTP 201 with `application/json` body
+ *    `{request_uri, expires_in}`.
+ *  - `request_uri` MUST be of the form
+ *    `urn:ietf:params:oauth:request_uri:<opaque>` (§2.2).
+ *  - Default TTL is 60 seconds — same as auth-code TTL.
+ *
+ * Per RFC 9126 §4:
+ *  - At `/authorize`, `request_uri` is one-shot — consumed and discarded
+ *    on first use.
+ *  - Parameters in the PAR record take precedence; additional `/authorize`
+ *    parameters MAY be merged but MUST NOT contradict (we strictly use
+ *    the PAR'd set and ignore any additional ones except `client_id`).
+ *
+ * Client authentication (§2):
+ *  - Public clients: `client_id` only.
+ *  - Confidential clients: `client_id` + `client_secret` (Basic or form).
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { SessionStore } from "../ports/session-store";
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { TenantContext } from "../types/tenant";
+export declare const PAR_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+export declare const DEFAULT_PAR_TTL_MS: number;
+export type ParRequest = {
+    clientId: string;
+    /** Confidential-client secret. */
+    clientSecret?: string;
+    /** Raw `/authorize` parameter record, posted by the RP. */
+    params: Record<string, string>;
+};
+export type ParResponse = {
+    request_uri: string;
+    expires_in: number;
+};
+export type ParDeps = {
+    configStore: ConfigStore;
+    sessionStore: SessionStore;
+    auditLog?: AuditLog;
+    clock: () => number;
+    /** Test override. */
+    newRequestUriSuffix?: () => string;
+    ttlMs?: number;
+};
+/**
+ * Process a `POST /par` request. Authenticates the client, validates the
+ * `client_id` consistency, and persists the parameter set.
+ */
+export declare function pushAuthorizationRequest(req: ParRequest, tenant: TenantContext, deps: ParDeps): Promise<Result<ParResponse, AuthError>>;
+//# sourceMappingURL=par.d.ts.map

package/dist/types/domain/par.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"par.d.ts","sourceRoot":"","sources":["../../../src/domain/par.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,eAAO,MAAM,cAAc,uCAAuC,CAAA;AAClE,eAAO,MAAM,kBAAkB,QAAY,CAAA;AAE3C,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,qBAAqB;IACrB,mBAAmB,CAAC,EAAE,MAAM,MAAM,CAAA;IAClC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAmEzC"}

package/dist/types/domain/refresh.d.ts

@@ -27,6 +27,13 @@ export type RefreshGrantRequest = {
     /** Confidential clients authenticate at /token. */
     clientId?: string;
     clientSecret?: string;
+    /**
+     * RFC 9449 §6 — JWK thumbprint of the DPoP proof presented on this
+     * refresh request. MUST match `RefreshTokenPayload.dpopJkt` when the
+     * original grant was DPoP-bound; presence is REQUIRED for bound
+     * tokens, OPTIONAL otherwise.
+     */
+    dpopJkt?: string;
 };
 export type RefreshTokensDeps = {
     configStore: ConfigStore;
@@ -38,6 +45,8 @@ export type RefreshTokensDeps = {
     /** Reuse-detection window (ms). Default 60 s. */
     reuseWindowMs?: number;
     newRefreshToken?: () => string;
+    /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
 };
 export declare function refreshTokens(req: RefreshGrantRequest, deps: RefreshTokensDeps): Promise<Result<TokenResponse, AuthError>>;
 //# sourceMappingURL=refresh.d.ts.map

package/dist/types/domain/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/domain/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAMnD,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,eAAe,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;CAC/B,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmH3C"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/domain/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAMnD,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,eAAe,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmJ3C"}

package/dist/types/domain/register.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Dynamic Client Registration (RFC 7591).
+ *
+ * The host owns persistence — this module validates the wire request,
+ * mints a fresh `client_id` (and `client_secret` for confidential
+ * clients), invokes the host's `registerClient` hook with a structured
+ * `ClientConfig`, and builds the §3.2.1 response.
+ *
+ * Per RFC 7591:
+ *  - §2: registration request body is JSON, fields include
+ *    `client_name`, `redirect_uris`, `grant_types`, `response_types`,
+ *    `token_endpoint_auth_method`, `scope`, etc.
+ *  - §3.2.1: response is JSON with `client_id`, optional
+ *    `client_secret`, `client_id_issued_at`, optional
+ *    `client_secret_expires_at`, and the registered metadata.
+ *  - §3.2.2: structural problems → `invalid_client_metadata` /
+ *    `invalid_redirect_uri`. We collapse to `invalid_request` for
+ *    consistency with the rest of the library's error mapping.
+ */
+import { type AuthError } from "../types/error";
+import type { RegisterClient, RegisterClientRequest, RegisterClientResponse } from "../types/idp";
+import type { Result } from "../types/result";
+import type { TenantContext } from "../types/tenant";
+export type RegisterDeps = {
+    registerClient?: RegisterClient;
+    clock: () => number;
+    /** Test override for deterministic client_id. */
+    newClientId?: () => string;
+    /** Test override for deterministic client_secret. */
+    newClientSecret?: () => string;
+};
+export declare function registerNewClient(request: RegisterClientRequest, tenant: TenantContext, deps: RegisterDeps): Promise<Result<RegisterClientResponse, AuthError>>;
+//# sourceMappingURL=register.d.ts.map

package/dist/types/domain/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/domain/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,MAAM,MAAM,YAAY,GAAG;IACzB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;CAC/B,CAAA;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC,CA0HpD"}

package/dist/types/domain/token-exchange.d.ts

@@ -62,6 +62,8 @@ export type ExchangeTokenDeps = {
     issuerUrl: string;
     clock: () => number;
     newRefreshFamily?: () => string;
+    /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
 };
 export declare function exchangeToken(req: TokenExchangeRequest, deps: ExchangeTokenDeps): Promise<Result<TokenExchangeResponse, AuthError>>;
 //# sourceMappingURL=token-exchange.d.ts.map

package/dist/types/domain/token-exchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../../../src/domain/token-exchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAQtE,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,iDAAiD,CAAA;IAC5D,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG;IAClD,6DAA6D;IAC7D,iBAAiB,EAAE,+CAA+C,CAAA;CACnE,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;CAChC,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAsJnD"}
+{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../../../src/domain/token-exchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAQtE,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,iDAAiD,CAAA;IAC5D,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG;IAClD,6DAA6D;IAC7D,iBAAiB,EAAE,+CAA+C,CAAA;CACnE,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CA+JnD"}

package/dist/types/domain/token.d.ts

@@ -48,6 +48,13 @@ export type TokenAuthCodeRequest = {
     clientSecret?: string;
     /** Required if the original `/authorize` request had a `code_challenge`. */
     codeVerifier?: string;
+    /**
+     * RFC 9449 §6 — the JWK thumbprint of the presented DPoP proof. Set by
+     * the HTTP layer after verifying the `DPoP:` header against this
+     * request's actual method + URI. The domain binds the issued access
+     * token to this thumbprint via `cnf.jkt`.
+     */
+    dpopJkt?: string;
 };
 export type ExchangeCodeDeps = {
     configStore: ConfigStore;
@@ -61,6 +68,11 @@ export type ExchangeCodeDeps = {
     newRefreshToken?: () => string;
     /** Test override. */
     newRefreshFamily?: () => string;
+    /**
+     * Host-supplied vendor scope → claim-names map. Forwarded to `mintTokens`
+     * for id_token + /userinfo scope-gating. See `IdPOptions.customScopeClaims`.
+     */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
 };
 export declare function exchangeCode(req: TokenAuthCodeRequest, deps: ExchangeCodeDeps): Promise<Result<TokenResponse, AuthError>>;
 /**
@@ -70,7 +82,30 @@ export declare function exchangeCode(req: TokenAuthCodeRequest, deps: ExchangeCo
 export declare function mintTokens(args: {
     tenant: TenantContext;
     claim: SubjectClaim;
-    payload: Pick<CodePayload, "tenantId" | "clientId" | "methodId" | "methodKind" | "scopes" | "audience">;
+    payload: Pick<CodePayload, "tenantId" | "clientId" | "methodId" | "methodKind" | "scopes" | "audience"> & {
+        /**
+         * Present on `authorization_code` and `refresh_token` grants where an
+         * end-user actually authenticated. Absent on `client_credentials`
+         * (no end-user) — and absent means no `id_token` is emitted even if
+         * the requested scopes nominally include `openid`.
+         */
+        authTime?: number;
+        /** RP's OIDC `nonce` from `/authorize`, when present. */
+        appNonce?: string;
+        /**
+         * DPoP key thumbprint (RFC 9449 §6.1). When present, the access
+         * token's `cnf.jkt` claim is set and `token_type` flips to `"DPoP"`;
+         * the saved refresh-token payload's `dpopJkt` is set so refresh
+         * rotation re-enforces sender constraint.
+         */
+        dpopJkt?: string;
+        /**
+         * OIDC Core §5.5 — RP-requested claims from `/authorize`. Carried
+         * into the id_token and forward across refresh rotations (§12) so
+         * later /userinfo calls keep returning the requested fields.
+         */
+        claimsRequest?: import("../types/authorization").ClaimsRequest;
+    };
     family: string;
     /**
      * `client_credentials` grants (RFC 6749 §4.4.3) and other paths where a
@@ -87,6 +122,11 @@ export declare function mintTokens(args: {
         issuerUrl: string;
         clock: () => number;
         newRefreshToken?: () => string;
+        /**
+         * Host-supplied vendor scope → claim-names map merged into the
+         * id_token + /userinfo scope-gating. See `IdPOptions.customScopeClaims`.
+         */
+        customScopeClaims?: Record<string, ReadonlyArray<string>>;
     };
 }): Promise<Result<TokenResponse, AuthError>>;
 /**

package/dist/types/domain/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/domain/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAEV,WAAW,EAEX,aAAa,EACd,MAAM,gBAAgB,CAAA;AAgBvB;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAclC;AAED,eAAO,MAAM,qBAAqB,QAAiB,CAAA;AACnD,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAE9D,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qBAAqB;IACrB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;CAChC,CAAA;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAoG3C;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,IAAI,CACX,WAAW,EACX,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAC5E,CAAA;IACD,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,IAAI,EAAE;QACJ,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,UAAU,CAAA;QACtB,QAAQ,CAAC,EAAE,QAAQ,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,MAAM,CAAA;QACnB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;KAC/B,CAAA;CACF,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmF5C;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/domain/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAEV,WAAW,EAEX,aAAa,EACd,MAAM,gBAAgB,CAAA;AAiBvB;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAclC;AAED,eAAO,MAAM,qBAAqB,QAAiB,CAAA;AACnD,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAE9D,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qBAAqB;IACrB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAkH3C;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,IAAI,CACX,WAAW,EACX,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAC5E,GAAG;QACF;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yDAAyD;QACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB;;;;;WAKG;QACH,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB;;;;WAIG;QACH,aAAa,CAAC,EAAE,OAAO,wBAAwB,EAAE,aAAa,CAAA;KAC/D,CAAA;IACD,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,IAAI,EAAE;QACJ,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,UAAU,CAAA;QACtB,QAAQ,CAAC,EAAE,QAAQ,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,MAAM,CAAA;QACnB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;QAC9B;;;WAGG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;KAC1D,CAAA;CACF,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CA8I5C;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE"}

package/dist/types/domain/userinfo.d.ts

@@ -1,22 +1,61 @@
 /**
- * `/userinfo` endpoint logic (OIDC Core §5.3). Verifies the bearer access
- * token and returns the inlined `SubjectClaim` claims.
+ * `/userinfo` endpoint logic (OIDC Core §5.3). Verifies the presented
+ * access token, optionally enforces a DPoP proof binding (RFC 9449 §7),
+ * and returns the inlined `SubjectClaim` claims, scope-gated per OIDC
+ * Core §5.4.
+ *
+ * Profile / email / phone / address claims appear in the response only
+ * when (a) the access token's `scope` includes the granting scope and
+ * (b) the value exists on `SubjectClaim.properties`. Other properties
+ * (host-specific subject fields like `userId`, `roles`, …) are returned
+ * under `properties` and not subject to OIDC scope gating — they're
+ * outside §5.4's universe.
+ *
+ * DPoP at the resource server (RFC 9449 §7):
+ *  - If the access token has a `cnf.jkt` claim, the request MUST carry a
+ *    matching `DPoP:` proof whose `ath` equals SHA-256(access_token).
+ *  - If no `cnf.jkt`, the access token is plain Bearer and any DPoP
+ *    proof is silently ignored at this layer (host can still enforce).
  */
+import type { TokenStore } from "../ports/token-store";
 import type { KeyStore } from "../ports/key-store";
 import { type AuthError } from "../types/error";
 import type { Result } from "../types/result";
-export type UserinfoResponse = {
+import type { ScopedProfileClaims } from "../types/token";
+export type UserinfoResponse = ScopedProfileClaims & {
     sub: string;
     /** Subject type discriminator (e.g. `"user"` / `"admin"`). */
     subject_type: string;
-    /** Inlined claim properties. */
+    /** Inlined claim properties, host-specific and not gated by OIDC scope. */
     properties: Record<string, unknown>;
     /** Scope granted to this access token. */
     scope?: string;
 };
 export type UserinfoDeps = {
     keyStore: KeyStore;
+    /** Required when DPoP-bound tokens are accepted. */
+    tokenStore?: TokenStore;
     issuerUrl?: string;
+    /**
+     * Host-supplied vendor scope → claim-names map. Merged into the
+     * scope-gated /userinfo response just as it is for id_token. See
+     * `IdPOptions.customScopeClaims`.
+     */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
 };
-export declare function userinfo(bearerToken: string, deps: UserinfoDeps): Promise<Result<UserinfoResponse, AuthError>>;
+export type UserinfoInput = {
+    /** Access token from `Authorization: Bearer ...` or `Authorization: DPoP ...`. */
+    accessToken: string;
+    /** `Authorization`-scheme as presented. Defaults to `"Bearer"`. */
+    scheme?: "Bearer" | "DPoP";
+    /** Raw `DPoP:` header from the request, if any. */
+    dpopProof?: string;
+    /** Canonical request URI for DPoP `htu` check (scheme + host + path). */
+    htu?: string;
+    /** Request method for DPoP `htm` check, uppercase. */
+    htm?: string;
+    /** Wall clock seconds for DPoP `iat` window. */
+    nowSec?: number;
+};
+export declare function userinfo(input: UserinfoInput, deps: UserinfoDeps): Promise<Result<UserinfoResponse, AuthError>>;
 //# sourceMappingURL=userinfo.d.ts.map

package/dist/types/domain/userinfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../src/domain/userinfo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAO7C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAA;IACpB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,QAAQ,CAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAwB9C"}
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../src/domain/userinfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAQ7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAEzD,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG;IACnD,GAAG,EAAE,MAAM,CAAA;IACX,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,oDAAoD;IACpD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAA;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC1B,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAiG9C"}

package/dist/types/http/context.d.ts

@@ -14,7 +14,7 @@ import type { SessionStore } from "../ports/session-store";
 import type { TokenStore } from "../ports/token-store";
 import type { MethodCache } from "../domain/method-cache";
 import type { AuthError } from "../types/error";
-import type { ExchangeAudience, PersistUpstreamTokens, RenderPicker, SuccessMapInput } from "../types/idp";
+import type { ExchangeAudience, PersistUpstreamTokens, RegisterClient, RenderPicker, SuccessMapInput } from "../types/idp";
 import type { Result } from "../types/result";
 import type { SubjectClaim } from "../types/subject";
 import type { StateKeyRing, TenantContext, TenantId, TenantRecovery } from "../types/tenant";
@@ -38,10 +38,13 @@ export type HttpDeps = {
     persistUpstreamTokens?: PersistUpstreamTokens;
     exchangeAudience?: ExchangeAudience;
     renderPicker?: RenderPicker;
+    registerClient?: RegisterClient;
     /** Builds `TenantContext.request.custom` for every request. See `IdPOptions.buildCustomContext`. */
     buildCustomContext?: (req: Request) => Record<string, unknown> | Promise<Record<string, unknown>>;
     clock: () => number;
     cookieDefaults: CookieDefaults;
+    /** See `IdPOptions.customScopeClaims`. */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
 };
 /** Per-request variables populated by middleware. */
 export type HttpVars = {

package/dist/types/http/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;CAC/B,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}

package/dist/types/http/handlers/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/authorize.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAQvD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,OAChC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA4JjD"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/authorize.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAWvD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,OAChC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAkOjD"}

package/dist/types/http/handlers/end-session.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeEndSessionHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=end-session.d.ts.map

package/dist/types/http/handlers/end-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-session.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/end-session.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAIvD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,OACjC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAgFjD"}

package/dist/types/http/handlers/metadata.d.ts

@@ -1,4 +1,4 @@
 import type { HttpContext, HttpDeps } from "../context";
-export declare function makeDiscoveryHandler(_deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+export declare function makeDiscoveryHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
 export declare function makeJwksHandler(deps: HttpDeps): (_c: HttpContext) => Promise<Response>;
 //# sourceMappingURL=metadata.d.ts.map

package/dist/types/http/handlers/metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/metadata.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,QAAQ,OACjC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAUjD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,QAC1B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAWlD"}
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/metadata.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,OAChC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAejD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,QAC1B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAWlD"}

package/dist/types/http/handlers/par.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeParHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=par.d.ts.map