@_mustachio/openauth 0.13.1 → 0.13.3

package/dist/esm/domain/authorize.js

@@ -4,6 +4,7 @@ import { err, isErr, ok } from "../types/result";
 import { safeAudit } from "./audit";
 import { randomId, randomToken } from "./crypto";
 import { dispatchMethod } from "./method-dispatch";
+import { callbackTarget } from "./mount";
 import { mintStateEnvelope } from "./state-envelope";
 import { saveEncryptedCode } from "./token";
 var DEFAULT_FLOW_TTL_MS = 10 * 60 * 1000;
@@ -54,9 +55,15 @@ async function startAuthorize(input, deps) {
   const nonce = (deps.newNonce ?? randomToken)();
   const flowTtl = deps.flowTtlMs ?? DEFAULT_FLOW_TTL_MS;
   const now = deps.clock();
-  const callbackHost = deps.callbackHostFor?.(tenant.id) ?? new URL(deps.issuerUrl).host;
-  const callbackPath = `/cb/${methodId}`;
-  const callbackUrl = `${new URL(deps.issuerUrl).protocol}//${callbackHost}${callbackPath}`;
+  const {
+    host: callbackHost,
+    path: callbackPath,
+    url: callbackUrl
+  } = callbackTarget({
+    issuerUrl: deps.issuerUrl,
+    methodId,
+    callbackHost: deps.callbackHostFor?.(tenant.id)
+  });
   const record = {
     flowId,
     tenantId: tenant.id,
@@ -103,6 +110,7 @@ async function startAuthorize(input, deps) {
     flow: record,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: deps.issuerUrl,
     dispatch: {
       state: stateEnvelope,
       callbackUrl,

package/dist/esm/domain/callback.js

@@ -4,6 +4,7 @@ import { err, isErr, ok } from "../types/result";
 import { safeAudit } from "./audit";
 import { randomToken } from "./crypto";
 import { dispatchMethod } from "./method-dispatch";
+import { callbackTarget } from "./mount";
 import { saveEncryptedCode } from "./token";
 import { verifyStateEnvelope } from "./state-envelope";
 import { AUTH_CODE_TTL_MS } from "./authorize";
@@ -114,6 +115,7 @@ async function handleCallback(input, deps) {
     flow,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.issuerUrl,
     dispatch: null
   });
   if (isErr(dispatched))
@@ -192,7 +194,7 @@ async function translate(result, flow, deps) {
 async function tryIdpInitiated(input, deps, url) {
   if (input.rawRequest.method !== "POST")
     return null;
-  if (!input.tenant || !input.issuerUrl)
+  if (!input.tenant)
     return null;
   const segments = url.pathname.split("/").filter(Boolean);
   if (segments.length < 2 || segments[0] !== "cb")
@@ -204,7 +206,11 @@ async function tryIdpInitiated(input, deps, url) {
   const method = methodRes.value;
   if (method.unsolicitedCallback !== true)
     return null;
-  const callbackUrl = `${url.protocol}//${url.host}/cb/${methodId}`;
+  const { url: callbackUrl } = callbackTarget({
+    issuerUrl: input.issuerUrl,
+    methodId,
+    callbackHost: url.host
+  });
   const dispatched = await dispatchMethod({
     method,
     route: "GET /callback",
@@ -214,6 +220,7 @@ async function tryIdpInitiated(input, deps, url) {
     flow: null,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.issuerUrl,
     dispatch: { state: "", callbackUrl, issuerUrl: input.issuerUrl }
   });
   if (isErr(dispatched))

package/dist/esm/domain/method-dispatch.js

@@ -8,6 +8,7 @@ async function dispatchMethod(input) {
   }
   const ctx = {
     request: input.request,
+    issuerUrl: input.issuerUrl,
     subPath: input.subPath,
     tenant: input.tenant,
     flow: input.flow,

package/dist/esm/domain/method-route.js

@@ -38,6 +38,7 @@ async function handleMethodRoute(input, deps) {
     flow,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.issuerUrl,
     dispatch: null
   });
   if (isErr(dispatched))
@@ -120,6 +121,7 @@ async function handlePublicMethodRoute(input, deps) {
     flow: null,
     cookies: new Map,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.dispatch.issuerUrl,
     dispatch: input.dispatch
   });
   if (isErr(dispatched))

package/dist/esm/domain/mount.js

@@ -0,0 +1,29 @@
+// src/domain/mount.ts
+function mountPath(issuerUrl) {
+  let pathname;
+  try {
+    pathname = new URL(issuerUrl).pathname;
+  } catch {
+    return "";
+  }
+  const segments = pathname.split("/").filter(Boolean);
+  return segments.length === 0 ? "" : `/${segments.join("/")}`;
+}
+function mountedPath(issuerUrl, path) {
+  return `${mountPath(issuerUrl)}${path}`;
+}
+function callbackTarget(input) {
+  const issuer = new URL(input.issuerUrl);
+  const host = input.callbackHost ?? issuer.host;
+  const path = `/cb/${input.methodId}`;
+  return {
+    host,
+    path,
+    url: `${issuer.protocol}//${host}${mountPath(input.issuerUrl)}${path}`
+  };
+}
+export {
+  callbackTarget,
+  mountPath,
+  mountedPath
+};

package/dist/esm/http/handlers/method-route.js

@@ -3,6 +3,7 @@ import {
   handleMethodRoute,
   handlePublicMethodRoute
 } from "../../domain/method-route";
+import { callbackTarget } from "../../domain/mount";
 import { authError } from "../../types/error";
 import { isErr } from "../../types/result";
 import { applyResponsePolicy, cacheControlHeader } from "../cookies";
@@ -24,8 +25,11 @@ function makeMethodRouteHandler(deps) {
         const resolved = await deps.methodCache.resolve(tenant.config, methodId);
         if (!isErr(resolved) && resolved.value.publicRoutes?.includes(routeKey)) {
           const issuerUrl = c.get("issuerUrl");
-          const callbackHost = deps.callbackHostFor?.(tenant.id) ?? new URL(issuerUrl).host;
-          const callbackUrl = `${new URL(issuerUrl).protocol}//${callbackHost}/cb/${methodId}`;
+          const { url: callbackUrl } = callbackTarget({
+            issuerUrl,
+            methodId,
+            callbackHost: deps.callbackHostFor?.(tenant.id)
+          });
           const pub = await handlePublicMethodRoute({
             rawRequest: c.req.raw,
             tenant,
@@ -75,7 +79,8 @@ function makeMethodRouteHandler(deps) {
       subPath,
       httpMethod,
       flowId,
-      cookies
+      cookies,
+      issuerUrl: c.get("issuerUrl")
     }, {
       sessionStore: deps.sessionStore,
       tokenStore: deps.tokenStore,

package/dist/esm/index.js

@@ -3,6 +3,7 @@ import { err, isErr, isOk, ok } from "./types/result";
 import { authError } from "./types/error";
 import { asTenantId } from "./types/tenant";
 import { revokeAllForSubject } from "./domain/revoke";
+import { mountedPath, mountPath } from "./domain/mount";
 import { passwordMethod } from "./methods/password";
 import { codeMethod } from "./methods/code";
 import { m2mMethod } from "./methods/m2m";
@@ -119,6 +120,8 @@ export {
   linkedinFactory,
   m2mMethod,
   microsoftFactory,
+  mountPath,
+  mountedPath,
   oauth2Factory,
   oidcFactory,
   ok,

package/dist/esm/methods/code.js

@@ -7,6 +7,7 @@ import {
   timingSafeEqualStr,
   utf8
 } from "../domain/crypto";
+import { mountedPath } from "../domain/mount";
 import { renderForm } from "../ui/forms";
 var configSchema = z.object({
   codeLength: z.number().int().min(4).max(10).optional(),
@@ -44,11 +45,11 @@ function codeMethod(opts) {
         kind,
         type: "code",
         routes: {
-          "GET /authorize": async (_ctx) => ({
+          "GET /authorize": async (ctx) => ({
             kind: "challenge",
             response: htmlResponse(renderForm({
               title: titleRequest,
-              action: `/m/${id}/send`,
+              action: mountedPath(ctx.issuerUrl, `/m/${id}/send`),
               fields: destinationField(destinationKind),
               submit: "Send code"
             }))
@@ -68,7 +69,7 @@ async function handleSend(ctx, methodId, titleRequest, titleVerify, destinationK
       kind: "challenge",
       response: htmlResponse(renderForm({
         title: titleRequest,
-        action: `/m/${methodId}/send`,
+        action: mountedPath(ctx.issuerUrl, `/m/${methodId}/send`),
         fields: destinationField(destinationKind),
         submit: "Send code",
         error: "Please enter a valid destination."
@@ -85,7 +86,7 @@ async function handleSend(ctx, methodId, titleRequest, titleVerify, destinationK
     kind: "challenge",
     response: htmlResponse(renderForm({
       title: titleVerify,
-      action: `/m/${methodId}/verify`,
+      action: mountedPath(ctx.issuerUrl, `/m/${methodId}/verify`),
       fields: [
         {
           name: "code",
@@ -122,11 +123,11 @@ async function handleVerify(ctx, methodId, titleVerify, maxAttempts) {
   const form = await safeForm(ctx.request);
   const parsed = verifyBody.safeParse(form);
   if (!parsed.success) {
-    return verifyError(methodId, state, titleVerify, "Please enter the code.");
+    return verifyError(ctx.issuerUrl, methodId, state, titleVerify, "Please enter the code.");
   }
   const submittedHash = base64url.encode(await sha256(utf8.encode(parsed.data.code)));
   if (!timingSafeEqualStr(submittedHash, state.codeHash)) {
-    return verifyError(methodId, { ...state, attempts: state.attempts + 1 }, titleVerify, "Incorrect code. Please try again.");
+    return verifyError(ctx.issuerUrl, methodId, { ...state, attempts: state.attempts + 1 }, titleVerify, "Incorrect code. Please try again.");
   }
   return {
     kind: "success",
@@ -134,12 +135,12 @@ async function handleVerify(ctx, methodId, titleVerify, maxAttempts) {
     properties: { destination: state.destination }
   };
 }
-function verifyError(methodId, next, titleVerify, error) {
+function verifyError(issuerUrl, methodId, next, titleVerify, error) {
   return {
     kind: "challenge",
     response: htmlResponse(renderForm({
       title: titleVerify,
-      action: `/m/${methodId}/verify`,
+      action: mountedPath(issuerUrl, `/m/${methodId}/verify`),
       fields: [
         {
           name: "code",

package/dist/esm/methods/oauth2-generic.js

@@ -1,6 +1,7 @@
 // src/methods/oauth2-generic.ts
 import * as oauth from "oauth4webapi";
 import { createRemoteJWKSet, jwtVerify } from "jose";
+import { mountedPath } from "../domain/mount";
 import { authError } from "../types/error";
 async function buildOauth2Method(opts) {
   const pkceMode = opts.pkce ?? "S256";
@@ -76,7 +77,7 @@ async function exchangeAndSucceed(ctx, opts, jwks, deriveSubject) {
       error: authError.internalError("flow missing on callback")
     };
   }
-  const callbackUrl = `${new URL(ctx.request.url).protocol}//${ctx.flow.callbackHost}${ctx.flow.callbackPath}`;
+  const callbackUrl = `${new URL(ctx.request.url).protocol}//${ctx.flow.callbackHost}${mountedPath(ctx.issuerUrl, ctx.flow.callbackPath)}`;
   const body = new URLSearchParams({
     grant_type: "authorization_code",
     code,

package/dist/esm/methods/passkey.js

@@ -6,6 +6,7 @@ import {
   verifyAuthenticationResponse,
   verifyRegistrationResponse
 } from "@simplewebauthn/server";
+import { mountedPath } from "../domain/mount";
 import { renderForm } from "../ui/forms";
 var configSchema = z.object({
   rpName: z.string().min(1),
@@ -36,11 +37,11 @@ function passkeyMethod(opts) {
         kind,
         type: "passkey",
         routes: {
-          "GET /authorize": async () => ({
+          "GET /authorize": async (ctx) => ({
             kind: "challenge",
             response: htmlResponse(renderForm({
               title: settings.title,
-              action: `/m/${id}/authenticate-options`,
+              action: mountedPath(ctx.issuerUrl, `/m/${id}/authenticate-options`),
               fields: [
                 {
                   name: "username",

package/dist/esm/methods/password.js

@@ -1,6 +1,7 @@
 // src/methods/password.ts
 import { z } from "zod";
 import { argon2idHasher } from "./password-hash";
+import { mountedPath } from "../domain/mount";
 import { renderForm } from "../ui/forms";
 var configSchema = z.object({}).strict();
 var loginBodySchema = z.object({
@@ -46,7 +47,7 @@ function passwordMethod(opts) {
 async function renderLogin(ctx, methodId, title) {
   const body = renderForm({
     title,
-    action: `/m/${methodId}/login`,
+    action: mountedPath(ctx.issuerUrl, `/m/${methodId}/login`),
     fields: [
       {
         name: "email",
@@ -78,15 +79,15 @@ async function handleLogin(ctx, methodId, title, users, hasher) {
   const form = await safeForm(ctx.request);
   const parsed = loginBodySchema.safeParse(form);
   if (!parsed.success) {
-    return reLoginWithError(methodId, title, "Please enter your email and password.");
+    return reLoginWithError(ctx.issuerUrl, methodId, title, "Please enter your email and password.");
   }
   const user = await users.findByEmail(parsed.data.email, ctx.tenant.id);
   if (!user) {
-    return reLoginWithError(methodId, title, "Invalid email or password.");
+    return reLoginWithError(ctx.issuerUrl, methodId, title, "Invalid email or password.");
   }
   const verified = await hasher.verify(parsed.data.password, user.passwordHash);
   if (!verified) {
-    return reLoginWithError(methodId, title, "Invalid email or password.");
+    return reLoginWithError(ctx.issuerUrl, methodId, title, "Invalid email or password.");
   }
   return {
     kind: "success",
@@ -101,11 +102,11 @@ async function handleRegister(ctx, methodId, title, create, users, hasher) {
   const form = await safeForm(ctx.request);
   const parsed = registerBodySchema.safeParse(form);
   if (!parsed.success) {
-    return reLoginWithError(methodId, title, "Password must be at least 8 characters and email must be valid.");
+    return reLoginWithError(ctx.issuerUrl, methodId, title, "Password must be at least 8 characters and email must be valid.");
   }
   const existing = await users.findByEmail(parsed.data.email, ctx.tenant.id);
   if (existing) {
-    return reLoginWithError(methodId, title, "An account with that email already exists.");
+    return reLoginWithError(ctx.issuerUrl, methodId, title, "An account with that email already exists.");
   }
   const passwordHash = await hasher.hash(parsed.data.password);
   const user = await create({
@@ -122,12 +123,12 @@ async function handleRegister(ctx, methodId, title, create, users, hasher) {
     }
   };
 }
-function reLoginWithError(methodId, title, error) {
+function reLoginWithError(issuerUrl, methodId, title, error) {
   return {
     kind: "challenge",
     response: new Response(renderForm({
       title,
-      action: `/m/${methodId}/login`,
+      action: mountedPath(issuerUrl, `/m/${methodId}/login`),
       fields: [
         {
           name: "email",

package/dist/esm/methods/saml-sp/metadata.js

@@ -1,4 +1,5 @@
 // src/methods/saml-sp/metadata.ts
+import { mountedPath } from "../../domain/mount";
 import { authError } from "../../types/error";
 import { resolveSpEntityId } from "./saml-instance";
 var NAME_ID_FORMAT_URN = {
@@ -46,7 +47,7 @@ async function buildSpMetadata(ctx, methodId, config) {
   }
   const spEntityId = resolveSpEntityId(config, ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
   const cb = new URL(ctx.dispatch.callbackUrl);
-  const slsUrl = `${cb.protocol}//${cb.host}/m/${methodId}/sls`;
+  const slsUrl = `${cb.protocol}//${cb.host}${mountedPath(ctx.dispatch.issuerUrl, `/m/${methodId}/sls`)}`;
   const xml = buildSpMetadataXml({
     spEntityId,
     acsUrl: ctx.dispatch.callbackUrl,

package/dist/types/domain/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/domain/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EACV,oBAAoB,EAGpB,SAAS,EACT,WAAW,EACZ,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIhF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAK5C,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAiB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAY,CAAA;AAEzC,MAAM,MAAM,eAAe;AACzB;;;;;;GAMG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AACH,6DAA6D;GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE;AAC7D;;;GAGG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D,CAAA;AAEL,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAA;IACvB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAuI7C;AA4ID,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/domain/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EACV,oBAAoB,EAGpB,SAAS,EACT,WAAW,EACZ,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIhF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAM5C,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAiB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAY,CAAA;AAEzC,MAAM,MAAM,eAAe;AACzB;;;;;;GAMG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AACH,6DAA6D;GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE;AAC7D;;;GAGG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D,CAAA;AAEL,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAA;IACvB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAiJ7C;AA4ID,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA"}

package/dist/types/domain/callback.d.ts

@@ -56,12 +56,13 @@ export type HandleCallbackInput = {
      */
     tenant?: TenantContext;
     /**
-     * Per-request issuer URL (HTTP layer). Used only by the
-     * IdP-initiated path to derive the SP entityID / ACS — the same
-     * derivation the AuthnRequest and metadata paths use, so the values
-     * cannot drift.
+     * Per-request issuer URL (HTTP layer). The IdP-initiated path derives
+     * the SP entityID / ACS from it — the same derivation the AuthnRequest
+     * and metadata paths use, so the values cannot drift — and every
+     * dispatched method receives it as `MethodContext.issuerUrl` to build
+     * mount-prefixed URLs of its own.
      */
-    issuerUrl?: string;
+    issuerUrl: string;
 };
 export type HandleCallbackDeps = {
     configStore: ConfigStore;

package/dist/types/domain/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/domain/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAgB,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAM5C,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,mBAAmB,GAAG;IAChC,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChE,CAAA;AA8BD,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAsH5C"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/domain/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAgB,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAO5C,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,mBAAmB,GAAG;IAChC,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChE,CAAA;AA8BD,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAuH5C"}

package/dist/types/domain/method-dispatch.d.ts

@@ -24,6 +24,11 @@ export type DispatchInput = {
     flow: FlowRecord | null;
     cookies: ReadonlyMap<string, string>;
     sessionStore: SessionStore;
+    /**
+     * Issuer URL of this IdP. Always required — unlike `dispatch`, methods
+     * need it on every route to emit mount-prefixed URLs of their own.
+     */
+    issuerUrl: string;
     /** Populated at `GET /authorize`; null on callbacks. */
     dispatch: MethodDispatchData | null;
 };

package/dist/types/domain/method-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-dispatch.d.ts","sourceRoot":"","sources":["../../../src/domain/method-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,YAAY,EAEb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAA;AAE9D,MAAM,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAEpD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAqD5D"}
+{"version":3,"file":"method-dispatch.d.ts","sourceRoot":"","sources":["../../../src/domain/method-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,YAAY,EAEb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAA;AAE9D,MAAM,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAEpD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAsD5D"}

package/dist/types/domain/method-route.d.ts

@@ -64,6 +64,12 @@ export type HandleMethodRouteInput = {
     /** flowId from the `idp.flow` cookie. */
     flowId: string;
     cookies: ReadonlyMap<string, string>;
+    /**
+     * Issuer URL — passed to the method so it can emit mount-prefixed URLs
+     * (a re-rendered form action, say). The inbound request URL cannot
+     * supply this: a proxy has already stripped the mount prefix from it.
+     */
+    issuerUrl: string;
 };
 export type HandleMethodRouteDeps = {
     sessionStore: SessionStore;

package/dist/types/domain/method-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../src/domain/method-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAElB,SAAS,EACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAIjE,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,GAAG,MAAM,CAAA;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;CACzB,CAAA;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAgD/C;AA6ED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,gFAAgF;IAChF,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,QAAQ,EAAE,kBAAkB,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;CAClD,CAAA;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,EACnC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC,CAsDrD"}
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../src/domain/method-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAElB,SAAS,EACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAIjE,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,GAAG,MAAM,CAAA;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;CACzB,CAAA;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAiD/C;AA6ED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,gFAAgF;IAChF,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,QAAQ,EAAE,kBAAkB,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;CAClD,CAAA;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,EACnC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC,CAuDrD"}

package/dist/types/domain/mount.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Mount prefix — where this IdP sits under its origin.
+ *
+ * The library serves its routes at its own root (`/authorize`, `/m/*`,
+ * `/cb/*`); a deployment may sit behind a reverse proxy that strips a path
+ * prefix before forwarding. Routing is unaffected — but every URL the
+ * library *emits* (form actions, upstream `redirect_uri`s, SAML metadata)
+ * is consumed on the public side of that proxy and must carry the prefix.
+ *
+ * `issuerUrl` already carries it. It is the single source of truth: there
+ * is deliberately no `basePath` option, because two sources could disagree
+ * and the `iss` claim would then contradict the URLs we hand out.
+ *
+ * All emitted-URL construction goes through this module. `metadata.test.ts`
+ * is an anti-drift test asserting the SAML entityID/ACS equal what
+ * `buildAuthnRequestRedirect` derives; funnelling every site through
+ * `callbackTarget` is what keeps that true.
+ */
+/**
+ * The normalised mount prefix of `issuerUrl`: `""` for a root-mounted
+ * deployment, otherwise a leading-slash, no-trailing-slash path.
+ *
+ *     https://example.com        -> ""
+ *     https://example.com/       -> ""
+ *     https://example.com/idp    -> "/idp"
+ *     https://example.com/idp/   -> "/idp"
+ *     https://example.com//idp// -> "/idp"
+ *
+ * A root-mounted issuer must yield `""` and not `"/"`, so that existing
+ * deployments emit byte-identical URLs to before this existed.
+ *
+ * An unparseable `issuerUrl` yields `""` rather than throwing: emitting a
+ * root-relative URL degrades to the pre-existing behaviour, whereas
+ * throwing would turn a misconfiguration into a 500 from inside form
+ * rendering. Misconfiguration still fails loudly at `/authorize`, which
+ * parses `issuerUrl` for the callback host.
+ */
+export declare function mountPath(issuerUrl: string): string;
+/**
+ * A path-absolute URL for one of the library's own routes, carrying the
+ * deployment's mount prefix. `path` is the route as the service itself
+ * serves it, with a leading slash.
+ *
+ *     mountedPath("https://x/idp", "/m/code/send") -> "/idp/m/code/send"
+ *     mountedPath("https://x",     "/m/code/send") -> "/m/code/send"
+ */
+export declare function mountedPath(issuerUrl: string, path: string): string;
+/**
+ * Where a method's callback lives, in the two forms the framework needs.
+ *
+ * The distinction matters under a path-mounted deployment and is the
+ * reason these are derived together rather than one from the other:
+ * `url` is public (registered with upstream providers, advertised in SAML
+ * metadata) and carries the mount prefix, while `path` is what the
+ * inbound request actually looks like after the proxy has stripped that
+ * prefix, and so must not.
+ */
+export type CallbackTarget = {
+    /** Public, fully-qualified callback URL. Carries the mount prefix. */
+    url: string;
+    /** Host the callback is expected to arrive on. */
+    host: string;
+    /**
+     * Expected pathname of the inbound request — this service's own route,
+     * *without* the mount prefix, because the proxy has already stripped it.
+     * Persisted on `FlowRecord.callbackPath` and matched in `domain/callback.ts`.
+     */
+    path: string;
+};
+/**
+ * The single derivation point for a method's callback URL.
+ *
+ * `callbackHost` is the optional per-tenant override from
+ * `IdPOptions.callbackHostFor`. **The issuer's mount prefix applies even
+ * when that override is in effect.** `callbackHostFor` exists to partition
+ * callbacks across hostnames so a tenant is recoverable from the `Host`
+ * header before the state envelope is verified (tenant-recovery mechanism
+ * #2) — it varies the authority of the *same* deployment, not the
+ * deployment itself. Those hosts are served by this service behind the
+ * same proxy, so they share its mount. A deployment needing partitioned
+ * hosts mounted differently from the issuer is describing two mounts,
+ * which one `issuerUrl` cannot express and a second option must not be
+ * introduced to paper over.
+ */
+export declare function callbackTarget(input: {
+    issuerUrl: string;
+    methodId: string;
+    callbackHost?: string | undefined;
+}): CallbackTarget;
+//# sourceMappingURL=mount.d.ts.map

package/dist/types/domain/mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/domain/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CASnD;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAA;IACX,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC,GAAG,cAAc,CASjB"}

package/dist/types/http/handlers/method-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/method-route.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,OAClC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAuJjD"}
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/method-route.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,OAClC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA0JjD"}

package/dist/types/index.d.ts

@@ -38,6 +38,22 @@ export type { TokenStore } from "./ports/token-store";
  * ARCHITECTURE.md "Reuse detection scope").
  */
 export { revokeAllForSubject } from "./domain/revoke";
+/**
+ * Build a path-absolute URL for one of the library's own routes, carrying
+ * the mount prefix from `issuerUrl`.
+ *
+ * Custom methods that render their own URLs — a form `action`, say — must
+ * use this rather than a path-absolute literal, or the URL will 404 under
+ * a deployment mounted behind a proxy at a path prefix. Root-mounted
+ * issuers yield the literal unchanged.
+ *
+ *     mountedPath(ctx.issuerUrl, `/m/${id}/send`)
+ *     // "https://x"     -> "/m/mycode/send"
+ *     // "https://x/idp" -> "/idp/m/mycode/send"
+ *
+ * See INTEGRATION.md § 8.
+ */
+export { mountedPath, mountPath } from "./domain/mount";
 export { passwordMethod } from "./methods/password";
 export type { PasswordMethodOptions, PasswordProperties, PasswordUser, PasswordUserStore, PasswordState, } from "./methods/password";
 export { codeMethod } from "./methods/code";

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAuF/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAuF/C"}

package/dist/types/methods/code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code.d.ts","sourceRoot":"","sources":["../../../src/methods/code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AASvB,OAAO,KAAK,EAEV,iBAAiB,EAGlB,MAAM,iBAAiB,CAAA;AAGxB,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B,CAAA;AAED;;;;GAIG;AACH,QAAA,MAAM,YAAY;IAChB,6BAA6B;;IAE7B,qEAAqE;;IAErE,uBAAuB;;IAEvB,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO3B,CAAA;AACF,KAAK,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAS9C,wBAAgB,UAAU,CACxB,IAAI,EAAE,iBAAiB,GACtB,iBAAiB,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC,CAgD1D"}
+{"version":3,"file":"code.d.ts","sourceRoot":"","sources":["../../../src/methods/code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AASvB,OAAO,KAAK,EAEV,iBAAiB,EAGlB,MAAM,iBAAiB,CAAA;AAIxB,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B,CAAA;AAED;;;;GAIG;AACH,QAAA,MAAM,YAAY;IAChB,6BAA6B;;IAE7B,qEAAqE;;IAErE,uBAAuB;;IAEvB,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO3B,CAAA;AACF,KAAK,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAS9C,wBAAgB,UAAU,CACxB,IAAI,EAAE,iBAAiB,GACtB,iBAAiB,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC,CAgD1D"}

package/dist/types/methods/oauth2-generic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-generic.d.ts","sourceRoot":"","sources":["../../../src/methods/oauth2-generic.ts"],"names":[],"mappings":"AA8BA;;;;;;GAMG;AACH,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAG5C,OAAO,KAAK,EAAE,UAAU,EAA+B,MAAM,iBAAiB,CAAA;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,uFAAuF;AACvF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,wFAAwF;QACxF,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;IACD,4DAA4D;IAC5D,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC7B,CAAA;AAED,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG;IACxB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAA;IACV,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,8EAA8E;IAC9E,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yBAAyB;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAEhB,qBAAqB;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,WAAW,CAAA;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC5B,aAAa,CAAC,EAAE,aAAa,CAAA;KAC9B,KAAK,MAAM,CAAA;CACb,CAAA;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CA6BpD"}
+{"version":3,"file":"oauth2-generic.d.ts","sourceRoot":"","sources":["../../../src/methods/oauth2-generic.ts"],"names":[],"mappings":"AA8BA;;;;;;GAMG;AACH,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAI5C,OAAO,KAAK,EAAE,UAAU,EAA+B,MAAM,iBAAiB,CAAA;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,uFAAuF;AACvF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,wFAAwF;QACxF,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;IACD,4DAA4D;IAC5D,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC7B,CAAA;AAED,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG;IACxB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAA;IACV,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,8EAA8E;IAC9E,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yBAAyB;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAEhB,qBAAqB;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,WAAW,CAAA;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC5B,aAAa,CAAC,EAAE,aAAa,CAAA;KAC9B,KAAK,MAAM,CAAA;CACb,CAAA;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CA6BpD"}