@_mustachio/openauth 0.13.1 → 0.13.3

package/dist/types/methods/passkey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../../src/methods/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAQvB,OAAO,KAAK,EAEV,iBAAiB,EAGlB,MAAM,iBAAiB,CAAA;AAGxB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,+BAA+B;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;IACf,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IACtE,QAAQ,CACN,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACnC,oEAAoE;IACpE,aAAa,CAAC,KAAK,EAAE;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,6CAA6C;IAC7C,MAAM,CAAC,CAAC,KAAK,EAAE;QACb,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,gBAAgB,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,WAAW,EAAE,sBAAsB,CAAA;CACpC,CAAA;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9E;;;;;;;;GAQG;AACH,QAAA,MAAM,YAAY;IAChB,kDAAkD;;IAElD,iDAAiD;;IAEjD,mEAAmE;;IAEnE,2BAA2B;;;;;;;;;;;;EAE3B,CAAA;AACF,KAAK,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAkBjD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,oBAAoB,GACzB,iBAAiB,CAAC,iBAAiB,EAAE,YAAY,EAAE,aAAa,CAAC,CAiDnE"}
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../../src/methods/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAQvB,OAAO,KAAK,EAEV,iBAAiB,EAGlB,MAAM,iBAAiB,CAAA;AAIxB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,+BAA+B;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;IACf,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IACtE,QAAQ,CACN,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACnC,oEAAoE;IACpE,aAAa,CAAC,KAAK,EAAE;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,6CAA6C;IAC7C,MAAM,CAAC,CAAC,KAAK,EAAE;QACb,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,gBAAgB,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,WAAW,EAAE,sBAAsB,CAAA;CACpC,CAAA;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9E;;;;;;;;GAQG;AACH,QAAA,MAAM,YAAY;IAChB,kDAAkD;;IAElD,iDAAiD;;IAEjD,mEAAmE;;IAEnE,2BAA2B;;;;;;;;;;;;EAE3B,CAAA;AACF,KAAK,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAkBjD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,oBAAoB,GACzB,iBAAiB,CAAC,iBAAiB,EAAE,YAAY,EAAE,aAAa,CAAC,CAoDnE"}

package/dist/types/methods/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/methods/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACrE,OAAO,KAAK,EAEV,iBAAiB,EAGlB,MAAM,iBAAiB,CAAA;AAGxB,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,kDAAkD;IAClD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAC1E;;;;OAIG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,MAAM,CAAA;QACb,YAAY,EAAE,MAAM,CAAA;QACpB,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,sCAAsC;IACtC,KAAK,EAAE,iBAAiB,CAAA;IACxB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,iGAAiG;AACjG,QAAA,MAAM,YAAY,iDAAwB,CAAA;AAC1C,KAAK,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAYlD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,qBAAqB,GAC1B,iBAAiB,CAAC,kBAAkB,EAAE,aAAa,EAAE,cAAc,CAAC,CAwCtE"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/methods/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACrE,OAAO,KAAK,EAEV,iBAAiB,EAGlB,MAAM,iBAAiB,CAAA;AAIxB,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,kDAAkD;IAClD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAC1E;;;;OAIG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,MAAM,CAAA;QACb,YAAY,EAAE,MAAM,CAAA;QACpB,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,sCAAsC;IACtC,KAAK,EAAE,iBAAiB,CAAA;IACxB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,iGAAiG;AACjG,QAAA,MAAM,YAAY,iDAAwB,CAAA;AAC1C,KAAK,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAYlD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,qBAAqB,GAC1B,iBAAiB,CAAC,kBAAkB,EAAE,aAAa,EAAE,cAAc,CAAC,CAwCtE"}

package/dist/types/methods/saml-sp/metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/metadata.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGrE,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAqBhB,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAUD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAkDjE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAkDtD"}
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/methods/saml-sp/metadata.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGrE,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,SAAS,CAAA;AAqBhB,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,CAAA;AAUD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAkDjE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,CAAC,WAAW,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAqDtD"}

package/dist/types/types/idp.d.ts

@@ -233,7 +233,22 @@ export type IdPOptions = {
      * mechanism (see plan §"Tenant Recovery Across Redirects").
      */
     resolveTenant: (req: Request) => Promise<Result<TenantId, AuthError>>;
-    /** Opt-in for partitioned callback hosts (recovery mechanism #2). */
+    /**
+     * Opt-in for partitioned callback hosts (recovery mechanism #2).
+     *
+     * Returns the hostname a given tenant's callbacks arrive on, so the
+     * tenant is recoverable from the `Host` header before the state
+     * envelope is verified.
+     *
+     * **The issuer's mount prefix still applies to the returned host.** If
+     * `issuerUrl` is `https://example.com/idp`, a tenant host of
+     * `acme.example.com` produces `https://acme.example.com/idp/cb/<id>`.
+     * This option varies the *authority* of one deployment — those hosts
+     * are served by this same service behind the same proxy, so they share
+     * its mount. A deployment needing partitioned hosts mounted differently
+     * from the issuer is describing two mounts, which one `issuerUrl`
+     * cannot express; a second option must not be added to paper over it.
+     */
     callbackHostFor?: (tenantId: TenantId) => string;
     /**
      * HMAC-SHA-256 key ring used to MAC the minimal state envelope. The

package/dist/types/types/idp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAC3C,yDAAyD;IACzD,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,cAAc,CAAA;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAA;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,0BAA0B,CAAC,EACzB,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,CAAA;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,sBAAsB;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,KAAK,CAAC,EAAE;QACN,yDAAyD;QACzD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAClD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACnD,CAAA;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAEjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,oCAAoC;IACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,8CAA8C;IAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9C,CAAA"}
+{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAC3C,yDAAyD;IACzD,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,cAAc,CAAA;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAA;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,0BAA0B,CAAC,EACzB,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,CAAA;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,sBAAsB;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAE7B,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,KAAK,CAAC,EAAE;QACN,yDAAyD;QACzD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAClD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACnD,CAAA;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAEjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,oCAAoC;IACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,8CAA8C;IAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9C,CAAA"}

package/dist/types/types/method.d.ts

@@ -107,6 +107,17 @@ export type MethodHandler<P, S> = (ctx: MethodContext<S>) => Promise<MethodResul
 export type MethodContext<S = unknown> = {
     /** The raw Web Fetch `Request`. Web standard, not Hono `Context`. */
     request: Request;
+    /**
+     * The issuer URL of this IdP, always present.
+     *
+     * Distinct from `dispatch.issuerUrl`, which is only populated for
+     * `GET /authorize`. Methods that render their own URLs — a form action
+     * re-rendered on a validation error, say — need it on every route, and
+     * must build those URLs with `mountedPath` so they carry the
+     * deployment's mount prefix. `ctx.request.url` is not a substitute: a
+     * proxy-stripped inbound URL has already lost that prefix.
+     */
+    issuerUrl: string;
     /** Path within the method's mount, e.g. `"/callback"` (without the `/<id>` prefix). */
     subPath: string;
     tenant: TenantContext;

package/dist/types/types/method.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method.d.ts","sourceRoot":"","sources":["../../../src/types/method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAEnE;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,IAAI;IACjD;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,IAAI,CAChC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,KAClB,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAEhC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI;IACvC,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAA;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,2EAA2E;IAC3E,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB;;;OAGG;IACH,WAAW,EAAE,CAAC,GAAG,IAAI,CAAA;IACrB,6DAA6D;IAC7D,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACnC;;;;;;;;;;;;;;OAcG;IACH,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACrE;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACzC,gEAAgE;IAChE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAC3C,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO;AAC/C;;;;;;;;GAQG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,wEAAwE;IACxE,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB,eAAe,CAAC,EAAE,CAAC,CAAA;IACnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,EAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,SAAS,CAAA;IACf,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,CAAC,CAAA;IACb,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE;QACnB,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,MAAM,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;CACF;AACH,6EAA6E;GAC3E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;CAAE;AAC9D,kFAAkF;GAChF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,8CAA8C;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;CACrC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;AAEnC;;;;;;;;;;;;;;GAcG;AAMH,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,CAClD,GAAG,EAAE,6CAA6C;AAClD,GAAG,EAAE,2BAA2B;AAChC,GAAG,CACJ,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI;IACvE,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAA;IAEZ;;;;;;;;;;;;OAYG;IACH,YAAY,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAE7C;;;;;OAKG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE;QACb,6EAA6E;QAC7E,EAAE,EAAE,MAAM,CAAA;QACV,mEAAmE;QACnE,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,QAAQ,CAAA;QAClB,wCAAwC;QACxC,MAAM,EAAE,GAAG,CAAA;KACZ,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;CAChC,CAAA"}
+{"version":3,"file":"method.d.ts","sourceRoot":"","sources":["../../../src/types/method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAEnE;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,IAAI;IACjD;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,IAAI,CAChC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,KAClB,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAEhC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI;IACvC,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;;;;OASG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,2EAA2E;IAC3E,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB;;;OAGG;IACH,WAAW,EAAE,CAAC,GAAG,IAAI,CAAA;IACrB,6DAA6D;IAC7D,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACnC;;;;;;;;;;;;;;OAcG;IACH,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACrE;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACzC,gEAAgE;IAChE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAC3C,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO;AAC/C;;;;;;;;GAQG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,wEAAwE;IACxE,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB,eAAe,CAAC,EAAE,CAAC,CAAA;IACnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,EAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,SAAS,CAAA;IACf,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,CAAC,CAAA;IACb,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE;QACnB,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,MAAM,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;CACF;AACH,6EAA6E;GAC3E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;CAAE;AAC9D,kFAAkF;GAChF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,8CAA8C;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;CACrC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;AAEnC;;;;;;;;;;;;;;GAcG;AAMH,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,CAClD,GAAG,EAAE,6CAA6C;AAClD,GAAG,EAAE,2BAA2B;AAChC,GAAG,CACJ,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI;IACvE,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAA;IAEZ;;;;;;;;;;;;OAYG;IACH,YAAY,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAE7C;;;;;OAKG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE;QACb,6EAA6E;QAC7E,EAAE,EAAE,MAAM,CAAA;QACV,mEAAmE;QACnE,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,QAAQ,CAAA;QAClB,wCAAwC;QACxC,MAAM,EAAE,GAAG,CAAA;KACZ,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;CAChC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@_mustachio/openauth",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -11,6 +11,7 @@
     "build": "bun run script/build.ts",
     "build:watch": "bun run script/build-watch.ts",
     "test": "bun test",
+    "typecheck": "tsc --noEmit -p tsconfig.test.json",
     "preview:ui": "bun --hot run script/preview-ui.ts"
   },
   "sideEffects": false,

package/src/domain/authorize.ts

@@ -51,6 +51,7 @@ import { safeAudit } from "./audit"
 import { randomId, randomToken } from "./crypto"
 import { MethodCache } from "./method-cache"
 import { dispatchMethod } from "./method-dispatch"
+import { callbackTarget } from "./mount"
 import { mintStateEnvelope } from "./state-envelope"
 import { saveEncryptedCode } from "./token"
 
@@ -200,10 +201,19 @@ export async function startAuthorize(
   const nonce = (deps.newNonce ?? randomToken)()
   const flowTtl = deps.flowTtlMs ?? DEFAULT_FLOW_TTL_MS
   const now = deps.clock()
-  const callbackHost =
-    deps.callbackHostFor?.(tenant.id) ?? new URL(deps.issuerUrl).host
-  const callbackPath = `/cb/${methodId}`
-  const callbackUrl = `${new URL(deps.issuerUrl).protocol}//${callbackHost}${callbackPath}`
+  // Source of truth for callback derivation — every other site that needs
+  // this URL goes through `callbackTarget` so they cannot drift apart.
+  // Note `path` is the *inbound* route (no mount prefix; the proxy strips
+  // it before we see the request) while `url` is the public form.
+  const {
+    host: callbackHost,
+    path: callbackPath,
+    url: callbackUrl,
+  } = callbackTarget({
+    issuerUrl: deps.issuerUrl,
+    methodId,
+    callbackHost: deps.callbackHostFor?.(tenant.id),
+  })
 
   const record: FlowRecord = {
     flowId,
@@ -262,6 +272,7 @@ export async function startAuthorize(
     flow: record,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: deps.issuerUrl,
     dispatch: {
       state: stateEnvelope,
       callbackUrl,

package/src/domain/callback.ts

@@ -35,6 +35,7 @@ import { safeAudit } from "./audit"
 import { randomToken } from "./crypto"
 import { MethodCache } from "./method-cache"
 import { dispatchMethod } from "./method-dispatch"
+import { callbackTarget } from "./mount"
 import { saveEncryptedCode } from "./token"
 import { verifyStateEnvelope } from "./state-envelope"
 import { AUTH_CODE_TTL_MS } from "./authorize"
@@ -67,12 +68,13 @@ export type HandleCallbackInput = {
    */
   tenant?: TenantContext
   /**
-   * Per-request issuer URL (HTTP layer). Used only by the
-   * IdP-initiated path to derive the SP entityID / ACS — the same
-   * derivation the AuthnRequest and metadata paths use, so the values
-   * cannot drift.
+   * Per-request issuer URL (HTTP layer). The IdP-initiated path derives
+   * the SP entityID / ACS from it — the same derivation the AuthnRequest
+   * and metadata paths use, so the values cannot drift — and every
+   * dispatched method receives it as `MethodContext.issuerUrl` to build
+   * mount-prefixed URLs of its own.
    */
-  issuerUrl?: string
+  issuerUrl: string
 }
 
 export type HandleCallbackDeps = {
@@ -241,6 +243,7 @@ export async function handleCallback(
     flow,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.issuerUrl,
     dispatch: null,
   })
   if (isErr(dispatched)) return err(dispatched.error)
@@ -351,7 +354,7 @@ async function tryIdpInitiated(
   url: URL,
 ): Promise<Result<CallbackOutput, AuthError> | null> {
   if (input.rawRequest.method !== "POST") return null
-  if (!input.tenant || !input.issuerUrl) return null
+  if (!input.tenant) return null
 
   const segments = url.pathname.split("/").filter(Boolean)
   if (segments.length < 2 || segments[0] !== "cb") return null
@@ -365,7 +368,14 @@ async function tryIdpInitiated(
   const method = methodRes.value
   if (method.unsolicitedCallback !== true) return null
 
-  const callbackUrl = `${url.protocol}//${url.host}/cb/${methodId}`
+  // Derived from `issuerUrl`, not the inbound request URL: a path-mounted
+  // deployment sees a proxy-stripped pathname, so rebuilding from `url`
+  // would emit a callback URL missing the mount prefix.
+  const { url: callbackUrl } = callbackTarget({
+    issuerUrl: input.issuerUrl,
+    methodId,
+    callbackHost: url.host,
+  })
   const dispatched = await dispatchMethod({
     method,
     route: "GET /callback",
@@ -375,6 +385,7 @@ async function tryIdpInitiated(
     flow: null,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.issuerUrl,
     dispatch: { state: "", callbackUrl, issuerUrl: input.issuerUrl },
   })
   if (isErr(dispatched)) return err(dispatched.error)

package/src/domain/method-dispatch.ts

@@ -33,6 +33,11 @@ export type DispatchInput = {
   flow: FlowRecord | null
   cookies: ReadonlyMap<string, string>
   sessionStore: SessionStore
+  /**
+   * Issuer URL of this IdP. Always required — unlike `dispatch`, methods
+   * need it on every route to emit mount-prefixed URLs of their own.
+   */
+  issuerUrl: string
   /** Populated at `GET /authorize`; null on callbacks. */
   dispatch: MethodDispatchData | null
 }
@@ -57,6 +62,7 @@ export async function dispatchMethod(
 
   const ctx: MethodContext<unknown> = {
     request: input.request,
+    issuerUrl: input.issuerUrl,
     subPath: input.subPath,
     tenant: input.tenant,
     flow: input.flow,

package/src/domain/method-route.ts

@@ -79,6 +79,12 @@ export type HandleMethodRouteInput = {
   /** flowId from the `idp.flow` cookie. */
   flowId: string
   cookies: ReadonlyMap<string, string>
+  /**
+   * Issuer URL — passed to the method so it can emit mount-prefixed URLs
+   * (a re-rendered form action, say). The inbound request URL cannot
+   * supply this: a proxy has already stripped the mount prefix from it.
+   */
+  issuerUrl: string
 }
 
 export type HandleMethodRouteDeps = {
@@ -139,6 +145,7 @@ export async function handleMethodRoute(
     flow,
     cookies: input.cookies,
     sessionStore: deps.sessionStore,
+    issuerUrl: input.issuerUrl,
     dispatch: null,
   })
   if (isErr(dispatched)) return err(dispatched.error)
@@ -295,6 +302,7 @@ export async function handlePublicMethodRoute(
     flow: null,
     cookies: new Map(),
     sessionStore: deps.sessionStore,
+    issuerUrl: input.dispatch.issuerUrl,
     dispatch: input.dispatch,
   })
   if (isErr(dispatched)) return err(dispatched.error)

package/src/domain/mount.ts

@@ -0,0 +1,113 @@
+/**
+ * Mount prefix — where this IdP sits under its origin.
+ *
+ * The library serves its routes at its own root (`/authorize`, `/m/*`,
+ * `/cb/*`); a deployment may sit behind a reverse proxy that strips a path
+ * prefix before forwarding. Routing is unaffected — but every URL the
+ * library *emits* (form actions, upstream `redirect_uri`s, SAML metadata)
+ * is consumed on the public side of that proxy and must carry the prefix.
+ *
+ * `issuerUrl` already carries it. It is the single source of truth: there
+ * is deliberately no `basePath` option, because two sources could disagree
+ * and the `iss` claim would then contradict the URLs we hand out.
+ *
+ * All emitted-URL construction goes through this module. `metadata.test.ts`
+ * is an anti-drift test asserting the SAML entityID/ACS equal what
+ * `buildAuthnRequestRedirect` derives; funnelling every site through
+ * `callbackTarget` is what keeps that true.
+ */
+
+/**
+ * The normalised mount prefix of `issuerUrl`: `""` for a root-mounted
+ * deployment, otherwise a leading-slash, no-trailing-slash path.
+ *
+ *     https://example.com        -> ""
+ *     https://example.com/       -> ""
+ *     https://example.com/idp    -> "/idp"
+ *     https://example.com/idp/   -> "/idp"
+ *     https://example.com//idp// -> "/idp"
+ *
+ * A root-mounted issuer must yield `""` and not `"/"`, so that existing
+ * deployments emit byte-identical URLs to before this existed.
+ *
+ * An unparseable `issuerUrl` yields `""` rather than throwing: emitting a
+ * root-relative URL degrades to the pre-existing behaviour, whereas
+ * throwing would turn a misconfiguration into a 500 from inside form
+ * rendering. Misconfiguration still fails loudly at `/authorize`, which
+ * parses `issuerUrl` for the callback host.
+ */
+export function mountPath(issuerUrl: string): string {
+  let pathname: string
+  try {
+    pathname = new URL(issuerUrl).pathname
+  } catch {
+    return ""
+  }
+  const segments = pathname.split("/").filter(Boolean)
+  return segments.length === 0 ? "" : `/${segments.join("/")}`
+}
+
+/**
+ * A path-absolute URL for one of the library's own routes, carrying the
+ * deployment's mount prefix. `path` is the route as the service itself
+ * serves it, with a leading slash.
+ *
+ *     mountedPath("https://x/idp", "/m/code/send") -> "/idp/m/code/send"
+ *     mountedPath("https://x",     "/m/code/send") -> "/m/code/send"
+ */
+export function mountedPath(issuerUrl: string, path: string): string {
+  return `${mountPath(issuerUrl)}${path}`
+}
+
+/**
+ * Where a method's callback lives, in the two forms the framework needs.
+ *
+ * The distinction matters under a path-mounted deployment and is the
+ * reason these are derived together rather than one from the other:
+ * `url` is public (registered with upstream providers, advertised in SAML
+ * metadata) and carries the mount prefix, while `path` is what the
+ * inbound request actually looks like after the proxy has stripped that
+ * prefix, and so must not.
+ */
+export type CallbackTarget = {
+  /** Public, fully-qualified callback URL. Carries the mount prefix. */
+  url: string
+  /** Host the callback is expected to arrive on. */
+  host: string
+  /**
+   * Expected pathname of the inbound request — this service's own route,
+   * *without* the mount prefix, because the proxy has already stripped it.
+   * Persisted on `FlowRecord.callbackPath` and matched in `domain/callback.ts`.
+   */
+  path: string
+}
+
+/**
+ * The single derivation point for a method's callback URL.
+ *
+ * `callbackHost` is the optional per-tenant override from
+ * `IdPOptions.callbackHostFor`. **The issuer's mount prefix applies even
+ * when that override is in effect.** `callbackHostFor` exists to partition
+ * callbacks across hostnames so a tenant is recoverable from the `Host`
+ * header before the state envelope is verified (tenant-recovery mechanism
+ * #2) — it varies the authority of the *same* deployment, not the
+ * deployment itself. Those hosts are served by this service behind the
+ * same proxy, so they share its mount. A deployment needing partitioned
+ * hosts mounted differently from the issuer is describing two mounts,
+ * which one `issuerUrl` cannot express and a second option must not be
+ * introduced to paper over.
+ */
+export function callbackTarget(input: {
+  issuerUrl: string
+  methodId: string
+  callbackHost?: string | undefined
+}): CallbackTarget {
+  const issuer = new URL(input.issuerUrl)
+  const host = input.callbackHost ?? issuer.host
+  const path = `/cb/${input.methodId}`
+  return {
+    host,
+    path,
+    url: `${issuer.protocol}//${host}${mountPath(input.issuerUrl)}${path}`,
+  }
+}

package/src/http/handlers/method-route.ts

@@ -12,6 +12,7 @@ import {
   handlePublicMethodRoute,
 } from "../../domain/method-route"
 import type { RouteKey } from "../../domain/method-dispatch"
+import { callbackTarget } from "../../domain/mount"
 import { authError } from "../../types/error"
 import { isErr } from "../../types/result"
 
@@ -51,13 +52,15 @@ export function makeMethodRouteHandler(deps: HttpDeps) {
           resolved.value.publicRoutes?.includes(routeKey)
         ) {
           const issuerUrl = c.get("issuerUrl")
-          const callbackHost =
-            deps.callbackHostFor?.(tenant.id) ?? new URL(issuerUrl).host
-          // Mirrors the ACS URL derivation in domain/authorize.ts
-          // (callbackHost/path/url). Source of truth is there; the
+          // Same derivation as domain/authorize.ts — both call
+          // `callbackTarget`, which is the single source of truth. The
           // metadata.test.ts anti-drift test asserts the emitted
           // entityID/ACS equal what buildAuthnRequestRedirect derives.
-          const callbackUrl = `${new URL(issuerUrl).protocol}//${callbackHost}/cb/${methodId}`
+          const { url: callbackUrl } = callbackTarget({
+            issuerUrl,
+            methodId,
+            callbackHost: deps.callbackHostFor?.(tenant.id),
+          })
           const pub = await handlePublicMethodRoute(
             {
               rawRequest: c.req.raw,
@@ -122,6 +125,7 @@ export function makeMethodRouteHandler(deps: HttpDeps) {
         httpMethod,
         flowId,
         cookies,
+        issuerUrl: c.get("issuerUrl"),
       },
       {
         sessionStore: deps.sessionStore,

package/src/index.ts

@@ -133,6 +133,23 @@ export type { TokenStore } from "./ports/token-store"
  */
 export { revokeAllForSubject } from "./domain/revoke"
 
+/**
+ * Build a path-absolute URL for one of the library's own routes, carrying
+ * the mount prefix from `issuerUrl`.
+ *
+ * Custom methods that render their own URLs — a form `action`, say — must
+ * use this rather than a path-absolute literal, or the URL will 404 under
+ * a deployment mounted behind a proxy at a path prefix. Root-mounted
+ * issuers yield the literal unchanged.
+ *
+ *     mountedPath(ctx.issuerUrl, `/m/${id}/send`)
+ *     // "https://x"     -> "/m/mycode/send"
+ *     // "https://x/idp" -> "/idp/m/mycode/send"
+ *
+ * See INTEGRATION.md § 8.
+ */
+export { mountedPath, mountPath } from "./domain/mount"
+
 // Phase 4 — credential + WebAuthn method factories.
 export { passwordMethod } from "./methods/password"
 export type {

package/src/methods/code.ts

@@ -31,6 +31,7 @@ import type {
   MethodContext,
   MethodResult,
 } from "../types/method"
+import { mountedPath } from "../domain/mount"
 import { renderForm } from "../ui/forms"
 
 export type CodeProperties = {
@@ -120,12 +121,12 @@ export function codeMethod(
         kind,
         type: "code",
         routes: {
-          "GET /authorize": async (_ctx) => ({
+          "GET /authorize": async (ctx) => ({
             kind: "challenge",
             response: htmlResponse(
               renderForm({
                 title: titleRequest,
-                action: `/m/${id}/send`,
+                action: mountedPath(ctx.issuerUrl, `/m/${id}/send`),
                 fields: destinationField(destinationKind),
                 submit: "Send code",
               }),
@@ -169,7 +170,7 @@ async function handleSend(
       response: htmlResponse(
         renderForm({
           title: titleRequest,
-          action: `/m/${methodId}/send`,
+          action: mountedPath(ctx.issuerUrl, `/m/${methodId}/send`),
           fields: destinationField(destinationKind),
           submit: "Send code",
           error: "Please enter a valid destination.",
@@ -193,7 +194,7 @@ async function handleSend(
     response: htmlResponse(
       renderForm({
         title: titleVerify,
-        action: `/m/${methodId}/verify`,
+        action: mountedPath(ctx.issuerUrl, `/m/${methodId}/verify`),
         fields: [
           {
             name: "code",
@@ -238,7 +239,13 @@ async function handleVerify(
   const form = await safeForm(ctx.request)
   const parsed = verifyBody.safeParse(form)
   if (!parsed.success) {
-    return verifyError(methodId, state, titleVerify, "Please enter the code.")
+    return verifyError(
+      ctx.issuerUrl,
+      methodId,
+      state,
+      titleVerify,
+      "Please enter the code.",
+    )
   }
 
   const submittedHash = base64url.encode(
@@ -246,6 +253,7 @@ async function handleVerify(
   )
   if (!timingSafeEqualStr(submittedHash, state.codeHash)) {
     return verifyError(
+      ctx.issuerUrl,
       methodId,
       { ...state, attempts: state.attempts + 1 },
       titleVerify,
@@ -261,6 +269,7 @@ async function handleVerify(
 }
 
 function verifyError(
+  issuerUrl: string,
   methodId: string,
   next: CodeState,
   titleVerify: string,
@@ -271,7 +280,7 @@ function verifyError(
     response: htmlResponse(
       renderForm({
         title: titleVerify,
-        action: `/m/${methodId}/verify`,
+        action: mountedPath(issuerUrl, `/m/${methodId}/verify`),
         fields: [
           {
             name: "code",

package/src/methods/oauth2-generic.ts

@@ -37,6 +37,7 @@ import { createRemoteJWKSet, jwtVerify } from "jose"
  */
 type IdTokenClaims = Record<string, unknown>
 
+import { mountedPath } from "../domain/mount"
 import { authError } from "../types/error"
 import type { AuthMethod, MethodContext, MethodResult } from "../types/method"
 import type { MethodType } from "../types/tenant"
@@ -212,7 +213,11 @@ async function exchangeAndSucceed(
       error: authError.internalError("flow missing on callback"),
     }
   }
-  const callbackUrl = `${new URL(ctx.request.url).protocol}//${ctx.flow.callbackHost}${ctx.flow.callbackPath}`
+  // The `redirect_uri` on the token exchange must be byte-identical to the
+  // one sent on the authorize redirect (OAuth 2.1 §4.1.3). `flow.callbackPath`
+  // is the *inbound* route, which a path-mounted proxy has stripped the mount
+  // prefix from, so re-apply it here rather than replaying the stored path.
+  const callbackUrl = `${new URL(ctx.request.url).protocol}//${ctx.flow.callbackHost}${mountedPath(ctx.issuerUrl, ctx.flow.callbackPath)}`
 
   const body = new URLSearchParams({
     grant_type: "authorization_code",

package/src/methods/passkey.ts

@@ -32,6 +32,7 @@ import type {
   MethodContext,
   MethodResult,
 } from "../types/method"
+import { mountedPath } from "../domain/mount"
 import { renderForm } from "../ui/forms"
 
 export type PasskeyProperties = {
@@ -146,12 +147,15 @@ export function passkeyMethod(
         kind,
         type: "passkey",
         routes: {
-          "GET /authorize": async () => ({
+          "GET /authorize": async (ctx) => ({
             kind: "challenge",
             response: htmlResponse(
               renderForm({
                 title: settings.title,
-                action: `/m/${id}/authenticate-options`,
+                action: mountedPath(
+                  ctx.issuerUrl,
+                  `/m/${id}/authenticate-options`,
+                ),
                 fields: [
                   {
                     name: "username",