@_mustachio/openauth 0.13.2 → 0.14.0

package/dist/esm/index.js

@@ -3,6 +3,7 @@ import { err, isErr, isOk, ok } from "./types/result";
 import { authError } from "./types/error";
 import { asTenantId } from "./types/tenant";
 import { revokeAllForSubject } from "./domain/revoke";
+import { mountedPath, mountPath } from "./domain/mount";
 import { passwordMethod } from "./methods/password";
 import { codeMethod } from "./methods/code";
 import { m2mMethod } from "./methods/m2m";
@@ -66,6 +67,7 @@ function createIdP(opts) {
     ...opts.callbackHostFor ? { callbackHostFor: opts.callbackHostFor } : {},
     resolveTenant: opts.resolveTenant,
     success: opts.success,
+    subjects: opts.subjects,
     ...opts.onLogout ? { onLogout: opts.onLogout } : {},
     ...opts.persistUpstreamTokens ? { persistUpstreamTokens: opts.persistUpstreamTokens } : {},
     ...opts.exchangeAudience ? { exchangeAudience: opts.exchangeAudience } : {},
@@ -119,6 +121,8 @@ export {
   linkedinFactory,
   m2mMethod,
   microsoftFactory,
+  mountPath,
+  mountedPath,
   oauth2Factory,
   oidcFactory,
   ok,

package/dist/esm/methods/code.js

@@ -7,6 +7,7 @@ import {
   timingSafeEqualStr,
   utf8
 } from "../domain/crypto";
+import { mountedPath } from "../domain/mount";
 import { renderForm } from "../ui/forms";
 var configSchema = z.object({
   codeLength: z.number().int().min(4).max(10).optional(),
@@ -44,11 +45,11 @@ function codeMethod(opts) {
         kind,
         type: "code",
         routes: {
-          "GET /authorize": async (_ctx) => ({
+          "GET /authorize": async (ctx) => ({
             kind: "challenge",
             response: htmlResponse(renderForm({
               title: titleRequest,
-              action: `/m/${id}/send`,
+              action: mountedPath(ctx.issuerUrl, `/m/${id}/send`),
               fields: destinationField(destinationKind),
               submit: "Send code"
             }))
@@ -68,7 +69,7 @@ async function handleSend(ctx, methodId, titleRequest, titleVerify, destinationK
       kind: "challenge",
       response: htmlResponse(renderForm({
         title: titleRequest,
-        action: `/m/${methodId}/send`,
+        action: mountedPath(ctx.issuerUrl, `/m/${methodId}/send`),
         fields: destinationField(destinationKind),
         submit: "Send code",
         error: "Please enter a valid destination."
@@ -85,7 +86,7 @@ async function handleSend(ctx, methodId, titleRequest, titleVerify, destinationK
     kind: "challenge",
     response: htmlResponse(renderForm({
       title: titleVerify,
-      action: `/m/${methodId}/verify`,
+      action: mountedPath(ctx.issuerUrl, `/m/${methodId}/verify`),
       fields: [
         {
           name: "code",
@@ -122,11 +123,11 @@ async function handleVerify(ctx, methodId, titleVerify, maxAttempts) {
   const form = await safeForm(ctx.request);
   const parsed = verifyBody.safeParse(form);
   if (!parsed.success) {
-    return verifyError(methodId, state, titleVerify, "Please enter the code.");
+    return verifyError(ctx.issuerUrl, methodId, state, titleVerify, "Please enter the code.");
   }
   const submittedHash = base64url.encode(await sha256(utf8.encode(parsed.data.code)));
   if (!timingSafeEqualStr(submittedHash, state.codeHash)) {
-    return verifyError(methodId, { ...state, attempts: state.attempts + 1 }, titleVerify, "Incorrect code. Please try again.");
+    return verifyError(ctx.issuerUrl, methodId, { ...state, attempts: state.attempts + 1 }, titleVerify, "Incorrect code. Please try again.");
   }
   return {
     kind: "success",
@@ -134,12 +135,12 @@ async function handleVerify(ctx, methodId, titleVerify, maxAttempts) {
     properties: { destination: state.destination }
   };
 }
-function verifyError(methodId, next, titleVerify, error) {
+function verifyError(issuerUrl, methodId, next, titleVerify, error) {
   return {
     kind: "challenge",
     response: htmlResponse(renderForm({
       title: titleVerify,
-      action: `/m/${methodId}/verify`,
+      action: mountedPath(issuerUrl, `/m/${methodId}/verify`),
       fields: [
         {
           name: "code",

package/dist/esm/methods/oauth2-generic.js

@@ -1,6 +1,7 @@
 // src/methods/oauth2-generic.ts
 import * as oauth from "oauth4webapi";
 import { createRemoteJWKSet, jwtVerify } from "jose";
+import { mountedPath } from "../domain/mount";
 import { authError } from "../types/error";
 async function buildOauth2Method(opts) {
   const pkceMode = opts.pkce ?? "S256";
@@ -76,7 +77,7 @@ async function exchangeAndSucceed(ctx, opts, jwks, deriveSubject) {
       error: authError.internalError("flow missing on callback")
     };
   }
-  const callbackUrl = `${new URL(ctx.request.url).protocol}//${ctx.flow.callbackHost}${ctx.flow.callbackPath}`;
+  const callbackUrl = `${new URL(ctx.request.url).protocol}//${ctx.flow.callbackHost}${mountedPath(ctx.issuerUrl, ctx.flow.callbackPath)}`;
   const body = new URLSearchParams({
     grant_type: "authorization_code",
     code,

package/dist/esm/methods/passkey.js

@@ -6,6 +6,7 @@ import {
   verifyAuthenticationResponse,
   verifyRegistrationResponse
 } from "@simplewebauthn/server";
+import { mountedPath } from "../domain/mount";
 import { renderForm } from "../ui/forms";
 var configSchema = z.object({
   rpName: z.string().min(1),
@@ -36,11 +37,11 @@ function passkeyMethod(opts) {
         kind,
         type: "passkey",
         routes: {
-          "GET /authorize": async () => ({
+          "GET /authorize": async (ctx) => ({
             kind: "challenge",
             response: htmlResponse(renderForm({
               title: settings.title,
-              action: `/m/${id}/authenticate-options`,
+              action: mountedPath(ctx.issuerUrl, `/m/${id}/authenticate-options`),
               fields: [
                 {
                   name: "username",

package/dist/esm/methods/password.js

@@ -1,6 +1,7 @@
 // src/methods/password.ts
 import { z } from "zod";
 import { argon2idHasher } from "./password-hash";
+import { mountedPath } from "../domain/mount";
 import { renderForm } from "../ui/forms";
 var configSchema = z.object({}).strict();
 var loginBodySchema = z.object({
@@ -46,7 +47,7 @@ function passwordMethod(opts) {
 async function renderLogin(ctx, methodId, title) {
   const body = renderForm({
     title,
-    action: `/m/${methodId}/login`,
+    action: mountedPath(ctx.issuerUrl, `/m/${methodId}/login`),
     fields: [
       {
         name: "email",
@@ -78,15 +79,15 @@ async function handleLogin(ctx, methodId, title, users, hasher) {
   const form = await safeForm(ctx.request);
   const parsed = loginBodySchema.safeParse(form);
   if (!parsed.success) {
-    return reLoginWithError(methodId, title, "Please enter your email and password.");
+    return reLoginWithError(ctx.issuerUrl, methodId, title, "Please enter your email and password.");
   }
   const user = await users.findByEmail(parsed.data.email, ctx.tenant.id);
   if (!user) {
-    return reLoginWithError(methodId, title, "Invalid email or password.");
+    return reLoginWithError(ctx.issuerUrl, methodId, title, "Invalid email or password.");
   }
   const verified = await hasher.verify(parsed.data.password, user.passwordHash);
   if (!verified) {
-    return reLoginWithError(methodId, title, "Invalid email or password.");
+    return reLoginWithError(ctx.issuerUrl, methodId, title, "Invalid email or password.");
   }
   return {
     kind: "success",
@@ -101,11 +102,11 @@ async function handleRegister(ctx, methodId, title, create, users, hasher) {
   const form = await safeForm(ctx.request);
   const parsed = registerBodySchema.safeParse(form);
   if (!parsed.success) {
-    return reLoginWithError(methodId, title, "Password must be at least 8 characters and email must be valid.");
+    return reLoginWithError(ctx.issuerUrl, methodId, title, "Password must be at least 8 characters and email must be valid.");
   }
   const existing = await users.findByEmail(parsed.data.email, ctx.tenant.id);
   if (existing) {
-    return reLoginWithError(methodId, title, "An account with that email already exists.");
+    return reLoginWithError(ctx.issuerUrl, methodId, title, "An account with that email already exists.");
   }
   const passwordHash = await hasher.hash(parsed.data.password);
   const user = await create({
@@ -122,12 +123,12 @@ async function handleRegister(ctx, methodId, title, create, users, hasher) {
     }
   };
 }
-function reLoginWithError(methodId, title, error) {
+function reLoginWithError(issuerUrl, methodId, title, error) {
   return {
     kind: "challenge",
     response: new Response(renderForm({
       title,
-      action: `/m/${methodId}/login`,
+      action: mountedPath(issuerUrl, `/m/${methodId}/login`),
       fields: [
         {
           name: "email",

package/dist/esm/methods/saml-sp/metadata.js

@@ -1,4 +1,5 @@
 // src/methods/saml-sp/metadata.ts
+import { mountedPath } from "../../domain/mount";
 import { authError } from "../../types/error";
 import { resolveSpEntityId } from "./saml-instance";
 var NAME_ID_FORMAT_URN = {
@@ -46,7 +47,7 @@ async function buildSpMetadata(ctx, methodId, config) {
   }
   const spEntityId = resolveSpEntityId(config, ctx.dispatch.issuerUrl, ctx.tenant.id, methodId);
   const cb = new URL(ctx.dispatch.callbackUrl);
-  const slsUrl = `${cb.protocol}//${cb.host}/m/${methodId}/sls`;
+  const slsUrl = `${cb.protocol}//${cb.host}${mountedPath(ctx.dispatch.issuerUrl, `/m/${methodId}/sls`)}`;
   const xml = buildSpMetadataXml({
     spEntityId,
     acsUrl: ctx.dispatch.callbackUrl,

package/dist/types/client.d.ts

@@ -90,26 +90,45 @@ export interface ClientInput {
      */
     issuer?: string;
     /**
-     * Optionally, override the internally used fetch function.
+     * The client secret, for **confidential** clients only.
      *
-     * This is useful if you are using a polyfilled fetch function in your application and you
-     * want the client to use it too.
-     */
-    fetch?: FetchLike;
-}
-export interface AuthorizeOptions {
-    /**
-     * Enable the PKCE flow. This is for SPA apps.
+     * Supply this for a server-side app registered as a confidential client;
+     * `exchange()` and `refresh()` then authenticate at `/token`. Omit it for
+     * public clients (SPA, mobile, CLI) — a secret cannot be kept in code
+     * that ships to users, and the IdP requires PKCE there instead.
+     *
+     * Without this, a confidential client's `exchange()` is rejected with
+     * `invalid_client`: the token endpoint has no way to authenticate it.
      *
+     * @example
      * ```ts
      * {
-     *   pkce: true
+     *   clientID: "my-server-app",
+     *   clientSecret: process.env.CLIENT_SECRET
      * }
      * ```
+     */
+    clientSecret?: string;
+    /**
+     * How to present `clientSecret` at the token endpoint.
      *
-     * @default false
+     * `client_secret_basic` (the default) sends HTTP Basic credentials, which
+     * is what RFC 6749 §2.3.1 prefers and what the IdP parses first.
+     * `client_secret_post` puts them in the form body. Both are advertised in
+     * discovery as `token_endpoint_auth_methods_supported`.
+     *
+     * @default "client_secret_basic"
+     */
+    tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post";
+    /**
+     * Optionally, override the internally used fetch function.
+     *
+     * This is useful if you are using a polyfilled fetch function in your application and you
+     * want the client to use it too.
      */
-    pkce?: boolean;
+    fetch?: FetchLike;
+}
+export interface AuthorizeOptions {
     /**
      * The provider you want to use for the OAuth flow.
      *
@@ -238,7 +257,13 @@ export interface VerifyOptions {
      */
     issuer?: string;
     /**
-     * @internal
+     * The audience to require on the token.
+     *
+     * Defaults to this client's `clientID`, which is what the IdP puts in
+     * `aud` for an ordinary login. Set this when verifying a token minted
+     * for a **resource** — an `/authorize` call that passed `audience` puts
+     * that value in `aud` instead, so a resource server verifying it must
+     * name itself here.
      */
     audience?: string;
     /**
@@ -251,9 +276,14 @@ export interface VerifyOptions {
 }
 export interface VerifyResult<T extends SubjectSchema> {
     /**
-     * This is always `undefined` when the verify is successful.
+     * This is always `false` when the verify is successful.
+     *
+     * A literal, not an optional — `err?: undefined` would leave the
+     * property present on this arm, so `"err" in result` narrowed nothing
+     * and callers had to test truthiness instead. Matches `ExchangeSuccess`
+     * and `RefreshSuccess`.
      */
-    err?: undefined;
+    err: false;
     /**
      * Returns the refreshed tokens only if they’ve been refreshed.
      *
@@ -297,38 +327,29 @@ export interface VerifyError {
  */
 export interface Client {
     /**
-     * Start the autorization flow. For example, in SSR sites.
+     * Start the authorization code flow.
      *
      * ```ts
-     * const { url } = await client.authorize(<redirect_uri>, "code")
+     * const { challenge, url } = await client.authorize(<redirect_uri>)
+     * // store `challenge`, then redirect the user to `url`
      * ```
      *
-     * This takes a redirect URI and the type of flow you want to use. The redirect URI is the
-     * location where the user will be redirected to after the flow is complete.
-     *
-     * Supports both the _code_ and _token_ flows. We recommend using the _code_ flow as it's more
-     * secure.
+     * Returns the URL to send the user to, and a `challenge` carrying the
+     * CSRF `state` and the PKCE `verifier`. Persist the challenge (a cookie
+     * server-side, `sessionStorage` in a SPA) and hand the verifier back to
+     * {@link Client.exchange} when the user returns.
      *
-     * :::tip
-     * This returns a URL to redirect the user to. This starts the OAuth flow.
-     * :::
-     *
-     * This returns a URL to the auth server. You can redirect the user to the URL to start the
-     * OAuth flow.
-     *
-     * For SPA apps, we recommend using the PKCE flow.
-     *
-     * ```ts {4}
-     * const { challenge, url } = await client.authorize(
-     *   <redirect_uri>,
-     *   "code",
-     *   { pkce: true }
-     * )
-     * ```
+     * **PKCE is always used.** The IdP requires it for public clients, and
+     * OAuth 2.1 §7.5.1 recommends it for confidential ones too, so there is
+     * no reason to offer it as a toggle. Before 0.14.0 it was opt-in and
+     * off by default, which meant the documented server-side flow could not
+     * complete against a public client at all.
      *
-     * This returns a redirect URL and a challenge that you need to use later to verify the code.
+     * Only the authorization code flow is supported. The implicit flow
+     * (`response_type=token`) is removed in OAuth 2.1 and the IdP rejects
+     * it with `unsupported_response_type`.
      */
-    authorize(redirectURI: string, response: "code" | "token", opts?: AuthorizeOptions): Promise<AuthorizeResult>;
+    authorize(redirectURI: string, opts?: AuthorizeOptions): Promise<AuthorizeResult>;
     /**
      * Exchange the code for access and refresh tokens.
      *

package/dist/types/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EAEzB,MAAM,YAAY,CAAA;AAGnB;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,UAAU,YAAY;IACpB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;CACnB;AACD,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAE1D;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,CAAA;IACpB;;;;;;;;OAQG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,GAAG,EAAE,6BAA6B,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,aAAa;IACnD;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,OAAO,EAAE;SACN,IAAI,IAAI,MAAM,CAAC,GAAG;YAAE,IAAI,EAAE,IAAI,CAAC;YAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;KACvE,CAAC,MAAM,CAAC,CAAC,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GAAG,OAAO,EAC1B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,GAAG,aAAa,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,cAAc,GAAG,YAAY,CAAC,CAAA;IACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,MAAM,CAAC,CAAC,SAAS,aAAa,EAC5B,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAwPvD"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EAEzB,MAAM,YAAY,CAAA;AAGnB;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,UAAU,YAAY;IACpB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;CACnB;AACD,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAE1D;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;;;;OASG;IACH,uBAAuB,CAAC,EAAE,qBAAqB,GAAG,oBAAoB,CAAA;IACtE;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,CAAA;IACpB;;;;;;;;OAQG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,GAAG,EAAE,6BAA6B,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,aAAa;IACnD;;;;;;;OAOG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,OAAO,EAAE;SACN,IAAI,IAAI,MAAM,CAAC,GAAG;YAAE,IAAI,EAAE,IAAI,CAAC;YAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;KACvE,CAAC,MAAM,CAAC,CAAC,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,GAAG,aAAa,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,cAAc,GAAG,YAAY,CAAC,CAAA;IACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,MAAM,CAAC,CAAC,SAAS,aAAa,EAC5B,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAoPvD"}

package/dist/types/domain/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/domain/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EACV,oBAAoB,EAGpB,SAAS,EACT,WAAW,EACZ,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIhF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAK5C,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAiB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAY,CAAA;AAEzC,MAAM,MAAM,eAAe;AACzB;;;;;;GAMG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AACH,6DAA6D;GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE;AAC7D;;;GAGG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D,CAAA;AAEL,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAA;IACvB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAuI7C;AA4ID,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/domain/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EACV,oBAAoB,EAGpB,SAAS,EACT,WAAW,EACZ,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIhF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAM5C,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAiB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAY,CAAA;AAEzC,MAAM,MAAM,eAAe;AACzB;;;;;;GAMG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AACH,6DAA6D;GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE;AAC7D;;;GAGG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D,CAAA;AAEL,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAA;IACvB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAiJ7C;AAsJD,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA"}

package/dist/types/domain/callback.d.ts

@@ -56,12 +56,13 @@ export type HandleCallbackInput = {
      */
     tenant?: TenantContext;
     /**
-     * Per-request issuer URL (HTTP layer). Used only by the
-     * IdP-initiated path to derive the SP entityID / ACS — the same
-     * derivation the AuthnRequest and metadata paths use, so the values
-     * cannot drift.
+     * Per-request issuer URL (HTTP layer). The IdP-initiated path derives
+     * the SP entityID / ACS from it — the same derivation the AuthnRequest
+     * and metadata paths use, so the values cannot drift — and every
+     * dispatched method receives it as `MethodContext.issuerUrl` to build
+     * mount-prefixed URLs of its own.
      */
-    issuerUrl?: string;
+    issuerUrl: string;
 };
 export type HandleCallbackDeps = {
     configStore: ConfigStore;

package/dist/types/domain/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/domain/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAgB,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAM5C,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,mBAAmB,GAAG;IAChC,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChE,CAAA;AA8BD,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAsH5C"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/domain/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAgB,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAO5C,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,mBAAmB,GAAG;IAChC,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChE,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAuH5C"}

package/dist/types/domain/client-credentials.d.ts

@@ -24,7 +24,7 @@ import type { TokenStore } from "../ports/token-store";
 import { type AuthError } from "../types/error";
 import type { PersistUpstreamTokens, SuccessMapInput } from "../types/idp";
 import type { Result } from "../types/result";
-import type { SubjectClaim } from "../types/subject";
+import type { SubjectClaim, SubjectSchema } from "../types/subject";
 import type { TenantId } from "../types/tenant";
 import type { TokenResponse } from "../types/token";
 import { MethodCache } from "./method-cache";
@@ -43,6 +43,8 @@ export type ClientCredentialsDeps = {
     auditLog?: AuditLog;
     methodCache: MethodCache;
     success: (input: SuccessMapInput) => Promise<SubjectClaim>;
+    /** Host-declared subject schemas; the claim is validated against them. */
+    subjects: SubjectSchema;
     persistUpstreamTokens?: PersistUpstreamTokens;
     issuerUrl: string;
     clock: () => number;

package/dist/types/domain/client-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../src/domain/client-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAKnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5C,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,wBAAwB,EAC7B,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmH3C"}
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../src/domain/client-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAKnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAI5C,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,0EAA0E;IAC1E,QAAQ,EAAE,aAAa,CAAA;IACvB,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,wBAAwB,EAC7B,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAkI3C"}

package/dist/types/domain/method-dispatch.d.ts

@@ -24,6 +24,11 @@ export type DispatchInput = {
     flow: FlowRecord | null;
     cookies: ReadonlyMap<string, string>;
     sessionStore: SessionStore;
+    /**
+     * Issuer URL of this IdP. Always required — unlike `dispatch`, methods
+     * need it on every route to emit mount-prefixed URLs of their own.
+     */
+    issuerUrl: string;
     /** Populated at `GET /authorize`; null on callbacks. */
     dispatch: MethodDispatchData | null;
 };

package/dist/types/domain/method-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-dispatch.d.ts","sourceRoot":"","sources":["../../../src/domain/method-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,YAAY,EAEb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAA;AAE9D,MAAM,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAEpD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAqD5D"}
+{"version":3,"file":"method-dispatch.d.ts","sourceRoot":"","sources":["../../../src/domain/method-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,YAAY,EAEb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAA;AAE9D,MAAM,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAEpD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAsD5D"}

package/dist/types/domain/method-route.d.ts

@@ -64,6 +64,12 @@ export type HandleMethodRouteInput = {
     /** flowId from the `idp.flow` cookie. */
     flowId: string;
     cookies: ReadonlyMap<string, string>;
+    /**
+     * Issuer URL — passed to the method so it can emit mount-prefixed URLs
+     * (a re-rendered form action, say). The inbound request URL cannot
+     * supply this: a proxy has already stripped the mount prefix from it.
+     */
+    issuerUrl: string;
 };
 export type HandleMethodRouteDeps = {
     sessionStore: SessionStore;

package/dist/types/domain/method-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../src/domain/method-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAElB,SAAS,EACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAIjE,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,GAAG,MAAM,CAAA;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;CACzB,CAAA;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAgD/C;AA6ED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,gFAAgF;IAChF,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,QAAQ,EAAE,kBAAkB,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;CAClD,CAAA;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,EACnC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC,CAsDrD"}
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../src/domain/method-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAElB,SAAS,EACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAIjE,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,GAAG,MAAM,CAAA;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;CACzB,CAAA;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAiD/C;AAuFD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,gFAAgF;IAChF,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,QAAQ,EAAE,kBAAkB,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;CAClD,CAAA;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,EACnC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC,CAuDrD"}

package/dist/types/domain/mount.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Mount prefix — where this IdP sits under its origin.
+ *
+ * The library serves its routes at its own root (`/authorize`, `/m/*`,
+ * `/cb/*`); a deployment may sit behind a reverse proxy that strips a path
+ * prefix before forwarding. Routing is unaffected — but every URL the
+ * library *emits* (form actions, upstream `redirect_uri`s, SAML metadata)
+ * is consumed on the public side of that proxy and must carry the prefix.
+ *
+ * `issuerUrl` already carries it. It is the single source of truth: there
+ * is deliberately no `basePath` option, because two sources could disagree
+ * and the `iss` claim would then contradict the URLs we hand out.
+ *
+ * All emitted-URL construction goes through this module. `metadata.test.ts`
+ * is an anti-drift test asserting the SAML entityID/ACS equal what
+ * `buildAuthnRequestRedirect` derives; funnelling every site through
+ * `callbackTarget` is what keeps that true.
+ */
+/**
+ * The normalised mount prefix of `issuerUrl`: `""` for a root-mounted
+ * deployment, otherwise a leading-slash, no-trailing-slash path.
+ *
+ *     https://example.com        -> ""
+ *     https://example.com/       -> ""
+ *     https://example.com/idp    -> "/idp"
+ *     https://example.com/idp/   -> "/idp"
+ *     https://example.com//idp// -> "/idp"
+ *
+ * A root-mounted issuer must yield `""` and not `"/"`, so that existing
+ * deployments emit byte-identical URLs to before this existed.
+ *
+ * An unparseable `issuerUrl` yields `""` rather than throwing: emitting a
+ * root-relative URL degrades to the pre-existing behaviour, whereas
+ * throwing would turn a misconfiguration into a 500 from inside form
+ * rendering. Misconfiguration still fails loudly at `/authorize`, which
+ * parses `issuerUrl` for the callback host.
+ */
+export declare function mountPath(issuerUrl: string): string;
+/**
+ * A path-absolute URL for one of the library's own routes, carrying the
+ * deployment's mount prefix. `path` is the route as the service itself
+ * serves it, with a leading slash.
+ *
+ *     mountedPath("https://x/idp", "/m/code/send") -> "/idp/m/code/send"
+ *     mountedPath("https://x",     "/m/code/send") -> "/m/code/send"
+ */
+export declare function mountedPath(issuerUrl: string, path: string): string;
+/**
+ * Where a method's callback lives, in the two forms the framework needs.
+ *
+ * The distinction matters under a path-mounted deployment and is the
+ * reason these are derived together rather than one from the other:
+ * `url` is public (registered with upstream providers, advertised in SAML
+ * metadata) and carries the mount prefix, while `path` is what the
+ * inbound request actually looks like after the proxy has stripped that
+ * prefix, and so must not.
+ */
+export type CallbackTarget = {
+    /** Public, fully-qualified callback URL. Carries the mount prefix. */
+    url: string;
+    /** Host the callback is expected to arrive on. */
+    host: string;
+    /**
+     * Expected pathname of the inbound request — this service's own route,
+     * *without* the mount prefix, because the proxy has already stripped it.
+     * Persisted on `FlowRecord.callbackPath` and matched in `domain/callback.ts`.
+     */
+    path: string;
+};
+/**
+ * The single derivation point for a method's callback URL.
+ *
+ * `callbackHost` is the optional per-tenant override from
+ * `IdPOptions.callbackHostFor`. **The issuer's mount prefix applies even
+ * when that override is in effect.** `callbackHostFor` exists to partition
+ * callbacks across hostnames so a tenant is recoverable from the `Host`
+ * header before the state envelope is verified (tenant-recovery mechanism
+ * #2) — it varies the authority of the *same* deployment, not the
+ * deployment itself. Those hosts are served by this service behind the
+ * same proxy, so they share its mount. A deployment needing partitioned
+ * hosts mounted differently from the issuer is describing two mounts,
+ * which one `issuerUrl` cannot express and a second option must not be
+ * introduced to paper over.
+ */
+export declare function callbackTarget(input: {
+    issuerUrl: string;
+    methodId: string;
+    callbackHost?: string | undefined;
+}): CallbackTarget;
+//# sourceMappingURL=mount.d.ts.map

package/dist/types/domain/mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../../../src/domain/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CASnD;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAA;IACX,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC,GAAG,cAAc,CASjB"}

package/dist/types/domain/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/domain/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAMnD,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,eAAe,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmJ3C"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/domain/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAMnD,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,eAAe,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAsBD,wBAAsB,aAAa,CACjC,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CA4J3C"}

package/dist/types/domain/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/domain/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,MAAM,MAAM,YAAY,GAAG;IACzB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;CAC/B,CAAA;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC,CA0HpD"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/domain/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,MAAM,MAAM,YAAY,GAAG;IACzB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;CAC/B,CAAA;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC,CA6IpD"}