@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/types/domain/revoke.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `/revoke` endpoint logic (RFC 7009).
+ *
+ * Access tokens are stateless JWTs in this IdP; revocation has to wait
+ * for natural expiry. `tokenTypeHint: "access_token"` resolves to a
+ * no-op per RFC 7009 §2.2 (invalid hint is ignored).
+ *
+ * Refresh tokens are server-side state. RFC 7009 §2.2 requires the
+ * authorization server to verify that the presented token was issued to
+ * the authenticated client and refuse otherwise. We implement this via
+ * `peekRefresh` (non-destructive) → ownership check → `consumeRefresh`
+ * (destructive). The peek/consume race is benign: if a concurrent caller
+ * consumes the token in between, our consume returns `invalid_grant`,
+ * which RFC 7009 §2.2 says we treat as a successful no-op.
+ *
+ * Anonymous revoke (no `client_id`) is permitted only for tokens issued
+ * to public clients. Confidential-client tokens MUST authenticate per
+ * RFC 7009 §2.1.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { TokenStore } from "../ports/token-store";
+import type { AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { TenantId } from "../types/tenant";
+export type RevokeRequest = {
+    token: string;
+    /** RFC 7009 hint: `"access_token"` or `"refresh_token"`. */
+    tokenTypeHint?: "access_token" | "refresh_token";
+    /** Optional — required when revoking a confidential client's token. */
+    clientId?: string;
+    clientSecret?: string;
+};
+export type RevokeDeps = {
+    tokenStore: TokenStore;
+    configStore: ConfigStore;
+    auditLog?: AuditLog;
+    clock: () => number;
+};
+/**
+ * Revoke a single refresh token. Anonymous revokes are accepted for
+ * public-client tokens; confidential-client tokens require valid
+ * credentials.
+ */
+export declare function revokeToken(req: RevokeRequest, deps: RevokeDeps): Promise<Result<void, AuthError>>;
+/**
+ * Revoke every refresh token for a `(tenantId, subjectId)` pair and emit
+ * a `token_revoked` audit event with `reason: "subject_revoke"`.
+ *
+ * Public primitive exposed for host-driven "log me out of all devices"
+ * flows. Not called from the reuse-detection path — that stays at
+ * family-scope per OAuth 2.0 Security BCP §4.13.2 (revoking sibling
+ * families would punish legitimate other-device sessions sharing the
+ * same subject). See ARCHITECTURE.md §"Reuse detection scope".
+ */
+export declare function revokeAllForSubject(tenantId: TenantId, subjectId: string, deps: {
+    tokenStore: TokenStore;
+    auditLog?: AuditLog;
+    clock: () => number;
+}): Promise<Result<void, AuthError>>;
+//# sourceMappingURL=revoke.d.ts.map

package/dist/types/domain/revoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../../src/domain/revoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAK/C,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,4DAA4D;IAC5D,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAA;IAChD,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,EAAE,WAAW,CAAA;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,EAAE,MAAM,MAAM,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CA6ElC;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,MAAM,CAAA;CAAE,GACzE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAYlC"}

package/dist/types/domain/state-envelope.d.ts

@@ -0,0 +1,30 @@
+/**
+ * MAC-signed `state` envelope used by the tenant-recovery chain.
+ *
+ * Format (intentionally compact, well under 256 base64url bytes):
+ *
+ *   `<b64u(payloadJson)>.<b64u(hmacSha256(payloadJson, key[kid]))>`
+ *
+ * where `payloadJson` is canonical JSON over `{tenantId, flowId, nonce, kid}`.
+ *
+ * **Nothing sensitive is in the envelope** — only the minimal recovery
+ * tuple. Sensitive data (`clientPkce`, `appRedirectUri`, scopes, etc.)
+ * lives in the server-side `FlowRecord`, identified by `flowId`.
+ *
+ * See `ARCHITECTURE.md` §"Tenant recovery across redirects" and plan
+ * §"Crypto — HMAC-SHA-256".
+ */
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { StateEnvelope, StateKeyRing } from "../types/tenant";
+/** Mint a signed state string for the given envelope under the active key. */
+export declare function mintStateEnvelope(envelope: Omit<StateEnvelope, "kid">, keyRing: StateKeyRing): Promise<string>;
+/**
+ * Verify and parse a state string. Returns `unknown_state` on malformed
+ * input, unknown `kid`, or signature mismatch.
+ *
+ * The MAC verification step uses `crypto.subtle.verify`, which is
+ * timing-safe by spec.
+ */
+export declare function verifyStateEnvelope(state: string, keyRing: StateKeyRing): Promise<Result<StateEnvelope, AuthError>>;
+//# sourceMappingURL=state-envelope.d.ts.map

package/dist/types/domain/state-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-envelope.d.ts","sourceRoot":"","sources":["../../../src/domain/state-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EACV,aAAa,EAEb,YAAY,EAEb,MAAM,iBAAiB,CAAA;AAkBxB,8EAA8E;AAC9E,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EACpC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAsD3C"}

package/dist/types/domain/token-exchange.d.ts

@@ -0,0 +1,67 @@
+/**
+ * `/token` logic for `grant_type=urn:ietf:params:oauth:grant-type:token-exchange`
+ * (RFC 8693).
+ *
+ * Scope: **audience-switch / impersonation only.** A subject who holds an
+ * access token for tenant A can present it here to receive a fresh
+ * access + refresh pair scoped to tenant B (the `audience` parameter).
+ * Delegation (`actor_token`) is rejected at the HTTP layer.
+ *
+ * Flow:
+ *   1. Verify the `subject_token` JWT against the IdP's own signing keys.
+ *      Expired / wrong-issuer / bad-sig tokens fail with `invalid_grant`
+ *      (per RFC 8693 §2.4).
+ *   2. Refuse if the host hasn't configured `exchangeAudience` — return
+ *      `unsupported_grant_type` for graceful degradation.
+ *   3. Narrow scope if the caller requested a subset.
+ *   4. Call `exchangeAudience(currentClaim, request)`. The host returns
+ *      either the SubjectClaim that should anchor the new tokens at the
+ *      target tenant, or an `AuthError` (typically `invalid_target`).
+ *   5. Load the target tenant config via `ConfigStore.getTenantConfig`.
+ *      This validates that the audience is a real partition.
+ *   6. Mint a fresh access + refresh pair with `tid = audience` and a
+ *      brand-new refresh family. The previous family lives untouched.
+ *   7. Audit `token_exchanged`.
+ *
+ * Notes:
+ *   - The new tokens' `clientId` is the **authenticated** client (the
+ *     one doing the exchange), not the original audience of the
+ *     subject_token. Hosts that need a different client must register
+ *     one in the target tenant.
+ *   - `methodId` / `methodKind` are preserved from the subject_token so
+ *     the audit trail still names the original authentication method.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { ExchangeAudience } from "../types/idp";
+import type { Result } from "../types/result";
+import type { TokenResponse } from "../types/token";
+export type TokenExchangeRequest = {
+    grantType: "urn:ietf:params:oauth:grant-type:token-exchange";
+    subjectToken: string;
+    audience: string;
+    /** Confidential clients authenticate. Public clients use the subject_token alone. */
+    clientId?: string;
+    clientSecret?: string;
+    /** Optional subset of subject_token scopes. */
+    scope?: string;
+};
+export type TokenExchangeResponse = TokenResponse & {
+    /** RFC 8693 §2.2.1. Always `access_token` for this grant. */
+    issued_token_type: "urn:ietf:params:oauth:token-type:access_token";
+};
+export type ExchangeTokenDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    exchangeAudience?: ExchangeAudience;
+    issuerUrl: string;
+    clock: () => number;
+    newRefreshFamily?: () => string;
+};
+export declare function exchangeToken(req: TokenExchangeRequest, deps: ExchangeTokenDeps): Promise<Result<TokenExchangeResponse, AuthError>>;
+//# sourceMappingURL=token-exchange.d.ts.map

package/dist/types/domain/token-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../../../src/domain/token-exchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAQtE,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,iDAAiD,CAAA;IAC5D,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG;IAClD,6DAA6D;IAC7D,iBAAiB,EAAE,+CAA+C,CAAA;CACnE,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;CAChC,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAsJnD"}

package/dist/types/domain/token.d.ts

@@ -0,0 +1,100 @@
+/**
+ * `/token` endpoint logic for `grant_type=authorization_code`.
+ *
+ * Steps:
+ *   1. Authenticate client (public: id only; confidential: id + secret).
+ *   2. `TokenStore.consumeCode(code)` — strong CAS; returns the decrypted
+ *      `CodePayload`.
+ *   3. Verify the consumed code matches the request (`client_id`,
+ *      `redirect_uri`). Any mismatch → `invalid_grant`.
+ *   4. Verify PKCE if the code carries a `clientPkce` (RP→IdP PKCE).
+ *   5. Call the user's `success` callback with `SuccessMapInput` to mint
+ *      the `SubjectClaim` — the same role the legacy `auth.success`
+ *      callback plays in `issuer.ts`.
+ *   6. (Optional) `persistUpstreamTokens` hook — runs here, not at
+ *      callback time, so failed exchanges don't pollute the secrets store.
+ *   7. Mint access (JWT, ES256) + refresh (random opaque) tokens, save
+ *      refresh, audit `token_issued`.
+ *
+ * Refresh-grant logic lives in `./refresh.ts`. Revocation in `./revoke.ts`.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { KeyStore } from "../ports/key-store";
+import type { TokenStore } from "../ports/token-store";
+import type { ConfigStore } from "../ports/config-store";
+import type { AuthError } from "../types/error";
+import type { PersistUpstreamTokens, SuccessMapInput } from "../types/idp";
+import type { Result } from "../types/result";
+import type { SubjectClaim } from "../types/subject";
+import type { TenantContext } from "../types/tenant";
+import type { CodePayload, TokenResponse } from "../types/token";
+/**
+ * Encrypt a `CodePayload` with the active `KeyStore` encryption key and
+ * persist it via `tokenStore.saveCode`. Centralizes the encrypt-then-store
+ * pattern so adapters never see plaintext (M1).
+ */
+export declare function saveEncryptedCode(code: string, payload: CodePayload, ttl: number, deps: {
+    keyStore: KeyStore;
+    tokenStore: TokenStore;
+}): Promise<Result<void, AuthError>>;
+export declare const DEFAULT_ACCESS_TTL_MS: number;
+export declare const DEFAULT_REFRESH_TTL_MS: number;
+export type TokenAuthCodeRequest = {
+    grantType: "authorization_code";
+    code: string;
+    redirectUri: string;
+    clientId: string;
+    /** Confidential clients only. */
+    clientSecret?: string;
+    /** Required if the original `/authorize` request had a `code_challenge`. */
+    codeVerifier?: string;
+};
+export type ExchangeCodeDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    success: (input: SuccessMapInput) => Promise<SubjectClaim>;
+    persistUpstreamTokens?: PersistUpstreamTokens;
+    issuerUrl: string;
+    clock: () => number;
+    newRefreshToken?: () => string;
+    /** Test override. */
+    newRefreshFamily?: () => string;
+};
+export declare function exchangeCode(req: TokenAuthCodeRequest, deps: ExchangeCodeDeps): Promise<Result<TokenResponse, AuthError>>;
+/**
+ * Shared mint logic used by both `exchangeCode` and `refreshTokens` (which
+ * passes its previous `family` through to preserve the rotation chain).
+ */
+export declare function mintTokens(args: {
+    tenant: TenantContext;
+    claim: SubjectClaim;
+    payload: Pick<CodePayload, "tenantId" | "clientId" | "methodId" | "methodKind" | "scopes" | "audience">;
+    family: string;
+    /**
+     * `client_credentials` grants (RFC 6749 §4.4.3) and other paths where a
+     * refresh token is not appropriate set `skipRefresh: true`. The response
+     * then omits `refresh_token` and **no row is written** to `TokenStore`,
+     * so the durable store doesn't accumulate orphaned refresh entries that
+     * the response strips and discards.
+     */
+    skipRefresh?: boolean;
+    deps: {
+        keyStore: KeyStore;
+        tokenStore: TokenStore;
+        auditLog?: AuditLog;
+        issuerUrl: string;
+        clock: () => number;
+        newRefreshToken?: () => string;
+    };
+}): Promise<Result<TokenResponse, AuthError>>;
+/**
+ * Phase 2 client-secret hash format: SHA-256 over UTF-8 bytes, base64url.
+ *
+ * Production deployments will move to argon2id (per cross-cutting
+ * decisions) in Phase 8. The storage shape (`ClientConfig.secretHash:
+ * string`) is unchanged; only the hashing function swaps.
+ */
+export declare function hashClientSecret(plain: string): Promise<string>;
+//# sourceMappingURL=token.d.ts.map

package/dist/types/domain/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/domain/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAEV,WAAW,EAEX,aAAa,EACd,MAAM,gBAAgB,CAAA;AAgBvB;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAclC;AAED,eAAO,MAAM,qBAAqB,QAAiB,CAAA;AACnD,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAE9D,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qBAAqB;IACrB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;CAChC,CAAA;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAoG3C;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,IAAI,CACX,WAAW,EACX,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAC5E,CAAA;IACD,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,IAAI,EAAE;QACJ,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,UAAU,CAAA;QACtB,QAAQ,CAAC,EAAE,QAAQ,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,MAAM,CAAA;QACnB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;KAC/B,CAAA;CACF,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmF5C;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE"}

package/dist/types/domain/userinfo.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `/userinfo` endpoint logic (OIDC Core §5.3). Verifies the bearer access
+ * token and returns the inlined `SubjectClaim` claims.
+ */
+import type { KeyStore } from "../ports/key-store";
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+export type UserinfoResponse = {
+    sub: string;
+    /** Subject type discriminator (e.g. `"user"` / `"admin"`). */
+    subject_type: string;
+    /** Inlined claim properties. */
+    properties: Record<string, unknown>;
+    /** Scope granted to this access token. */
+    scope?: string;
+};
+export type UserinfoDeps = {
+    keyStore: KeyStore;
+    issuerUrl?: string;
+};
+export declare function userinfo(bearerToken: string, deps: UserinfoDeps): Promise<Result<UserinfoResponse, AuthError>>;
+//# sourceMappingURL=userinfo.d.ts.map

package/dist/types/domain/userinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../src/domain/userinfo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAO7C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAA;IACpB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,QAAQ,CAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAwB9C"}

package/dist/types/http/context.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Shared deps + per-request context for the HTTP layer.
+ *
+ * `HttpDeps` is constructed once by `createIdP` and threaded through every
+ * handler. `HttpVars` is the per-request Hono-variable shape: tenant
+ * resolution, parsed cookies, optional recovery info from the callback chain.
+ */
+import type { Context } from "hono";
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { MethodStore } from "../ports/method-store";
+import type { SessionStore } from "../ports/session-store";
+import type { TokenStore } from "../ports/token-store";
+import type { MethodCache } from "../domain/method-cache";
+import type { AuthError } from "../types/error";
+import type { ExchangeAudience, PersistUpstreamTokens, RenderPicker, SuccessMapInput } from "../types/idp";
+import type { Result } from "../types/result";
+import type { SubjectClaim } from "../types/subject";
+import type { StateKeyRing, TenantContext, TenantId, TenantRecovery } from "../types/tenant";
+import type { CookieDefaults } from "./cookies";
+/** Long-lived deps the HTTP layer shares across requests. */
+export type HttpDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    sessionStore: SessionStore;
+    keyStore: KeyStore;
+    methodStore?: MethodStore;
+    auditLog?: AuditLog;
+    methodCache: MethodCache;
+    stateKeys: StateKeyRing;
+    /** Resolves the issuer URL — string or per-request function. */
+    resolveIssuer: (req: Request) => string;
+    /** Optional partitioned-host helper (recovery #2). */
+    callbackHostFor?: (tenantId: TenantId) => string;
+    resolveTenant: (req: Request) => Promise<Result<TenantId, AuthError>>;
+    success: (input: SuccessMapInput) => Promise<SubjectClaim>;
+    persistUpstreamTokens?: PersistUpstreamTokens;
+    exchangeAudience?: ExchangeAudience;
+    renderPicker?: RenderPicker;
+    /** Builds `TenantContext.request.custom` for every request. See `IdPOptions.buildCustomContext`. */
+    buildCustomContext?: (req: Request) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    clock: () => number;
+    cookieDefaults: CookieDefaults;
+};
+/** Per-request variables populated by middleware. */
+export type HttpVars = {
+    /** Parsed `Cookie:` header. */
+    cookies: Map<string, string>;
+    /** Populated by the tenant middleware. May be `null` for unauthenticated public endpoints. */
+    tenant: TenantContext | null;
+    /** Outcome of the callback-recovery chain on `/cb/*` requests. */
+    recovery: TenantRecovery | null;
+    /** Issuer URL for this request — pre-resolved by middleware. */
+    issuerUrl: string;
+};
+export type HttpEnv = {
+    Variables: HttpVars;
+};
+export type HttpContext = Context<HttpEnv>;
+/** Convenience: build the initial `HttpVars` value for a request. */
+export declare function initialVars(issuerUrl: string, cookies: Map<string, string>): HttpVars;
+//# sourceMappingURL=context.d.ts.map

package/dist/types/http/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;CAC/B,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}

package/dist/types/http/cookies.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Cookie parsing + serialization for the HTTP layer.
+ *
+ * The framework owns cookie policy (per `ARCHITECTURE.md` §"Response
+ * sanitization"). Methods never set cookies through `Response.headers`; they
+ * return `SetCookie[]` data and this module renders them. We additionally
+ * strip method-returned `Set-Cookie` / security / `Cache-Control` headers so
+ * methods cannot bypass policy.
+ */
+import type { SetCookie } from "../types/method";
+/** Parse an incoming `Cookie:` header into a read-only map. */
+export declare function parseCookieHeader(header: string | null): Map<string, string>;
+export type CookieDefaults = {
+    /** Secure flag default. Production should pass `true`. */
+    secure?: boolean;
+    domain?: string;
+    path?: string;
+};
+/**
+ * Serialize a single `SetCookie` data instruction into a `Set-Cookie` header
+ * string. Enforces framework policy:
+ *   - `Secure` forced on if `defaults.secure === true`.
+ *   - `SameSite` defaults to `Lax` if unspecified.
+ *   - `HttpOnly` defaults to `true` for any cookie name in the `auth.*` /
+ *     `idp.*` reserved namespace.
+ *   - `null` value → `Max-Age=0` to clear.
+ */
+export declare function serializeSetCookie(cookie: SetCookie, defaults?: CookieDefaults): string;
+export type ApplyOptions = {
+    setCookies?: SetCookie[];
+    cookieDefaults?: CookieDefaults;
+    /** When set, framework writes this `Cache-Control` value. Default `no-store`. */
+    cacheControl?: string;
+};
+/**
+ * Sanitize a method-returned `Response` and apply framework-owned headers.
+ *
+ * Returns a new `Response` so the original is left untouched. When the
+ * method's response carried any of the stripped headers, emit a
+ * `console.warn` so a programmer notices their header got dropped
+ * silently. (Per ARCHITECTURE.md §"Response sanitization"; switches to
+ * the Logger port when that lands in Phase 8.)
+ */
+export declare function applyResponsePolicy(response: Response, opts?: ApplyOptions): Response;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/types/http/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAsB5E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,QAAQ,GAAE,cAAmB,GAC5B,MAAM,CA4BR;AAgBD,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,YAAiB,GACtB,QAAQ,CA4BV"}

package/dist/types/http/errors.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Map an `AuthError` into a standards-compliant HTTP response.
+ *
+ * Two surfaces:
+ *   - **Token / introspect / revoke endpoints (RFC 6749 §5.2).** JSON body
+ *     `{ "error": "...", "error_description": "..." }` with the spec status
+ *     codes (`invalid_client` → 401, server-side → 500, the rest → 400).
+ *   - **Authorize endpoint (RFC 6749 §4.1.2.1).** Recoverable errors redirect
+ *     back to the relying party with `error` + `error_description` + the
+ *     echoed `state`. Non-recoverable errors (unknown client, unregistered
+ *     redirect_uri) surface as plain text to avoid open-redirector behavior.
+ *
+ * `internal_error` is framework-internal; the HTTP layer always rewrites it
+ * to `server_error` before responding to the client.
+ */
+import type { AuthError, AuthErrorCode } from "../types/error";
+/** Public OAuth error code emitted on the wire. Strips framework-internal. */
+export declare function publicErrorCode(code: AuthErrorCode): string;
+export declare function tokenEndpointErrorResponse(error: AuthError): Response;
+/**
+ * Redirect back to the RP with the OAuth error in the query (RFC 6749
+ * §4.1.2.1). Returns `null` if the error is non-recoverable — the caller
+ * should render a plain-text response instead.
+ */
+export declare function authorizeRedirectErrorResponse(error: AuthError, appRedirectUri: string, appState: string | null): Response;
+/**
+ * Plain-text fallback for errors that occur before a valid `redirect_uri`
+ * has been established — open-redirector defense.
+ */
+export declare function authorizeDirectErrorResponse(error: AuthError): Response;
+/**
+ * Errors that must never round-trip through `appRedirectUri` because the URI
+ * itself is what failed validation.
+ */
+export declare function isNonRecoverable(error: AuthError): boolean;
+//# sourceMappingURL=errors.d.ts.map

package/dist/types/http/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/http/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAS9D,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAM3D;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAerE;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,QAAQ,CASV;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAMvE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAW1D"}

package/dist/types/http/handlers/authorize.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeAuthorizeHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/types/http/handlers/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/authorize.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAQvD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,OAChC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA4JjD"}

package/dist/types/http/handlers/callback.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeCallbackHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=callback.d.ts.map

package/dist/types/http/handlers/callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/callback.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA2DjD"}

package/dist/types/http/handlers/metadata.d.ts

@@ -0,0 +1,4 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeDiscoveryHandler(_deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+export declare function makeJwksHandler(deps: HttpDeps): (_c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/types/http/handlers/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/metadata.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,QAAQ,OACjC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAUjD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,QAC1B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAWlD"}

package/dist/types/http/handlers/method-route.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeMethodRouteHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=method-route.d.ts.map

package/dist/types/http/handlers/method-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/method-route.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,OAClC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAqFjD"}

package/dist/types/http/handlers/revocation.d.ts

@@ -0,0 +1,4 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeRevokeHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+export declare function makeIntrospectHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/types/http/handlers/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/revocation.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKvD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,OAC7B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA+CjD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,OACjC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAkEjD"}

package/dist/types/http/handlers/token.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeTokenHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=token.d.ts.map

package/dist/types/http/handlers/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/token.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,OAC5B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA6KjD"}

package/dist/types/http/handlers/userinfo.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeUserinfoHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=userinfo.d.ts.map

package/dist/types/http/handlers/userinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/userinfo.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAEvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAiDjD"}

package/dist/types/http/middleware/error.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Global error middleware. Catches thrown values and serializes them as
+ * OAuth-compliant responses. Inside handlers we route through `Result<T,
+ * AuthError>` instead — this is the last-resort net for unexpected throws.
+ */
+import type { MiddlewareHandler } from "hono";
+import type { HttpDeps, HttpEnv } from "../context";
+export declare function errorMiddleware(_deps: HttpDeps): MiddlewareHandler<HttpEnv>;
+//# sourceMappingURL=error.d.ts.map

package/dist/types/http/middleware/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAI7C,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAGnD,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAa3E"}

package/dist/types/http/middleware/tenant.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Tenant resolution + callback-recovery middleware.
+ *
+ * Phase 3 ships the mac-state recovery path. Mechanisms #2 (partitioned
+ * host) and #3 (`flowId`-in-URI) are scaffolded but not yet plumbed end-to-
+ * end (per plan §"Phase 2 — Deferred"); the framework currently falls back
+ * to `resolveTenant` when the state envelope is absent or invalid, so users
+ * who want partitioned-host deployments can implement the lookup inside
+ * their own `resolveTenant`.
+ *
+ * Order on `/cb/*`:
+ *   1. If `state` MAC-verifies → `mac-state`. `resolveTenant` is NOT called.
+ *   2. Else fall through to `resolveTenant` (host-plus-* deployments do the
+ *      host inspection there).
+ *
+ * Order on all other paths: `resolveTenant` directly.
+ */
+import type { MiddlewareHandler } from "hono";
+import type { HttpDeps, HttpEnv } from "../context";
+/**
+ * Initial pass — parse cookies + resolve issuer URL. Runs unconditionally.
+ */
+export declare function bootstrapMiddleware(deps: HttpDeps): MiddlewareHandler<HttpEnv>;
+/**
+ * Tenant + recovery resolution middleware. Mount on routes that need a
+ * tenant in scope (`/authorize`, method dispatch, `/cb/*`). Token endpoints
+ * derive tenant from the auth code's snapshot — they skip this middleware.
+ */
+export declare function tenantMiddleware(deps: HttpDeps): MiddlewareHandler<HttpEnv>;
+//# sourceMappingURL=tenant.d.ts.map

package/dist/types/http/middleware/tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAY7C,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAWnD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,GACb,iBAAiB,CAAC,OAAO,CAAC,CAS5B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAkD3E"}

package/dist/types/http/resolver.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Helpers that prepare a `Request` for the host-supplied
+ * `IdPOptions.resolveTenant` hook.
+ *
+ * The canonical resolver reads `client_id` from URL search params
+ * (INTEGRATION.md §5.1). On endpoints where `client_id` is carried in
+ * the form body / Basic-auth header rather than the URL (m2m at
+ * `/token`, introspect at `/introspect`, revoke at `/revoke`) the
+ * framework parses the body first and then injects the parsed
+ * `client_id` into a synthesized request so the resolver still sees
+ * what it expects.
+ */
+/**
+ * Build a new `Request` whose URL search params carry the supplied
+ * resolver hints. Existing query params win — hosts can still override
+ * via the URL. Headers are copied so Basic-auth-based resolvers still
+ * see the original `Authorization`. The body is intentionally dropped:
+ * the original is already consumed by the handler and resolvers must
+ * not depend on body state.
+ */
+export declare function injectResolverHints(original: Request, hints: Record<string, string>): Request;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/types/http/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/http/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAST"}