@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/types/http/router.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Top-level Hono router for the IdP HTTP surface.
+ *
+ * Routes (Phase 3):
+ *   GET  /authorize                                    — start OAuth flow
+ *   POST /token                                         — exchange code / refresh
+ *   GET  /userinfo, POST /userinfo                      — OIDC claims
+ *   GET  /cb/:methodId{.*}                              — upstream callback
+ *   GET  /.well-known/openid-configuration              — discovery
+ *   GET  /.well-known/oauth-authorization-server        — discovery (alias)
+ *   GET  /.well-known/jwks.json                         — JWKS
+ *   POST /revoke                                        — RFC 7009
+ *   POST /introspect                                    — RFC 7662
+ *
+ * Hono is imported **only** from this directory. `domain/`, `methods/`,
+ * `types/`, `ports/`, and `adapters/` remain framework-agnostic.
+ */
+import { Hono } from "hono";
+import type { HttpDeps, HttpEnv } from "./context";
+export declare function buildRouter(deps: HttpDeps): Hono<HttpEnv>;
+//# sourceMappingURL=router.d.ts.map

package/dist/types/http/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAW3B,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAmCzD"}

package/dist/types/http/schemas/authorize.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Zod schemas for the `/authorize` endpoint.
+ *
+ * Parse the raw query into an `AuthorizationRequest` shape. We surface OAuth
+ * `invalid_request` (or the more specific `unsupported_response_type` /
+ * `invalid_scope`) for any structural failure here; downstream domain code
+ * then handles semantic validation (client lookup, redirect-uri match, PKCE
+ * requirement, etc.).
+ */
+import { z } from "zod";
+export declare const authorizeQuerySchema: z.ZodObject<{
+    response_type: z.ZodString;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    scope: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string[], string>, z.ZodArray<z.ZodString, "many">>>;
+    state: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    method_id: z.ZodOptional<z.ZodString>;
+    code_challenge: z.ZodOptional<z.ZodString>;
+    code_challenge_method: z.ZodOptional<z.ZodLiteral<"S256">>;
+    prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    nonce: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    response_type: z.ZodString;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    scope: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string[], string>, z.ZodArray<z.ZodString, "many">>>;
+    state: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    method_id: z.ZodOptional<z.ZodString>;
+    code_challenge: z.ZodOptional<z.ZodString>;
+    code_challenge_method: z.ZodOptional<z.ZodLiteral<"S256">>;
+    prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    nonce: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    response_type: z.ZodString;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    scope: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string[], string>, z.ZodArray<z.ZodString, "many">>>;
+    state: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    method_id: z.ZodOptional<z.ZodString>;
+    code_challenge: z.ZodOptional<z.ZodString>;
+    code_challenge_method: z.ZodOptional<z.ZodLiteral<"S256">>;
+    prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    nonce: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export type AuthorizeQuery = z.infer<typeof authorizeQuerySchema>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/types/http/schemas/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAyBvB,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAqBjB,CAAA;AAEhB,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/types/http/schemas/revocation.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Zod schemas for RFC 7009 `/revoke` and RFC 7662 `/introspect`. Both are
+ * advertised in discovery from Phase 3 onward; their HTTP shims live here so
+ * the domain functions are reachable without waiting for Phase 8.
+ */
+import { z } from "zod";
+export declare const revokeBodySchema: z.ZodObject<{
+    token: z.ZodString;
+    token_type_hint: z.ZodOptional<z.ZodEnum<["access_token", "refresh_token"]>>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    token: string;
+    client_id?: string | undefined;
+    client_secret?: string | undefined;
+    token_type_hint?: "refresh_token" | "access_token" | undefined;
+}, {
+    token: string;
+    client_id?: string | undefined;
+    client_secret?: string | undefined;
+    token_type_hint?: "refresh_token" | "access_token" | undefined;
+}>;
+export declare const introspectBodySchema: z.ZodObject<{
+    token: z.ZodString;
+    token_type_hint: z.ZodOptional<z.ZodEnum<["access_token", "refresh_token"]>>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    token: string;
+    client_id?: string | undefined;
+    client_secret?: string | undefined;
+    token_type_hint?: "refresh_token" | "access_token" | undefined;
+}, {
+    token: string;
+    client_id?: string | undefined;
+    client_secret?: string | undefined;
+    token_type_hint?: "refresh_token" | "access_token" | undefined;
+}>;
+export type RevokeBody = z.infer<typeof revokeBodySchema>;
+export type IntrospectBody = z.infer<typeof introspectBodySchema>;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/types/http/schemas/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/revocation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;EAK3B,CAAA;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;EAK/B,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACzD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/types/http/schemas/token.d.ts

@@ -0,0 +1,227 @@
+/**
+ * Zod schemas for the `/token` endpoint.
+ *
+ * The endpoint accepts `application/x-www-form-urlencoded` per RFC 6749.
+ * `grant_type` discriminates between the supported grants:
+ *   - `authorization_code`
+ *   - `refresh_token`
+ *   - `client_credentials`
+ *   - `urn:ietf:params:oauth:grant-type:token-exchange` (RFC 8693)
+ */
+import { z } from "zod";
+/** RFC 8693 §3 token-type identifiers used at this endpoint. */
+export declare const TOKEN_EXCHANGE_GRANT_TYPE: "urn:ietf:params:oauth:grant-type:token-exchange";
+export declare const ACCESS_TOKEN_TYPE: "urn:ietf:params:oauth:token-type:access_token";
+export declare const REFRESH_TOKEN_TYPE: "urn:ietf:params:oauth:token-type:refresh_token";
+export declare const authorizationCodeGrantSchema: z.ZodObject<{
+    grant_type: z.ZodLiteral<"authorization_code">;
+    code: z.ZodString;
+    redirect_uri: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    code_verifier: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+    grant_type: "authorization_code";
+    code_verifier?: string | undefined;
+    client_secret?: string | undefined;
+}, {
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+    grant_type: "authorization_code";
+    code_verifier?: string | undefined;
+    client_secret?: string | undefined;
+}>;
+export declare const refreshTokenGrantSchema: z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id?: string | undefined;
+    scope?: string | undefined;
+    client_secret?: string | undefined;
+}, {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id?: string | undefined;
+    scope?: string | undefined;
+    client_secret?: string | undefined;
+}>;
+export declare const clientCredentialsGrantSchema: z.ZodObject<{
+    grant_type: z.ZodLiteral<"client_credentials">;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    grant_type: z.ZodLiteral<"client_credentials">;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    grant_type: z.ZodLiteral<"client_credentials">;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * RFC 8693 §2.1 token-exchange request.
+ *
+ * `subject_token_type` MUST identify the type of `subject_token`. We only
+ * accept access tokens here — refresh-token-as-subject is out of scope.
+ *
+ * `audience` is opaque to the library; the host's `exchangeAudience`
+ * hook decides what counts as a legal target. In our two-level
+ * `App × App-Tenant` encoding pattern this is the new `TenantId`.
+ *
+ * `actor_token` (delegation) is intentionally rejected at the handler;
+ * only impersonation / audience-switching is supported in this phase.
+ */
+export declare const tokenExchangeGrantSchema: z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:token-exchange">;
+    subject_token: z.ZodString;
+    subject_token_type: z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">;
+    audience: z.ZodString;
+    requested_token_type: z.ZodOptional<z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">>;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+    actor_token: z.ZodOptional<z.ZodString>;
+    actor_token_type: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:token-exchange">;
+    subject_token: z.ZodString;
+    subject_token_type: z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">;
+    audience: z.ZodString;
+    requested_token_type: z.ZodOptional<z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">>;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+    actor_token: z.ZodOptional<z.ZodString>;
+    actor_token_type: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:token-exchange">;
+    subject_token: z.ZodString;
+    subject_token_type: z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">;
+    audience: z.ZodString;
+    requested_token_type: z.ZodOptional<z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">>;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+    actor_token: z.ZodOptional<z.ZodString>;
+    actor_token_type: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export declare const tokenRequestSchema: z.ZodDiscriminatedUnion<"grant_type", [z.ZodObject<{
+    grant_type: z.ZodLiteral<"authorization_code">;
+    code: z.ZodString;
+    redirect_uri: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    code_verifier: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+    grant_type: "authorization_code";
+    code_verifier?: string | undefined;
+    client_secret?: string | undefined;
+}, {
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+    grant_type: "authorization_code";
+    code_verifier?: string | undefined;
+    client_secret?: string | undefined;
+}>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    refresh_token: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id?: string | undefined;
+    scope?: string | undefined;
+    client_secret?: string | undefined;
+}, {
+    grant_type: "refresh_token";
+    refresh_token: string;
+    client_id?: string | undefined;
+    scope?: string | undefined;
+    client_secret?: string | undefined;
+}>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"client_credentials">;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    grant_type: z.ZodLiteral<"client_credentials">;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    grant_type: z.ZodLiteral<"client_credentials">;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>, z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:token-exchange">;
+    subject_token: z.ZodString;
+    subject_token_type: z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">;
+    audience: z.ZodString;
+    requested_token_type: z.ZodOptional<z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">>;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+    actor_token: z.ZodOptional<z.ZodString>;
+    actor_token_type: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:token-exchange">;
+    subject_token: z.ZodString;
+    subject_token_type: z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">;
+    audience: z.ZodString;
+    requested_token_type: z.ZodOptional<z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">>;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+    actor_token: z.ZodOptional<z.ZodString>;
+    actor_token_type: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:token-exchange">;
+    subject_token: z.ZodString;
+    subject_token_type: z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">;
+    audience: z.ZodString;
+    requested_token_type: z.ZodOptional<z.ZodLiteral<"urn:ietf:params:oauth:token-type:access_token">>;
+    scope: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+    actor_token: z.ZodOptional<z.ZodString>;
+    actor_token_type: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>]>;
+export type TokenRequest = z.infer<typeof tokenRequestSchema>;
+//# sourceMappingURL=token.d.ts.map

package/dist/types/http/schemas/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,mDACsB,CAAA;AAC5D,eAAO,MAAM,iBAAiB,iDAC4B,CAAA;AAC1D,eAAO,MAAM,kBAAkB,kDAC4B,CAAA;AAE3D,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;EAOvC,CAAA;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;EAMlC,CAAA;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;gCASzB,CAAA;AAEhB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAcrB,CAAA;AAEhB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAK7B,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA"}

package/dist/types/index.d.ts

@@ -1,20 +1,70 @@
-export { 
 /**
- * @deprecated
- * Use `import { createClient } from "@openauthjs/openauth/client"` instead - it will tree shake better
+ * `@_mustachio/openauth` — public entry point.
+ *
+ * Library-only IdP surface: domain logic + ports + adapters. Consumers
+ * embed this in a host application that owns UI, RBAC, admin, and tenant
+ * management. See `docs/integration-guide.md` for the embedding pattern.
+ *
+ * `createClient` continues to ship at the dedicated path
+ * `@_mustachio/openauth/client` (better tree-shaking than re-exporting
+ * it from the root).
  */
-createClient, } from "./client.js";
-export { 
+export type { Result } from "./types/result";
+export { err, isErr, isOk, ok } from "./types/result";
+export type { AuthError, AuthErrorCode } from "./types/error";
+export { authError } from "./types/error";
+export type { ClientConfig, ConfidentialClientConfig, GrantType, MethodConfig, MethodType, PublicClientConfig, StateEnvelope, StateKey, StateKeyRing, TenantConfig, TenantContext, TenantId, TenantRecovery, ThemeConfig, } from "./types/tenant";
+export { asTenantId } from "./types/tenant";
+export type { FlowRecord } from "./types/flow";
+export type { AuthMethod, AuthMethodFactory, CachePolicy, ClientFn, MethodContext, MethodDispatchData, MethodHandler, MethodResult, SetCookie, } from "./types/method";
+export type { AuthorizationRequest, AuthorizationState, } from "./types/authorization";
+export type { AccessTokenClaims, CodePayload, RefreshTokenPayload, TokenResponse, } from "./types/token";
+export type { SubjectClaim, SubjectPayload, SubjectSchema, } from "./types/subject";
+export type { ExchangeAudience, FailureEvent, IdP, IdPOptions, PersistUpstreamTokens, RenderPicker, SuccessEvent, SuccessMapInput, } from "./types/idp";
+export type { PickerContext, PickerMethod } from "./types/picker";
+export type { AuditEvent, AuditLog } from "./ports/audit-log";
+export type { ConfigStore } from "./ports/config-store";
+export type { EncryptionKey, KeyStore, KeyWrapper, SigningKey, } from "./ports/key-store";
+export type { MethodStore } from "./ports/method-store";
+export type { SessionRecord, SessionStore } from "./ports/session-store";
+export type { TokenStore } from "./ports/token-store";
 /**
- * @deprecated
- * Use `import { createSubjects } from "@openauthjs/openauth/subject"` instead - it will tree shake better
+ * Host-callable primitive for "log me out of all devices" UX. Wraps
+ * `TokenStore.revokeBySubject` with the framework's audit emission so
+ * hosts don't need to reimplement it. Reuse-detection escalation itself
+ * stays at family-scope per OAuth 2.0 Security BCP §4.13.2 (see
+ * ARCHITECTURE.md "Reuse detection scope").
  */
-createSubjects, } from "./subject.js";
-import { issuer } from "./issuer.js";
-export { 
+export { revokeAllForSubject } from "./domain/revoke";
+export { passwordMethod } from "./methods/password";
+export type { PasswordMethodOptions, PasswordProperties, PasswordUser, PasswordUserStore, PasswordState, } from "./methods/password";
+export { codeMethod } from "./methods/code";
+export type { CodeMethodOptions, CodeProperties, CodeState, } from "./methods/code";
+export { m2mMethod } from "./methods/m2m";
+export type { M2MMethodOptions, M2MProperties } from "./methods/m2m";
+export { passkeyMethod } from "./methods/passkey";
+export type { PasskeyMethodOptions, PasskeyProperties, PasskeyState, PasskeyCredentialStore, StoredCredential, } from "./methods/passkey";
+export { argon2idHasher, DEFAULT_ARGON2ID_PARAMS, } from "./methods/password-hash";
+export type { PasswordHasher, Argon2idParams } from "./methods/password-hash";
+export { buildOauth2Method } from "./methods/oauth2-generic";
+export type { Oauth2MethodInput, Oauth2Properties, Oauth2State, } from "./methods/oauth2-generic";
+export { buildOidcMethod } from "./methods/oidc-generic";
+export type { OidcMethodInput } from "./methods/oidc-generic";
+export { oauth2Factory, oidcFactory, type Oauth2FactoryConfig, type OidcFactoryConfig, } from "./methods/oauth2-factory";
+export { appleFactory, cognitoFactory, discordFactory, facebookFactory, githubFactory, googleFactory, jumpcloudFactory, keycloakFactory, linkedinFactory, microsoftFactory, slackFactory, spotifyFactory, twitchFactory, xFactory, yahooFactory, } from "./methods/providers";
+import type { IdP, IdPOptions } from "./types/idp";
 /**
- * @deprecated
- * Use `import { issuer } from "@openauthjs/openauth"` instead, it was renamed
+ * Construct a new IdP from the supplied options.
+ *
+ * Phase 3 ships the full HTTP surface backed by the Phase 2 domain
+ * functions. Wire up:
+ *
+ *  - A `MethodCache` over the configured factories. The factory map's
+ *    keys MUST equal each factory's `kind`; we throw on construction if
+ *    any disagree.
+ *  - A `HttpDeps` record passed into the Hono router.
+ *  - The returned `IdP.handle` is `app.fetch.bind(app)`; the per-endpoint
+ *    primitives (`authorize`, `token`, etc.) re-enter the same app.
  */
-issuer as authorizer, issuer, };
+export declare function createIdP(opts: IdPOptions): IdP;
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO;AACL;;;GAGG;AACH,YAAY,GACb,MAAM,aAAa,CAAA;AAEpB,OAAO;AACL;;;GAGG;AACH,cAAc,GACf,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,OAAO;AACL;;;GAGG;AACH,MAAM,IAAI,UAAU,EACpB,MAAM,GACP,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACxE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CA8E/C"}

package/dist/types/methods/code.d.ts

@@ -0,0 +1,96 @@
+/**
+ * `codeMethod` — magic-code (email / SMS) credential factory.
+ *
+ * Routes:
+ *   GET  /authorize → render destination form (email or phone input).
+ *   POST /send      → mint code, call `sendCode(destination, code)` hook,
+ *                      stash hashed code in `methodState`, render verify form.
+ *   POST /verify    → compare submitted code against stored hash; on match,
+ *                      return `success` with the destination as provider
+ *                      subject.
+ *
+ * The framework's flow record TTL (10 minutes) doubles as the code TTL —
+ * the methodState rolls off when the flow does.
+ *
+ * Anti-enumeration: the `/send` route always renders the verify form,
+ * whether or not the destination is valid. The user-supplied `sendCode`
+ * hook can silently no-op for unknown destinations.
+ */
+import { z } from "zod";
+import type { AuthMethodFactory } from "../types/method";
+export type CodeProperties = {
+    destination: string;
+};
+export type CodeState = {
+    destination: string;
+    /** Base64url SHA-256 hash of the code; the plain code never persists. */
+    codeHash: string;
+    /** Failed-verify counter. After 5 attempts the flow is denied. */
+    attempts: number;
+    error?: string;
+};
+export type CodeMethodOptions = {
+    /**
+     * Called when the user submits a destination. The hook receives the
+     * generated code and is responsible for delivering it (email, SMS,
+     * etc.). Returning normally means "delivery attempted"; the framework
+     * does not inspect the outcome.
+     */
+    sendCode: (input: {
+        destination: string;
+        code: string;
+        tenantId: string;
+    }) => Promise<void>;
+    /**
+     * Override code generation. Default: 6-digit numeric.
+     *
+     * Kept on the factory closure (not per-tenant) because the generation
+     * algorithm is part of the host's overall deliverability + UX
+     * decisions, not something that should be reconfigured per tenant.
+     */
+    generateCode?: () => string;
+};
+/**
+ * Per-tenant config. Host supplies these via `MethodConfig.config` so
+ * each tenant can ship its own code length, attempt cap, channel kind,
+ * and copy without instantiating a new factory.
+ */
+declare const configSchema: z.ZodObject<{
+    /** Default 6. Range 4–10. */
+    codeLength: z.ZodOptional<z.ZodNumber>;
+    /** Default 5. After this many failed verifies the flow is denied. */
+    maxAttempts: z.ZodOptional<z.ZodNumber>;
+    /** Default "email". */
+    destinationKind: z.ZodOptional<z.ZodEnum<["email", "tel", "any"]>>;
+    /** Form copy overrides. */
+    titles: z.ZodOptional<z.ZodObject<{
+        request: z.ZodOptional<z.ZodString>;
+        verify: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        verify?: string | undefined;
+        request?: string | undefined;
+    }, {
+        verify?: string | undefined;
+        request?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    codeLength?: number | undefined;
+    maxAttempts?: number | undefined;
+    destinationKind?: "email" | "tel" | "any" | undefined;
+    titles?: {
+        verify?: string | undefined;
+        request?: string | undefined;
+    } | undefined;
+}, {
+    codeLength?: number | undefined;
+    maxAttempts?: number | undefined;
+    destinationKind?: "email" | "tel" | "any" | undefined;
+    titles?: {
+        verify?: string | undefined;
+        request?: string | undefined;
+    } | undefined;
+}>;
+type CodeConfig = z.infer<typeof configSchema>;
+export declare function codeMethod(opts: CodeMethodOptions): AuthMethodFactory<CodeProperties, CodeState, CodeConfig>;
+export {};
+//# sourceMappingURL=code.d.ts.map

package/dist/types/methods/code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code.d.ts","sourceRoot":"","sources":["../../../src/methods/code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AASvB,OAAO,KAAK,EAEV,iBAAiB,EAGlB,MAAM,iBAAiB,CAAA;AAGxB,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B,CAAA;AAED;;;;GAIG;AACH,QAAA,MAAM,YAAY;IAChB,6BAA6B;;IAE7B,qEAAqE;;IAErE,uBAAuB;;IAEvB,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO3B,CAAA;AACF,KAAK,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAS9C,wBAAgB,UAAU,CACxB,IAAI,EAAE,iBAAiB,GACtB,iBAAiB,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC,CAgD1D"}

package/dist/types/methods/m2m.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `m2mMethod` — machine-to-machine factory (RFC 6749 §4.4 client_credentials).
+ *
+ * No URL routes. The factory ships only a `client` fn the framework invokes
+ * from `/token` after standard client authentication has succeeded. The
+ * fn validates and returns the `P` properties the success callback will
+ * map into the issued subject claim.
+ *
+ * Typical use: a tenant configures one m2m method instance per tenant.
+ * The user-supplied `verify` hook decides whether the (already
+ * authenticated) client is allowed to use this method and what claims it
+ * carries (org id, service tier, etc.).
+ */
+import { z } from "zod";
+import type { AuthMethodFactory } from "../types/method";
+export type M2MProperties = {
+    /** The client's stable id (echoed back from the request). */
+    clientId: string;
+    /** Tenant-supplied extra claims. */
+    claims?: Record<string, unknown>;
+};
+export type M2MMethodOptions = {
+    /**
+     * Look up the client's per-client metadata. Return `null` for unauthorized
+     * (the framework already authenticated the secret; this is for
+     * application-level authorization — e.g. "is this client allowed to use
+     * this method?", "what claims should we attach?").
+     */
+    verify: (input: {
+        clientID: string;
+        params: Record<string, string>;
+        tenantId: string;
+    }) => Promise<{
+        claims?: Record<string, unknown>;
+    } | null>;
+};
+declare const configSchema: z.ZodObject<{}, "strict", z.ZodTypeAny, {}, {}>;
+type M2MConfig = z.infer<typeof configSchema>;
+export declare function m2mMethod(opts: M2MMethodOptions): AuthMethodFactory<M2MProperties, never, M2MConfig>;
+export {};
+//# sourceMappingURL=m2m.d.ts.map

package/dist/types/methods/m2m.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"m2m.d.ts","sourceRoot":"","sources":["../../../src/methods/m2m.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,KAAK,EAAc,iBAAiB,EAAY,MAAM,iBAAiB,CAAA;AAE9E,MAAM,MAAM,aAAa,GAAG;IAC1B,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAA;IAChB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,KAAK,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC9B,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;CAC3D,CAAA;AAED,QAAA,MAAM,YAAY,iDAAwB,CAAA;AAC1C,KAAK,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAE7C,wBAAgB,SAAS,CACvB,IAAI,EAAE,gBAAgB,GACrB,iBAAiB,CAAC,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,CAoCpD"}