@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/types/adapters/postgres/migrations.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Postgres schema for the IdP adapters. One migration; future schema changes
+ * append new migrations and a small migrate-from-version routine.
+ *
+ * Tables are prefixed `openauth_` so the IdP can share a database with the
+ * application that consumes it. The schema is intentionally narrow — JSONB
+ * blobs carry the bulk of the data (auth-code ciphertext, refresh payload,
+ * tenant config) so that adding fields in later phases is non-breaking.
+ *
+ * Timestamps are `bigint` (epoch ms) rather than `timestamptz` so that the
+ * adapter's injectable clock works seamlessly in tests and so that
+ * comparisons are simple integer math.
+ */
+import type { PostgresExecutor } from "./executor";
+export declare const INITIAL_SCHEMA_SQL = "\nCREATE TABLE IF NOT EXISTS openauth_tenants (\n  id text PRIMARY KEY,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_methods (\n  tenant_id text NOT NULL,\n  method_id text NOT NULL,\n  config jsonb NOT NULL,\n  updated_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, method_id)\n);\n\nCREATE TABLE IF NOT EXISTS openauth_signing_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  crv text,\n  public_jwk jsonb NOT NULL,\n  private_jwk jsonb NOT NULL,\n  private_jwk_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_signing_keys\n  ADD COLUMN IF NOT EXISTS private_jwk_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_encryption_keys (\n  kid text PRIMARY KEY,\n  alg text NOT NULL,\n  key_material bytea NOT NULL,\n  key_material_wrapped boolean NOT NULL DEFAULT false,\n  status text NOT NULL,\n  created_at bigint NOT NULL,\n  rotated_at bigint\n);\n\nALTER TABLE openauth_encryption_keys\n  ADD COLUMN IF NOT EXISTS key_material_wrapped boolean NOT NULL DEFAULT false;\n\nCREATE TABLE IF NOT EXISTS openauth_codes (\n  code text PRIMARY KEY,\n  ciphertext text NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_refresh_tokens (\n  token text PRIMARY KEY,\n  tenant_id text NOT NULL,\n  client_id text NOT NULL,\n  subject_id text NOT NULL,\n  family text NOT NULL,\n  expires_at bigint NOT NULL,\n  consumed_at bigint,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_refresh_family_idx\n  ON openauth_refresh_tokens (family);\nCREATE INDEX IF NOT EXISTS openauth_refresh_subject_idx\n  ON openauth_refresh_tokens (tenant_id, subject_id);\n\nCREATE TABLE IF NOT EXISTS openauth_flows (\n  flow_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_sessions (\n  session_id text PRIMARY KEY,\n  payload jsonb NOT NULL,\n  expires_at bigint NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS openauth_audit_events (\n  id bigserial PRIMARY KEY,\n  ts bigint NOT NULL,\n  kind text NOT NULL,\n  payload jsonb NOT NULL\n);\nCREATE INDEX IF NOT EXISTS openauth_audit_kind_idx\n  ON openauth_audit_events (kind);\nCREATE INDEX IF NOT EXISTS openauth_audit_ts_idx\n  ON openauth_audit_events (ts);\n\nCREATE TABLE IF NOT EXISTS openauth_passkey_credentials (\n  tenant_id text NOT NULL,\n  credential_id text NOT NULL,\n  user_id text NOT NULL,\n  public_key text NOT NULL,\n  counter bigint NOT NULL DEFAULT 0,\n  transports jsonb,\n  created_at bigint NOT NULL,\n  PRIMARY KEY (tenant_id, credential_id)\n);\nCREATE INDEX IF NOT EXISTS openauth_passkey_user_idx\n  ON openauth_passkey_credentials (tenant_id, user_id);\n";
+/**
+ * Apply the initial schema. Idempotent — uses `CREATE TABLE IF NOT EXISTS`.
+ * Deployments using a real migration tool can apply the SQL above directly
+ * and skip this helper.
+ */
+export declare function migrate(exec: PostgresExecutor): Promise<void>;
+//# sourceMappingURL=migrations.d.ts.map

package/dist/types/adapters/postgres/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,eAAO,MAAM,kBAAkB,mwFAmG9B,CAAA;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CASnE"}

package/dist/types/adapters/postgres/passkey-credential-store.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Postgres `PasskeyCredentialStore`.
+ *
+ * Schema (created by `migrate()` in `./migrations.ts`):
+ *
+ *   openauth_passkey_credentials
+ *     tenant_id   text  NOT NULL
+ *     credential_id text NOT NULL
+ *     user_id     text  NOT NULL
+ *     public_key  text  NOT NULL
+ *     counter     bigint NOT NULL DEFAULT 0
+ *     transports  jsonb
+ *     created_at  bigint NOT NULL
+ *     PRIMARY KEY (tenant_id, credential_id)
+ *     INDEX (tenant_id, user_id)   -- findByUsername path
+ *
+ * The reference adapter treats `userId` as the username lookup key —
+ * matching the bundled `passkeyMethod` which sets `userId =
+ * parsed.data.username` at registration. Hosts that want a separate
+ * username dimension implement `PasskeyCredentialStore` directly
+ * against their own user table.
+ */
+import type { PasskeyCredentialStore, StoredCredential } from "../../methods/passkey";
+import type { PostgresExecutor } from "./executor";
+export type PostgresPasskeyCredentialStoreOptions = {
+    exec: PostgresExecutor;
+    clock?: () => number;
+};
+export declare class PostgresPasskeyCredentialStore implements PasskeyCredentialStore {
+    #private;
+    constructor(opts: PostgresPasskeyCredentialStoreOptions);
+    findByUsername(username: string, tenantId: string): Promise<{
+        userId: string;
+        credentials: StoredCredential[];
+    } | null>;
+    findById(credentialId: string, tenantId: string): Promise<StoredCredential | null>;
+    updateCounter(input: {
+        credentialId: string;
+        counter: number;
+        tenantId: string;
+    }): Promise<void>;
+    create(input: {
+        userId: string;
+        credential: StoredCredential;
+        tenantId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=passkey-credential-store.d.ts.map

package/dist/types/adapters/postgres/passkey-credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credential-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/passkey-credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAUD,qBAAa,8BAA+B,YAAW,sBAAsB;;gBAI/D,IAAI,EAAE,qCAAqC;IAKjD,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAchE,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAY7B,aAAa,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IASX,MAAM,CAAC,KAAK,EAAE;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,gBAAgB,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBlB"}

package/dist/types/adapters/postgres/session-store.d.ts

@@ -0,0 +1,20 @@
+import type { FlowRecord } from "../../types/flow";
+import type { SessionRecord, SessionStore } from "../../ports/session-store";
+import type { Result } from "../../types/result";
+import type { PostgresExecutor } from "./executor";
+export type PostgresSessionStoreOptions = {
+    exec: PostgresExecutor;
+    clock?: () => number;
+};
+export declare class PostgresSessionStore implements SessionStore {
+    #private;
+    constructor(opts: PostgresSessionStoreOptions);
+    saveFlow(flowId: string, payload: FlowRecord, ttl: number): Promise<Result<void>>;
+    updateFlowMethodState(flowId: string, methodState: unknown): Promise<Result<void>>;
+    readFlow(flowId: string): Promise<Result<FlowRecord>>;
+    consumeFlow(flowId: string): Promise<Result<FlowRecord>>;
+    createSession(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
+    readSession(sessionId: string): Promise<Result<SessionRecord>>;
+    revokeSession(sessionId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/types/adapters/postgres/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/session-store.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAGhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,oBAAqB,YAAW,YAAY;;gBAI3C,IAAI,EAAE,2BAA2B;IAKvC,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBlB,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAwBlB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA6BrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IA4BxD,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBlB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA6B9D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAW9D"}

package/dist/types/adapters/postgres/token-store.d.ts

@@ -0,0 +1,30 @@
+import type { KeyStore } from "../../ports/key-store";
+import type { TokenStore } from "../../ports/token-store";
+import type { Result } from "../../types/result";
+import type { TenantId } from "../../types/tenant";
+import type { RefreshTokenPayload } from "../../types/token";
+import type { PostgresExecutor } from "./executor";
+export type PostgresTokenStoreOptions = {
+    exec: PostgresExecutor;
+    /**
+     * Optional — retained for API stability after M1 moved code-payload
+     * encryption to the domain layer. The adapter no longer touches it.
+     */
+    keyStore?: KeyStore;
+    /** Injectable clock — defaults to `Date.now`. Tests advance it. */
+    clock?: () => number;
+};
+export declare class PostgresTokenStore implements TokenStore {
+    #private;
+    constructor(opts: PostgresTokenStoreOptions);
+    saveCode(code: string, ciphertext: string, ttl: number): Promise<Result<void>>;
+    consumeCode(code: string): Promise<Result<string>>;
+    saveRefresh(refresh: string, payload: RefreshTokenPayload): Promise<Result<void>>;
+    consumeRefresh(refresh: string, options?: {
+        reuseWindowMs?: number;
+    }): Promise<Result<RefreshTokenPayload>>;
+    peekRefresh(refresh: string): Promise<Result<RefreshTokenPayload>>;
+    revokeFamily(family: string): Promise<Result<void>>;
+    revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/types/adapters/postgres/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/adapters/postgres/token-store.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAE5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,gBAAgB,CAAA;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB,CAAA;AAED,qBAAa,kBAAmB,YAAW,UAAU;;gBAIvC,IAAI,EAAE,yBAAyB;IAKrC,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoBlB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAyBlD,WAAW,CACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsBlB,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IA6EjC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAyBlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYnD,eAAe,CACnB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CAYzB"}

package/dist/types/client.d.ts

@@ -1,4 +1,4 @@
-import { SubjectSchema } from "./subject.js";
+import type { SubjectSchema } from "./types/subject";
 import type { v1 } from "@standard-schema/spec";
 import { InvalidAccessTokenError, InvalidAuthorizationCodeError, InvalidRefreshTokenError } from "./error.js";
 /**
@@ -35,6 +35,13 @@ export interface Tokens {
      * The number of seconds until the access token expires.
      */
     expiresIn: number;
+    /**
+     * The OIDC `id_token` (signed JWT), present when `scope=openid` was granted.
+     *
+     * Refresh-grant rotation reissues this with a stable `auth_time` per
+     * OIDC Core §12 and deliberately omits the original `nonce`.
+     */
+    idToken?: string;
 }
 interface ResponseLike {
     json(): Promise<unknown>;
@@ -118,6 +125,18 @@ export interface AuthorizeOptions {
      * If there's only one provider configured, the user will be redirected to that.
      */
     provider?: string;
+    /**
+     * OAuth scopes to request, e.g. `["openid", "email", "profile"]`.
+     *
+     * Pass `openid` to request an `id_token` at `/token` (OIDC Core §2). Pass
+     * `email` / `profile` / `phone` / `address` to opt into the standard §5.4
+     * profile claim sets on the id_token and `/userinfo` response.
+     *
+     * Accepts an array or a pre-joined space-separated string. When omitted,
+     * no `scope` is sent — the IdP's default grant applies, which typically
+     * does NOT include `openid` and therefore does NOT issue an id_token.
+     */
+    scope?: string | string[];
 }
 export interface AuthorizeResult {
     /**

package/dist/types/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EAEzB,MAAM,YAAY,CAAA;AAGnB;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,UAAU,YAAY;IACpB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;CACnB;AACD,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAE1D;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,CAAA;IACpB;;;;;;;;OAQG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,GAAG,EAAE,6BAA6B,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,aAAa;IACnD;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,OAAO,EAAE;SACN,IAAI,IAAI,MAAM,CAAC,GAAG;YAAE,IAAI,EAAE,IAAI,CAAC;YAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;KACvE,CAAC,MAAM,CAAC,CAAC,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GAAG,OAAO,EAC1B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,GAAG,aAAa,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,cAAc,GAAG,YAAY,CAAC,CAAA;IACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,MAAM,CAAC,CAAC,SAAS,aAAa,EAC5B,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CA0MvD"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EAEzB,MAAM,YAAY,CAAA;AAGnB;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,UAAU,YAAY;IACpB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACxB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;CACnB;AACD,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAE1D;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,SAAS,EAAE,SAAS,CAAA;IACpB;;;;;;;;OAQG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;OASG;IACH,GAAG,EAAE,6BAA6B,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,GAAG,EAAE,KAAK,CAAA;IACV;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,aAAa;IACnD;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,OAAO,EAAE;SACN,IAAI,IAAI,MAAM,CAAC,GAAG;YAAE,IAAI,EAAE,IAAI,CAAC;YAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;SAAE;KACvE,CAAC,MAAM,CAAC,CAAC,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,GAAG,EAAE,wBAAwB,GAAG,uBAAuB,CAAA;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GAAG,OAAO,EAC1B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACH,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,GAAG,aAAa,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,cAAc,GAAG,YAAY,CAAC,CAAA;IACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,MAAM,CAAC,CAAC,SAAS,aAAa,EAC5B,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAA;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAwPvD"}

package/dist/types/domain/audit.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Shared `safeAudit` helper — every domain module that emits audit
+ * events used to keep its own private `audit(...)` wrapper around
+ * `auditLog.log(event)` that silently swallowed any thrown error. The
+ * intent (per `ports/audit-log.ts`) is that audit emission must not
+ * derail the OAuth hot path, but operators have no signal when the
+ * pipeline goes down.
+ *
+ * Until the Logger port lands in Phase 8, durability failures here
+ * surface via `console.error` with a discriminating prefix. The Logger
+ * port will replace this single helper — the call sites stay put.
+ */
+import type { AuditLog } from "../ports/audit-log";
+export declare function safeAudit(deps: {
+    auditLog?: AuditLog;
+}, event: Parameters<AuditLog["log"]>[0]): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/types/domain/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/domain/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAElD,wBAAsB,SAAS,CAC7B,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE,EAC7B,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/types/domain/authorize.d.ts

@@ -0,0 +1,125 @@
+/**
+ * `startAuthorize` — orchestrate the `/authorize` flow.
+ *
+ * Pure domain function over typed ports. The HTTP layer (Phase 3) parses
+ * the incoming `Request` into an `AuthorizationRequest`, runs
+ * `resolveTenant`, then calls into this function. No framework imports.
+ *
+ * Responsibilities (in order):
+ *   1. Validate the request against the registered `ClientConfig` —
+ *      client lookup, redirect-URI exact match, scope subset, PKCE
+ *      required-when-required.
+ *   2. Pick the method to dispatch to: explicit `methodId` if present,
+ *      else the only enabled method, else surface a method-selection
+ *      output for the UI.
+ *   3. Atomically `saveFlow` the `FlowRecord` (creates the
+ *      pre-callback state) under a freshly minted `flowId`.
+ *   4. Mint the MAC-signed `state` envelope under the active key.
+ *   5. Dispatch to the method's `GET /authorize` handler — the method
+ *      builds the upstream redirect (or renders the credential form,
+ *      etc.) using the `dispatch.state` / `dispatch.callbackUrl` data
+ *      we supply.
+ *   6. Translate the `MethodResult` into an `AuthorizeOutput`:
+ *      `challenge` (HTTP layer renders), `success` (HTTP layer issues a
+ *      code immediately — e.g. single-step credential flows), `denied`
+ *      (OAuth `access_denied`), `error` (propagated).
+ *
+ * The framework writes / consumes `FlowRecord`. Methods read via
+ * `MethodContext.flow` / `methodState` and request state changes via
+ * `MethodResult.challenge.saveMethodState`.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { KeyStore } from "../ports/key-store";
+import type { SessionStore } from "../ports/session-store";
+import type { TokenStore } from "../ports/token-store";
+import type { AuthError } from "../types/error";
+import type { AuthorizationRequest } from "../types/authorization";
+import type { AnyAuthMethodFactory, SetCookie, CachePolicy } from "../types/method";
+import type { Result } from "../types/result";
+import type { StateKeyRing, TenantContext } from "../types/tenant";
+import { MethodCache } from "./method-cache";
+/** Default 10-minute pre-callback flow lifetime per plan §"TTLs". */
+export declare const DEFAULT_FLOW_TTL_MS: number;
+/**
+ * Auth-code lifetime per OAuth 2.1 BCP (`draft-ietf-oauth-v2-1-13` §4.1.3):
+ * the framework issues codes with this exact TTL, and every `TokenStore`
+ * adapter rejects `saveCode` calls whose `ttl` exceeds it. Treated as
+ * both the canonical default and the hard ceiling — there is no
+ * separate "max" knob.
+ */
+export declare const AUTH_CODE_TTL_MS: number;
+export type AuthorizeOutput = 
+/**
+ * Render the method's challenge (UI / redirect). HTTP layer applies
+ * cookies. `flowId` is exposed so the HTTP layer can stamp the
+ * framework's `idp.flow` cookie — used by credential POSTs (`/m/...`)
+ * to identify the in-flight flow without trusting form input, and as
+ * defense-in-depth for the OAuth callback path.
+ */
+{
+    kind: "challenge";
+    response: Response;
+    setCookies: SetCookie[];
+    flowId: string;
+    cache?: CachePolicy;
+}
+/**
+ * Method returned synchronous success (e.g. single-step credential flow).
+ * The framework has minted an auth code; HTTP layer 302s back to the RP
+ * with `code` + `state` in the query.
+ */
+ | {
+    kind: "issue-code";
+    code: string;
+    appRedirectUri: string;
+    appState: string | null;
+}
+/** Method denied — surface `access_denied` per OAuth 2.1. */
+ | {
+    kind: "denied";
+    reason: string;
+    setCookies: SetCookie[];
+}
+/**
+ * No `methodId` given and >1 enabled methods configured. HTTP layer
+ * renders a selection page that re-requests `/authorize?methodId=…`.
+ */
+ | {
+    kind: "select-method";
+    methods: Array<{
+        id: string;
+        kind: string;
+        type: string;
+    }>;
+};
+export type StartAuthorizeInput = {
+    request: AuthorizationRequest;
+    /** The raw `Request` — handed to the method via `MethodContext.request`. */
+    rawRequest: Request;
+    tenant: TenantContext;
+    cookies: ReadonlyMap<string, string>;
+};
+export type StartAuthorizeDeps = {
+    sessionStore: SessionStore;
+    tokenStore: TokenStore;
+    /** Needed for at-rest encryption of the code payload — see `domain/token.ts`. */
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    methodCache: MethodCache;
+    stateKeys: StateKeyRing;
+    /** Issuer URL — used to build the callback URL and threaded to methods. */
+    issuerUrl: string;
+    /** Tenant-partitioned callback host helper. Optional (recovery mechanism #2). */
+    callbackHostFor?: (tenantId: string) => string;
+    clock: () => number;
+    /** Override for testability. Defaults to `randomId` / `randomToken`. */
+    newFlowId?: () => string;
+    newCodeId?: () => string;
+    newNonce?: () => string;
+    /** Override TTLs. */
+    flowTtlMs?: number;
+};
+export declare function startAuthorize(input: StartAuthorizeInput, deps: StartAuthorizeDeps): Promise<Result<AuthorizeOutput, AuthError>>;
+/** Factory map type — exported for HTTP-layer consumers. */
+export type FactoryMap = Record<string, AnyAuthMethodFactory>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/types/domain/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/domain/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EACV,oBAAoB,EAGpB,SAAS,EACT,WAAW,EACZ,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIhF,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAK5C,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,QAAiB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAY,CAAA;AAEzC,MAAM,MAAM,eAAe;AACzB;;;;;;GAMG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AACH,6DAA6D;GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE;AAC7D;;;GAGG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D,CAAA;AAEL,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,oBAAoB,CAAA;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAA;IACvB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAuI7C;AA4ID,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA"}

package/dist/types/domain/callback.d.ts

@@ -0,0 +1,70 @@
+/**
+ * `handleCallback` — process the upstream provider's redirect back to the
+ * IdP. The framework:
+ *
+ *   1. Recovers `(tenantId, flowId)` from the MAC-bound `state` envelope.
+ *   2. Atomically `consumeFlow(flowId)` — single delete-on-read, returns
+ *      the full `FlowRecord`.
+ *   3. Runs the **state-flow consistency check** (tenant, nonce, host,
+ *      path). Any mismatch → `invalid_request` + corresponding audit.
+ *   4. Loads tenant config + resolves the method via `MethodCache`.
+ *   5. Dispatches the method's `GET /callback` handler.
+ *   6. On `success`, snapshots the in-memory `FlowRecord` into the
+ *      auth-code payload via `TokenStore.saveCode` and returns
+ *      `issue-code`. `methodState` is NOT snapshotted.
+ *
+ * Phase 2 implements the `mac-state` recovery only. Recovery mechanisms
+ * #2 (partitioned-host) and #3 (`flowId`-in-URI) are wired in Phase 3
+ * alongside the HTTP layer that knows the request's host / path /
+ * registered redirect URIs.
+ */
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { SessionStore } from "../ports/session-store";
+import type { TokenStore } from "../ports/token-store";
+import type { AuditLog } from "../ports/audit-log";
+import type { AuthError } from "../types/error";
+import type { SetCookie, CachePolicy } from "../types/method";
+import type { Result } from "../types/result";
+import type { StateKeyRing } from "../types/tenant";
+import { MethodCache } from "./method-cache";
+export type CallbackOutput = {
+    kind: "issue-code";
+    code: string;
+    appRedirectUri: string;
+    appState: string | null;
+} | {
+    kind: "challenge";
+    response: Response;
+    setCookies: SetCookie[];
+    cache?: CachePolicy;
+} | {
+    kind: "denied";
+    reason: string;
+    setCookies: SetCookie[];
+};
+export type HandleCallbackInput = {
+    /** The raw `Request` for the upstream provider's redirect. */
+    rawRequest: Request;
+    cookies: ReadonlyMap<string, string>;
+};
+export type HandleCallbackDeps = {
+    configStore: ConfigStore;
+    sessionStore: SessionStore;
+    tokenStore: TokenStore;
+    /** Needed for at-rest encryption of the code payload — see `domain/token.ts`. */
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    methodCache: MethodCache;
+    stateKeys: StateKeyRing;
+    clock: () => number;
+    newCodeId?: () => string;
+    /**
+     * Build the `TenantContext.request.custom` blob. Wired through from
+     * `IdPOptions.buildCustomContext` by the HTTP layer; if absent the
+     * blob is `{}`.
+     */
+    buildCustomContext?: (req: Request) => Record<string, unknown> | Promise<Record<string, unknown>>;
+};
+export declare function handleCallback(input: HandleCallbackInput, deps: HandleCallbackDeps): Promise<Result<CallbackOutput, AuthError>>;
+//# sourceMappingURL=callback.d.ts.map

package/dist/types/domain/callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../src/domain/callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C,OAAO,KAAK,EAAgB,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAM5C,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,mBAAmB,GAAG;IAChC,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAChE,CAAA;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAiG5C"}

package/dist/types/domain/client-auth.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Shared client-authentication helpers.
+ *
+ * `/token`, `/revoke`, `/introspect`, and refresh-token rotation all need
+ * to validate presented credentials against a `ClientConfig`. The logic is
+ * the same in every case:
+ *
+ *  - **Public clients** MUST NOT present a `client_secret` (RFC 6749 §2.3).
+ *  - **Confidential clients** MUST present a `client_secret`, hashed and
+ *    compared in constant time against `ClientConfig.secretHash`.
+ *
+ * Credentials may ride either in the form body (`client_id`,
+ * `client_secret`) or in an `Authorization: Basic` header
+ * (RFC 6749 §2.3.1). Both encodings are accepted; the header takes
+ * precedence when both are present.
+ *
+ * The hashing function lives in `./token.ts` (`hashClientSecret`) to keep
+ * the legacy phase-2 SHA-256 / base64url format in one place; production
+ * deployments migrate to argon2id later in the rebuild.
+ */
+import { type AuthError } from "../types/error";
+import type { ClientConfig } from "../types/tenant";
+export type ClientCredentials = {
+    /** Client identifier (always present when credentials are presented). */
+    clientId: string;
+    /** Confidential clients only. */
+    clientSecret?: string;
+};
+/**
+ * Validate presented credentials against `client`. Returns `null` on
+ * success, `AuthError` on rejection.
+ *
+ * Public clients pass when no secret is presented. Confidential clients
+ * require both a secret and a matching `secretHash`.
+ */
+export declare function verifyClientCredentials(client: ClientConfig, presentedSecret: string | undefined): Promise<AuthError | null>;
+/**
+ * Parse an `Authorization: Basic <base64>` header.
+ *
+ * Returns `null` for missing / non-Basic headers and for any decoding
+ * failure; callers fall back to form-body credentials.
+ */
+export declare function parseBasicAuth(header: string | null): ClientCredentials | null;
+/**
+ * Merge form-body credentials with an optional `Authorization: Basic`
+ * header. The header wins per RFC 6749 §2.3 when both are present.
+ *
+ * Returns `null` when neither source supplies a `client_id` — callers
+ * then decide whether that's permissible (anonymous revoke is OK; the
+ * token endpoint isn't).
+ */
+export declare function resolveClientCredentials(input: {
+    authorizationHeader: string | null;
+    bodyClientId: string | undefined;
+    bodyClientSecret: string | undefined;
+}): ClientCredentials | null;
+//# sourceMappingURL=client-auth.d.ts.map

package/dist/types/domain/client-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-auth.d.ts","sourceRoot":"","sources":["../../../src/domain/client-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAKnD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,YAAY,EACpB,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAiB3B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,iBAAiB,GAAG,IAAI,CAqB1B;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;CACrC,GAAG,iBAAiB,GAAG,IAAI,CAU3B"}

package/dist/types/domain/client-credentials.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `/token` endpoint logic for `grant_type=client_credentials` (RFC 6749 §4.4).
+ *
+ * Steps:
+ *   1. Authenticate the client. Must be confidential and must declare
+ *      `client_credentials` in `grantTypes`.
+ *   2. Resolve the tenant's m2m method. The plan models m2m as a method
+ *      with a `client` fn and no routes; we look for the unique
+ *      `type === "m2m"` instance on the tenant. Zero or multiple → error.
+ *   3. Call `method.client({ clientID, clientSecret, params })`. On
+ *      success the method returns the `P` properties it would have
+ *      emitted on a `success` MethodResult.
+ *   4. Invoke the user's `success` callback to mint the subject claim
+ *      with `methodKind = method.kind`, `methodId = method.id`.
+ *   5. `mintTokens` — access token only (no refresh per §4.4.3).
+ *
+ * The framework rejects requests presenting `scope` beyond what
+ * `ClientConfig.scopes` allows.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { PersistUpstreamTokens, SuccessMapInput } from "../types/idp";
+import type { Result } from "../types/result";
+import type { SubjectClaim } from "../types/subject";
+import type { TenantId } from "../types/tenant";
+import type { TokenResponse } from "../types/token";
+import { MethodCache } from "./method-cache";
+export type ClientCredentialsRequest = {
+    grantType: "client_credentials";
+    clientId: string;
+    clientSecret: string;
+    scope?: string;
+    /** Extra params (audience, resource, etc.). Forwarded to `method.client`. */
+    params?: Record<string, string>;
+};
+export type ClientCredentialsDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    methodCache: MethodCache;
+    success: (input: SuccessMapInput) => Promise<SubjectClaim>;
+    persistUpstreamTokens?: PersistUpstreamTokens;
+    issuerUrl: string;
+    clock: () => number;
+    newRefreshFamily?: () => string;
+    /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
+};
+export declare function clientCredentialsGrant(req: ClientCredentialsRequest, deps: ClientCredentialsDeps, tenantId: TenantId): Promise<Result<TokenResponse, AuthError>>;
+//# sourceMappingURL=client-credentials.d.ts.map

package/dist/types/domain/client-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../../src/domain/client-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAKnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE5C,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,wBAAwB,EAC7B,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmH3C"}

package/dist/types/domain/crypto.d.ts

@@ -0,0 +1,53 @@
+/** 256-bit random token, base64url-encoded. ~43 chars. */
+export declare function randomToken(): string;
+/** 128-bit random id, base64url-encoded. ~22 chars. */
+export declare function randomId(): string;
+/** Cryptographic random hex string of `bytes` length. */
+export declare function randomHex(bytes: number): string;
+/** Cryptographic random `Uint8Array` of `bytes` length. */
+export declare function randomBytes(bytes: number): Uint8Array;
+/** Base64url encode raw bytes (jose alias for downstream consistency). */
+export declare const base64url: {
+    encode: (data: Uint8Array | string) => string;
+    decode: (s: string) => Uint8Array;
+};
+/** UTF-8 helpers. */
+export declare const utf8: {
+    encode: (s: string) => Uint8Array;
+    decode: (b: Uint8Array) => string;
+};
+/**
+ * Constant-time byte-array compare. Returns false fast on length mismatch
+ * (length itself is not secret), then XORs every byte to avoid early exit.
+ */
+export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+/** Constant-time string compare (UTF-8 bytes). */
+export declare function timingSafeEqualStr(a: string, b: string): boolean;
+/** SHA-256 digest. */
+export declare function sha256(data: Uint8Array | string): Promise<Uint8Array>;
+/** Import a 32-byte HMAC-SHA-256 key for sign/verify use. */
+export declare function importHmacKey(raw: Uint8Array, usage?: ReadonlyArray<"sign" | "verify">): Promise<CryptoKey>;
+/** HMAC-SHA-256 sign. */
+export declare function hmacSign(key: CryptoKey, message: Uint8Array): Promise<Uint8Array>;
+/**
+ * HMAC-SHA-256 verify. `crypto.subtle.verify` is timing-safe by spec, which
+ * is why we use it instead of recomputing + comparing manually.
+ */
+export declare function hmacVerify(key: CryptoKey, signature: Uint8Array, message: Uint8Array): Promise<boolean>;
+/**
+ * Encrypt a JSON-serializable payload with AES-256-GCM under the supplied
+ * 256-bit key. Output is a compact JWE string (`{header}.{enc-key}.{iv}.{ct}.{tag}`).
+ *
+ * Used for `TokenStore.saveCode` — the auth-code payload is encrypted at
+ * rest. The compact-JWE format embeds the `kid` so `consumeCode` can pick
+ * the right key during overlap rotation.
+ *
+ * For symmetric direct encryption we use `dir` with `A256GCM`, so the
+ * supplied `keyBytes` is the content-encryption key itself.
+ */
+export declare function encryptPayload(payload: unknown, kid: string, keyBytes: Uint8Array): Promise<string>;
+/** Inverse of {@link encryptPayload}. Returns the parsed JSON payload. */
+export declare function decryptPayload<T = unknown>(jwe: string, resolveKey: (kid: string) => Promise<Uint8Array>): Promise<T>;
+/** Generate a fresh 32-byte AES-256 / HMAC-SHA-256 key. */
+export declare function generateSymmetricKey(): Uint8Array;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/types/domain/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/domain/crypto.ts"],"names":[],"mappings":"AAQA,0DAA0D;AAC1D,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED,uDAAuD;AACvD,wBAAgB,QAAQ,IAAI,MAAM,CAIjC;AAED,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAIrD;AAED,0EAA0E;AAC1E,eAAO,MAAM,SAAS;mBACL,UAAU,GAAG,MAAM,KAAG,MAAM;gBAC/B,MAAM,KAAG,UAAU;CAChC,CAAA;AAED,qBAAqB;AACrB,eAAO,MAAM,IAAI;gBACH,MAAM,KAAG,UAAU;gBACnB,UAAU,KAAG,MAAM;CAChC,CAAA;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAKrE;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,sBAAsB;AACtB,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAI3E;AAED,6DAA6D;AAC7D,wBAAsB,aAAa,CACjC,GAAG,EAAE,UAAU,EACf,KAAK,GAAE,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAsB,GAC3D,OAAO,CAAC,SAAS,CAAC,CAQpB;AAED,yBAAyB;AACzB,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,0EAA0E;AAC1E,wBAAsB,cAAc,CAAC,CAAC,GAAG,OAAO,EAC9C,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,GAC/C,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED,2DAA2D;AAC3D,wBAAgB,oBAAoB,IAAI,UAAU,CAIjD"}