@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/types/domain/discovery.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Metadata-document builders for `/.well-known/openid-configuration` and
+ * `/.well-known/jwks.json`.
+ *
+ * Pure functions over typed ports + a small options record.
+ */
+import type { KeyStore } from "../ports/key-store";
+import type { AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import { buildJwksDocument } from "./jwt";
+export type DiscoveryDocument = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    jwks_uri: string;
+    revocation_endpoint: string;
+    introspection_endpoint: string;
+    /** OIDC RP-Initiated Logout 1.0 §2. */
+    end_session_endpoint: string;
+    /** RFC 7591 §3.1. */
+    registration_endpoint: string;
+    /** RFC 9126 §5. */
+    pushed_authorization_request_endpoint: string;
+    /**
+     * RFC 9126 §5. True iff every client on this tenant is required to use
+     * PAR. We advertise `false` at the tenant level — the per-client toggle
+     * is read at request time.
+     */
+    require_pushed_authorization_requests: boolean;
+    /** RFC 9449 §5.1 — DPoP algorithms accepted on proof JWTs. */
+    dpop_signing_alg_values_supported: string[];
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+    scopes_supported: string[];
+    /** OIDC Core §3 — registered claim names the IdP can return. */
+    claims_supported: string[];
+    /** OIDC Core §5.5 — `claims` request parameter is honored. */
+    claims_parameter_supported: boolean;
+    /** OIDC Core §6.1 — JAR (`request` parameter). Not implemented. */
+    request_parameter_supported: boolean;
+    /** OIDC Core §6.2 — JAR (`request_uri` parameter). Not implemented. */
+    request_uri_parameter_supported: boolean;
+    /** OIDC Core §6.2 — whether `request_uri` values must be pre-registered. */
+    require_request_uri_registration: boolean;
+    /** OIDC Core §3.1.2.1 — UI locales the OP can render. */
+    ui_locales_supported?: string[];
+    token_endpoint_auth_methods_supported: string[];
+    code_challenge_methods_supported: string[];
+};
+export type DiscoveryDeps = {
+    issuerUrl: string;
+    /** Override path defaults if mounted under a non-root prefix. */
+    paths?: Partial<{
+        authorize: string;
+        token: string;
+        userinfo: string;
+        jwks: string;
+        revoke: string;
+        introspect: string;
+        endSession: string;
+        par: string;
+        register: string;
+    }>;
+    /** Advertised scopes. Defaults to `["openid", "email", "profile"]`. */
+    scopes?: string[];
+    /** Advertised UI locales. Defaults to `["en"]`. */
+    uiLocales?: string[];
+    /**
+     * Host-supplied scope → claim-names map. Each key adds a scope to
+     * `scopes_supported`; the union of values augments `claims_supported`.
+     * Mirrors `IdPOptions.customScopeClaims`.
+     */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
+};
+export declare function buildDiscoveryDocument(deps: DiscoveryDeps): DiscoveryDocument;
+export type JwksDoc = ReturnType<typeof buildJwksDocument>;
+export declare function buildJwks(keyStore: KeyStore): Promise<Result<JwksDoc, AuthError>>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/types/domain/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/domain/discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAA;AAEzC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,iBAAiB,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,sBAAsB,EAAE,MAAM,CAAA;IAC9B,uCAAuC;IACvC,oBAAoB,EAAE,MAAM,CAAA;IAC5B,qBAAqB;IACrB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,mBAAmB;IACnB,qCAAqC,EAAE,MAAM,CAAA;IAC7C;;;;OAIG;IACH,qCAAqC,EAAE,OAAO,CAAA;IAC9C,8DAA8D;IAC9D,iCAAiC,EAAE,MAAM,EAAE,CAAA;IAC3C,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClC,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,uBAAuB,EAAE,MAAM,EAAE,CAAA;IACjC,qCAAqC,EAAE,MAAM,EAAE,CAAA;IAC/C,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,8DAA8D;IAC9D,0BAA0B,EAAE,OAAO,CAAA;IACnC,mEAAmE;IACnE,2BAA2B,EAAE,OAAO,CAAA;IACpC,uEAAuE;IACvE,+BAA+B,EAAE,OAAO,CAAA;IACxC,4EAA4E;IAC5E,gCAAgC,EAAE,OAAO,CAAA;IACzC,yDAAyD;IACzD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,qCAAqC,EAAE,MAAM,EAAE,CAAA;IAC/C,gCAAgC,EAAE,MAAM,EAAE,CAAA;CAC3C,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,CAAC;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,MAAM,CAAA;QAClB,UAAU,EAAE,MAAM,CAAA;QAClB,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAC,CAAA;IACF,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CAoE7E;AAED,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE1D,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAIrC"}

package/dist/types/domain/dpop.d.ts

@@ -0,0 +1,61 @@
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+/** RFC 9449 §4.2 — fixed 60-second tolerance is the conventional default. */
+export declare const DEFAULT_DPOP_IAT_TOLERANCE_SEC = 60;
+/** Replay-window TTL for `jti` tracking. Matches `iat` tolerance × 2. */
+export declare const DEFAULT_DPOP_JTI_TTL_MS: number;
+export type DpopProofPayload = {
+    htu: string;
+    htm: string;
+    iat: number;
+    jti: string;
+    ath?: string;
+    nonce?: string;
+};
+export type VerifiedDpopProof = {
+    /** RFC 7638 JWK thumbprint of the proof's public key. */
+    jkt: string;
+    /** The decoded + signature-verified proof payload. */
+    payload: DpopProofPayload;
+};
+export type VerifyDpopProofInput = {
+    proofJwt: string;
+    /** Actual request URI (scheme + host + port + path; query/frag stripped). */
+    htu: string;
+    /** Actual HTTP method, uppercase. */
+    htm: string;
+    /** Wall clock seconds. */
+    nowSec: number;
+    /** Optional skew allowance. */
+    iatToleranceSec?: number;
+    /**
+     * Required at resource servers when the proof must bind to a presented
+     * access token. The verifier checks the proof's `ath` equals
+     * base64url(SHA-256(access_token ASCII)). Omit at the AS `/token`
+     * endpoint — no access token exists yet there.
+     */
+    expectedAth?: string;
+};
+export type VerifyDpopProofDeps = {
+    tokenStore: TokenStore;
+    jtiTtlMs?: number;
+};
+/**
+ * Verify a DPoP proof JWT and return its `jkt` + payload. Side-effect:
+ * records the `jti` in `TokenStore` so a replay within the TTL window
+ * is rejected.
+ */
+export declare function verifyDpopProof(input: VerifyDpopProofInput, deps: VerifyDpopProofDeps): Promise<Result<VerifiedDpopProof, AuthError>>;
+/**
+ * Canonicalize a request URL for `htu` comparison (RFC 9449 §4.3).
+ * Strips query string and fragment; preserves scheme, host, port, path.
+ * Default port for the scheme is removed.
+ */
+export declare function canonicalHtu(rawUrl: string): string;
+/**
+ * Compute the `ath` value (RFC 9449 §4.2): base64url(SHA-256(access_token ASCII)).
+ * Resource servers compare the presented DPoP proof's `ath` to this.
+ */
+export declare function computeAth(accessToken: string): Promise<string>;
+//# sourceMappingURL=dpop.d.ts.map

package/dist/types/domain/dpop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../../src/domain/dpop.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAQ7C,6EAA6E;AAC7E,eAAO,MAAM,8BAA8B,KAAK,CAAA;AAEhD,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,QAA4C,CAAA;AAEhF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAA;IACX,sDAAsD;IACtD,OAAO,EAAE,gBAAgB,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAA;IACX,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAA;IACX,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,+BAA+B;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAwK/C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMnD;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE"}

package/dist/types/domain/id-token.d.ts

@@ -0,0 +1,83 @@
+import type { ClaimsRequest } from "../types/authorization";
+import type { IdTokenClaims, ScopedProfileClaims } from "../types/token";
+import type { SubjectClaim } from "../types/subject";
+/**
+ * Derive `amr` from the originating `methodKind`. Values are RFC 8176
+ * registered AMR codes. Returns `undefined` when no clean mapping exists
+ * — `amr` is an OPTIONAL id_token claim, so omission is spec-compliant.
+ */
+export declare function deriveAmr(methodKind: string): string[] | undefined;
+/**
+ * `at_hash` per OIDC Core §3.1.3.6: left-half of SHA-256(access_token
+ * ASCII), base64url. Always 16 bytes → 22 base64url characters for
+ * SHA-256 (256-bit → 128-bit half → 16 bytes → 22 chars).
+ */
+export declare function computeAtHash(accessToken: string): Promise<string>;
+/**
+ * Filter a `SubjectClaim.properties` record down to claims granted by the
+ * requested OIDC scopes, then optionally augment with claim names the RP
+ * specifically requested via the OIDC Core §5.5 `claims` parameter.
+ * Returns a typed `ScopedProfileClaims` ready to spread into the id_token
+ * or `/userinfo` response. Properties not named by any granted scope or
+ * explicit claim request are dropped.
+ *
+ * `extra` is the set of claim names the RP requested via `claims`
+ * parameter for THIS surface (id_token vs userinfo). Listing a name in
+ * `extra` bypasses scope gating per §5.5 ("works without the requestor
+ * having to include the scope value").
+ *
+ * `customMappings` is a host-supplied scope → claim-names map merged on
+ * top of the OIDC Core §5.4 table. Lets the host expose vendor-specific
+ * identity fields (e.g. `tenant_id`, `org_role`) via a custom scope
+ * (`scope=foo` granting `[tenant_id, …]`). Reserved §5.4 names cannot be
+ * shadowed — the standard mapping always wins on collision so an
+ * `email` scope can't accidentally start meaning something else.
+ *
+ * Host-supplied values are trusted to match their declared OIDC types
+ * — schemas live on `IdPOptions.subjects`, not here. The narrowing cast
+ * is the boundary between "host's responsibility" and "framework's
+ * responsibility."
+ */
+export declare function pickScopedClaims(claim: SubjectClaim, scopes: ReadonlyArray<string>, extra?: ReadonlyArray<string>, customMappings?: Record<string, ReadonlyArray<string>>): ScopedProfileClaims;
+export type BuildIdTokenInput = {
+    issuerUrl: string;
+    /** RP `client_id` — the id_token's `aud`. */
+    audience: string;
+    /** Stable subject identifier (same value as the access token's `sub`). */
+    subjectId: string;
+    claim: SubjectClaim;
+    scopes: ReadonlyArray<string>;
+    /** Seconds-since-epoch the user authenticated. */
+    authTime: number;
+    /** RP-supplied OIDC nonce, when present. */
+    appNonce?: string;
+    /** Wall clock (ms). */
+    now: number;
+    /** id_token TTL (ms). Default 5 minutes. */
+    ttlMs?: number;
+    /** Method kind for `amr` derivation. */
+    methodKind: string;
+    /** Pre-signed access token whose `at_hash` is bound into the id_token. */
+    accessToken: string;
+    /** OIDC Core §5.5 — RP-requested claims (this drives only id_token here). */
+    claimsRequest?: ClaimsRequest;
+    /**
+     * Host-supplied vendor scope → claim-names map. Merged on top of OIDC
+     * Core §5.4 at scope-gating time. See `pickScopedClaims`.
+     */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
+};
+export declare const DEFAULT_ID_TOKEN_TTL_MS: number;
+/**
+ * Assemble an `IdTokenClaims` object. Pure — no crypto except `at_hash`.
+ * Caller signs the result via `signIdToken`.
+ *
+ * Composition is via spread so the type stays narrow: the base claim set
+ * (REQUIRED OIDC §2 + auth_time + at_hash + optional nonce/amr) is built
+ * first; the scope-gated §5.1 profile claims merge over the top via
+ * `...pickScopedClaims(...)`. No dynamic index assignment, no cast.
+ */
+export declare function buildIdTokenClaims(input: BuildIdTokenInput): Promise<IdTokenClaims>;
+/** Predicate: does this token request warrant an `id_token` being issued? */
+export declare function shouldIssueIdToken(scopes: ReadonlyArray<string>): boolean;
+//# sourceMappingURL=id-token.d.ts.map

package/dist/types/domain/id-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-token.d.ts","sourceRoot":"","sources":["../../../src/domain/id-token.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AA6BpD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAiBlE;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAC7B,KAAK,GAAE,aAAa,CAAC,MAAM,CAAM,EACjC,cAAc,GAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAM,GACzD,mBAAmB,CAqBrB;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC7B,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAA;IACnB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAgB,CAAA;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,aAAa,CAAC,CAqBxB;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAEzE"}

package/dist/types/domain/introspect.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `/introspect` endpoint logic (RFC 7662).
+ *
+ * RFC 7662 §2.1 REQUIRES authentication: "To prevent token scanning
+ * attacks, the endpoint MUST also require some form of authorization to
+ * access this endpoint." Confidential-client credentials are validated
+ * against the **presenter's** tenant — resolved by the HTTP layer from
+ * the request, exactly the same way `/token client_credentials` resolves
+ * tenant. Authenticating before touching the token's `tid` means:
+ *
+ *   - Unknown presenting client OR wrong secret → `invalid_client`
+ *     (uniform — the response says nothing about the token).
+ *   - Token belongs to a different tenant than the presenter, or names a
+ *     different client as audience, or fails verification → `{active: false}`.
+ *
+ * Pre-fix the order was "verify token → load token's tenant → look up
+ * presenter in *that* tenant", which let a client authenticated in
+ * tenant X probe whether its `client_id` existed in tenant Y by
+ * watching for `invalid_client` versus `{active: false}` responses.
+ *
+ * Audience check (RFC 7662 §2.2): an authenticated client may only
+ * inspect tokens that name it as the audience. Tokens belonging to a
+ * different client return `{ active: false }` — never a structured
+ * error — to avoid leaking which tokens exist.
+ *
+ * Refresh tokens are not introspectable here; RFC 7662 §2.1 only
+ * requires access-token introspection, and our refresh tokens are
+ * opaque and don't carry the standard introspection metadata.
+ */
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { TenantId } from "../types/tenant";
+export type IntrospectResponse = {
+    active: false;
+} | {
+    active: true;
+    sub: string;
+    aud: string;
+    iss: string;
+    exp: number;
+    iat: number;
+    scope?: string;
+    client_id?: string;
+    /** RFC 7662 §2.2 — the token's type indicator. */
+    token_type: "Bearer" | "DPoP";
+    tid: string;
+    mid?: string;
+    mkind?: string;
+    /** Library-specific — subject schema discriminator (e.g. "user", "admin"). */
+    subject_type?: string;
+    /** RFC 9449 §6 — present when the access token is DPoP-bound. */
+    cnf?: {
+        jkt: string;
+    };
+};
+export type IntrospectRequest = {
+    token: string;
+    tokenTypeHint?: "access_token" | "refresh_token";
+    /** REQUIRED — RFC 7662 §2.1. */
+    clientId: string;
+    clientSecret?: string;
+    /**
+     * The tenant the presenting client belongs to. Resolved by the HTTP
+     * layer via `IdPOptions.resolveTenant`, just like for the m2m grant.
+     * Cross-tenant introspection collapses to `{active: false}` regardless
+     * of whether the presenter's client exists in the token's tenant.
+     */
+    presenterTenantId: TenantId;
+};
+export type IntrospectDeps = {
+    keyStore: KeyStore;
+    configStore: ConfigStore;
+    /** Expected issuer for additional validation. */
+    issuerUrl?: string;
+};
+export declare function introspect(req: IntrospectRequest, deps: IntrospectDeps): Promise<Result<IntrospectResponse, AuthError>>;
+//# sourceMappingURL=introspect.d.ts.map

package/dist/types/domain/introspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect.d.ts","sourceRoot":"","sources":["../../../src/domain/introspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAK/C,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,KAAK,CAAA;CAAE,GACjB;IACE,MAAM,EAAE,IAAI,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kDAAkD;IAClD,UAAU,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iEAAiE;IACjE,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CACtB,CAAA;AAEL,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAA;IAChD,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,iBAAiB,EAAE,QAAQ,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,EAAE,WAAW,CAAA;IACxB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAkEhD"}

package/dist/types/domain/jwt.d.ts

@@ -0,0 +1,74 @@
+/**
+ * JWT signing + verification for access tokens, plus the JWKS document
+ * builder consumed by `/.well-known/jwks.json`.
+ *
+ * Per AD9 / AD11, access tokens are JWTs (ES256 default; Ed25519 supported).
+ * Refresh tokens are opaque server-side records — they do NOT pass through
+ * this module.
+ */
+import type { JWK, KeyLike } from "jose";
+import type { AccessTokenClaims, IdTokenClaims } from "../types/token";
+import type { SigningKey } from "../ports/key-store";
+/**
+ * Sign an access-token claim set under the supplied private key. `kid` is
+ * stamped into the JWT header so verifiers can look up the right public
+ * key from JWKS.
+ */
+export declare function signAccessToken(claims: AccessTokenClaims, privateKey: KeyLike, alg: string, kid: string): Promise<string>;
+/**
+ * Sign an OIDC `id_token` claim set (OIDC Core §2). Header `typ` is
+ * `"JWT"` per common practice; OIDC Core does not mandate `"id_token"`.
+ * The claims object is verified by the caller to include `iss`, `sub`,
+ * `aud`, `exp`, `iat` (REQUIRED per §2).
+ */
+export declare function signIdToken(claims: IdTokenClaims, privateKey: KeyLike, alg: string, kid: string): Promise<string>;
+/**
+ * Verify an OIDC `id_token` against the IdP's published signing keys.
+ * Used at `/end_session` to validate `id_token_hint` and by adjacent
+ * domain code that needs to introspect a previously-issued id_token.
+ *
+ * Same algorithm-confusion defenses as `verifyAccessToken`: only the
+ * asymmetric allow-list (`ES256`, `EdDSA`) accepted; `alg: "none"`
+ * rejected explicitly.
+ *
+ * `acceptExpired` relaxes the `exp` check — required at `/end_session`
+ * per OIDC RP-Initiated Logout 1.0 §2, where logout often follows token
+ * expiry and the spec permits accepting an expired hint. The signature
+ * + issuer + audience checks remain strict.
+ */
+export declare function verifyIdToken(token: string, keys: ReadonlyArray<SigningKey>, options?: {
+    issuer?: string;
+    audience?: string;
+    acceptExpired?: boolean;
+}): Promise<IdTokenClaims>;
+/**
+ * Verify a JWT access token using a list of trusted signing keys (from
+ * `KeyStore.signingKeys()`). Looks up by `kid` in the JWT header.
+ *
+ * Algorithm enforcement: the allow-list is derived from the loaded
+ * `SigningKey.alg` values, intersected with the asymmetric allow-list
+ * (`ES256`, `EdDSA`). Symmetric (`HS*`) and `none` are filtered out, so a
+ * symmetric key accidentally landing in the store does not open an
+ * alg-confusion path. The kid resolver also rejects `alg: "none"`
+ * explicitly as defense in depth — `jose` already refuses tokens whose
+ * header `alg` is outside `algorithms`, but a future call site that
+ * dropped the option would still be safe.
+ *
+ * Returns the typed claims on success. Throws (via `jose`) on any
+ * signature, expiry, or alg-mismatch failure — callers wrap in `try` and
+ * convert to `Result`.
+ */
+export declare function verifyAccessToken(token: string, keys: ReadonlyArray<SigningKey>, options?: {
+    issuer?: string;
+    audience?: string;
+}): Promise<AccessTokenClaims>;
+/**
+ * Build the JWKS document for `/.well-known/jwks.json`. Includes active +
+ * recently-rotated keys (the overlap window) so consumers caching JWKS
+ * continue to verify tokens signed under a just-retired key until they
+ * refresh.
+ */
+export declare function buildJwksDocument(keys: ReadonlyArray<SigningKey>): {
+    keys: JWK[];
+};
+//# sourceMappingURL=jwt.d.ts.map

package/dist/types/domain/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/domain/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAGxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,OAAO,EACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,OAAO,EACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,EAC/B,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,OAAO,CAAA;CACnB,GACL,OAAO,CAAC,aAAa,CAAC,CAsCxB;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,EAC/B,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACnD,OAAO,CAAC,iBAAiB,CAAC,CAgC5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG;IAClE,IAAI,EAAE,GAAG,EAAE,CAAA;CACZ,CASA"}

package/dist/types/domain/logout.d.ts

@@ -0,0 +1,69 @@
+/**
+ * `/end_session` endpoint logic — OIDC RP-Initiated Logout 1.0.
+ *
+ * The OP validates the optional `id_token_hint`, validates the optional
+ * `post_logout_redirect_uri` against the client's registered list,
+ * revokes the subject's refresh tokens (when a subject is identified),
+ * and either redirects the user-agent back to the RP with `state` echoed
+ * or returns a generic "logged out" acknowledgement.
+ *
+ * Per §2:
+ *  - `id_token_hint` (RECOMMENDED): a previously-issued id_token. The
+ *    OP MUST verify the signature; expiry MAY be tolerated because
+ *    logout commonly follows token expiry. We accept expired hints but
+ *    enforce signature + issuer.
+ *  - `client_id` (OPTIONAL): when both this and `id_token_hint` are
+ *    present, the OP MUST verify the client_id matches the hint's `aud`.
+ *  - `post_logout_redirect_uri` (OPTIONAL): MUST be exact-match against
+ *    the resolved client's `postLogoutRedirectUris`. If the URI is not
+ *    registered, the OP MUST NOT redirect — surface a non-redirecting
+ *    error instead, otherwise the endpoint becomes an open redirector.
+ *  - `state` (OPTIONAL): echoed back in the redirect.
+ *
+ * Front-channel / back-channel logout (RP notification of OP-initiated
+ * logout) is out of scope for this minimal endpoint. Hosts that need it
+ * can layer their own notification fan-out on top of `session_logout`
+ * audit events.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { TenantContext } from "../types/tenant";
+export type EndSessionRequest = {
+    idTokenHint?: string;
+    clientId?: string;
+    postLogoutRedirectUri?: string;
+    state?: string;
+};
+export type EndSessionDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    issuerUrl: string;
+    clock: () => number;
+};
+export type EndSessionOutput = 
+/** Redirect the user-agent back to the RP. */
+{
+    kind: "redirect";
+    url: string;
+}
+/**
+ * No `post_logout_redirect_uri` was supplied (or it wasn't registered).
+ * Caller should render a minimal "logged out" page or return 200.
+ */
+ | {
+    kind: "ok";
+    subjectId?: string;
+};
+/**
+ * Process an `/end_session` request and return an outcome the HTTP
+ * adapter can translate into a `Response`. Pure domain — no Hono types,
+ * no `Response` construction here.
+ */
+export declare function endSession(req: EndSessionRequest, tenant: TenantContext, deps: EndSessionDeps): Promise<Result<EndSessionOutput, AuthError>>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/types/domain/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/domain/logout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAMlE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,gBAAgB;AAC1B,8CAA8C;AAC5C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnC;;;GAGG;GACD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAyG9C"}

package/dist/types/domain/method-cache.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `MethodCache` — loads `AuthMethodFactory` builds per
+ * `(tenantId, MethodConfig.id)` and caches the result.
+ *
+ * Responsibilities per plan §"Per-tenant config → typed method config":
+ *  1. Look up the factory by `MethodConfig.kind`. Unknown kind → audit
+ *     `unknown_method_kind`, treat instance as disabled.
+ *  2. Validate `MethodConfig.config` against `factory.configSchema`.
+ *     Failure → audit `invalid_method_config`, treat instance as disabled.
+ *  3. Call `factory.build({ id, kind, tenantId, config })`. Verify the
+ *     returned `AuthMethod` has `id` / `kind` matching the inputs. Mismatch
+ *     → audit `factory_id_mismatch`, fail the load.
+ *  4. Cache per `(tenantId, MethodConfig.id)`. The cache is in-process —
+ *     TTL is governed by the `ConfigStore` invalidation hook in Phase 3+;
+ *     in Phase 2 / tests, manual `invalidate(tenantId)` is sufficient.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import { type AuthError } from "../types/error";
+import type { AnyAuthMethodFactory, AuthMethod } from "../types/method";
+import type { Result } from "../types/result";
+import type { TenantConfig, TenantId } from "../types/tenant";
+export type MethodCacheOptions = {
+    factories: Record<string, AnyAuthMethodFactory>;
+    auditLog?: AuditLog;
+    /** Injectable clock for audit timestamps. */
+    now: () => number;
+};
+export declare class MethodCache {
+    #private;
+    constructor(opts: MethodCacheOptions);
+    /**
+     * Load (or fetch from cache) the `AuthMethod` for the given tenant +
+     * tenant-local method instance id. Returns `method_not_found` for any
+     * disabled / unknown / invalid-config path.
+     */
+    resolve(tenant: TenantConfig, methodId: string): Promise<Result<AuthMethod, AuthError>>;
+    /** Drop cached instances for a tenant. Called on config invalidation. */
+    invalidate(tenantId: TenantId, methodId?: string): void;
+    /** List all enabled methods for a tenant — used by method-selection UI. */
+    listAvailable(tenant: TenantConfig): Promise<AuthMethod[]>;
+}
+//# sourceMappingURL=method-cache.d.ts.map

package/dist/types/domain/method-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-cache.d.ts","sourceRoot":"","sources":["../../../src/domain/method-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAgB,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE3E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC/C,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,MAAM,CAAA;CAClB,CAAA;AAED,qBAAa,WAAW;;gBAQV,IAAI,EAAE,kBAAkB;IAMpC;;;;OAIG;IACG,OAAO,CACX,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAsCzC,yEAAyE;IACzE,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAevD,2EAA2E;IACrE,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CAgHjE"}

package/dist/types/domain/method-dispatch.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Method dispatch — invoke a method's route handler, then enforce the
+ * `saveMethodState` durability contract.
+ *
+ * Per `ARCHITECTURE.md`: when a method handler returns
+ * `{ kind: "challenge", saveMethodState }`, the framework MUST persist
+ * `methodState` via `SessionStore.updateFlowMethodState` **before**
+ * surfacing the response. Centralizing that here keeps the
+ * happens-before contract uniform across every call site.
+ */
+import type { SessionStore } from "../ports/session-store";
+import { type AuthError } from "../types/error";
+import type { FlowRecord } from "../types/flow";
+import type { AuthMethod, MethodDispatchData, MethodResult } from "../types/method";
+import type { Result } from "../types/result";
+import type { TenantContext } from "../types/tenant";
+export type RouteKey = `${"GET" | "POST"} ${string}`;
+export type DispatchInput = {
+    method: AuthMethod;
+    route: RouteKey;
+    tenant: TenantContext;
+    request: Request;
+    subPath: string;
+    flow: FlowRecord | null;
+    cookies: ReadonlyMap<string, string>;
+    sessionStore: SessionStore;
+    /** Populated at `GET /authorize`; null on callbacks. */
+    dispatch: MethodDispatchData | null;
+};
+/**
+ * Invoke the named route on the method. If the result is a challenge with
+ * `saveMethodState`, persist it to `SessionStore` and only then return.
+ * The framework owns this happens-before guarantee so methods cannot
+ * accidentally surface a redirect before the upstream verifier is durable.
+ */
+export declare function dispatchMethod(input: DispatchInput): Promise<Result<MethodResult<unknown, unknown>, AuthError>>;
+//# sourceMappingURL=method-dispatch.d.ts.map

package/dist/types/domain/method-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-dispatch.d.ts","sourceRoot":"","sources":["../../../src/domain/method-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EAClB,YAAY,EACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAEpD,MAAM,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,MAAM,IAAI,MAAM,EAAE,CAAA;AAEpD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAgD5D"}

package/dist/types/domain/method-route.d.ts

@@ -0,0 +1,77 @@
+/**
+ * `handleMethodRoute` — the third pipeline.
+ *
+ * `/authorize` and `/cb/:methodId` are the two pipelines that produce a
+ * flow record and consume it respectively. Credential-style methods
+ * (password, code, passkey) additionally need a way to make in-flight
+ * POSTs against the IdP — submitting a login form, asking for a one-time
+ * code, completing a WebAuthn ceremony. The HTTP layer mounts these at
+ * `/m/<methodId>/<subPath>` and delegates here.
+ *
+ * Responsibilities:
+ *   1. Read `flowId` from the framework-set HttpOnly `idp.flow` cookie.
+ *      No cookie → `invalid_request` (the user lost their flow).
+ *   2. `SessionStore.readFlow(flowId)` — peek, do not consume. Methods may
+ *      need multiple round trips before completing (e.g. send-code →
+ *      verify-code).
+ *   3. Tenant must match the cookie's flow. If the request's tenant
+ *      (resolved via `resolveTenant`) disagrees with the flow's tenant,
+ *      audit `flow_tenant_mismatch` and reject. This is the same invariant
+ *      the upstream-callback path enforces.
+ *   4. Dispatch the method's `<METHOD> <subPath>` route.
+ *   5. Translate `MethodResult`:
+ *      - `challenge` → return response (methodState merged before send).
+ *      - `success`   → `consumeFlow`, snapshot into auth code, return
+ *                      `issue-code` for the HTTP layer to redirect.
+ *      - `denied`    → return reason; HTTP layer renders.
+ *      - `error`     → propagated.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { KeyStore } from "../ports/key-store";
+import type { SessionStore } from "../ports/session-store";
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { CachePolicy, SetCookie } from "../types/method";
+import type { Result } from "../types/result";
+import type { TenantContext } from "../types/tenant";
+import { MethodCache } from "./method-cache";
+export type MethodRouteOutput = {
+    kind: "issue-code";
+    code: string;
+    appRedirectUri: string;
+    appState: string | null;
+} | {
+    kind: "challenge";
+    response: Response;
+    setCookies: SetCookie[];
+    cache?: CachePolicy;
+} | {
+    kind: "denied";
+    reason: string;
+    setCookies: SetCookie[];
+};
+export type HandleMethodRouteInput = {
+    rawRequest: Request;
+    tenant: TenantContext;
+    /** Tenant-local instance id (`MethodConfig.id`) parsed from the URL. */
+    methodId: string;
+    /** Path within the method's mount, e.g. `"/login"`. */
+    subPath: string;
+    /** HTTP method of the incoming request: `"GET"` or `"POST"`. */
+    httpMethod: "GET" | "POST";
+    /** flowId from the `idp.flow` cookie. */
+    flowId: string;
+    cookies: ReadonlyMap<string, string>;
+};
+export type HandleMethodRouteDeps = {
+    sessionStore: SessionStore;
+    tokenStore: TokenStore;
+    /** Needed for at-rest encryption of the code payload — see `domain/token.ts`. */
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    methodCache: MethodCache;
+    clock: () => number;
+    newCodeId?: () => string;
+};
+export declare function handleMethodRoute(input: HandleMethodRouteInput, deps: HandleMethodRouteDeps): Promise<Result<MethodRouteOutput, AuthError>>;
+//# sourceMappingURL=method-route.d.ts.map