@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/types/domain/method-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../src/domain/method-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1D,OAAO,KAAK,EAAgB,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAI5C,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB,GACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,EAAE,CAAA;CAAE,CAAA;AAE/D,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,aAAa,CAAA;IACrB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,KAAK,GAAG,MAAM,CAAA;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,YAAY,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,iFAAiF;IACjF,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAA;CACzB,CAAA;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAgD/C"}

package/dist/types/domain/par.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Pushed Authorization Requests (RFC 9126).
+ *
+ * The RP submits the full `/authorize` parameter set to `POST /par` along
+ * with its client credentials. The OP authenticates the client, stores
+ * the payload under an opaque `request_uri`, and returns it with an
+ * `expires_in`. The RP then redirects the user-agent to
+ * `GET /authorize?client_id=...&request_uri=...` and the OP rehydrates
+ * the original parameter set.
+ *
+ * Per RFC 9126 §3:
+ *  - Response is HTTP 201 with `application/json` body
+ *    `{request_uri, expires_in}`.
+ *  - `request_uri` MUST be of the form
+ *    `urn:ietf:params:oauth:request_uri:<opaque>` (§2.2).
+ *  - Default TTL is 60 seconds — same as auth-code TTL.
+ *
+ * Per RFC 9126 §4:
+ *  - At `/authorize`, `request_uri` is one-shot — consumed and discarded
+ *    on first use.
+ *  - Parameters in the PAR record take precedence; additional `/authorize`
+ *    parameters MAY be merged but MUST NOT contradict (we strictly use
+ *    the PAR'd set and ignore any additional ones except `client_id`).
+ *
+ * Client authentication (§2):
+ *  - Public clients: `client_id` only.
+ *  - Confidential clients: `client_id` + `client_secret` (Basic or form).
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { SessionStore } from "../ports/session-store";
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { TenantContext } from "../types/tenant";
+export declare const PAR_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+export declare const DEFAULT_PAR_TTL_MS: number;
+export type ParRequest = {
+    clientId: string;
+    /** Confidential-client secret. */
+    clientSecret?: string;
+    /** Raw `/authorize` parameter record, posted by the RP. */
+    params: Record<string, string>;
+};
+export type ParResponse = {
+    request_uri: string;
+    expires_in: number;
+};
+export type ParDeps = {
+    configStore: ConfigStore;
+    sessionStore: SessionStore;
+    auditLog?: AuditLog;
+    clock: () => number;
+    /** Test override. */
+    newRequestUriSuffix?: () => string;
+    ttlMs?: number;
+};
+/**
+ * Process a `POST /par` request. Authenticates the client, validates the
+ * `client_id` consistency, and persists the parameter set.
+ */
+export declare function pushAuthorizationRequest(req: ParRequest, tenant: TenantContext, deps: ParDeps): Promise<Result<ParResponse, AuthError>>;
+//# sourceMappingURL=par.d.ts.map

package/dist/types/domain/par.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"par.d.ts","sourceRoot":"","sources":["../../../src/domain/par.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,eAAO,MAAM,cAAc,uCAAuC,CAAA;AAClE,eAAO,MAAM,kBAAkB,QAAY,CAAA;AAE3C,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,qBAAqB;IACrB,mBAAmB,CAAC,EAAE,MAAM,MAAM,CAAA;IAClC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAmEzC"}

package/dist/types/domain/pkce.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Compute the S256 challenge for a verifier. Used at `/token` to recompute
+ * the expected challenge from the supplied `code_verifier` and compare it
+ * (timing-safe) against the challenge stashed in the auth-code payload.
+ */
+export declare function s256Challenge(verifier: string): Promise<string>;
+/**
+ * Verify a `code_verifier` against a previously-stored `code_challenge`.
+ *
+ * - Returns `false` on any length / character anomaly without computing the
+ *   hash — these are public-shape checks, not secret-dependent.
+ * - Uses a constant-time compare for the recomputed challenge.
+ */
+export declare function validatePkce(verifier: string, challenge: string): Promise<boolean>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/types/domain/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/domain/pkce.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/types/domain/refresh.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `/token` endpoint logic for `grant_type=refresh_token`.
+ *
+ * Rotation semantics (plan §"Cross-cutting Decisions" + §"Port consistency
+ * contracts"):
+ *
+ *  - Refresh tokens rotate on every use. The presented token is consumed
+ *    (CAS); a fresh refresh token is issued, keyed by the same `family`.
+ *  - If the same token is presented a second time within the reuse window
+ *    (default 60 s), the family is revoked and the request is rejected
+ *    with `invalid_grant`. Audit: `refresh_reuse_detected`.
+ *  - Outside the reuse window the row should be GC'd; presentation
+ *    returns `invalid_grant` ("unknown token").
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { TokenResponse } from "../types/token";
+export type RefreshGrantRequest = {
+    grantType: "refresh_token";
+    refreshToken: string;
+    /** Optional per RFC 6749 — narrow scope. If absent, original scopes are reused. */
+    scope?: string;
+    /** Confidential clients authenticate at /token. */
+    clientId?: string;
+    clientSecret?: string;
+    /**
+     * RFC 9449 §6 — JWK thumbprint of the DPoP proof presented on this
+     * refresh request. MUST match `RefreshTokenPayload.dpopJkt` when the
+     * original grant was DPoP-bound; presence is REQUIRED for bound
+     * tokens, OPTIONAL otherwise.
+     */
+    dpopJkt?: string;
+};
+export type RefreshTokensDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    issuerUrl: string;
+    clock: () => number;
+    /** Reuse-detection window (ms). Default 60 s. */
+    reuseWindowMs?: number;
+    newRefreshToken?: () => string;
+    /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
+};
+export declare function refreshTokens(req: RefreshGrantRequest, deps: RefreshTokensDeps): Promise<Result<TokenResponse, AuthError>>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/types/domain/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/domain/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAMnD,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,eAAe,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAmJ3C"}

package/dist/types/domain/register.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Dynamic Client Registration (RFC 7591).
+ *
+ * The host owns persistence — this module validates the wire request,
+ * mints a fresh `client_id` (and `client_secret` for confidential
+ * clients), invokes the host's `registerClient` hook with a structured
+ * `ClientConfig`, and builds the §3.2.1 response.
+ *
+ * Per RFC 7591:
+ *  - §2: registration request body is JSON, fields include
+ *    `client_name`, `redirect_uris`, `grant_types`, `response_types`,
+ *    `token_endpoint_auth_method`, `scope`, etc.
+ *  - §3.2.1: response is JSON with `client_id`, optional
+ *    `client_secret`, `client_id_issued_at`, optional
+ *    `client_secret_expires_at`, and the registered metadata.
+ *  - §3.2.2: structural problems → `invalid_client_metadata` /
+ *    `invalid_redirect_uri`. We collapse to `invalid_request` for
+ *    consistency with the rest of the library's error mapping.
+ */
+import { type AuthError } from "../types/error";
+import type { RegisterClient, RegisterClientRequest, RegisterClientResponse } from "../types/idp";
+import type { Result } from "../types/result";
+import type { TenantContext } from "../types/tenant";
+export type RegisterDeps = {
+    registerClient?: RegisterClient;
+    clock: () => number;
+    /** Test override for deterministic client_id. */
+    newClientId?: () => string;
+    /** Test override for deterministic client_secret. */
+    newClientSecret?: () => string;
+};
+export declare function registerNewClient(request: RegisterClientRequest, tenant: TenantContext, deps: RegisterDeps): Promise<Result<RegisterClientResponse, AuthError>>;
+//# sourceMappingURL=register.d.ts.map

package/dist/types/domain/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/domain/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKpD,MAAM,MAAM,YAAY,GAAG;IACzB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;CAC/B,CAAA;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC,CA0HpD"}

package/dist/types/domain/revoke.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `/revoke` endpoint logic (RFC 7009).
+ *
+ * Access tokens are stateless JWTs in this IdP; revocation has to wait
+ * for natural expiry. `tokenTypeHint: "access_token"` resolves to a
+ * no-op per RFC 7009 §2.2 (invalid hint is ignored).
+ *
+ * Refresh tokens are server-side state. RFC 7009 §2.2 requires the
+ * authorization server to verify that the presented token was issued to
+ * the authenticated client and refuse otherwise. We implement this via
+ * `peekRefresh` (non-destructive) → ownership check → `consumeRefresh`
+ * (destructive). The peek/consume race is benign: if a concurrent caller
+ * consumes the token in between, our consume returns `invalid_grant`,
+ * which RFC 7009 §2.2 says we treat as a successful no-op.
+ *
+ * Anonymous revoke (no `client_id`) is permitted only for tokens issued
+ * to public clients. Confidential-client tokens MUST authenticate per
+ * RFC 7009 §2.1.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { TokenStore } from "../ports/token-store";
+import type { AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { TenantId } from "../types/tenant";
+export type RevokeRequest = {
+    token: string;
+    /** RFC 7009 hint: `"access_token"` or `"refresh_token"`. */
+    tokenTypeHint?: "access_token" | "refresh_token";
+    /** Optional — required when revoking a confidential client's token. */
+    clientId?: string;
+    clientSecret?: string;
+};
+export type RevokeDeps = {
+    tokenStore: TokenStore;
+    configStore: ConfigStore;
+    auditLog?: AuditLog;
+    clock: () => number;
+};
+/**
+ * Revoke a single refresh token. Anonymous revokes are accepted for
+ * public-client tokens; confidential-client tokens require valid
+ * credentials.
+ */
+export declare function revokeToken(req: RevokeRequest, deps: RevokeDeps): Promise<Result<void, AuthError>>;
+/**
+ * Revoke every refresh token for a `(tenantId, subjectId)` pair and emit
+ * a `token_revoked` audit event with `reason: "subject_revoke"`.
+ *
+ * Public primitive exposed for host-driven "log me out of all devices"
+ * flows. Not called from the reuse-detection path — that stays at
+ * family-scope per OAuth 2.0 Security BCP §4.13.2 (revoking sibling
+ * families would punish legitimate other-device sessions sharing the
+ * same subject). See ARCHITECTURE.md §"Reuse detection scope".
+ */
+export declare function revokeAllForSubject(tenantId: TenantId, subjectId: string, deps: {
+    tokenStore: TokenStore;
+    auditLog?: AuditLog;
+    clock: () => number;
+}): Promise<Result<void, AuthError>>;
+//# sourceMappingURL=revoke.d.ts.map

package/dist/types/domain/revoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../../src/domain/revoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAK/C,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,4DAA4D;IAC5D,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,CAAA;IAChD,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,EAAE,WAAW,CAAA;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,EAAE,MAAM,MAAM,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CA6ElC;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,MAAM,CAAA;CAAE,GACzE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAYlC"}

package/dist/types/domain/state-envelope.d.ts

@@ -0,0 +1,30 @@
+/**
+ * MAC-signed `state` envelope used by the tenant-recovery chain.
+ *
+ * Format (intentionally compact, well under 256 base64url bytes):
+ *
+ *   `<b64u(payloadJson)>.<b64u(hmacSha256(payloadJson, key[kid]))>`
+ *
+ * where `payloadJson` is canonical JSON over `{tenantId, flowId, nonce, kid}`.
+ *
+ * **Nothing sensitive is in the envelope** — only the minimal recovery
+ * tuple. Sensitive data (`clientPkce`, `appRedirectUri`, scopes, etc.)
+ * lives in the server-side `FlowRecord`, identified by `flowId`.
+ *
+ * See `ARCHITECTURE.md` §"Tenant recovery across redirects" and plan
+ * §"Crypto — HMAC-SHA-256".
+ */
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { StateEnvelope, StateKeyRing } from "../types/tenant";
+/** Mint a signed state string for the given envelope under the active key. */
+export declare function mintStateEnvelope(envelope: Omit<StateEnvelope, "kid">, keyRing: StateKeyRing): Promise<string>;
+/**
+ * Verify and parse a state string. Returns `unknown_state` on malformed
+ * input, unknown `kid`, or signature mismatch.
+ *
+ * The MAC verification step uses `crypto.subtle.verify`, which is
+ * timing-safe by spec.
+ */
+export declare function verifyStateEnvelope(state: string, keyRing: StateKeyRing): Promise<Result<StateEnvelope, AuthError>>;
+//# sourceMappingURL=state-envelope.d.ts.map

package/dist/types/domain/state-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-envelope.d.ts","sourceRoot":"","sources":["../../../src/domain/state-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EACV,aAAa,EAEb,YAAY,EAEb,MAAM,iBAAiB,CAAA;AAkBxB,8EAA8E;AAC9E,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EACpC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAsD3C"}

package/dist/types/domain/token-exchange.d.ts

@@ -0,0 +1,69 @@
+/**
+ * `/token` logic for `grant_type=urn:ietf:params:oauth:grant-type:token-exchange`
+ * (RFC 8693).
+ *
+ * Scope: **audience-switch / impersonation only.** A subject who holds an
+ * access token for tenant A can present it here to receive a fresh
+ * access + refresh pair scoped to tenant B (the `audience` parameter).
+ * Delegation (`actor_token`) is rejected at the HTTP layer.
+ *
+ * Flow:
+ *   1. Verify the `subject_token` JWT against the IdP's own signing keys.
+ *      Expired / wrong-issuer / bad-sig tokens fail with `invalid_grant`
+ *      (per RFC 8693 §2.4).
+ *   2. Refuse if the host hasn't configured `exchangeAudience` — return
+ *      `unsupported_grant_type` for graceful degradation.
+ *   3. Narrow scope if the caller requested a subset.
+ *   4. Call `exchangeAudience(currentClaim, request)`. The host returns
+ *      either the SubjectClaim that should anchor the new tokens at the
+ *      target tenant, or an `AuthError` (typically `invalid_target`).
+ *   5. Load the target tenant config via `ConfigStore.getTenantConfig`.
+ *      This validates that the audience is a real partition.
+ *   6. Mint a fresh access + refresh pair with `tid = audience` and a
+ *      brand-new refresh family. The previous family lives untouched.
+ *   7. Audit `token_exchanged`.
+ *
+ * Notes:
+ *   - The new tokens' `clientId` is the **authenticated** client (the
+ *     one doing the exchange), not the original audience of the
+ *     subject_token. Hosts that need a different client must register
+ *     one in the target tenant.
+ *   - `methodId` / `methodKind` are preserved from the subject_token so
+ *     the audit trail still names the original authentication method.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { TokenStore } from "../ports/token-store";
+import { type AuthError } from "../types/error";
+import type { ExchangeAudience } from "../types/idp";
+import type { Result } from "../types/result";
+import type { TokenResponse } from "../types/token";
+export type TokenExchangeRequest = {
+    grantType: "urn:ietf:params:oauth:grant-type:token-exchange";
+    subjectToken: string;
+    audience: string;
+    /** Confidential clients authenticate. Public clients use the subject_token alone. */
+    clientId?: string;
+    clientSecret?: string;
+    /** Optional subset of subject_token scopes. */
+    scope?: string;
+};
+export type TokenExchangeResponse = TokenResponse & {
+    /** RFC 8693 §2.2.1. Always `access_token` for this grant. */
+    issued_token_type: "urn:ietf:params:oauth:token-type:access_token";
+};
+export type ExchangeTokenDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    exchangeAudience?: ExchangeAudience;
+    issuerUrl: string;
+    clock: () => number;
+    newRefreshFamily?: () => string;
+    /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
+};
+export declare function exchangeToken(req: TokenExchangeRequest, deps: ExchangeTokenDeps): Promise<Result<TokenExchangeResponse, AuthError>>;
+//# sourceMappingURL=token-exchange.d.ts.map

package/dist/types/domain/token-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../../../src/domain/token-exchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAQtE,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,iDAAiD,CAAA;IAC5D,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG;IAClD,6DAA6D;IAC7D,iBAAiB,EAAE,+CAA+C,CAAA;CACnE,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CA+JnD"}

package/dist/types/domain/token.d.ts

@@ -0,0 +1,140 @@
+/**
+ * `/token` endpoint logic for `grant_type=authorization_code`.
+ *
+ * Steps:
+ *   1. Authenticate client (public: id only; confidential: id + secret).
+ *   2. `TokenStore.consumeCode(code)` — strong CAS; returns the decrypted
+ *      `CodePayload`.
+ *   3. Verify the consumed code matches the request (`client_id`,
+ *      `redirect_uri`). Any mismatch → `invalid_grant`.
+ *   4. Verify PKCE if the code carries a `clientPkce` (RP→IdP PKCE).
+ *   5. Call the user's `success` callback with `SuccessMapInput` to mint
+ *      the `SubjectClaim` — the same role the legacy `auth.success`
+ *      callback plays in `issuer.ts`.
+ *   6. (Optional) `persistUpstreamTokens` hook — runs here, not at
+ *      callback time, so failed exchanges don't pollute the secrets store.
+ *   7. Mint access (JWT, ES256) + refresh (random opaque) tokens, save
+ *      refresh, audit `token_issued`.
+ *
+ * Refresh-grant logic lives in `./refresh.ts`. Revocation in `./revoke.ts`.
+ */
+import type { AuditLog } from "../ports/audit-log";
+import type { KeyStore } from "../ports/key-store";
+import type { TokenStore } from "../ports/token-store";
+import type { ConfigStore } from "../ports/config-store";
+import type { AuthError } from "../types/error";
+import type { PersistUpstreamTokens, SuccessMapInput } from "../types/idp";
+import type { Result } from "../types/result";
+import type { SubjectClaim } from "../types/subject";
+import type { TenantContext } from "../types/tenant";
+import type { CodePayload, TokenResponse } from "../types/token";
+/**
+ * Encrypt a `CodePayload` with the active `KeyStore` encryption key and
+ * persist it via `tokenStore.saveCode`. Centralizes the encrypt-then-store
+ * pattern so adapters never see plaintext (M1).
+ */
+export declare function saveEncryptedCode(code: string, payload: CodePayload, ttl: number, deps: {
+    keyStore: KeyStore;
+    tokenStore: TokenStore;
+}): Promise<Result<void, AuthError>>;
+export declare const DEFAULT_ACCESS_TTL_MS: number;
+export declare const DEFAULT_REFRESH_TTL_MS: number;
+export type TokenAuthCodeRequest = {
+    grantType: "authorization_code";
+    code: string;
+    redirectUri: string;
+    clientId: string;
+    /** Confidential clients only. */
+    clientSecret?: string;
+    /** Required if the original `/authorize` request had a `code_challenge`. */
+    codeVerifier?: string;
+    /**
+     * RFC 9449 §6 — the JWK thumbprint of the presented DPoP proof. Set by
+     * the HTTP layer after verifying the `DPoP:` header against this
+     * request's actual method + URI. The domain binds the issued access
+     * token to this thumbprint via `cnf.jkt`.
+     */
+    dpopJkt?: string;
+};
+export type ExchangeCodeDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    keyStore: KeyStore;
+    auditLog?: AuditLog;
+    success: (input: SuccessMapInput) => Promise<SubjectClaim>;
+    persistUpstreamTokens?: PersistUpstreamTokens;
+    issuerUrl: string;
+    clock: () => number;
+    newRefreshToken?: () => string;
+    /** Test override. */
+    newRefreshFamily?: () => string;
+    /**
+     * Host-supplied vendor scope → claim-names map. Forwarded to `mintTokens`
+     * for id_token + /userinfo scope-gating. See `IdPOptions.customScopeClaims`.
+     */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
+};
+export declare function exchangeCode(req: TokenAuthCodeRequest, deps: ExchangeCodeDeps): Promise<Result<TokenResponse, AuthError>>;
+/**
+ * Shared mint logic used by both `exchangeCode` and `refreshTokens` (which
+ * passes its previous `family` through to preserve the rotation chain).
+ */
+export declare function mintTokens(args: {
+    tenant: TenantContext;
+    claim: SubjectClaim;
+    payload: Pick<CodePayload, "tenantId" | "clientId" | "methodId" | "methodKind" | "scopes" | "audience"> & {
+        /**
+         * Present on `authorization_code` and `refresh_token` grants where an
+         * end-user actually authenticated. Absent on `client_credentials`
+         * (no end-user) — and absent means no `id_token` is emitted even if
+         * the requested scopes nominally include `openid`.
+         */
+        authTime?: number;
+        /** RP's OIDC `nonce` from `/authorize`, when present. */
+        appNonce?: string;
+        /**
+         * DPoP key thumbprint (RFC 9449 §6.1). When present, the access
+         * token's `cnf.jkt` claim is set and `token_type` flips to `"DPoP"`;
+         * the saved refresh-token payload's `dpopJkt` is set so refresh
+         * rotation re-enforces sender constraint.
+         */
+        dpopJkt?: string;
+        /**
+         * OIDC Core §5.5 — RP-requested claims from `/authorize`. Carried
+         * into the id_token and forward across refresh rotations (§12) so
+         * later /userinfo calls keep returning the requested fields.
+         */
+        claimsRequest?: import("../types/authorization").ClaimsRequest;
+    };
+    family: string;
+    /**
+     * `client_credentials` grants (RFC 6749 §4.4.3) and other paths where a
+     * refresh token is not appropriate set `skipRefresh: true`. The response
+     * then omits `refresh_token` and **no row is written** to `TokenStore`,
+     * so the durable store doesn't accumulate orphaned refresh entries that
+     * the response strips and discards.
+     */
+    skipRefresh?: boolean;
+    deps: {
+        keyStore: KeyStore;
+        tokenStore: TokenStore;
+        auditLog?: AuditLog;
+        issuerUrl: string;
+        clock: () => number;
+        newRefreshToken?: () => string;
+        /**
+         * Host-supplied vendor scope → claim-names map merged into the
+         * id_token + /userinfo scope-gating. See `IdPOptions.customScopeClaims`.
+         */
+        customScopeClaims?: Record<string, ReadonlyArray<string>>;
+    };
+}): Promise<Result<TokenResponse, AuthError>>;
+/**
+ * Phase 2 client-secret hash format: SHA-256 over UTF-8 bytes, base64url.
+ *
+ * Production deployments will move to argon2id (per cross-cutting
+ * decisions) in Phase 8. The storage shape (`ClientConfig.secretHash:
+ * string`) is unchanged; only the hashing function swaps.
+ */
+export declare function hashClientSecret(plain: string): Promise<string>;
+//# sourceMappingURL=token.d.ts.map

package/dist/types/domain/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/domain/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAEV,WAAW,EAEX,aAAa,EACd,MAAM,gBAAgB,CAAA;AAiBvB;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAclC;AAED,eAAO,MAAM,qBAAqB,QAAiB,CAAA;AACnD,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAE9D,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,oBAAoB,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;IAC9B,qBAAqB;IACrB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAA;IAC/B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAkH3C;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,aAAa,CAAA;IACrB,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,IAAI,CACX,WAAW,EACX,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,UAAU,CAC5E,GAAG;QACF;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,yDAAyD;QACzD,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB;;;;;WAKG;QACH,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB;;;;WAIG;QACH,aAAa,CAAC,EAAE,OAAO,wBAAwB,EAAE,aAAa,CAAA;KAC/D,CAAA;IACD,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,IAAI,EAAE;QACJ,QAAQ,EAAE,QAAQ,CAAA;QAClB,UAAU,EAAE,UAAU,CAAA;QACtB,QAAQ,CAAC,EAAE,QAAQ,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,MAAM,CAAA;QACnB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAA;QAC9B;;;WAGG;QACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;KAC1D,CAAA;CACF,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CA8I5C;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE"}

package/dist/types/domain/userinfo.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `/userinfo` endpoint logic (OIDC Core §5.3). Verifies the presented
+ * access token, optionally enforces a DPoP proof binding (RFC 9449 §7),
+ * and returns the inlined `SubjectClaim` claims, scope-gated per OIDC
+ * Core §5.4.
+ *
+ * Profile / email / phone / address claims appear in the response only
+ * when (a) the access token's `scope` includes the granting scope and
+ * (b) the value exists on `SubjectClaim.properties`. Other properties
+ * (host-specific subject fields like `userId`, `roles`, …) are returned
+ * under `properties` and not subject to OIDC scope gating — they're
+ * outside §5.4's universe.
+ *
+ * DPoP at the resource server (RFC 9449 §7):
+ *  - If the access token has a `cnf.jkt` claim, the request MUST carry a
+ *    matching `DPoP:` proof whose `ath` equals SHA-256(access_token).
+ *  - If no `cnf.jkt`, the access token is plain Bearer and any DPoP
+ *    proof is silently ignored at this layer (host can still enforce).
+ */
+import type { TokenStore } from "../ports/token-store";
+import type { KeyStore } from "../ports/key-store";
+import { type AuthError } from "../types/error";
+import type { Result } from "../types/result";
+import type { ScopedProfileClaims } from "../types/token";
+export type UserinfoResponse = ScopedProfileClaims & {
+    sub: string;
+    /** Subject type discriminator (e.g. `"user"` / `"admin"`). */
+    subject_type: string;
+    /** Inlined claim properties, host-specific and not gated by OIDC scope. */
+    properties: Record<string, unknown>;
+    /** Scope granted to this access token. */
+    scope?: string;
+};
+export type UserinfoDeps = {
+    keyStore: KeyStore;
+    /** Required when DPoP-bound tokens are accepted. */
+    tokenStore?: TokenStore;
+    issuerUrl?: string;
+    /**
+     * Host-supplied vendor scope → claim-names map. Merged into the
+     * scope-gated /userinfo response just as it is for id_token. See
+     * `IdPOptions.customScopeClaims`.
+     */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
+};
+export type UserinfoInput = {
+    /** Access token from `Authorization: Bearer ...` or `Authorization: DPoP ...`. */
+    accessToken: string;
+    /** `Authorization`-scheme as presented. Defaults to `"Bearer"`. */
+    scheme?: "Bearer" | "DPoP";
+    /** Raw `DPoP:` header from the request, if any. */
+    dpopProof?: string;
+    /** Canonical request URI for DPoP `htu` check (scheme + host + path). */
+    htu?: string;
+    /** Request method for DPoP `htm` check, uppercase. */
+    htm?: string;
+    /** Wall clock seconds for DPoP `iat` window. */
+    nowSec?: number;
+};
+export declare function userinfo(input: UserinfoInput, deps: UserinfoDeps): Promise<Result<UserinfoResponse, AuthError>>;
+//# sourceMappingURL=userinfo.d.ts.map

package/dist/types/domain/userinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../src/domain/userinfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAQ7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAEzD,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG;IACnD,GAAG,EAAE,MAAM,CAAA;IACX,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,oDAAoD;IACpD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAA;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC1B,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAiG9C"}

package/dist/types/http/context.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Shared deps + per-request context for the HTTP layer.
+ *
+ * `HttpDeps` is constructed once by `createIdP` and threaded through every
+ * handler. `HttpVars` is the per-request Hono-variable shape: tenant
+ * resolution, parsed cookies, optional recovery info from the callback chain.
+ */
+import type { Context } from "hono";
+import type { AuditLog } from "../ports/audit-log";
+import type { ConfigStore } from "../ports/config-store";
+import type { KeyStore } from "../ports/key-store";
+import type { MethodStore } from "../ports/method-store";
+import type { SessionStore } from "../ports/session-store";
+import type { TokenStore } from "../ports/token-store";
+import type { MethodCache } from "../domain/method-cache";
+import type { AuthError } from "../types/error";
+import type { ExchangeAudience, PersistUpstreamTokens, RegisterClient, RenderPicker, SuccessMapInput } from "../types/idp";
+import type { Result } from "../types/result";
+import type { SubjectClaim } from "../types/subject";
+import type { StateKeyRing, TenantContext, TenantId, TenantRecovery } from "../types/tenant";
+import type { CookieDefaults } from "./cookies";
+/** Long-lived deps the HTTP layer shares across requests. */
+export type HttpDeps = {
+    configStore: ConfigStore;
+    tokenStore: TokenStore;
+    sessionStore: SessionStore;
+    keyStore: KeyStore;
+    methodStore?: MethodStore;
+    auditLog?: AuditLog;
+    methodCache: MethodCache;
+    stateKeys: StateKeyRing;
+    /** Resolves the issuer URL — string or per-request function. */
+    resolveIssuer: (req: Request) => string;
+    /** Optional partitioned-host helper (recovery #2). */
+    callbackHostFor?: (tenantId: TenantId) => string;
+    resolveTenant: (req: Request) => Promise<Result<TenantId, AuthError>>;
+    success: (input: SuccessMapInput) => Promise<SubjectClaim>;
+    persistUpstreamTokens?: PersistUpstreamTokens;
+    exchangeAudience?: ExchangeAudience;
+    renderPicker?: RenderPicker;
+    registerClient?: RegisterClient;
+    /** Builds `TenantContext.request.custom` for every request. See `IdPOptions.buildCustomContext`. */
+    buildCustomContext?: (req: Request) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    clock: () => number;
+    cookieDefaults: CookieDefaults;
+    /** See `IdPOptions.customScopeClaims`. */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
+};
+/** Per-request variables populated by middleware. */
+export type HttpVars = {
+    /** Parsed `Cookie:` header. */
+    cookies: Map<string, string>;
+    /** Populated by the tenant middleware. May be `null` for unauthenticated public endpoints. */
+    tenant: TenantContext | null;
+    /** Outcome of the callback-recovery chain on `/cb/*` requests. */
+    recovery: TenantRecovery | null;
+    /** Issuer URL for this request — pre-resolved by middleware. */
+    issuerUrl: string;
+};
+export type HttpEnv = {
+    Variables: HttpVars;
+};
+export type HttpContext = Context<HttpEnv>;
+/** Convenience: build the initial `HttpVars` value for a request. */
+export declare function initialVars(issuerUrl: string, cookies: Map<string, string>): HttpVars;
+//# sourceMappingURL=context.d.ts.map