@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/types/http/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/http/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,YAAY,CAAA;IACvB,gEAAgE;IAChE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAA;IACvC,sDAAsD;IACtD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAChD,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,MAAM,CAAA;IACnB,cAAc,EAAE,cAAc,CAAA;IAC9B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,qDAAqD;AACrD,MAAM,MAAM,QAAQ,GAAG;IACrB,+BAA+B;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,8FAA8F;IAC9F,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,EAAE,QAAQ,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE1C,qEAAqE;AACrE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,QAAQ,CAEV"}

package/dist/types/http/cookies.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Cookie parsing + serialization for the HTTP layer.
+ *
+ * The framework owns cookie policy (per `ARCHITECTURE.md` §"Response
+ * sanitization"). Methods never set cookies through `Response.headers`; they
+ * return `SetCookie[]` data and this module renders them. We additionally
+ * strip method-returned `Set-Cookie` / security / `Cache-Control` headers so
+ * methods cannot bypass policy.
+ */
+import type { SetCookie } from "../types/method";
+/** Parse an incoming `Cookie:` header into a read-only map. */
+export declare function parseCookieHeader(header: string | null): Map<string, string>;
+export type CookieDefaults = {
+    /** Secure flag default. Production should pass `true`. */
+    secure?: boolean;
+    domain?: string;
+    path?: string;
+};
+/**
+ * Serialize a single `SetCookie` data instruction into a `Set-Cookie` header
+ * string. Enforces framework policy:
+ *   - `Secure` forced on if `defaults.secure === true`.
+ *   - `SameSite` defaults to `Lax` if unspecified.
+ *   - `HttpOnly` defaults to `true` for any cookie name in the `auth.*` /
+ *     `idp.*` reserved namespace.
+ *   - `null` value → `Max-Age=0` to clear.
+ */
+export declare function serializeSetCookie(cookie: SetCookie, defaults?: CookieDefaults): string;
+export type ApplyOptions = {
+    setCookies?: SetCookie[];
+    cookieDefaults?: CookieDefaults;
+    /** When set, framework writes this `Cache-Control` value. Default `no-store`. */
+    cacheControl?: string;
+};
+/**
+ * Sanitize a method-returned `Response` and apply framework-owned headers.
+ *
+ * Returns a new `Response` so the original is left untouched. When the
+ * method's response carried any of the stripped headers, emit a
+ * `console.warn` so a programmer notices their header got dropped
+ * silently. (Per ARCHITECTURE.md §"Response sanitization"; switches to
+ * the Logger port when that lands in Phase 8.)
+ */
+export declare function applyResponsePolicy(response: Response, opts?: ApplyOptions): Response;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/types/http/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAsB5E;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,QAAQ,GAAE,cAAmB,GAC5B,MAAM,CA4BR;AAgBD,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,YAAiB,GACtB,QAAQ,CA4BV"}

package/dist/types/http/errors.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Map an `AuthError` into a standards-compliant HTTP response.
+ *
+ * Two surfaces:
+ *   - **Token / introspect / revoke endpoints (RFC 6749 §5.2).** JSON body
+ *     `{ "error": "...", "error_description": "..." }` with the spec status
+ *     codes (`invalid_client` → 401, server-side → 500, the rest → 400).
+ *   - **Authorize endpoint (RFC 6749 §4.1.2.1).** Recoverable errors redirect
+ *     back to the relying party with `error` + `error_description` + the
+ *     echoed `state`. Non-recoverable errors (unknown client, unregistered
+ *     redirect_uri) surface as plain text to avoid open-redirector behavior.
+ *
+ * `internal_error` is framework-internal; the HTTP layer always rewrites it
+ * to `server_error` before responding to the client.
+ */
+import type { AuthError, AuthErrorCode } from "../types/error";
+/** Public OAuth error code emitted on the wire. Strips framework-internal. */
+export declare function publicErrorCode(code: AuthErrorCode): string;
+export declare function tokenEndpointErrorResponse(error: AuthError): Response;
+/**
+ * Redirect back to the RP with the OAuth error in the query (RFC 6749
+ * §4.1.2.1). Returns `null` if the error is non-recoverable — the caller
+ * should render a plain-text response instead.
+ */
+export declare function authorizeRedirectErrorResponse(error: AuthError, appRedirectUri: string, appState: string | null): Response;
+/**
+ * Plain-text fallback for errors that occur before a valid `redirect_uri`
+ * has been established — open-redirector defense.
+ */
+export declare function authorizeDirectErrorResponse(error: AuthError): Response;
+/**
+ * Errors that must never round-trip through `appRedirectUri` because the URI
+ * itself is what failed validation.
+ */
+export declare function isNonRecoverable(error: AuthError): boolean;
+//# sourceMappingURL=errors.d.ts.map

package/dist/types/http/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/http/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAS9D,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAM3D;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAerE;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,QAAQ,CASV;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAMvE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAW1D"}

package/dist/types/http/handlers/authorize.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeAuthorizeHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/types/http/handlers/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/authorize.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAWvD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,OAChC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAkOjD"}

package/dist/types/http/handlers/callback.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeCallbackHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=callback.d.ts.map

package/dist/types/http/handlers/callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/callback.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA2DjD"}

package/dist/types/http/handlers/end-session.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeEndSessionHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=end-session.d.ts.map

package/dist/types/http/handlers/end-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-session.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/end-session.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAIvD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,OACjC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAgFjD"}

package/dist/types/http/handlers/metadata.d.ts

@@ -0,0 +1,4 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeDiscoveryHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+export declare function makeJwksHandler(deps: HttpDeps): (_c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/types/http/handlers/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/metadata.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,OAChC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAejD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,QAC1B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAWlD"}

package/dist/types/http/handlers/method-route.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeMethodRouteHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=method-route.d.ts.map

package/dist/types/http/handlers/method-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-route.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/method-route.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAGvD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,OAClC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAqFjD"}

package/dist/types/http/handlers/par.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeParHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=par.d.ts.map

package/dist/types/http/handlers/par.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"par.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/par.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAIvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,OAC1B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA+DjD"}

package/dist/types/http/handlers/register.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeRegisterHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=register.d.ts.map

package/dist/types/http/handlers/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/register.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAIvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAkDjD"}

package/dist/types/http/handlers/revocation.d.ts

@@ -0,0 +1,4 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeRevokeHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+export declare function makeIntrospectHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/types/http/handlers/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/revocation.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKvD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,OAC7B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA+CjD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,OACjC,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAkEjD"}

package/dist/types/http/handlers/token.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeTokenHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=token.d.ts.map

package/dist/types/http/handlers/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/token.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,OAC5B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAoOjD"}

package/dist/types/http/handlers/userinfo.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeUserinfoHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=userinfo.d.ts.map

package/dist/types/http/handlers/userinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/userinfo.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAEvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAgDjD"}

package/dist/types/http/middleware/error.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Global error middleware. Catches thrown values and serializes them as
+ * OAuth-compliant responses. Inside handlers we route through `Result<T,
+ * AuthError>` instead — this is the last-resort net for unexpected throws.
+ */
+import type { MiddlewareHandler } from "hono";
+import type { HttpDeps, HttpEnv } from "../context";
+export declare function errorMiddleware(_deps: HttpDeps): MiddlewareHandler<HttpEnv>;
+//# sourceMappingURL=error.d.ts.map

package/dist/types/http/middleware/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAI7C,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAGnD,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAa3E"}

package/dist/types/http/middleware/tenant.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Tenant resolution + callback-recovery middleware.
+ *
+ * Phase 3 ships the mac-state recovery path. Mechanisms #2 (partitioned
+ * host) and #3 (`flowId`-in-URI) are scaffolded but not yet plumbed end-to-
+ * end (per plan §"Phase 2 — Deferred"); the framework currently falls back
+ * to `resolveTenant` when the state envelope is absent or invalid, so users
+ * who want partitioned-host deployments can implement the lookup inside
+ * their own `resolveTenant`.
+ *
+ * Order on `/cb/*`:
+ *   1. If `state` MAC-verifies → `mac-state`. `resolveTenant` is NOT called.
+ *   2. Else fall through to `resolveTenant` (host-plus-* deployments do the
+ *      host inspection there).
+ *
+ * Order on all other paths: `resolveTenant` directly.
+ */
+import type { MiddlewareHandler } from "hono";
+import type { HttpDeps, HttpEnv } from "../context";
+/**
+ * Initial pass — parse cookies + resolve issuer URL. Runs unconditionally.
+ */
+export declare function bootstrapMiddleware(deps: HttpDeps): MiddlewareHandler<HttpEnv>;
+/**
+ * Tenant + recovery resolution middleware. Mount on routes that need a
+ * tenant in scope (`/authorize`, method dispatch, `/cb/*`). Token endpoints
+ * derive tenant from the auth code's snapshot — they skip this middleware.
+ */
+export declare function tenantMiddleware(deps: HttpDeps): MiddlewareHandler<HttpEnv>;
+//# sourceMappingURL=tenant.d.ts.map

package/dist/types/http/middleware/tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAY7C,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAWnD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,GACb,iBAAiB,CAAC,OAAO,CAAC,CAS5B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAkD3E"}

package/dist/types/http/resolver.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Helpers that prepare a `Request` for the host-supplied
+ * `IdPOptions.resolveTenant` hook.
+ *
+ * The canonical resolver reads `client_id` from URL search params
+ * (INTEGRATION.md §5.1). On endpoints where `client_id` is carried in
+ * the form body / Basic-auth header rather than the URL (m2m at
+ * `/token`, introspect at `/introspect`, revoke at `/revoke`) the
+ * framework parses the body first and then injects the parsed
+ * `client_id` into a synthesized request so the resolver still sees
+ * what it expects.
+ */
+/**
+ * Build a new `Request` whose URL search params carry the supplied
+ * resolver hints. Existing query params win — hosts can still override
+ * via the URL. Headers are copied so Basic-auth-based resolvers still
+ * see the original `Authorization`. The body is intentionally dropped:
+ * the original is already consumed by the handler and resolvers must
+ * not depend on body state.
+ */
+export declare function injectResolverHints(original: Request, hints: Record<string, string>): Request;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/types/http/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/http/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAST"}

package/dist/types/http/router.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Top-level Hono router for the IdP HTTP surface.
+ *
+ * Routes (Phase 3):
+ *   GET  /authorize                                    — start OAuth flow
+ *   POST /token                                         — exchange code / refresh
+ *   GET  /userinfo, POST /userinfo                      — OIDC claims
+ *   GET  /cb/:methodId{.*}                              — upstream callback
+ *   GET  /.well-known/openid-configuration              — discovery
+ *   GET  /.well-known/oauth-authorization-server        — discovery (alias)
+ *   GET  /.well-known/jwks.json                         — JWKS
+ *   POST /revoke                                        — RFC 7009
+ *   POST /introspect                                    — RFC 7662
+ *
+ * Hono is imported **only** from this directory. `domain/`, `methods/`,
+ * `types/`, `ports/`, and `adapters/` remain framework-agnostic.
+ */
+import { Hono } from "hono";
+import type { HttpDeps, HttpEnv } from "./context";
+export declare function buildRouter(deps: HttpDeps): Hono<HttpEnv>;
+//# sourceMappingURL=router.d.ts.map

package/dist/types/http/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAc3B,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAmDzD"}

package/dist/types/http/schemas/authorize.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Zod schemas for the `/authorize` endpoint.
+ *
+ * Parse the raw query into an `AuthorizationRequest` shape. We surface OAuth
+ * `invalid_request` (or the more specific `unsupported_response_type` /
+ * `invalid_scope`) for any structural failure here; downstream domain code
+ * then handles semantic validation (client lookup, redirect-uri match, PKCE
+ * requirement, etc.).
+ */
+import { z } from "zod";
+/**
+ * Standard `/authorize` query schema. Used both for direct calls and as
+ * the validation target after a PAR record is rehydrated — the PAR'd
+ * params are passed through this same parser so semantic checks stay in
+ * a single place.
+ */
+export declare const authorizeQuerySchema: z.ZodObject<{
+    response_type: z.ZodString;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    scope: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string[], string>, z.ZodArray<z.ZodString, "many">>>;
+    state: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    method_id: z.ZodOptional<z.ZodString>;
+    code_challenge: z.ZodOptional<z.ZodString>;
+    code_challenge_method: z.ZodOptional<z.ZodLiteral<"S256">>;
+    prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    nonce: z.ZodOptional<z.ZodString>;
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    response_type: z.ZodString;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    scope: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string[], string>, z.ZodArray<z.ZodString, "many">>>;
+    state: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    method_id: z.ZodOptional<z.ZodString>;
+    code_challenge: z.ZodOptional<z.ZodString>;
+    code_challenge_method: z.ZodOptional<z.ZodLiteral<"S256">>;
+    prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    nonce: z.ZodOptional<z.ZodString>;
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    response_type: z.ZodString;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    scope: z.ZodOptional<z.ZodPipeline<z.ZodEffects<z.ZodString, string[], string>, z.ZodArray<z.ZodString, "many">>>;
+    state: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    method_id: z.ZodOptional<z.ZodString>;
+    code_challenge: z.ZodOptional<z.ZodString>;
+    code_challenge_method: z.ZodOptional<z.ZodLiteral<"S256">>;
+    prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
+    nonce: z.ZodOptional<z.ZodString>;
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * RFC 9126 §4: when `request_uri` is presented, the user-agent's
+ * `/authorize` URL is allowed to carry only `client_id` and
+ * `request_uri`; the rest of the parameter set must come from the
+ * stored PAR record.
+ */
+export declare const authorizeRequestUriQuerySchema: z.ZodObject<{
+    client_id: z.ZodString;
+    request_uri: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    client_id: z.ZodString;
+    request_uri: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    client_id: z.ZodString;
+    request_uri: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>;
+export type AuthorizeQuery = z.infer<typeof authorizeQuerySchema>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/types/http/schemas/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAyBvB;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;IAoB7B;;;;OAIG;;;;;;;;;;;;;;;IAJH;;;;OAIG;;;;;;;;;;;;;;;IAJH;;;;OAIG;;gCAGS,CAAA;AAEhB;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;gCAO3B,CAAA;AAEhB,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/types/http/schemas/end-session.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Zod schema for `/end_session` (OIDC RP-Initiated Logout 1.0 §2).
+ *
+ * Every parameter is optional per spec. The domain layer enforces the
+ * "needs identifying client to honor post_logout_redirect_uri" rule.
+ */
+import { z } from "zod";
+export declare const endSessionParamsSchema: z.ZodObject<{
+    id_token_hint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    logout_hint: z.ZodOptional<z.ZodString>;
+    ui_locales: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id_token_hint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    logout_hint: z.ZodOptional<z.ZodString>;
+    ui_locales: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id_token_hint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    logout_hint: z.ZodOptional<z.ZodString>;
+    ui_locales: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export type EndSessionParams = z.infer<typeof endSessionParamsSchema>;
+//# sourceMappingURL=end-session.d.ts.map

package/dist/types/http/schemas/end-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-session.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/end-session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;gCAYnB,CAAA;AAEhB,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA"}

package/dist/types/http/schemas/par.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Zod schema for the `POST /par` body (RFC 9126 §2).
+ *
+ * The shape is identical to `/authorize` query parameters; we just need
+ * `client_id` to identify the authenticating client. `client_secret` is
+ * accepted in-body for `client_secret_post` auth.
+ */
+import { z } from "zod";
+export declare const parBodySchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodString, z.objectOutputType<{
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.ZodString, "strip">, z.objectInputType<{
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.ZodString, "strip">>;
+export type ParBody = z.infer<typeof parBodySchema>;
+//# sourceMappingURL=par.d.ts.map

package/dist/types/http/schemas/par.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"par.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/par.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,aAAa;;;;;;;;;yBAWH,CAAA;AAEvB,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA"}

package/dist/types/http/schemas/register.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Zod schema for `POST /register` (RFC 7591 §2).
+ *
+ * The body is `application/json`. We surface invalid structure as
+ * `invalid_request` rather than the spec's `invalid_client_metadata` /
+ * `invalid_redirect_uri` codes — the library collapses all wire-format
+ * problems to the OAuth-2.0 `invalid_request` family for consistency.
+ */
+import { z } from "zod";
+export declare const registerBodySchema: z.ZodObject<{
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString, "many">;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<["none", "client_secret_basic", "client_secret_post"]>>;
+    scope: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sector_identifier_uri: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString, "many">;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<["none", "client_secret_basic", "client_secret_post"]>>;
+    scope: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sector_identifier_uri: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString, "many">;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<["none", "client_secret_basic", "client_secret_post"]>>;
+    scope: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sector_identifier_uri: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, z.ZodTypeAny, "passthrough">>;
+export type RegisterBody = z.infer<typeof registerBodySchema>;
+//# sourceMappingURL=register.d.ts.map

package/dist/types/http/schemas/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/register.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAgBf,CAAA;AAEhB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA"}

package/dist/types/http/schemas/revocation.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Zod schemas for RFC 7009 `/revoke` and RFC 7662 `/introspect`. Both are
+ * advertised in discovery from Phase 3 onward; their HTTP shims live here so
+ * the domain functions are reachable without waiting for Phase 8.
+ */
+import { z } from "zod";
+export declare const revokeBodySchema: z.ZodObject<{
+    token: z.ZodString;
+    token_type_hint: z.ZodOptional<z.ZodEnum<["access_token", "refresh_token"]>>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    token: string;
+    client_id?: string | undefined;
+    client_secret?: string | undefined;
+    token_type_hint?: "refresh_token" | "access_token" | undefined;
+}, {
+    token: string;
+    client_id?: string | undefined;
+    client_secret?: string | undefined;
+    token_type_hint?: "refresh_token" | "access_token" | undefined;
+}>;
+export declare const introspectBodySchema: z.ZodObject<{
+    token: z.ZodString;
+    token_type_hint: z.ZodOptional<z.ZodEnum<["access_token", "refresh_token"]>>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    token: string;
+    client_id?: string | undefined;
+    client_secret?: string | undefined;
+    token_type_hint?: "refresh_token" | "access_token" | undefined;
+}, {
+    token: string;
+    client_id?: string | undefined;
+    client_secret?: string | undefined;
+    token_type_hint?: "refresh_token" | "access_token" | undefined;
+}>;
+export type RevokeBody = z.infer<typeof revokeBodySchema>;
+export type IntrospectBody = z.infer<typeof introspectBodySchema>;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/types/http/schemas/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/revocation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;EAK3B,CAAA;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;EAK/B,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACzD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}