@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/types/types/subject.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Subject — the typed principal the IdP issues at the end of an auth flow.
+ *
+ * Per AD4 / plan §"Subject", Zod is the canonical schema library. The
+ * subject schema type is library-agnostic at the boundary (any schema that
+ * implements the [Standard Schema v1] spec — including Zod 3.24+, Valibot,
+ * and Arktype) so existing consumers can migrate from Valibot/Arktype
+ * without rewriting subject definitions.
+ *
+ * [Standard Schema v1]: https://github.com/standard-schema/standard-schema
+ */
+import type { v1 } from "@standard-schema/spec";
+/**
+ * Map of subject-type id → schema for that subject's `properties`.
+ *
+ * @example
+ * ```ts
+ * import { z } from "zod"
+ *
+ * const subjects: SubjectSchema = {
+ *   user:  z.object({ userId: z.string(), email: z.string().email() }),
+ *   admin: z.object({ adminId: z.string(), roles: z.array(z.string()) }),
+ * }
+ * ```
+ */
+export type SubjectSchema = Record<string, v1.StandardSchema>;
+/**
+ * Helper that infers the discriminated-union `{ type, properties }` shape
+ * from a `SubjectSchema`. Used to type the IdP's `success` callback return
+ * and the access-token `claim` payload.
+ */
+export type SubjectPayload<T extends SubjectSchema> = {
+    [type in keyof T & string]: {
+        type: type;
+        properties: v1.InferOutput<T[type]>;
+    };
+}[keyof T & string];
+/**
+ * Generic typed-subject claim — what the user's `IdPOptions.success`
+ * callback returns and what is inlined as `claim` on the access token.
+ *
+ * Domain / port signatures keep the generic open (`SubjectClaim`) so the
+ * framework doesn't need to know each consumer's subject schema. Concrete
+ * call sites narrow `T extends SubjectSchema` for type safety.
+ */
+export type SubjectClaim<T extends SubjectSchema = SubjectSchema> = SubjectPayload<T>;
+//# sourceMappingURL=subject.d.ts.map

package/dist/types/types/subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject.d.ts","sourceRoot":"","sources":["../../../src/types/subject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,CAAA;AAE7D;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,aAAa,IAAI;KACnD,IAAI,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG;QAC1B,IAAI,EAAE,IAAI,CAAA;QACV,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;KACpC;CACF,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAA;AAEnB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IAC9D,cAAc,CAAC,CAAC,CAAC,CAAA"}

package/dist/types/types/tenant.d.ts

@@ -0,0 +1,276 @@
+/**
+ * Tenant model + tenant-resolution / callback-recovery types.
+ *
+ * Per AD1, tenancy is **not** a URL concept. A tenant is whatever the
+ * user-supplied `resolveTenant(req)` says it is for an incoming request, plus
+ * a deterministic callback-recovery chain (MAC-bound state, partitioned host,
+ * or `flowId`-in-URI) for the post-redirect leg where the original tenant
+ * signal may no longer be available.
+ *
+ * The minimal state envelope MACed and round-tripped through upstream
+ * providers carries only `{ tenantId, flowId, nonce, kid }`. Everything else
+ * lives in the server-side `FlowRecord` (see `./flow.ts`).
+ */
+/**
+ * Branded tenant id — **opaque to the framework**.
+ *
+ * The framework treats `TenantId` as a comparable string and nothing more.
+ * It never parses it, never assumes a hierarchy or naming convention, never
+ * imposes uniqueness rules, never knows the lifecycle of a tenant. The
+ * embedding application decides what a tenant *is* (an organization, a
+ * workspace, an App-Tenant tuple, a customer, …) and supplies a
+ * `resolveTenant(req)` that maps incoming requests to the right key.
+ *
+ * Common embedding pattern when the host application has two levels of
+ * scoping (e.g. `App` ⇒ `App-Tenant`): encode the tuple into the key.
+ *
+ * ```ts
+ * // Inside the host application's resolveTenant:
+ * return ok(`${app.id}:${appTenant?.id ?? "__default__"}` as TenantId)
+ *
+ * // Inside the host application's ConfigStore.getTenantConfig:
+ * const [appId, subId] = (id as string).split(":")
+ * // merge App defaults + App-Tenant overrides from your own DB ...
+ * ```
+ *
+ * The brand exists to keep arbitrary `string` values from being passed
+ * where a `TenantId` is expected; the *meaning* of the string is the host
+ * application's concern.
+ */
+export type TenantId = string & {
+    readonly __brand: "TenantId";
+};
+/**
+ * Cast helper for code that mints `TenantId` from a validated string. The
+ * framework imposes no validation on the value — callers ensure their key
+ * is non-empty and stable per partition.
+ */
+export declare const asTenantId: (value: string) => TenantId;
+/** OAuth 2.1 grant types in scope for this IdP. Implicit is intentionally absent. */
+export type GrantType = "authorization_code" | "refresh_token" | "client_credentials";
+/**
+ * `MethodType` is the canonical discriminator for an `AuthMethod`. It mirrors
+ * the existing provider taxonomy. The UI uses it to decide which selection /
+ * form to render; the framework uses it as a routing / dispatch hint.
+ */
+export type MethodType = "oauth2" | "oidc" | "password" | "code" | "m2m" | "passkey" | "custom";
+/**
+ * Per-tenant configuration for a single auth method **instance**.
+ *
+ * `id` is the **tenant-local instance id** — the value that ends up in URLs
+ * (`/<id>/*`) and that the framework dispatches by.
+ *
+ * `kind` is the **factory id** — the value that selects which
+ * `AuthMethodFactory` builds this instance. A tenant may register multiple
+ * instances of the same factory (e.g. one Google Workspace SSO and one
+ * consumer Google Sign-In) by giving each instance a unique `id` while
+ * sharing a `kind`.
+ *
+ * `type` is the `MethodType` discriminator the UI uses. The framework
+ * verifies it agrees with the factory's declared type at load time.
+ *
+ * `config` is the tenant-supplied configuration blob. The framework validates
+ * it against the factory's Zod `configSchema` before any handler runs.
+ */
+export type MethodConfig = {
+    id: string;
+    kind: string;
+    type: MethodType;
+    enabled: boolean;
+    config: Record<string, unknown>;
+};
+/** Optional theme metadata. Schema expanded in later phases. */
+export type ThemeConfig = {
+    primary?: string;
+    logo?: string;
+    favicon?: string;
+    background?: string;
+    font?: string;
+};
+/**
+ * Registered OAuth client of this IdP (an app, SPA, mobile, M2M).
+ *
+ * Phase 8: split into a discriminated union so misconfiguration is a type
+ * error, not a runtime check. The runtime in `domain/authorize.ts` still
+ * enforces PKCE for public clients defensively, but hosts will see the
+ * problem at compile time.
+ *
+ * - **Public clients** (SPAs, mobile apps, native apps): no client secret;
+ *   `pkceRequired` is the literal `true`. PKCE is non-negotiable per
+ *   OAuth 2.1 BCP §2.1.1.
+ * - **Confidential clients** (server-side apps, M2M): `secretHash` is
+ *   required (this used to be optional, in practice always set). PKCE
+ *   recommended but may be disabled by the host.
+ */
+export type ClientConfig = PublicClientConfig | ConfidentialClientConfig;
+export type PublicClientConfig = {
+    id: string;
+    name: string;
+    type: "public";
+    redirectUris: string[];
+    grantTypes: GrantType[];
+    scopes: string[];
+    /** Must be `true` for public clients per OAuth 2.1 §2.1.1. */
+    pkceRequired: true;
+    /**
+     * Registered URIs to which `/end_session` may redirect after RP-initiated
+     * logout (OIDC RP-Initiated Logout 1.0 §2). Exact-match. If absent, the
+     * `/end_session` endpoint refuses any `post_logout_redirect_uri`.
+     */
+    postLogoutRedirectUris?: string[];
+    /**
+     * RFC 9126 §2: when `true`, the client MUST use Pushed Authorization
+     * Requests; a direct `GET /authorize` call without `request_uri` is
+     * rejected with `invalid_request`.
+     */
+    requirePushedAuthorizationRequests?: boolean;
+    /**
+     * OIDC Core §8.1 — when set, the subject identifier (`sub`) is derived
+     * as a pairwise pseudonym keyed by this string. Two clients sharing
+     * the same `sectorIdentifier` will see the same `sub`; different
+     * values yield different `sub`s for the same end user. Absent =
+     * public subject (sub is identical across all RPs).
+     */
+    sectorIdentifier?: string;
+    /** Phase 8. */
+    dpopRequired?: boolean;
+};
+export type ConfidentialClientConfig = {
+    id: string;
+    name: string;
+    type: "confidential";
+    /** Hash of the client secret. Required for confidential clients. */
+    secretHash: string;
+    redirectUris: string[];
+    grantTypes: GrantType[];
+    scopes: string[];
+    /**
+     * Default true. Disabling it is permitted for confidential clients but
+     * strongly discouraged; OAuth 2.1 §2.1.1 recommends PKCE for every client.
+     */
+    pkceRequired: boolean;
+    /**
+     * Registered URIs to which `/end_session` may redirect after RP-initiated
+     * logout (OIDC RP-Initiated Logout 1.0 §2). Exact-match.
+     */
+    postLogoutRedirectUris?: string[];
+    /**
+     * RFC 9126 §2: when `true`, the client MUST use Pushed Authorization
+     * Requests; a direct `GET /authorize` call without `request_uri` is
+     * rejected with `invalid_request`.
+     */
+    requirePushedAuthorizationRequests?: boolean;
+    /**
+     * OIDC Core §8.1 — see `PublicClientConfig.sectorIdentifier` for
+     * semantics. Same field; duplicated on each branch because the
+     * `ClientConfig` discriminated union doesn't share optional fields.
+     */
+    sectorIdentifier?: string;
+    /** Phase 8. */
+    dpopRequired?: boolean;
+};
+export type TenantConfig = {
+    id: TenantId;
+    displayName: string;
+    clients: ClientConfig[];
+    methods: MethodConfig[];
+    theme?: ThemeConfig;
+    /** Set when the tenant needs cross-subdomain SSO. */
+    cookieDomain?: string;
+    /** Override default refresh-token TTL (seconds). */
+    refreshTtl?: number;
+    /** Override default access-token TTL (seconds). */
+    accessTtl?: number;
+};
+/**
+ * Per-request tenant context handed to methods and the user-supplied
+ * `success` callback. `request.raw` is the Web Fetch `Request` the framework
+ * received; `request.custom` is whatever the host returned from the
+ * `IdPOptions.buildCustomContext` hook (request id, decoded JWT claims, mTLS
+ * cert info, geo hints — anything per-request that methods or `success`
+ * should see). Without the hook the blob is `{}`. The same blob is also
+ * persisted on the `FlowRecord` at `/authorize` time so it survives the
+ * upstream redirect and re-presents on the callback side.
+ */
+export type TenantContext = {
+    id: TenantId;
+    config: TenantConfig;
+    request: {
+        raw: Request;
+        custom: Record<string, unknown>;
+    };
+};
+/**
+ * Outcome of the framework's tenant-recovery chain, evaluated **before**
+ * `resolveTenant` runs on the incoming request. Each non-`fresh-request`
+ * variant carries a `flowId`; the framework consumes the matching
+ * `FlowRecord` and dispatches without consulting `resolveTenant`.
+ *
+ * Order of evaluation (see plan §"Tenant Recovery Across Redirects"):
+ *   1. If `callbackHostFor` configured AND host matches a known tenant:
+ *        a. `state` MAC-verifies → host-plus-mac
+ *        b. `flowId` in URI       → host-plus-uri
+ *        c. otherwise              → invalid_request, audit unrecoverable_flow
+ *   2. Else if `state` MAC-verifies → mac-state
+ *   3. Else if `flowId` in registered URI path/query → flow-id-in-uri
+ *   4. Else → fresh-request → call user's `resolveTenant(req)`
+ */
+export type TenantRecovery = {
+    kind: "mac-state";
+    tenantId: TenantId;
+    flowId: string;
+} | {
+    kind: "host-plus-uri";
+    tenantId: TenantId;
+    flowId: string;
+} | {
+    kind: "host-plus-mac";
+    tenantId: TenantId;
+    flowId: string;
+} | {
+    kind: "flow-id-in-uri";
+    tenantId: TenantId;
+    flowId: string;
+} | {
+    kind: "fresh-request";
+};
+/**
+ * Minimal envelope MACed into the `state` query parameter. Intentionally
+ * tiny — under 256 base64url bytes — so it stays clear of provider URL
+ * limits. **No sensitive data must ever be added here.** Everything else
+ * lives in the server-side `FlowRecord`.
+ */
+export type StateEnvelope = {
+    tenantId: TenantId;
+    flowId: string;
+    /** Per-flow nonce. Distinct from the relying party's `state` param. */
+    nonce: string;
+    /** Key id of the HMAC key used to mint this envelope (`StateKeyRing` lookup). */
+    kid: string;
+};
+/**
+ * HMAC-SHA-256 key entry used to mint / verify the `state` envelope MAC.
+ * The 32-byte key is global (shared across IdP instances) — recovery has to
+ * work before tenant config is loaded, so per-tenant keys would create a
+ * bootstrap problem.
+ */
+export type StateKey = {
+    kid: string;
+    /** 32 raw bytes. */
+    key: Uint8Array;
+};
+/**
+ * State-MAC key ring with overlap-based rotation. `active` mints new state;
+ * any key in `verify` accepts existing state during its overlap window.
+ *
+ * Rotation cadence: monthly. The overlap window must be at least as long as
+ * the flow-record TTL (default 10 minutes); a 1-hour overlap is the
+ * recommended default. New keys are added to `verify` first, promoted to
+ * `active` on the next rotation, then dropped from `verify` after overlap.
+ */
+export type StateKeyRing = {
+    active: StateKey;
+    /** Includes `active` plus any previous keys still inside their overlap window. */
+    verify: ReadonlyArray<StateKey>;
+};
+//# sourceMappingURL=tenant.d.ts.map

package/dist/types/types/tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/types/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,QAA6B,CAAA;AAExE,qFAAqF;AACrF,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8DAA8D;IAC9D,YAAY,EAAE,IAAI,CAAA;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAA;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,QAAQ,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,QAAQ,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE;QACP,GAAG,EAAE,OAAO,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,kFAAkF;IAClF,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA"}

package/dist/types/types/token.d.ts

@@ -0,0 +1,231 @@
+/**
+ * Token-domain shapes — auth code payload (snapshot of `FlowRecord` at
+ * handoff), access-token claims, refresh-token payload, and the small
+ * envelopes the `TokenStore` persists.
+ *
+ * Per AD9, access tokens are JWTs (ES256 by default, Ed25519 optional per
+ * AD11) and refresh tokens are opaque server-side records.
+ */
+import type { ClaimsRequest } from "./authorization";
+import type { SubjectClaim } from "./subject";
+import type { TenantId } from "./tenant";
+/**
+ * Payload stored under an auth code. Built at callback time from the consumed
+ * `FlowRecord` plus the method's `success` result. Encrypted at rest by
+ * `TokenStore.saveCode` (see `ports/CONSISTENCY.md`).
+ *
+ * `methodState` is intentionally **not** snapshotted: it served its
+ * upstream-callback purpose and is dropped with the flow record.
+ */
+export type CodePayload = {
+    tenantId: TenantId;
+    clientId: string;
+    appRedirectUri: string;
+    /** Relying party's `state` param, echoed back at success. */
+    appState: string | null;
+    scopes: string[];
+    audience?: string;
+    /** Relying-party → IdP PKCE; verified at `/token` against the RP's verifier. */
+    clientPkce?: {
+        challenge: string;
+        method: "S256";
+    };
+    /** Tenant-local method instance id (`MethodConfig.id`). */
+    methodId: string;
+    /** Factory kind (`MethodConfig.kind`). */
+    methodKind: string;
+    /** User's `requestContext` snapshot, if any. */
+    context?: Record<string, unknown> | null;
+    /** Upstream system's stable identifier (from `MethodResult.success`). */
+    providerSubject: string;
+    /** Typed-per-method properties from `MethodResult.success`. */
+    properties: unknown;
+    /**
+     * Relying party's OIDC `nonce` (OIDC Core §3.1.2.1). Snapshotted from
+     * `FlowRecord.appNonce`. Echoed into the issued `id_token` when present.
+     */
+    appNonce?: string;
+    /**
+     * Seconds-since-epoch when end-user authentication completed
+     * (OIDC Core §2 `auth_time`). Stamped at the moment the method's
+     * `MethodResult.success` fires. Carried into the `id_token` and forward
+     * across refresh-token rotations.
+     */
+    authTime: number;
+    /** OIDC Core §5.5 — RP-requested claims; honored at id_token + /userinfo. */
+    claimsRequest?: ClaimsRequest;
+    /** Auth-code TTL is 60 s — framework refuses anything longer. */
+    expiresAt: number;
+};
+/**
+ * OIDC Core §5.1 `address` claim. Structured object value rather than a
+ * scalar — distinct from the rest of the profile fields.
+ */
+export type AddressClaim = {
+    formatted?: string;
+    street_address?: string;
+    locality?: string;
+    region?: string;
+    postal_code?: string;
+    country?: string;
+};
+/**
+ * OIDC Core §5.1 profile / email / phone / address claims, gated by the
+ * `profile` / `email` / `phone` / `address` scopes via §5.4. Reused by
+ * `IdTokenClaims` and the `/userinfo` response so the two surfaces share
+ * exactly one source of truth for scope→claim mapping.
+ *
+ * Every field is optional: presence depends on (a) which scopes were
+ * granted and (b) whether the host populated the matching key in
+ * `SubjectClaim.properties`.
+ */
+export type ScopedProfileClaims = {
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    middle_name?: string;
+    nickname?: string;
+    preferred_username?: string;
+    profile?: string;
+    picture?: string;
+    website?: string;
+    gender?: string;
+    birthdate?: string;
+    zoneinfo?: string;
+    locale?: string;
+    updated_at?: number;
+    email?: string;
+    email_verified?: boolean;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    address?: AddressClaim;
+};
+/**
+ * OIDC `id_token` JWT claims this IdP issues at `/token` when `openid`
+ * scope is granted (OIDC Core §2). Distinct from access-token claims:
+ *
+ *  - `aud` is the relying-party `client_id` (not the API audience).
+ *  - `nonce` echoes the RP's `/authorize` `nonce` parameter when present.
+ *  - `auth_time` is stable across refresh-token rotations (OIDC Core §12).
+ *  - `at_hash` is recommended whenever an id_token and access_token are
+ *    returned in the same response (§3.1.3.6).
+ *
+ * Standard OIDC claim names use snake_case on the wire; TypeScript field
+ * names match to keep the marshalling 1:1.
+ */
+export type IdTokenClaims = ScopedProfileClaims & {
+    iss: string;
+    sub: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    /** Seconds-since-epoch when end-user auth completed. */
+    auth_time?: number;
+    /** RP-supplied OIDC nonce, when present. MUST equal the `/authorize` value. */
+    nonce?: string;
+    /** Authentication Methods References (RFC 8176). */
+    amr?: string[];
+    /** Authentication Context Class Reference. */
+    acr?: string;
+    /** Authorized party — the client_id of the party the id_token is for. */
+    azp?: string;
+    /** Access-token hash (OIDC Core §3.1.3.6). */
+    at_hash?: string;
+};
+/** Access-token JWT claims this IdP issues. */
+export type AccessTokenClaims = {
+    iss: string;
+    sub: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    /** Tenant id. */
+    tid: TenantId;
+    /** Tenant-local method instance id that originated this token. */
+    mid?: string;
+    /** Factory kind that originated this token. */
+    mkind?: string;
+    scope?: string;
+    /**
+     * Seconds-since-epoch when the end-user originally authenticated
+     * (OIDC Core §2). Stable across refresh-token rotation and across
+     * RFC 8693 token-exchange (§12 — exchanging an audience does NOT
+     * re-authenticate the user). Absent on `client_credentials` grants
+     * where there is no end-user.
+     *
+     * Carried on the access token so RFC 8693 `subject_token` consumers
+     * can propagate it without needing the original id_token. Resource
+     * servers typically ignore it; it's there for the IdP's own
+     * downstream issuance.
+     */
+    auth_time?: number;
+    /** DPoP confirmation claim (Phase 8). */
+    cnf?: {
+        jkt: string;
+    };
+    /**
+     * OIDC Core §5.5 — list of claim names the RP requested for the
+     * `/userinfo` response via the `claims` parameter. The resource server
+     * surface uses this to bypass scope-gating per §5.5; it is empty /
+     * absent when the RP did not use the `claims` parameter.
+     */
+    uic?: string[];
+    /** The structured subject (matches `SubjectClaim`). Inlined for resource servers. */
+    claim: SubjectClaim;
+};
+/**
+ * Opaque refresh-token payload — persisted in `TokenStore` with strong CAS
+ * semantics (see `ports/CONSISTENCY.md`). The token itself is a random
+ * string; the payload is what the store returns on consume.
+ */
+export type RefreshTokenPayload = {
+    tenantId: TenantId;
+    clientId: string;
+    /** Stable subject id derived from the issued `SubjectClaim`. */
+    subjectId: string;
+    claim: SubjectClaim;
+    scopes: string[];
+    audience?: string;
+    /** Reuse-detection chain id. Rotation issues a new token with the same family. */
+    family: string;
+    /**
+     * Tenant-local method instance id (`MethodConfig.id`) that originated the
+     * chain. Preserved across `refresh_token` rotations so descendant access
+     * tokens carry the original `mid` / `mkind` claims instead of the
+     * grant-type literal "refresh".
+     */
+    methodId: string;
+    /** Factory kind (`MethodConfig.kind`) that originated the chain. */
+    methodKind: string;
+    /**
+     * Seconds-since-epoch when end-user authentication originally completed
+     * (OIDC Core §2 `auth_time`). Stable across refresh-token rotations —
+     * `auth_time` does **not** advance on refresh, only on re-authentication.
+     */
+    authTime: number;
+    /**
+     * RFC 7638 JWK thumbprint of the client's DPoP key (RFC 9449 §6.1).
+     * Present when the original token grant was DPoP-bound. Refresh-grant
+     * rotation REQUIRES a fresh DPoP proof whose thumbprint matches; absent
+     * = the token is plain Bearer and Bearer is acceptable on refresh.
+     */
+    dpopJkt?: string;
+    /**
+     * OIDC Core §12 — the original RP-requested claims, preserved so
+     * refresh-grant id_token + /userinfo responses keep returning them.
+     */
+    claimsRequest?: ClaimsRequest;
+    /** Wall-clock issuance and absolute-expiry timestamps. */
+    issuedAt: number;
+    expiresAt: number;
+};
+/** Response body of `/token` (RFC 6749 §5.1). */
+export type TokenResponse = {
+    access_token: string;
+    token_type: "Bearer" | "DPoP";
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+    id_token?: string;
+};
+//# sourceMappingURL=token.d.ts.map

package/dist/types/types/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/types/token.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAClD,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACxC,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,+DAA+D;IAC/D,UAAU,EAAE,OAAO,CAAA;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAEhC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IAExB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAE/B,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,mBAAmB,GAAG;IAChD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACd,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,iBAAiB;IACjB,GAAG,EAAE,QAAQ,CAAA;IACb,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yCAAyC;IACzC,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACrB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACd,qFAAqF;IACrF,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA"}

package/dist/types/ui/forms.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Server-rendered HTML helpers for the bundled credential methods and the
+ * default authorization picker.
+ *
+ * Intentionally minimal — zero JS, no client framework. Hosts that want a
+ * richer UI override `IdPOptions.renderPicker` (for method selection) or
+ * supply their own `success-response` from method handlers (for credential
+ * forms). The helpers escape user-provided strings so callers can drop
+ * arbitrary labels or error messages without thinking about XSS.
+ */
+export declare function escapeHtml(s: string): string;
+export declare const BASE_STYLES = "\n:root {\n  color-scheme: light dark;\n\n  --bg-page: #eef0f4;\n  --bg-card: #ffffff;\n  --bg-input: #ffffff;\n  --bg-row: #f5f6f8;\n  --bg-row-hover: #eaecf1;\n  --fg-high: #0e1116;\n  --fg-mid: #4a5160;\n  --fg-low: #8b93a3;\n  --border: #d8dce3;\n  --border-strong: #9aa3b2;\n  --primary: #2f3137;\n  --primary-fg: #ffffff;\n  --primary-hover: #1b1d22;\n  --focus-ring: rgba(47, 49, 55, 0.18);\n  --error-bg: #fdecec;\n  --error-fg: #8a1a1a;\n  --radius: 8px;\n  --shadow-card: 0 1px 2px rgba(15, 18, 25, 0.04), 0 12px 28px rgba(15, 18, 25, 0.08);\n}\n\n@media (prefers-color-scheme: dark) {\n  :root {\n    --bg-page: #0e0f12;\n    --bg-card: #16181d;\n    --bg-input: #1c1f25;\n    --bg-row: #20242c;\n    --bg-row-hover: #2a2f38;\n    --fg-high: #f3f4f6;\n    --fg-mid: #b6bcc7;\n    --fg-low: #7a8190;\n    --border: #2a2e36;\n    --border-strong: #3a4049;\n    --primary: #f3f4f6;\n    --primary-fg: #0e1116;\n    --primary-hover: #ffffff;\n    --focus-ring: rgba(243, 244, 246, 0.22);\n    --error-bg: #2a1414;\n    --error-fg: #f5b4b4;\n    --shadow-card: 0 1px 2px rgba(0, 0, 0, 0.5), 0 18px 40px rgba(0, 0, 0, 0.5);\n  }\n}\n\n* { box-sizing: border-box; }\n\nhtml, body { margin: 0; padding: 0; }\n\nbody {\n  min-height: 100vh;\n  background: var(--bg-page);\n  color: var(--fg-high);\n  font-family: ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", \"Inter\", \"Helvetica Neue\", sans-serif, \"Apple Color Emoji\", \"Segoe UI Emoji\";\n  font-size: 15px;\n  line-height: 1.45;\n  display: grid;\n  place-items: center;\n  padding: 1.5rem;\n  -webkit-font-smoothing: antialiased;\n  -moz-osx-font-smoothing: grayscale;\n}\n\nmain {\n  max-width: 380px;\n  width: 100%;\n  padding: 2rem 1.75rem;\n  background: var(--bg-card);\n  border-radius: var(--radius);\n  box-shadow: var(--shadow-card);\n}\n\nh1 {\n  font-size: 1.125rem;\n  font-weight: 600;\n  letter-spacing: -0.01em;\n  margin: 0 0 1.25rem;\n  color: var(--fg-high);\n}\n\nform {\n  display: grid;\n  gap: 0.85rem;\n  margin: 0;\n}\n\nlabel {\n  display: grid;\n  gap: 0.4rem;\n  font-size: 0.78rem;\n  font-weight: 500;\n  color: var(--fg-mid);\n  text-transform: none;\n}\n\ninput {\n  width: 100%;\n  height: 2.5rem;\n  padding: 0 0.85rem;\n  background: var(--bg-input);\n  color: var(--fg-high);\n  border: 1px solid var(--border);\n  border-radius: calc(var(--radius) - 2px);\n  font-size: 0.95rem;\n  font-family: inherit;\n  outline: none;\n  transition: border-color 120ms ease, box-shadow 120ms ease;\n}\ninput::placeholder { color: var(--fg-low); }\ninput:hover { border-color: var(--border-strong); }\ninput:focus {\n  border-color: var(--primary);\n  box-shadow: 0 0 0 3px var(--focus-ring);\n}\ninput:user-invalid:not(:focus) {\n  border-color: var(--error-fg);\n}\n\nbutton {\n  height: 2.5rem;\n  padding: 0 1rem;\n  border: 0;\n  border-radius: calc(var(--radius) - 2px);\n  background: var(--primary);\n  color: var(--primary-fg);\n  font-family: inherit;\n  font-size: 0.9rem;\n  font-weight: 600;\n  letter-spacing: 0.01em;\n  cursor: pointer;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  gap: 0.5rem;\n  transition: background 120ms ease, transform 80ms ease;\n}\nbutton:hover { background: var(--primary-hover); }\nbutton:active { transform: translateY(1px); }\nbutton:focus-visible { box-shadow: 0 0 0 3px var(--focus-ring); outline: none; }\n\n.error {\n  display: flex;\n  align-items: center;\n  min-height: 2.25rem;\n  padding: 0.5rem 0.85rem;\n  margin: 0 0 0.25rem;\n  background: var(--error-bg);\n  color: var(--error-fg);\n  font-size: 0.82rem;\n  border-radius: calc(var(--radius) - 2px);\n}\n\n.methods {\n  list-style: none;\n  padding: 0;\n  margin: 0;\n  display: grid;\n  gap: 0.5rem;\n}\n.methods a {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  min-height: 2.75rem;\n  padding: 0 1rem;\n  background: var(--bg-row);\n  border: 1px solid var(--border);\n  border-radius: calc(var(--radius) - 2px);\n  color: var(--fg-high);\n  font-size: 0.92rem;\n  font-weight: 500;\n  text-decoration: none;\n  transition: background 120ms ease, border-color 120ms ease, transform 80ms ease;\n}\n.methods a::after {\n  content: \"\u203A\";\n  color: var(--fg-mid);\n  font-size: 1.15rem;\n  font-weight: 500;\n  line-height: 1;\n}\n.methods a:hover {\n  background: var(--bg-row-hover);\n  border-color: var(--border-strong);\n  color: var(--fg-high);\n}\n.methods a:hover::after {\n  color: var(--fg-high);\n}\n.methods a:active { transform: translateY(1px); }\n.methods a:focus-visible {\n  outline: none;\n  border-color: var(--primary);\n  box-shadow: 0 0 0 3px var(--focus-ring);\n}\n";
+export declare function htmlPage(opts: {
+    title: string;
+    body: string;
+}): string;
+export type FormField = {
+    name: string;
+    label: string;
+    type?: "text" | "password" | "email" | "tel";
+    value?: string;
+    required?: boolean;
+    autocomplete?: string;
+    inputmode?: string;
+};
+/** Build a `<form>` POSTing to `action`. */
+export declare function renderForm(opts: {
+    title: string;
+    action: string;
+    fields: FormField[];
+    submit: string;
+    error?: string;
+    hidden?: Record<string, string>;
+}): string;
+//# sourceMappingURL=forms.d.ts.map

package/dist/types/ui/forms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms.d.ts","sourceRoot":"","sources":["../../../src/ui/forms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAiB5C;AAED,eAAO,MAAM,WAAW,+jJAoMvB,CAAA;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAatE;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,KAAK,CAAA;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,4CAA4C;AAC5C,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,SAAS,EAAE,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC,GAAG,MAAM,CA2BT"}

package/dist/types/ui/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Public surface for the built-in server-rendered UI helpers.
+ *
+ * Hosts who want their own UI typically don't import from here at all —
+ * they intercept at the host application layer. Hosts that want to keep
+ * the defaults but tweak around the edges (e.g. supply a custom picker
+ * while keeping the default credential forms) can pull renderForm /
+ * renderPicker from here.
+ */
+export { renderForm, escapeHtml, htmlPage, BASE_STYLES } from "./forms";
+export type { FormField } from "./forms";
+export { renderPicker, buildMethodLink } from "./picker";
+export type { PickerMethod, PickerContext } from "./picker";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/ui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ui/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACvE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AACxD,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}

package/dist/types/ui/picker.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Default provider picker — rendered when an `/authorize` request matches
+ * more than one enabled method and no `method_id` was specified.
+ *
+ * Hosts that want a fully custom UI override `IdPOptions.renderPicker`.
+ * Both the default and any override return a `Response`; the framework
+ * applies caching headers afterward.
+ */
+import type { PickerContext, PickerMethod } from "../types/picker";
+export type { PickerContext, PickerMethod };
+/**
+ * Build an `/authorize` URL that pre-selects a specific `method_id` while
+ * carrying every other OAuth param through unchanged.
+ */
+export declare function buildMethodLink(methodId: string, ctx: PickerContext): string;
+/** Default styled HTML picker. */
+export declare function renderPicker(methods: PickerMethod[], ctx: PickerContext): Response;
+//# sourceMappingURL=picker.d.ts.map

package/dist/types/ui/picker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"picker.d.ts","sourceRoot":"","sources":["../../../src/ui/picker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAGlE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;AAE3C;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAgB5E;AAED,kCAAkC;AAClC,wBAAgB,YAAY,CAC1B,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,GACjB,QAAQ,CAeV"}