@aooth/auth 0.1.8 → 0.1.9

package/dist/authz.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_clock = require("./clock-Bl-H3eqE.cjs");
 let node_crypto = require("node:crypto");
+let jose = require("jose");
 //#region src/authz/authz-errors.ts
 /** A typed authorization-server failure. */
 var AuthorizeError = class extends Error {
@@ -52,11 +53,205 @@ var LoopbackClientPolicy = class {
 		if (!isLoopbackRedirectUri(args.redirectUri)) throw new AuthorizeError("invalid_redirect", "redirect_uri must be a loopback address");
 		return {
 			redirectUri: args.redirectUri,
-			tokenPolicy: structuredClone(this.tokenPolicy)
+			tokenPolicy: structuredClone(this.tokenPolicy),
+			...args.scope !== void 0 && { scope: args.scope }
 		};
 	}
 };
 //#endregion
+//#region src/authz/oidc-claims-resolver.ts
+/**
+* Resolves the OIDC profile claims to embed in an `id_token` for a given user +
+* granted scope (AUTH-SERVER.md §4.9). The authorization server already controls
+* the registered claims (`iss`/`aud`/`sub`/`iat`/`exp`/`nonce`) itself — this seam
+* supplies the **profile** claims that depend on the consumer's user shape
+* (`email`/`email_verified`/`name`/`picture`), which `@aooth/auth` cannot know.
+*
+* Pluggable like every other store/policy: the no-op default ({@link NoopOidcClaimsResolver},
+* `sub`-only tokens) ships, and a consumer subclasses it to read its own user
+* record. Bound in `@aooth/auth-moost` under `OIDC_CLAIMS_RESOLVER_TOKEN`.
+*
+* The map's keys are standard OIDC claim names; values MUST be JSON-safe. Honour
+* the granted `scope` — only emit `email`/`email_verified` under `email`, and
+* `name`/`picture`/etc. under `profile`, so a client receives only what it asked
+* for (and was allowed).
+*/
+var OidcClaimsResolver = class {};
+/** Default resolver: emits no profile claims, so the `id_token` carries only `sub` + the registered claims. */
+var NoopOidcClaimsResolver = class extends OidcClaimsResolver {
+	resolveClaims() {
+		return {};
+	}
+};
+/** `true` when `scope` (space-joined) grants `claim` — `"email"`/`"profile"` etc. */
+function scopeGrants(scope, claim) {
+	if (!scope) return false;
+	return scope.split(/\s+/u).includes(claim);
+}
+//#endregion
+//#region src/authz/registered-client-policy.ts
+/**
+* Tier-2 policy: a static registry of first-party clients. `resolveClient`
+* authorizes the client + `redirect_uri` (against the registered allowlist) and
+* resolves the granted scope + what the grant delivers (`id_token`/`access_token`,
+* `aud = client_id`); `authenticateClient` authenticates the client at `/token`
+* (`client_secret` for confidential clients; PKCE is the binding for public ones).
+* An unregistered client or an unlisted redirect is rejected.
+*/
+var RegisteredClientPolicy = class {
+	clients = /* @__PURE__ */ new Map();
+	constructor(opts) {
+		for (const c of opts.clients) this.clients.set(c.clientId, c);
+	}
+	resolveClient(args) {
+		const client = this.requireClient(args.clientId);
+		if (!this.redirectAllowed(client, args.redirectUri)) throw new AuthorizeError("invalid_redirect", "redirect_uri is not registered for this client");
+		const scope = this.grantScope(client, args.scope);
+		const idToken = client.idToken !== false && scopeGrants(scope, "openid");
+		return {
+			clientId: client.clientId,
+			redirectUri: args.redirectUri,
+			audience: client.clientId,
+			idToken,
+			accessToken: client.accessToken === true,
+			tokenPolicy: client.tokenPolicy ? structuredClone(client.tokenPolicy) : {},
+			...scope !== void 0 && { scope }
+		};
+	}
+	authenticateClient(args) {
+		const client = this.requireClient(args.clientId);
+		if ((client.type ?? "public") !== "confidential") return;
+		if (!client.clientSecret || !args.clientSecret || !timingSafeEqualStr(args.clientSecret, client.clientSecret)) throw new AuthorizeError("invalid_client", "client authentication failed");
+	}
+	requireClient(clientId) {
+		const client = clientId ? this.clients.get(clientId) : void 0;
+		if (!client) throw new AuthorizeError("invalid_client", "unknown client");
+		return client;
+	}
+	redirectAllowed(client, uri) {
+		if (client.redirectUris?.includes(uri)) return true;
+		if (!client.redirectPrefixes?.length) return false;
+		let normalized;
+		try {
+			normalized = new URL(uri).href;
+		} catch {
+			return false;
+		}
+		return client.redirectPrefixes.some((p) => {
+			if (p.length === 0 || !normalized.startsWith(p)) return false;
+			if (p.endsWith("/")) return true;
+			const next = normalized[p.length];
+			return next === void 0 || next === "/" || next === "?" || next === "#";
+		});
+	}
+	grantScope(client, requested) {
+		if (!requested) return void 0;
+		const req = requested.split(/\s+/u).filter(Boolean);
+		const granted = client.scopes ? req.filter((s) => client.scopes.includes(s)) : req;
+		return granted.length > 0 ? granted.join(" ") : void 0;
+	}
+};
+/** Constant-time string compare that also fails closed on a length mismatch. */
+function timingSafeEqualStr(a, b) {
+	const ab = Buffer.from(a, "utf8");
+	const bb = Buffer.from(b, "utf8");
+	if (ab.length !== bb.length) return false;
+	return (0, node_crypto.timingSafeEqual)(ab, bb);
+}
+//#endregion
+//#region src/authz/composite-client-policy.ts
+/**
+* Runs Tier-1 and Tier-2 side by side, dispatching on the **presence of
+* `client_id`** (AUTH-SERVER.md §10): a request with a `client_id` is a
+* registered client, one without is a loopback CLI. The split is the safety
+* boundary — a registered client is routed only to {@link RegisteredClientPolicy}
+* (which enforces ITS redirect allowlist, so it cannot smuggle a loopback
+* redirect), and a no-`client_id` request is routed only to the loopback policy
+* (so it cannot claim to be a registered client). Each sub-policy still owns its
+* own redirect validation; this only picks which one runs.
+*/
+var CompositeClientPolicy = class {
+	loopback;
+	registered;
+	constructor(opts) {
+		this.loopback = opts.loopback;
+		this.registered = opts.registered;
+	}
+	resolveClient(args) {
+		return args.clientId ? this.registered.resolveClient(args) : this.loopback.resolveClient(args);
+	}
+	authenticateClient(args) {
+		if (args.clientId) return this.registered.authenticateClient?.(args);
+	}
+};
+//#endregion
+//#region src/authz/id-token-signer.ts
+/**
+* Signs OIDC `id_token`s and publishes the matching JWKS (AUTH-SERVER.md §4.9).
+* Holds one asymmetric keypair; mints short-lived RS256/ES256 tokens with the
+* issuer + audience + subject a relying `OidcProvider` validates, and exports the
+* public half as a JWKS for `GET /auth/jwks`. Keys are imported lazily and cached
+* (the Apple-client-secret pattern), so construction is cheap and synchronous.
+*
+* Never used for the access token (that stays in `AuthCredential`'s store) — the
+* `id_token` is a separate, audience-bound identity assertion.
+*/
+var IdTokenSigner = class {
+	/** The `iss` claim + discovery `issuer` (read by `/.well-known/openid-configuration`). */
+	issuer;
+	/** Signature algorithm — published in discovery's `id_token_signing_alg_values_supported`. */
+	alg;
+	/** Key id — the JWS header + JWKS entry `kid`. */
+	kid;
+	privateKeyPem;
+	publicKeyPem;
+	ttlSec;
+	clock;
+	privateKeyPromise;
+	jwksPromise;
+	constructor(opts) {
+		this.issuer = opts.issuer.replace(/\/$/u, "");
+		this.alg = opts.alg ?? "RS256";
+		this.kid = opts.kid;
+		this.privateKeyPem = opts.privateKey;
+		this.publicKeyPem = opts.publicKey;
+		this.ttlSec = opts.ttlSec ?? 300;
+		this.clock = opts.clock ?? require_clock.defaultClock;
+	}
+	/** Mint a signed `id_token` JWT. Iat/exp come from the injected clock. */
+	async sign(claims) {
+		const key = await this.importPrivateKey();
+		const nowSec = Math.floor(this.clock.now() / 1e3);
+		const ttl = claims.ttlSec ?? this.ttlSec;
+		const payload = { ...claims.extra };
+		if (claims.nonce !== void 0) payload.nonce = claims.nonce;
+		return new jose.SignJWT(payload).setProtectedHeader({
+			alg: this.alg,
+			kid: this.kid,
+			typ: "JWT"
+		}).setIssuer(this.issuer).setSubject(claims.sub).setAudience(claims.aud).setIssuedAt(nowSec).setExpirationTime(nowSec + ttl).sign(key);
+	}
+	/**
+	* The JWKS document served at `/auth/jwks` — the public key as a single
+	* `use: "sig"` entry tagged with the same `kid`/`alg` as the minted tokens, so
+	* a verifier selects it by `kid`. Computed once and cached.
+	*/
+	async jwks() {
+		this.jwksPromise ??= (async () => {
+			const jwk = await (0, jose.exportJWK)(await (0, jose.importSPKI)(this.publicKeyPem, this.alg, { extractable: true }));
+			jwk.kid = this.kid;
+			jwk.alg = this.alg;
+			jwk.use = "sig";
+			return { keys: [jwk] };
+		})();
+		return this.jwksPromise;
+	}
+	importPrivateKey() {
+		this.privateKeyPromise ??= (0, jose.importPKCS8)(this.privateKeyPem, this.alg);
+		return this.privateKeyPromise;
+	}
+};
+//#endregion
 //#region src/authz/pending-authorization-store.ts
 /**
 * Storage seam for in-flight authorizations (AUTH-SERVER.md §4.3). Short-lived
@@ -91,7 +286,11 @@ var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
 			expiresAt: now + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
 			...rec.clientState !== void 0 && { clientState: rec.clientState },
-			...rec.scope !== void 0 && { scope: rec.scope }
+			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.nonce !== void 0 && { nonce: rec.nonce },
+			...rec.idToken !== void 0 && { idToken: rec.idToken },
+			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
+			...rec.audience !== void 0 && { audience: rec.audience }
 		};
 		this.store.set(row.handle, structuredClone(row));
 		return { handle: row.handle };
@@ -145,7 +344,12 @@ var AuthCodeStoreMemory = class extends AuthCodeStore {
 			redirectUri: rec.redirectUri,
 			tokenPolicy: structuredClone(rec.tokenPolicy),
 			expiresAt: this.clock.now() + this.ttlMs,
-			...rec.clientId !== void 0 && { clientId: rec.clientId }
+			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.nonce !== void 0 && { nonce: rec.nonce },
+			...rec.idToken !== void 0 && { idToken: rec.idToken },
+			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
+			...rec.audience !== void 0 && { audience: rec.audience }
 		};
 		this.store.set(code, structuredClone(row));
 		return { code };
@@ -162,7 +366,13 @@ var AuthCodeStoreMemory = class extends AuthCodeStore {
 exports.AuthCodeStore = AuthCodeStore;
 exports.AuthCodeStoreMemory = AuthCodeStoreMemory;
 exports.AuthorizeError = AuthorizeError;
+exports.CompositeClientPolicy = CompositeClientPolicy;
+exports.IdTokenSigner = IdTokenSigner;
 exports.LoopbackClientPolicy = LoopbackClientPolicy;
+exports.NoopOidcClaimsResolver = NoopOidcClaimsResolver;
+exports.OidcClaimsResolver = OidcClaimsResolver;
 exports.PendingAuthorizationStore = PendingAuthorizationStore;
 exports.PendingAuthorizationStoreMemory = PendingAuthorizationStoreMemory;
+exports.RegisteredClientPolicy = RegisteredClientPolicy;
 exports.isLoopbackRedirectUri = isLoopbackRedirectUri;
+exports.scopeGrants = scopeGrants;

package/dist/authz.d.cts

@@ -1,4 +1,5 @@
 import { t as Clock } from "./clock-BjXa0LXb.cjs";
+import { JWK } from "jose";
 
 //#region src/authz/token-policy.d.ts
 /**
@@ -34,7 +35,7 @@ interface TokenPolicy {
  * code. Messages are benign — they must not disclose whether a failure was an
  * unknown client vs. a bad redirect vs. an expired code.
  */
-type AuthorizeErrorCode = /** Missing or malformed parameter at `/authorize` or `/token`. */"invalid_request" /** `redirect_uri` is not an allowed (loopback / registered) target. */ | "invalid_redirect" /** Code unknown / expired / already-redeemed, or PKCE verifier mismatch (`/token`). */ | "invalid_grant" /** Unknown or unauthenticated client (Tier 2). */ | "invalid_client" /** The user declined the authorization (consent). */ | "access_denied" /** An unexpected server-side failure. */ | "server_error";
+type AuthorizeErrorCode = /** Missing or malformed parameter at `/authorize` or `/token`. */"invalid_request" /** `redirect_uri` is not an allowed (loopback / registered) target. */ | "invalid_redirect" /** Code unknown / expired / already-redeemed, or PKCE verifier mismatch (`/token`). */ | "invalid_grant" /** Unknown or unauthenticated client (Tier 2). */ | "invalid_client" /** A known client used a grant/response it is not allowed (Tier 2). */ | "unauthorized_client" /** The user declined the authorization (consent). */ | "access_denied" /** An unexpected server-side failure. */ | "server_error";
 /** A typed authorization-server failure. */
 declare class AuthorizeError extends Error {
   readonly code: AuthorizeErrorCode;
@@ -53,6 +54,21 @@ interface ResolvedClient {
   redirectUri: string;
   /** What the grant mints (fixed here, recorded on the pending authorization). */
   tokenPolicy: TokenPolicy;
+  /**
+   * Tier 2 (OIDC): mint an `id_token` with `aud` = {@link audience}. Omitted ⇒
+   * no `id_token` (Tier-1 loopback).
+   */
+  idToken?: boolean;
+  /**
+   * Mint an access token. **Omitted ⇒ minted** (preserves Tier-1 loopback,
+   * where the CLI gets an access token); set `false` for a pure-OIDC sign-in
+   * client that should receive identity only.
+   */
+  accessToken?: boolean;
+  /** The `id_token` `aud` (the registered `client_id`). */
+  audience?: string;
+  /** Granted scope (space-joined) — `requested ∩ allowed`; drives the `id_token` profile claims. */
+  scope?: string;
 }
 /**
  * The pluggable trust boundary of the authorization server (AUTH-SERVER.md §4.5):
@@ -72,7 +88,18 @@ interface ClientRedirectPolicy {
   resolveClient(args: {
     clientId?: string;
     redirectUri: string;
+    scope?: string;
   }): ResolvedClient | Promise<ResolvedClient>;
+  /**
+   * Tier 2: authenticate the client at `POST /auth/token` — verify the
+   * `client_secret` of a confidential client (PKCE is the binding for a public
+   * one). THROW an {@link AuthorizeError} (`invalid_client`) on failure. Optional:
+   * a public-only policy (loopback) omits it.
+   */
+  authenticateClient?(args: {
+    clientId?: string;
+    clientSecret?: string;
+  }): void | Promise<void>;
 }
 /**
  * `true` when `uri` is a syntactically valid http(s) URL whose host is a
@@ -103,9 +130,205 @@ declare class LoopbackClientPolicy implements ClientRedirectPolicy {
   resolveClient(args: {
     clientId?: string;
     redirectUri: string;
+    scope?: string;
   }): ResolvedClient;
 }
 //#endregion
+//#region src/authz/registered-client-policy.d.ts
+/**
+ * One registered first-party client (AUTH-SERVER.md §4.5). The registry is the
+ * open-redirect / token-theft boundary, so a client's `redirect_uri` allowlist
+ * and what it may receive are declared HERE, never inferred from the request.
+ */
+interface RegisteredClient {
+  /** Stable client identifier; the `id_token` `aud`. */
+  clientId: string;
+  /** Exact-match `redirect_uri` allowlist (the safe default). */
+  redirectUris?: string[];
+  /**
+   * Strict-prefix `redirect_uri` allowlist (an entry must be a non-empty prefix
+   * of the request). Looser than exact match — only use for a tightly-scoped
+   * path prefix on a trusted origin.
+   */
+  redirectPrefixes?: string[];
+  /** `"public"` (PKCE only) or `"confidential"` (PKCE + `client_secret`). Default `"public"`. */
+  type?: "public" | "confidential";
+  /** Shared secret for a confidential client (compared in constant time at `/token`). */
+  clientSecret?: string;
+  /** Mint an `id_token` (requires the granted scope to include `openid`). Default `true`. */
+  idToken?: boolean;
+  /** Also mint an access token for the main API. Default `false` — a pure sign-in client gets identity only. */
+  accessToken?: boolean;
+  /** Allowed scopes; the granted scope is `requested ∩ allowed`. Omit to allow any requested scope. */
+  scopes?: string[];
+  /** Token policy for the access token, when `accessToken` is set. */
+  tokenPolicy?: TokenPolicy;
+}
+interface RegisteredClientPolicyOptions {
+  clients: RegisteredClient[];
+}
+/**
+ * Tier-2 policy: a static registry of first-party clients. `resolveClient`
+ * authorizes the client + `redirect_uri` (against the registered allowlist) and
+ * resolves the granted scope + what the grant delivers (`id_token`/`access_token`,
+ * `aud = client_id`); `authenticateClient` authenticates the client at `/token`
+ * (`client_secret` for confidential clients; PKCE is the binding for public ones).
+ * An unregistered client or an unlisted redirect is rejected.
+ */
+declare class RegisteredClientPolicy implements ClientRedirectPolicy {
+  private readonly clients;
+  constructor(opts: RegisteredClientPolicyOptions);
+  resolveClient(args: {
+    clientId?: string;
+    redirectUri: string;
+    scope?: string;
+  }): ResolvedClient;
+  authenticateClient(args: {
+    clientId?: string;
+    clientSecret?: string;
+  }): void;
+  private requireClient;
+  private redirectAllowed;
+  private grantScope;
+}
+//#endregion
+//#region src/authz/composite-client-policy.d.ts
+interface CompositeClientPolicyOptions {
+  /** Used when the request carries NO `client_id` (Tier-1 public/loopback CLI). */
+  loopback: ClientRedirectPolicy;
+  /** Used when the request carries a `client_id` (Tier-2 registered service). */
+  registered: ClientRedirectPolicy;
+}
+/**
+ * Runs Tier-1 and Tier-2 side by side, dispatching on the **presence of
+ * `client_id`** (AUTH-SERVER.md §10): a request with a `client_id` is a
+ * registered client, one without is a loopback CLI. The split is the safety
+ * boundary — a registered client is routed only to {@link RegisteredClientPolicy}
+ * (which enforces ITS redirect allowlist, so it cannot smuggle a loopback
+ * redirect), and a no-`client_id` request is routed only to the loopback policy
+ * (so it cannot claim to be a registered client). Each sub-policy still owns its
+ * own redirect validation; this only picks which one runs.
+ */
+declare class CompositeClientPolicy implements ClientRedirectPolicy {
+  private readonly loopback;
+  private readonly registered;
+  constructor(opts: CompositeClientPolicyOptions);
+  resolveClient(args: {
+    clientId?: string;
+    redirectUri: string;
+    scope?: string;
+  }): ResolvedClient | Promise<ResolvedClient>;
+  authenticateClient(args: {
+    clientId?: string;
+    clientSecret?: string;
+  }): void | Promise<void>;
+}
+//#endregion
+//#region src/authz/id-token-signer.d.ts
+/** Asymmetric signing algorithms an OIDC `id_token` may use (AUTH-SERVER.md §4.9). */
+type IdTokenAlg = "RS256" | "ES256";
+interface IdTokenSignerOptions {
+  /**
+   * The OIDC issuer — the `iss` claim AND the discovery `issuer`. A relying
+   * `OidcProvider` checks `id_token.iss` against this exactly, so it must match
+   * the value it was configured with (typically `{origin}/auth`).
+   */
+  issuer: string;
+  /** Signature algorithm. Default `"RS256"` (most universally accepted; `OidcProvider` accepts RS256/ES256). */
+  alg?: IdTokenAlg;
+  /** Key id — stamped in the JWS header AND the published JWKS entry, so a verifier matches the right key. */
+  kid: string;
+  /** PKCS8 PEM private key (lazily imported + cached). */
+  privateKey: string;
+  /** SPKI PEM public key — published in the JWKS so verifiers fetch it (lazily imported + cached). */
+  publicKey: string;
+  /** `id_token` lifetime in seconds. Default 300 (5 min — it is exchanged immediately). */
+  ttlSec?: number;
+  /** Injectable clock for deterministic `iat`/`exp` in tests. Defaults to wall-clock. */
+  clock?: Clock;
+}
+/** The claims the authorization server controls per-mint; profile claims ride `extra`. */
+interface IdTokenClaims {
+  /** Subject — the stable user id (the token subject). */
+  sub: string;
+  /** Audience — the requesting `client_id`. Binds the token to one client (§6 audience binding). */
+  aud: string;
+  /** Echoed from the `/authorize` request when present; a relying party checks it to defeat replay. */
+  nonce?: string;
+  /** Per-mint lifetime override (seconds). */
+  ttlSec?: number;
+  /** Profile/standard claims merged into the payload (e.g. `email`, `email_verified`, `name`). MUST be JSON-safe. */
+  extra?: Record<string, unknown>;
+}
+/**
+ * Signs OIDC `id_token`s and publishes the matching JWKS (AUTH-SERVER.md §4.9).
+ * Holds one asymmetric keypair; mints short-lived RS256/ES256 tokens with the
+ * issuer + audience + subject a relying `OidcProvider` validates, and exports the
+ * public half as a JWKS for `GET /auth/jwks`. Keys are imported lazily and cached
+ * (the Apple-client-secret pattern), so construction is cheap and synchronous.
+ *
+ * Never used for the access token (that stays in `AuthCredential`'s store) — the
+ * `id_token` is a separate, audience-bound identity assertion.
+ */
+declare class IdTokenSigner {
+  /** The `iss` claim + discovery `issuer` (read by `/.well-known/openid-configuration`). */
+  readonly issuer: string;
+  /** Signature algorithm — published in discovery's `id_token_signing_alg_values_supported`. */
+  readonly alg: IdTokenAlg;
+  /** Key id — the JWS header + JWKS entry `kid`. */
+  readonly kid: string;
+  private readonly privateKeyPem;
+  private readonly publicKeyPem;
+  private readonly ttlSec;
+  private readonly clock;
+  private privateKeyPromise?;
+  private jwksPromise?;
+  constructor(opts: IdTokenSignerOptions);
+  /** Mint a signed `id_token` JWT. Iat/exp come from the injected clock. */
+  sign(claims: IdTokenClaims): Promise<string>;
+  /**
+   * The JWKS document served at `/auth/jwks` — the public key as a single
+   * `use: "sig"` entry tagged with the same `kid`/`alg` as the minted tokens, so
+   * a verifier selects it by `kid`. Computed once and cached.
+   */
+  jwks(): Promise<{
+    keys: JWK[];
+  }>;
+  private importPrivateKey;
+}
+//#endregion
+//#region src/authz/oidc-claims-resolver.d.ts
+/**
+ * Resolves the OIDC profile claims to embed in an `id_token` for a given user +
+ * granted scope (AUTH-SERVER.md §4.9). The authorization server already controls
+ * the registered claims (`iss`/`aud`/`sub`/`iat`/`exp`/`nonce`) itself — this seam
+ * supplies the **profile** claims that depend on the consumer's user shape
+ * (`email`/`email_verified`/`name`/`picture`), which `@aooth/auth` cannot know.
+ *
+ * Pluggable like every other store/policy: the no-op default ({@link NoopOidcClaimsResolver},
+ * `sub`-only tokens) ships, and a consumer subclasses it to read its own user
+ * record. Bound in `@aooth/auth-moost` under `OIDC_CLAIMS_RESOLVER_TOKEN`.
+ *
+ * The map's keys are standard OIDC claim names; values MUST be JSON-safe. Honour
+ * the granted `scope` — only emit `email`/`email_verified` under `email`, and
+ * `name`/`picture`/etc. under `profile`, so a client receives only what it asked
+ * for (and was allowed).
+ */
+declare abstract class OidcClaimsResolver {
+  /**
+   * @param userId  the authenticated subject (the `id_token` `sub`).
+   * @param scope   the granted scope, space-joined (e.g. `"openid email profile"`), or undefined.
+   * @returns       a flat map of standard OIDC profile claims to merge into the `id_token`.
+   */
+  abstract resolveClaims(userId: string, scope: string | undefined): Record<string, unknown> | Promise<Record<string, unknown>>;
+}
+/** Default resolver: emits no profile claims, so the `id_token` carries only `sub` + the registered claims. */
+declare class NoopOidcClaimsResolver extends OidcClaimsResolver {
+  resolveClaims(): Record<string, unknown>;
+}
+/** `true` when `scope` (space-joined) grants `claim` — `"email"`/`"profile"` etc. */
+declare function scopeGrants(scope: string | undefined, claim: string): boolean;
+//#endregion
 //#region src/authz/pending-authorization-store.d.ts
 /**
  * One in-flight authorization request, recorded at `GET /auth/authorize` and
@@ -125,8 +348,16 @@ interface PendingAuthorization {
   codeChallenge: string;
   /** The client's `state`, echoed back on the redirect so the client can correlate. */
   clientState?: string;
-  /** Requested scope (space-joined), informational for Tier 1. */
+  /** Granted scope (space-joined) — `requested ∩ allowed`; drives the `id_token` profile claims. */
   scope?: string;
+  /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
+  nonce?: string;
+  /** Mint an `id_token` at `/token` (Tier 2). */
+  idToken?: boolean;
+  /** Mint an access token at `/token`. Omitted ⇒ minted (Tier-1 loopback). */
+  accessToken?: boolean;
+  /** The `id_token` `aud` (the registered `client_id`). */
+  audience?: string;
   /** What the grant will mint (fixed at authorize time). */
   tokenPolicy: TokenPolicy;
   createdAt: number;
@@ -139,6 +370,10 @@ interface NewPendingAuthorization {
   codeChallenge: string;
   clientState?: string;
   scope?: string;
+  nonce?: string;
+  idToken?: boolean;
+  accessToken?: boolean;
+  audience?: string;
   tokenPolicy: TokenPolicy;
 }
 /**
@@ -198,6 +433,16 @@ interface AuthCode {
   redirectUri: string;
   /** Registered client id (Tier 2), absent for a public/loopback client. */
   clientId?: string;
+  /** Granted scope (space-joined) — drives the `id_token` profile claims. */
+  scope?: string;
+  /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
+  nonce?: string;
+  /** Mint an `id_token` at `/token` (Tier 2). */
+  idToken?: boolean;
+  /** Mint an access token at `/token`. Omitted ⇒ minted (Tier-1 loopback). */
+  accessToken?: boolean;
+  /** The `id_token` `aud` (the registered `client_id`). */
+  audience?: string;
   /** What `/token` mints when this code is redeemed. */
   tokenPolicy: TokenPolicy;
   expiresAt: number;
@@ -208,6 +453,11 @@ interface NewAuthCode {
   codeChallenge: string;
   redirectUri: string;
   clientId?: string;
+  scope?: string;
+  nonce?: string;
+  idToken?: boolean;
+  accessToken?: boolean;
+  audience?: string;
   tokenPolicy: TokenPolicy;
 }
 /**
@@ -249,4 +499,4 @@ declare class AuthCodeStoreMemory extends AuthCodeStore {
   consume(code: string): Promise<AuthCode | null>;
 }
 //#endregion
-export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri };
+export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, CompositeClientPolicy, type CompositeClientPolicyOptions, type IdTokenAlg, type IdTokenClaims, IdTokenSigner, type IdTokenSignerOptions, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, NoopOidcClaimsResolver, OidcClaimsResolver, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type RegisteredClient, RegisteredClientPolicy, type RegisteredClientPolicyOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri, scopeGrants };

package/dist/authz.d.mts

@@ -1,4 +1,5 @@
 import { t as Clock } from "./clock-BjXa0LXb.mjs";
+import { JWK } from "jose";
 
 //#region src/authz/token-policy.d.ts
 /**
@@ -34,7 +35,7 @@ interface TokenPolicy {
  * code. Messages are benign — they must not disclose whether a failure was an
  * unknown client vs. a bad redirect vs. an expired code.
  */
-type AuthorizeErrorCode = /** Missing or malformed parameter at `/authorize` or `/token`. */"invalid_request" /** `redirect_uri` is not an allowed (loopback / registered) target. */ | "invalid_redirect" /** Code unknown / expired / already-redeemed, or PKCE verifier mismatch (`/token`). */ | "invalid_grant" /** Unknown or unauthenticated client (Tier 2). */ | "invalid_client" /** The user declined the authorization (consent). */ | "access_denied" /** An unexpected server-side failure. */ | "server_error";
+type AuthorizeErrorCode = /** Missing or malformed parameter at `/authorize` or `/token`. */"invalid_request" /** `redirect_uri` is not an allowed (loopback / registered) target. */ | "invalid_redirect" /** Code unknown / expired / already-redeemed, or PKCE verifier mismatch (`/token`). */ | "invalid_grant" /** Unknown or unauthenticated client (Tier 2). */ | "invalid_client" /** A known client used a grant/response it is not allowed (Tier 2). */ | "unauthorized_client" /** The user declined the authorization (consent). */ | "access_denied" /** An unexpected server-side failure. */ | "server_error";
 /** A typed authorization-server failure. */
 declare class AuthorizeError extends Error {
   readonly code: AuthorizeErrorCode;
@@ -53,6 +54,21 @@ interface ResolvedClient {
   redirectUri: string;
   /** What the grant mints (fixed here, recorded on the pending authorization). */
   tokenPolicy: TokenPolicy;
+  /**
+   * Tier 2 (OIDC): mint an `id_token` with `aud` = {@link audience}. Omitted ⇒
+   * no `id_token` (Tier-1 loopback).
+   */
+  idToken?: boolean;
+  /**
+   * Mint an access token. **Omitted ⇒ minted** (preserves Tier-1 loopback,
+   * where the CLI gets an access token); set `false` for a pure-OIDC sign-in
+   * client that should receive identity only.
+   */
+  accessToken?: boolean;
+  /** The `id_token` `aud` (the registered `client_id`). */
+  audience?: string;
+  /** Granted scope (space-joined) — `requested ∩ allowed`; drives the `id_token` profile claims. */
+  scope?: string;
 }
 /**
  * The pluggable trust boundary of the authorization server (AUTH-SERVER.md §4.5):
@@ -72,7 +88,18 @@ interface ClientRedirectPolicy {
   resolveClient(args: {
     clientId?: string;
     redirectUri: string;
+    scope?: string;
   }): ResolvedClient | Promise<ResolvedClient>;
+  /**
+   * Tier 2: authenticate the client at `POST /auth/token` — verify the
+   * `client_secret` of a confidential client (PKCE is the binding for a public
+   * one). THROW an {@link AuthorizeError} (`invalid_client`) on failure. Optional:
+   * a public-only policy (loopback) omits it.
+   */
+  authenticateClient?(args: {
+    clientId?: string;
+    clientSecret?: string;
+  }): void | Promise<void>;
 }
 /**
  * `true` when `uri` is a syntactically valid http(s) URL whose host is a
@@ -103,9 +130,205 @@ declare class LoopbackClientPolicy implements ClientRedirectPolicy {
   resolveClient(args: {
     clientId?: string;
     redirectUri: string;
+    scope?: string;
   }): ResolvedClient;
 }
 //#endregion
+//#region src/authz/registered-client-policy.d.ts
+/**
+ * One registered first-party client (AUTH-SERVER.md §4.5). The registry is the
+ * open-redirect / token-theft boundary, so a client's `redirect_uri` allowlist
+ * and what it may receive are declared HERE, never inferred from the request.
+ */
+interface RegisteredClient {
+  /** Stable client identifier; the `id_token` `aud`. */
+  clientId: string;
+  /** Exact-match `redirect_uri` allowlist (the safe default). */
+  redirectUris?: string[];
+  /**
+   * Strict-prefix `redirect_uri` allowlist (an entry must be a non-empty prefix
+   * of the request). Looser than exact match — only use for a tightly-scoped
+   * path prefix on a trusted origin.
+   */
+  redirectPrefixes?: string[];
+  /** `"public"` (PKCE only) or `"confidential"` (PKCE + `client_secret`). Default `"public"`. */
+  type?: "public" | "confidential";
+  /** Shared secret for a confidential client (compared in constant time at `/token`). */
+  clientSecret?: string;
+  /** Mint an `id_token` (requires the granted scope to include `openid`). Default `true`. */
+  idToken?: boolean;
+  /** Also mint an access token for the main API. Default `false` — a pure sign-in client gets identity only. */
+  accessToken?: boolean;
+  /** Allowed scopes; the granted scope is `requested ∩ allowed`. Omit to allow any requested scope. */
+  scopes?: string[];
+  /** Token policy for the access token, when `accessToken` is set. */
+  tokenPolicy?: TokenPolicy;
+}
+interface RegisteredClientPolicyOptions {
+  clients: RegisteredClient[];
+}
+/**
+ * Tier-2 policy: a static registry of first-party clients. `resolveClient`
+ * authorizes the client + `redirect_uri` (against the registered allowlist) and
+ * resolves the granted scope + what the grant delivers (`id_token`/`access_token`,
+ * `aud = client_id`); `authenticateClient` authenticates the client at `/token`
+ * (`client_secret` for confidential clients; PKCE is the binding for public ones).
+ * An unregistered client or an unlisted redirect is rejected.
+ */
+declare class RegisteredClientPolicy implements ClientRedirectPolicy {
+  private readonly clients;
+  constructor(opts: RegisteredClientPolicyOptions);
+  resolveClient(args: {
+    clientId?: string;
+    redirectUri: string;
+    scope?: string;
+  }): ResolvedClient;
+  authenticateClient(args: {
+    clientId?: string;
+    clientSecret?: string;
+  }): void;
+  private requireClient;
+  private redirectAllowed;
+  private grantScope;
+}
+//#endregion
+//#region src/authz/composite-client-policy.d.ts
+interface CompositeClientPolicyOptions {
+  /** Used when the request carries NO `client_id` (Tier-1 public/loopback CLI). */
+  loopback: ClientRedirectPolicy;
+  /** Used when the request carries a `client_id` (Tier-2 registered service). */
+  registered: ClientRedirectPolicy;
+}
+/**
+ * Runs Tier-1 and Tier-2 side by side, dispatching on the **presence of
+ * `client_id`** (AUTH-SERVER.md §10): a request with a `client_id` is a
+ * registered client, one without is a loopback CLI. The split is the safety
+ * boundary — a registered client is routed only to {@link RegisteredClientPolicy}
+ * (which enforces ITS redirect allowlist, so it cannot smuggle a loopback
+ * redirect), and a no-`client_id` request is routed only to the loopback policy
+ * (so it cannot claim to be a registered client). Each sub-policy still owns its
+ * own redirect validation; this only picks which one runs.
+ */
+declare class CompositeClientPolicy implements ClientRedirectPolicy {
+  private readonly loopback;
+  private readonly registered;
+  constructor(opts: CompositeClientPolicyOptions);
+  resolveClient(args: {
+    clientId?: string;
+    redirectUri: string;
+    scope?: string;
+  }): ResolvedClient | Promise<ResolvedClient>;
+  authenticateClient(args: {
+    clientId?: string;
+    clientSecret?: string;
+  }): void | Promise<void>;
+}
+//#endregion
+//#region src/authz/id-token-signer.d.ts
+/** Asymmetric signing algorithms an OIDC `id_token` may use (AUTH-SERVER.md §4.9). */
+type IdTokenAlg = "RS256" | "ES256";
+interface IdTokenSignerOptions {
+  /**
+   * The OIDC issuer — the `iss` claim AND the discovery `issuer`. A relying
+   * `OidcProvider` checks `id_token.iss` against this exactly, so it must match
+   * the value it was configured with (typically `{origin}/auth`).
+   */
+  issuer: string;
+  /** Signature algorithm. Default `"RS256"` (most universally accepted; `OidcProvider` accepts RS256/ES256). */
+  alg?: IdTokenAlg;
+  /** Key id — stamped in the JWS header AND the published JWKS entry, so a verifier matches the right key. */
+  kid: string;
+  /** PKCS8 PEM private key (lazily imported + cached). */
+  privateKey: string;
+  /** SPKI PEM public key — published in the JWKS so verifiers fetch it (lazily imported + cached). */
+  publicKey: string;
+  /** `id_token` lifetime in seconds. Default 300 (5 min — it is exchanged immediately). */
+  ttlSec?: number;
+  /** Injectable clock for deterministic `iat`/`exp` in tests. Defaults to wall-clock. */
+  clock?: Clock;
+}
+/** The claims the authorization server controls per-mint; profile claims ride `extra`. */
+interface IdTokenClaims {
+  /** Subject — the stable user id (the token subject). */
+  sub: string;
+  /** Audience — the requesting `client_id`. Binds the token to one client (§6 audience binding). */
+  aud: string;
+  /** Echoed from the `/authorize` request when present; a relying party checks it to defeat replay. */
+  nonce?: string;
+  /** Per-mint lifetime override (seconds). */
+  ttlSec?: number;
+  /** Profile/standard claims merged into the payload (e.g. `email`, `email_verified`, `name`). MUST be JSON-safe. */
+  extra?: Record<string, unknown>;
+}
+/**
+ * Signs OIDC `id_token`s and publishes the matching JWKS (AUTH-SERVER.md §4.9).
+ * Holds one asymmetric keypair; mints short-lived RS256/ES256 tokens with the
+ * issuer + audience + subject a relying `OidcProvider` validates, and exports the
+ * public half as a JWKS for `GET /auth/jwks`. Keys are imported lazily and cached
+ * (the Apple-client-secret pattern), so construction is cheap and synchronous.
+ *
+ * Never used for the access token (that stays in `AuthCredential`'s store) — the
+ * `id_token` is a separate, audience-bound identity assertion.
+ */
+declare class IdTokenSigner {
+  /** The `iss` claim + discovery `issuer` (read by `/.well-known/openid-configuration`). */
+  readonly issuer: string;
+  /** Signature algorithm — published in discovery's `id_token_signing_alg_values_supported`. */
+  readonly alg: IdTokenAlg;
+  /** Key id — the JWS header + JWKS entry `kid`. */
+  readonly kid: string;
+  private readonly privateKeyPem;
+  private readonly publicKeyPem;
+  private readonly ttlSec;
+  private readonly clock;
+  private privateKeyPromise?;
+  private jwksPromise?;
+  constructor(opts: IdTokenSignerOptions);
+  /** Mint a signed `id_token` JWT. Iat/exp come from the injected clock. */
+  sign(claims: IdTokenClaims): Promise<string>;
+  /**
+   * The JWKS document served at `/auth/jwks` — the public key as a single
+   * `use: "sig"` entry tagged with the same `kid`/`alg` as the minted tokens, so
+   * a verifier selects it by `kid`. Computed once and cached.
+   */
+  jwks(): Promise<{
+    keys: JWK[];
+  }>;
+  private importPrivateKey;
+}
+//#endregion
+//#region src/authz/oidc-claims-resolver.d.ts
+/**
+ * Resolves the OIDC profile claims to embed in an `id_token` for a given user +
+ * granted scope (AUTH-SERVER.md §4.9). The authorization server already controls
+ * the registered claims (`iss`/`aud`/`sub`/`iat`/`exp`/`nonce`) itself — this seam
+ * supplies the **profile** claims that depend on the consumer's user shape
+ * (`email`/`email_verified`/`name`/`picture`), which `@aooth/auth` cannot know.
+ *
+ * Pluggable like every other store/policy: the no-op default ({@link NoopOidcClaimsResolver},
+ * `sub`-only tokens) ships, and a consumer subclasses it to read its own user
+ * record. Bound in `@aooth/auth-moost` under `OIDC_CLAIMS_RESOLVER_TOKEN`.
+ *
+ * The map's keys are standard OIDC claim names; values MUST be JSON-safe. Honour
+ * the granted `scope` — only emit `email`/`email_verified` under `email`, and
+ * `name`/`picture`/etc. under `profile`, so a client receives only what it asked
+ * for (and was allowed).
+ */
+declare abstract class OidcClaimsResolver {
+  /**
+   * @param userId  the authenticated subject (the `id_token` `sub`).
+   * @param scope   the granted scope, space-joined (e.g. `"openid email profile"`), or undefined.
+   * @returns       a flat map of standard OIDC profile claims to merge into the `id_token`.
+   */
+  abstract resolveClaims(userId: string, scope: string | undefined): Record<string, unknown> | Promise<Record<string, unknown>>;
+}
+/** Default resolver: emits no profile claims, so the `id_token` carries only `sub` + the registered claims. */
+declare class NoopOidcClaimsResolver extends OidcClaimsResolver {
+  resolveClaims(): Record<string, unknown>;
+}
+/** `true` when `scope` (space-joined) grants `claim` — `"email"`/`"profile"` etc. */
+declare function scopeGrants(scope: string | undefined, claim: string): boolean;
+//#endregion
 //#region src/authz/pending-authorization-store.d.ts
 /**
  * One in-flight authorization request, recorded at `GET /auth/authorize` and
@@ -125,8 +348,16 @@ interface PendingAuthorization {
   codeChallenge: string;
   /** The client's `state`, echoed back on the redirect so the client can correlate. */
   clientState?: string;
-  /** Requested scope (space-joined), informational for Tier 1. */
+  /** Granted scope (space-joined) — `requested ∩ allowed`; drives the `id_token` profile claims. */
   scope?: string;
+  /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
+  nonce?: string;
+  /** Mint an `id_token` at `/token` (Tier 2). */
+  idToken?: boolean;
+  /** Mint an access token at `/token`. Omitted ⇒ minted (Tier-1 loopback). */
+  accessToken?: boolean;
+  /** The `id_token` `aud` (the registered `client_id`). */
+  audience?: string;
   /** What the grant will mint (fixed at authorize time). */
   tokenPolicy: TokenPolicy;
   createdAt: number;
@@ -139,6 +370,10 @@ interface NewPendingAuthorization {
   codeChallenge: string;
   clientState?: string;
   scope?: string;
+  nonce?: string;
+  idToken?: boolean;
+  accessToken?: boolean;
+  audience?: string;
   tokenPolicy: TokenPolicy;
 }
 /**
@@ -198,6 +433,16 @@ interface AuthCode {
   redirectUri: string;
   /** Registered client id (Tier 2), absent for a public/loopback client. */
   clientId?: string;
+  /** Granted scope (space-joined) — drives the `id_token` profile claims. */
+  scope?: string;
+  /** OIDC `nonce` from the authorize request — echoed into the `id_token` (Tier 2). */
+  nonce?: string;
+  /** Mint an `id_token` at `/token` (Tier 2). */
+  idToken?: boolean;
+  /** Mint an access token at `/token`. Omitted ⇒ minted (Tier-1 loopback). */
+  accessToken?: boolean;
+  /** The `id_token` `aud` (the registered `client_id`). */
+  audience?: string;
   /** What `/token` mints when this code is redeemed. */
   tokenPolicy: TokenPolicy;
   expiresAt: number;
@@ -208,6 +453,11 @@ interface NewAuthCode {
   codeChallenge: string;
   redirectUri: string;
   clientId?: string;
+  scope?: string;
+  nonce?: string;
+  idToken?: boolean;
+  accessToken?: boolean;
+  audience?: string;
   tokenPolicy: TokenPolicy;
 }
 /**
@@ -249,4 +499,4 @@ declare class AuthCodeStoreMemory extends AuthCodeStore {
   consume(code: string): Promise<AuthCode | null>;
 }
 //#endregion
-export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri };
+export { type AuthCode, AuthCodeStore, AuthCodeStoreMemory, type AuthCodeStoreMemoryOptions, AuthorizeError, type AuthorizeErrorCode, type ClientRedirectPolicy, CompositeClientPolicy, type CompositeClientPolicyOptions, type IdTokenAlg, type IdTokenClaims, IdTokenSigner, type IdTokenSignerOptions, LoopbackClientPolicy, type LoopbackClientPolicyOptions, type NewAuthCode, type NewPendingAuthorization, NoopOidcClaimsResolver, OidcClaimsResolver, type PendingAuthorization, PendingAuthorizationStore, PendingAuthorizationStoreMemory, type PendingAuthorizationStoreMemoryOptions, type RegisteredClient, RegisteredClientPolicy, type RegisteredClientPolicyOptions, type ResolvedClient, type TokenPolicy, isLoopbackRedirectUri, scopeGrants };

package/dist/authz.mjs

@@ -1,5 +1,6 @@
 import { t as defaultClock } from "./clock-Bdsep_1j.mjs";
-import { randomUUID } from "node:crypto";
+import { randomUUID, timingSafeEqual } from "node:crypto";
+import { SignJWT, exportJWK, importPKCS8, importSPKI } from "jose";
 //#region src/authz/authz-errors.ts
 /** A typed authorization-server failure. */
 var AuthorizeError = class extends Error {
@@ -51,11 +52,205 @@ var LoopbackClientPolicy = class {
 		if (!isLoopbackRedirectUri(args.redirectUri)) throw new AuthorizeError("invalid_redirect", "redirect_uri must be a loopback address");
 		return {
 			redirectUri: args.redirectUri,
-			tokenPolicy: structuredClone(this.tokenPolicy)
+			tokenPolicy: structuredClone(this.tokenPolicy),
+			...args.scope !== void 0 && { scope: args.scope }
 		};
 	}
 };
 //#endregion
+//#region src/authz/oidc-claims-resolver.ts
+/**
+* Resolves the OIDC profile claims to embed in an `id_token` for a given user +
+* granted scope (AUTH-SERVER.md §4.9). The authorization server already controls
+* the registered claims (`iss`/`aud`/`sub`/`iat`/`exp`/`nonce`) itself — this seam
+* supplies the **profile** claims that depend on the consumer's user shape
+* (`email`/`email_verified`/`name`/`picture`), which `@aooth/auth` cannot know.
+*
+* Pluggable like every other store/policy: the no-op default ({@link NoopOidcClaimsResolver},
+* `sub`-only tokens) ships, and a consumer subclasses it to read its own user
+* record. Bound in `@aooth/auth-moost` under `OIDC_CLAIMS_RESOLVER_TOKEN`.
+*
+* The map's keys are standard OIDC claim names; values MUST be JSON-safe. Honour
+* the granted `scope` — only emit `email`/`email_verified` under `email`, and
+* `name`/`picture`/etc. under `profile`, so a client receives only what it asked
+* for (and was allowed).
+*/
+var OidcClaimsResolver = class {};
+/** Default resolver: emits no profile claims, so the `id_token` carries only `sub` + the registered claims. */
+var NoopOidcClaimsResolver = class extends OidcClaimsResolver {
+	resolveClaims() {
+		return {};
+	}
+};
+/** `true` when `scope` (space-joined) grants `claim` — `"email"`/`"profile"` etc. */
+function scopeGrants(scope, claim) {
+	if (!scope) return false;
+	return scope.split(/\s+/u).includes(claim);
+}
+//#endregion
+//#region src/authz/registered-client-policy.ts
+/**
+* Tier-2 policy: a static registry of first-party clients. `resolveClient`
+* authorizes the client + `redirect_uri` (against the registered allowlist) and
+* resolves the granted scope + what the grant delivers (`id_token`/`access_token`,
+* `aud = client_id`); `authenticateClient` authenticates the client at `/token`
+* (`client_secret` for confidential clients; PKCE is the binding for public ones).
+* An unregistered client or an unlisted redirect is rejected.
+*/
+var RegisteredClientPolicy = class {
+	clients = /* @__PURE__ */ new Map();
+	constructor(opts) {
+		for (const c of opts.clients) this.clients.set(c.clientId, c);
+	}
+	resolveClient(args) {
+		const client = this.requireClient(args.clientId);
+		if (!this.redirectAllowed(client, args.redirectUri)) throw new AuthorizeError("invalid_redirect", "redirect_uri is not registered for this client");
+		const scope = this.grantScope(client, args.scope);
+		const idToken = client.idToken !== false && scopeGrants(scope, "openid");
+		return {
+			clientId: client.clientId,
+			redirectUri: args.redirectUri,
+			audience: client.clientId,
+			idToken,
+			accessToken: client.accessToken === true,
+			tokenPolicy: client.tokenPolicy ? structuredClone(client.tokenPolicy) : {},
+			...scope !== void 0 && { scope }
+		};
+	}
+	authenticateClient(args) {
+		const client = this.requireClient(args.clientId);
+		if ((client.type ?? "public") !== "confidential") return;
+		if (!client.clientSecret || !args.clientSecret || !timingSafeEqualStr(args.clientSecret, client.clientSecret)) throw new AuthorizeError("invalid_client", "client authentication failed");
+	}
+	requireClient(clientId) {
+		const client = clientId ? this.clients.get(clientId) : void 0;
+		if (!client) throw new AuthorizeError("invalid_client", "unknown client");
+		return client;
+	}
+	redirectAllowed(client, uri) {
+		if (client.redirectUris?.includes(uri)) return true;
+		if (!client.redirectPrefixes?.length) return false;
+		let normalized;
+		try {
+			normalized = new URL(uri).href;
+		} catch {
+			return false;
+		}
+		return client.redirectPrefixes.some((p) => {
+			if (p.length === 0 || !normalized.startsWith(p)) return false;
+			if (p.endsWith("/")) return true;
+			const next = normalized[p.length];
+			return next === void 0 || next === "/" || next === "?" || next === "#";
+		});
+	}
+	grantScope(client, requested) {
+		if (!requested) return void 0;
+		const req = requested.split(/\s+/u).filter(Boolean);
+		const granted = client.scopes ? req.filter((s) => client.scopes.includes(s)) : req;
+		return granted.length > 0 ? granted.join(" ") : void 0;
+	}
+};
+/** Constant-time string compare that also fails closed on a length mismatch. */
+function timingSafeEqualStr(a, b) {
+	const ab = Buffer.from(a, "utf8");
+	const bb = Buffer.from(b, "utf8");
+	if (ab.length !== bb.length) return false;
+	return timingSafeEqual(ab, bb);
+}
+//#endregion
+//#region src/authz/composite-client-policy.ts
+/**
+* Runs Tier-1 and Tier-2 side by side, dispatching on the **presence of
+* `client_id`** (AUTH-SERVER.md §10): a request with a `client_id` is a
+* registered client, one without is a loopback CLI. The split is the safety
+* boundary — a registered client is routed only to {@link RegisteredClientPolicy}
+* (which enforces ITS redirect allowlist, so it cannot smuggle a loopback
+* redirect), and a no-`client_id` request is routed only to the loopback policy
+* (so it cannot claim to be a registered client). Each sub-policy still owns its
+* own redirect validation; this only picks which one runs.
+*/
+var CompositeClientPolicy = class {
+	loopback;
+	registered;
+	constructor(opts) {
+		this.loopback = opts.loopback;
+		this.registered = opts.registered;
+	}
+	resolveClient(args) {
+		return args.clientId ? this.registered.resolveClient(args) : this.loopback.resolveClient(args);
+	}
+	authenticateClient(args) {
+		if (args.clientId) return this.registered.authenticateClient?.(args);
+	}
+};
+//#endregion
+//#region src/authz/id-token-signer.ts
+/**
+* Signs OIDC `id_token`s and publishes the matching JWKS (AUTH-SERVER.md §4.9).
+* Holds one asymmetric keypair; mints short-lived RS256/ES256 tokens with the
+* issuer + audience + subject a relying `OidcProvider` validates, and exports the
+* public half as a JWKS for `GET /auth/jwks`. Keys are imported lazily and cached
+* (the Apple-client-secret pattern), so construction is cheap and synchronous.
+*
+* Never used for the access token (that stays in `AuthCredential`'s store) — the
+* `id_token` is a separate, audience-bound identity assertion.
+*/
+var IdTokenSigner = class {
+	/** The `iss` claim + discovery `issuer` (read by `/.well-known/openid-configuration`). */
+	issuer;
+	/** Signature algorithm — published in discovery's `id_token_signing_alg_values_supported`. */
+	alg;
+	/** Key id — the JWS header + JWKS entry `kid`. */
+	kid;
+	privateKeyPem;
+	publicKeyPem;
+	ttlSec;
+	clock;
+	privateKeyPromise;
+	jwksPromise;
+	constructor(opts) {
+		this.issuer = opts.issuer.replace(/\/$/u, "");
+		this.alg = opts.alg ?? "RS256";
+		this.kid = opts.kid;
+		this.privateKeyPem = opts.privateKey;
+		this.publicKeyPem = opts.publicKey;
+		this.ttlSec = opts.ttlSec ?? 300;
+		this.clock = opts.clock ?? defaultClock;
+	}
+	/** Mint a signed `id_token` JWT. Iat/exp come from the injected clock. */
+	async sign(claims) {
+		const key = await this.importPrivateKey();
+		const nowSec = Math.floor(this.clock.now() / 1e3);
+		const ttl = claims.ttlSec ?? this.ttlSec;
+		const payload = { ...claims.extra };
+		if (claims.nonce !== void 0) payload.nonce = claims.nonce;
+		return new SignJWT(payload).setProtectedHeader({
+			alg: this.alg,
+			kid: this.kid,
+			typ: "JWT"
+		}).setIssuer(this.issuer).setSubject(claims.sub).setAudience(claims.aud).setIssuedAt(nowSec).setExpirationTime(nowSec + ttl).sign(key);
+	}
+	/**
+	* The JWKS document served at `/auth/jwks` — the public key as a single
+	* `use: "sig"` entry tagged with the same `kid`/`alg` as the minted tokens, so
+	* a verifier selects it by `kid`. Computed once and cached.
+	*/
+	async jwks() {
+		this.jwksPromise ??= (async () => {
+			const jwk = await exportJWK(await importSPKI(this.publicKeyPem, this.alg, { extractable: true }));
+			jwk.kid = this.kid;
+			jwk.alg = this.alg;
+			jwk.use = "sig";
+			return { keys: [jwk] };
+		})();
+		return this.jwksPromise;
+	}
+	importPrivateKey() {
+		this.privateKeyPromise ??= importPKCS8(this.privateKeyPem, this.alg);
+		return this.privateKeyPromise;
+	}
+};
+//#endregion
 //#region src/authz/pending-authorization-store.ts
 /**
 * Storage seam for in-flight authorizations (AUTH-SERVER.md §4.3). Short-lived
@@ -90,7 +285,11 @@ var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
 			expiresAt: now + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
 			...rec.clientState !== void 0 && { clientState: rec.clientState },
-			...rec.scope !== void 0 && { scope: rec.scope }
+			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.nonce !== void 0 && { nonce: rec.nonce },
+			...rec.idToken !== void 0 && { idToken: rec.idToken },
+			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
+			...rec.audience !== void 0 && { audience: rec.audience }
 		};
 		this.store.set(row.handle, structuredClone(row));
 		return { handle: row.handle };
@@ -144,7 +343,12 @@ var AuthCodeStoreMemory = class extends AuthCodeStore {
 			redirectUri: rec.redirectUri,
 			tokenPolicy: structuredClone(rec.tokenPolicy),
 			expiresAt: this.clock.now() + this.ttlMs,
-			...rec.clientId !== void 0 && { clientId: rec.clientId }
+			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.nonce !== void 0 && { nonce: rec.nonce },
+			...rec.idToken !== void 0 && { idToken: rec.idToken },
+			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
+			...rec.audience !== void 0 && { audience: rec.audience }
 		};
 		this.store.set(code, structuredClone(row));
 		return { code };
@@ -158,4 +362,4 @@ var AuthCodeStoreMemory = class extends AuthCodeStore {
 	}
 };
 //#endregion
-export { AuthCodeStore, AuthCodeStoreMemory, AuthorizeError, LoopbackClientPolicy, PendingAuthorizationStore, PendingAuthorizationStoreMemory, isLoopbackRedirectUri };
+export { AuthCodeStore, AuthCodeStoreMemory, AuthorizeError, CompositeClientPolicy, IdTokenSigner, LoopbackClientPolicy, NoopOidcClaimsResolver, OidcClaimsResolver, PendingAuthorizationStore, PendingAuthorizationStoreMemory, RegisteredClientPolicy, isLoopbackRedirectUri, scopeGrants };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/auth",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Auth method layer for aoothjs (sessions, tokens, password reset, MFA primitives)",
   "keywords": [
     "aoothjs",
@@ -74,17 +74,17 @@
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@aooth/user": "0.1.8"
+    "@aooth/user": "0.1.9"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.69",
-    "@atscript/db": "^0.1.96",
-    "@atscript/db-sql-tools": "^0.1.96",
-    "@atscript/db-sqlite": "^0.1.96",
-    "@atscript/typescript": "^0.1.69",
+    "@atscript/core": "^0.1.70",
+    "@atscript/db": "^0.1.97",
+    "@atscript/db-sql-tools": "^0.1.97",
+    "@atscript/db-sqlite": "^0.1.97",
+    "@atscript/typescript": "^0.1.70",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.69"
+    "unplugin-atscript": "^0.1.70"
   },
   "peerDependencies": {
     "@atscript/db": ">=0.1.79"