@aooth/idp 0.1.58 → 0.1.59

package/dist/index.d.cts

@@ -1,7 +1,6 @@
 import { Clock } from "@aooth/auth";
 import { FederatedIdentity, FederatedIdentityStore, FederatedProfileSnapshot, UserService } from "@aooth/user";
 import { JWTPayload, JWTVerifyGetKey } from "jose";
-
 //#region src/errors.d.ts
 /**
  * Federated-login failure taxonomy (RFC IDP.md §8). Mirrors `AuthError` /
@@ -12,7 +11,25 @@ import { JWTPayload, JWTVerifyGetKey } from "jose";
  * `OAuthController`'s job; this layer only classifies. Messages are deliberately
  * benign so the controller can surface them without leaking CSRF-vs-expiry.
  */
-type OAuthErrorType = /** `:provider` did not resolve in the registry (→ HTTP 404 in phase 3). */"UNKNOWN_PROVIDER" /** Misconfigured provider/registry (missing clientId, issuer, baseUrl, secret). */ | "INVALID_CONFIG" /** Signed `state` failed signature/binding verification (CSRF). */ | "STATE_INVALID" /** Signed `state` is well-formed but past its TTL — restart `/start`. */ | "STATE_EXPIRED" /** Provider returned `?error=` or the user denied consent. */ | "PROVIDER_DENIED" /** Token-endpoint exchange failed: network, 5xx, malformed body, or `code` reuse. */ | "EXCHANGE_FAILED" /** JWKS / discovery document fetch failed — verification fails CLOSED (§7). */ | "JWKS_FAILED" /** OIDC ID-token failed the OIDC Core 3.1.3.7 validation list (§7). */ | "ID_TOKEN_INVALID" /** Policy needed a verified email but the provider returned none. */ | "EMAIL_UNAVAILABLE";
+type OAuthErrorType =
+/** `:provider` did not resolve in the registry (→ HTTP 404 in phase 3). */
+"UNKNOWN_PROVIDER" |
+/** Misconfigured provider/registry (missing clientId, issuer, baseUrl, secret). */
+"INVALID_CONFIG" |
+/** Signed `state` failed signature/binding verification (CSRF). */
+"STATE_INVALID" |
+/** Signed `state` is well-formed but past its TTL — restart `/start`. */
+"STATE_EXPIRED" |
+/** Provider returned `?error=` or the user denied consent. */
+"PROVIDER_DENIED" |
+/** Token-endpoint exchange failed: network, 5xx, malformed body, or `code` reuse. */
+"EXCHANGE_FAILED" |
+/** JWKS / discovery document fetch failed — verification fails CLOSED (§7). */
+"JWKS_FAILED" |
+/** OIDC ID-token failed the OIDC Core 3.1.3.7 validation list (§7). */
+"ID_TOKEN_INVALID" |
+/** Policy needed a verified email but the provider returned none. */
+"EMAIL_UNAVAILABLE";
 declare class OAuthError extends Error {
   readonly type: OAuthErrorType;
   readonly details?: Record<string, unknown> | undefined;
@@ -127,12 +144,16 @@ declare function isConfigurableProvider(p: IdentityProvider): p is ConfigurableP
  * How a federated login that matches an existing local account **by email**
  * is handled (RFC §4 — the account-takeover-sensitive knob).
  */
-type EmailMatchPolicy = /** Never match by email — always create a fresh account. */"create-separate"
+type EmailMatchPolicy =
+/** Never match by email — always create a fresh account. */
+"create-separate" |
 /**
  * Auto-link only when the provider's `email_verified === true` AND the
  * provider is in `trustEmailVerifiedFrom`. A deliberate security downgrade.
  */
-| "auto-link-if-verified" /** Default & safest: surface the candidate; require interactive proof-of-control to link. */ | "require-interactive-link";
+"auto-link-if-verified" |
+/** Default & safest: surface the candidate; require interactive proof-of-control to link. */
+"require-interactive-link";
 interface FederatedPolicy {
   /** Default `'require-interactive-link'`. */
   emailMatch?: EmailMatchPolicy;
@@ -155,22 +176,32 @@ declare function resolveFederatedPolicy(policy?: FederatedPolicy): ResolvedFeder
  * (`linked`/`created`/`auto-linked`), divert to an interactive link sub-flow
  * (`needs-link`), or fail soft (`denied`).
  */
-type ResolveOutcome = /** Known `(provider, subject)` → its owning user. */{
+type ResolveOutcome =
+/** Known `(provider, subject)` → its owning user. */
+{
   kind: "linked";
   userId: string;
   isNew: false;
-} /** No match → a fresh account was created and linked. */ | {
+} |
+/** No match → a fresh account was created and linked. */
+{
   kind: "created";
   userId: string;
   isNew: true;
-} /** Email matched an existing account and policy auto-linked it. */ | {
+} |
+/** Email matched an existing account and policy auto-linked it. */
+{
   kind: "auto-linked";
   userId: string;
   isNew: false;
-} /** Email matched an existing account; interactive proof-of-control required to link. */ | {
+} |
+/** Email matched an existing account; interactive proof-of-control required to link. */
+{
   kind: "needs-link";
   candidateUserId: string;
-} /** Refused: signup disabled with no match, or policy needed an email the provider lacked. */ | {
+} |
+/** Refused: signup disabled with no match, or policy needed an email the provider lacked. */
+{
   kind: "denied";
   reason: "signup-disabled" | "email-unavailable";
 };

package/dist/index.d.mts

@@ -1,7 +1,6 @@
 import { Clock } from "@aooth/auth";
 import { JWTPayload, JWTVerifyGetKey } from "jose";
 import { FederatedIdentity, FederatedIdentityStore, FederatedProfileSnapshot, UserService } from "@aooth/user";
-
 //#region src/errors.d.ts
 /**
  * Federated-login failure taxonomy (RFC IDP.md §8). Mirrors `AuthError` /
@@ -12,7 +11,25 @@ import { FederatedIdentity, FederatedIdentityStore, FederatedProfileSnapshot, Us
  * `OAuthController`'s job; this layer only classifies. Messages are deliberately
  * benign so the controller can surface them without leaking CSRF-vs-expiry.
  */
-type OAuthErrorType = /** `:provider` did not resolve in the registry (→ HTTP 404 in phase 3). */"UNKNOWN_PROVIDER" /** Misconfigured provider/registry (missing clientId, issuer, baseUrl, secret). */ | "INVALID_CONFIG" /** Signed `state` failed signature/binding verification (CSRF). */ | "STATE_INVALID" /** Signed `state` is well-formed but past its TTL — restart `/start`. */ | "STATE_EXPIRED" /** Provider returned `?error=` or the user denied consent. */ | "PROVIDER_DENIED" /** Token-endpoint exchange failed: network, 5xx, malformed body, or `code` reuse. */ | "EXCHANGE_FAILED" /** JWKS / discovery document fetch failed — verification fails CLOSED (§7). */ | "JWKS_FAILED" /** OIDC ID-token failed the OIDC Core 3.1.3.7 validation list (§7). */ | "ID_TOKEN_INVALID" /** Policy needed a verified email but the provider returned none. */ | "EMAIL_UNAVAILABLE";
+type OAuthErrorType =
+/** `:provider` did not resolve in the registry (→ HTTP 404 in phase 3). */
+"UNKNOWN_PROVIDER" |
+/** Misconfigured provider/registry (missing clientId, issuer, baseUrl, secret). */
+"INVALID_CONFIG" |
+/** Signed `state` failed signature/binding verification (CSRF). */
+"STATE_INVALID" |
+/** Signed `state` is well-formed but past its TTL — restart `/start`. */
+"STATE_EXPIRED" |
+/** Provider returned `?error=` or the user denied consent. */
+"PROVIDER_DENIED" |
+/** Token-endpoint exchange failed: network, 5xx, malformed body, or `code` reuse. */
+"EXCHANGE_FAILED" |
+/** JWKS / discovery document fetch failed — verification fails CLOSED (§7). */
+"JWKS_FAILED" |
+/** OIDC ID-token failed the OIDC Core 3.1.3.7 validation list (§7). */
+"ID_TOKEN_INVALID" |
+/** Policy needed a verified email but the provider returned none. */
+"EMAIL_UNAVAILABLE";
 declare class OAuthError extends Error {
   readonly type: OAuthErrorType;
   readonly details?: Record<string, unknown> | undefined;
@@ -127,12 +144,16 @@ declare function isConfigurableProvider(p: IdentityProvider): p is ConfigurableP
  * How a federated login that matches an existing local account **by email**
  * is handled (RFC §4 — the account-takeover-sensitive knob).
  */
-type EmailMatchPolicy = /** Never match by email — always create a fresh account. */"create-separate"
+type EmailMatchPolicy =
+/** Never match by email — always create a fresh account. */
+"create-separate" |
 /**
  * Auto-link only when the provider's `email_verified === true` AND the
  * provider is in `trustEmailVerifiedFrom`. A deliberate security downgrade.
  */
-| "auto-link-if-verified" /** Default & safest: surface the candidate; require interactive proof-of-control to link. */ | "require-interactive-link";
+"auto-link-if-verified" |
+/** Default & safest: surface the candidate; require interactive proof-of-control to link. */
+"require-interactive-link";
 interface FederatedPolicy {
   /** Default `'require-interactive-link'`. */
   emailMatch?: EmailMatchPolicy;
@@ -155,22 +176,32 @@ declare function resolveFederatedPolicy(policy?: FederatedPolicy): ResolvedFeder
  * (`linked`/`created`/`auto-linked`), divert to an interactive link sub-flow
  * (`needs-link`), or fail soft (`denied`).
  */
-type ResolveOutcome = /** Known `(provider, subject)` → its owning user. */{
+type ResolveOutcome =
+/** Known `(provider, subject)` → its owning user. */
+{
   kind: "linked";
   userId: string;
   isNew: false;
-} /** No match → a fresh account was created and linked. */ | {
+} |
+/** No match → a fresh account was created and linked. */
+{
   kind: "created";
   userId: string;
   isNew: true;
-} /** Email matched an existing account and policy auto-linked it. */ | {
+} |
+/** Email matched an existing account and policy auto-linked it. */
+{
   kind: "auto-linked";
   userId: string;
   isNew: false;
-} /** Email matched an existing account; interactive proof-of-control required to link. */ | {
+} |
+/** Email matched an existing account; interactive proof-of-control required to link. */
+{
   kind: "needs-link";
   candidateUserId: string;
-} /** Refused: signup disabled with no match, or policy needed an email the provider lacked. */ | {
+} |
+/** Refused: signup disabled with no match, or policy needed an email the provider lacked. */
+{
   kind: "denied";
   reason: "signup-disabled" | "email-unavailable";
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/idp",
-  "version": "0.1.58",
+  "version": "0.1.59",
   "description": "Framework-agnostic OAuth2 / OIDC federated-login core for aoothjs (provider registry, PKCE/state, ID-token verification, account resolution)",
   "keywords": [
     "aoothjs",
@@ -43,8 +43,8 @@
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@aooth/auth": "0.1.58",
-    "@aooth/user": "0.1.58"
+    "@aooth/auth": "0.1.59",
+    "@aooth/user": "0.1.59"
   },
   "devDependencies": {
     "vitest": "npm:@voidzero-dev/vite-plus-test@latest"