@aooth/idp 0.2.1 → 0.2.2

package/dist/index.cjs

@@ -3,7 +3,7 @@ let node_crypto = require("node:crypto");
 let _aooth_auth = require("@aooth/auth");
 let jose = require("jose");
 let _aooth_user = require("@aooth/user");
-//#region src/errors.ts
+// src/errors.ts
 const defaultMessages = {
 	UNKNOWN_PROVIDER: "Unknown identity provider",
 	INVALID_CONFIG: "Invalid OAuth provider configuration",
@@ -25,8 +25,7 @@ var OAuthError = class extends Error {
 		this.details = details;
 	}
 };
-//#endregion
-//#region src/types.ts
+// src/types.ts
 /** Structural check used by the registry to feature-detect `applyDefaults`. */
 function isConfigurableProvider(p) {
 	return typeof p.applyDefaults === "function";
@@ -44,8 +43,7 @@ function resolveFederatedPolicy(policy = {}) {
 		trustEmailVerifiedFrom: policy.trustEmailVerifiedFrom ?? []
 	};
 }
-//#endregion
-//#region src/pkce.ts
+// src/pkce.ts
 /**
 * PKCE / CSRF primitives (RFC 7636 + OIDC nonce). All values are URL-safe
 * base64url with no padding, so they ride in query params and cookies without
@@ -107,8 +105,7 @@ function deriveSeededPkce(secret, seed) {
 		method: "S256"
 	};
 }
-//#endregion
-//#region src/state.ts
+// src/state.ts
 const DEFAULT_TTL_SEC = 600;
 function toKey(secret) {
 	return typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
@@ -163,8 +160,7 @@ async function verifyState(token, secret, opts = {}) {
 	if (typeof payload.uid === "string") out.userId = payload.uid;
 	return out;
 }
-//#endregion
-//#region src/providers/oauth2-shared.ts
+// src/providers/oauth2-shared.ts
 /** Resolve the effective `fetch`: an injected impl, else the global `fetch`. */
 function resolveFetch(impl) {
 	return impl ?? globalThis.fetch;
@@ -213,8 +209,7 @@ function buildAuthorizeUrl(endpoint, args, opts = {}) {
 	for (const [k, v] of Object.entries(opts.extraParams ?? {})) url.searchParams.set(k, v);
 	return url.toString();
 }
-//#endregion
-//#region src/providers/oidc.ts
+// src/providers/oidc.ts
 const DEFAULT_SCOPES$1 = [
 	"openid",
 	"email",
@@ -416,11 +411,11 @@ var OidcProvider = class {
 * token's hash, the hash chosen by the id_token's `alg` (RS256 → SHA-256).
 */
 function atHash(accessToken, alg) {
-	const digest = (0, node_crypto.createHash)(alg.endsWith("384") ? "sha384" : alg.endsWith("512") ? "sha512" : "sha256").update(accessToken).digest();
+	const sha = alg.endsWith("384") ? "sha384" : alg.endsWith("512") ? "sha512" : "sha256";
+	const digest = (0, node_crypto.createHash)(sha).update(accessToken).digest();
 	return digest.subarray(0, digest.length / 2).toString("base64url");
 }
-//#endregion
-//#region src/providers/google.ts
+// src/providers/google.ts
 /** Google's stable OIDC issuer — endpoints + JWKS are discovered from it. */
 const GOOGLE_ISSUER = "https://accounts.google.com";
 /**
@@ -438,8 +433,7 @@ var GoogleProvider = class extends OidcProvider {
 		});
 	}
 };
-//#endregion
-//#region src/providers/github.ts
+// src/providers/github.ts
 const GITHUB_AUTHORIZE = "https://github.com/login/oauth/authorize";
 const GITHUB_TOKEN = "https://github.com/login/oauth/access_token";
 const GITHUB_USER = "https://api.github.com/user";
@@ -576,8 +570,7 @@ var GithubProvider = class {
 		}, { label: `GitHub API (${url})` });
 	}
 };
-//#endregion
-//#region src/providers/apple.ts
+// src/providers/apple.ts
 /** Apple's stable OIDC issuer — endpoints + JWKS are discovered from it. */
 const APPLE_ISSUER = "https://appleid.apple.com";
 /** Apple ID tokens are always ES256. */
@@ -681,8 +674,7 @@ var AppleProvider = class extends OidcProvider {
 		return profile;
 	}
 };
-//#endregion
-//#region src/providers/fake.ts
+// src/providers/fake.ts
 /**
 * Deterministic, network-free {@link IdentityProvider} for unit tests and the
 * `DEMO_MODE=test` fake-IdP e2e route (RFC §9). `exchange` resolves a `code`
@@ -719,8 +711,7 @@ var FakeIdentityProvider = class {
 		});
 	}
 };
-//#endregion
-//#region src/registry.ts
+// src/registry.ts
 const DEFAULT_CALLBACK_TEMPLATE = "/auth/oauth/:provider/callback";
 /**
 * Holds the configured {@link IdentityProvider}s + {@link FederatedPolicy} +
@@ -802,8 +793,7 @@ var OAuthProviderRegistry = class {
 		return deriveSeededPkce(this.stateSecret, seed);
 	}
 };
-//#endregion
-//#region src/federated-login-service.ts
+// src/federated-login-service.ts
 /**
 * The core federated-login logic (RFC §3.5): map a verified provider profile to
 * an aooth user id. Pure orchestration over `UserService` + `FederatedIdentityStore`
@@ -940,7 +930,6 @@ var FederatedLoginService = class {
 		return this.federated.touchLogin(profile.provider, profile.subject, (0, _aooth_user.pickDefinedProfile)(profile));
 	}
 };
-//#endregion
 exports.AppleProvider = AppleProvider;
 exports.FakeIdentityProvider = FakeIdentityProvider;
 exports.FederatedLoginService = FederatedLoginService;

package/dist/index.d.cts

@@ -1,7 +1,6 @@
 import { Clock } from "@aooth/auth";
 import { FederatedIdentity, FederatedIdentityStore, FederatedProfileSnapshot, UserService } from "@aooth/user";
 import { JWTPayload, JWTVerifyGetKey } from "jose";
-//#region src/errors.d.ts
 /**
  * Federated-login failure taxonomy (RFC IDP.md §8). Mirrors `AuthError` /
  * `UserAuthError` — a typed `Error` with a stable `type` code, an optional
@@ -30,14 +29,12 @@ type OAuthErrorType =
 "ID_TOKEN_INVALID" |
 /** Policy needed a verified email but the provider returned none. */
 "EMAIL_UNAVAILABLE";
-declare class OAuthError extends Error {
+export declare class OAuthError extends Error {
   readonly type: OAuthErrorType;
   readonly details?: Record<string, unknown> | undefined;
   readonly name = "OAuthError";
   constructor(type: OAuthErrorType, message?: string, details?: Record<string, unknown> | undefined);
 }
-//#endregion
-//#region src/types.d.ts
 /**
  * A provider profile normalized to a single shape across Google / OIDC / etc.
  * Structural superset of `@aooth/user`'s {@link FederatedProfileSnapshot} (the
@@ -139,7 +136,7 @@ interface ConfigurableProvider extends IdentityProvider {
   applyDefaults(shared: SharedProviderConfig): void;
 }
 /** Structural check used by the registry to feature-detect `applyDefaults`. */
-declare function isConfigurableProvider(p: IdentityProvider): p is ConfigurableProvider;
+export declare function isConfigurableProvider(p: IdentityProvider): p is ConfigurableProvider;
 /**
  * How a federated login that matches an existing local account **by email**
  * is handled (RFC §4 — the account-takeover-sensitive knob).
@@ -166,9 +163,9 @@ interface FederatedPolicy {
 }
 type ResolvedFederatedPolicy = Required<FederatedPolicy>;
 /** Default username strategy: the verified email, else the stable `provider:subject`. */
-declare function defaultUsernameStrategy(p: NormalizedProfile): string;
+export declare function defaultUsernameStrategy(p: NormalizedProfile): string;
 /** Apply RFC §4 safe defaults over a partial policy. */
-declare function resolveFederatedPolicy(policy?: FederatedPolicy): ResolvedFederatedPolicy;
+export declare function resolveFederatedPolicy(policy?: FederatedPolicy): ResolvedFederatedPolicy;
 /**
  * The outcome of {@link FederatedLoginService.resolveUser} (decision #1). A
  * discriminated union — richer than the RFC's `{ userId, isNew }` sketch — so
@@ -205,8 +202,6 @@ type ResolveOutcome =
   kind: "denied";
   reason: "signup-disabled" | "email-unavailable";
 };
-//#endregion
-//#region src/pkce.d.ts
 interface PkcePair {
   /** The high-entropy secret kept server-side (cookie / wf state). */
   verifier: string;
@@ -229,13 +224,13 @@ interface SeededPkce {
  * Mint a fresh PKCE pair. The 32-byte verifier base64url-encodes to 43 chars,
  * comfortably inside RFC 7636's 43–128 range.
  */
-declare function createPkcePair(): PkcePair;
+export declare function createPkcePair(): PkcePair;
 /** Recompute the S256 challenge for a known verifier (verification side). */
-declare function pkceChallengeFor(verifier: string): string;
+export declare function pkceChallengeFor(verifier: string): string;
 /** OIDC `nonce` — minted at `/start`, bound into state, asserted in `exchange()`. */
-declare function generateNonce(bytes?: number): string;
+export declare function generateNonce(bytes?: number): string;
 /** Random component bound into the signed `state` (anti-CSRF / anti-replay). */
-declare function generateRandomState(bytes?: number): string;
+export declare function generateRandomState(bytes?: number): string;
 /**
  * STATELESS PKCE: deterministically DERIVE the code verifier + OIDC nonce from
  * a non-secret `seed` and the server's HMAC `secret`, instead of minting them
@@ -255,9 +250,7 @@ declare function generateRandomState(bytes?: number): string;
  * Same output range as {@link createPkcePair}: a 32-byte HMAC-SHA256 digest →
  * a 43-char base64url verifier, inside RFC 7636's 43–128.
  */
-declare function deriveSeededPkce(secret: string | Uint8Array, seed: string): SeededPkce;
-//#endregion
-//#region src/state.d.ts
+export declare function deriveSeededPkce(secret: string | Uint8Array, seed: string): SeededPkce;
 /**
  * The CSRF/replay binding carried across the OAuth bounce (RFC §7). Signed into
  * a compact HS256 JWT by {@link signState} so it is tamper-evident in the URL
@@ -293,15 +286,13 @@ interface VerifyStateOptions {
  * Sign the binding into a compact HS256 JWT. Field names are abbreviated to
  * keep the URL `state` short; {@link verifyState} maps them back.
  */
-declare function signState(payload: OAuthStatePayload, secret: string | Uint8Array, opts?: SignStateOptions): Promise<string>;
+export declare function signState(payload: OAuthStatePayload, secret: string | Uint8Array, opts?: SignStateOptions): Promise<string>;
 /**
  * Verify + decode the signed state. Pins `HS256` (rejects `alg:none` / key
  * confusion). Throws {@link OAuthError} `STATE_EXPIRED` past TTL,
  * `STATE_INVALID` on any other signature/shape failure.
  */
-declare function verifyState(token: string, secret: string | Uint8Array, opts?: VerifyStateOptions): Promise<OAuthStatePayload>;
-//#endregion
-//#region src/providers/oidc.d.ts
+export declare function verifyState(token: string, secret: string | Uint8Array, opts?: VerifyStateOptions): Promise<OAuthStatePayload>;
 /** The four endpoints the OIDC client needs — discovered or supplied explicitly. */
 interface OidcDiscoveryDocument {
   issuer: string;
@@ -365,7 +356,7 @@ interface OidcProviderOptions {
  *
  * `GoogleProvider` is a thin subclass pinning the issuer + algs.
  */
-declare class OidcProvider implements ConfigurableProvider {
+export declare class OidcProvider implements ConfigurableProvider {
   readonly id: string;
   protected readonly issuer: string;
   protected readonly clientId: string;
@@ -413,8 +404,6 @@ declare class OidcProvider implements ConfigurableProvider {
   private validateDiscovery;
   private getJwks;
 }
-//#endregion
-//#region src/providers/google.d.ts
 /** Google options = OIDC options minus the pinned `id`/`issuer`. */
 type GoogleProviderOptions = Omit<OidcProviderOptions, "id" | "issuer">;
 /**
@@ -422,11 +411,9 @@ type GoogleProviderOptions = Omit<OidcProviderOptions, "id" | "issuer">;
  * (Google's only ID-token alg). Everything else — discovery, JWKS rotation,
  * the full §7 validation — is inherited from {@link OidcProvider}.
  */
-declare class GoogleProvider extends OidcProvider {
+export declare class GoogleProvider extends OidcProvider {
   constructor(opts: GoogleProviderOptions);
 }
-//#endregion
-//#region src/providers/github.d.ts
 interface GithubProviderOptions {
   /** Provider id. Default `'github'`. */
   id?: string;
@@ -457,7 +444,7 @@ interface GithubProviderOptions {
  * Implements {@link ConfigurableProvider} so the registry can inject a shared
  * `fetch` (deterministic tests) / `clock`; a constructor value always wins.
  */
-declare class GithubProvider implements ConfigurableProvider {
+export declare class GithubProvider implements ConfigurableProvider {
   readonly id: string;
   private readonly clientId;
   private readonly clientSecret;
@@ -486,8 +473,6 @@ declare class GithubProvider implements ConfigurableProvider {
   private fetchPrimaryEmail;
   private apiGet;
 }
-//#endregion
-//#region src/providers/apple.d.ts
 interface AppleProviderOptions extends Omit<OidcProviderOptions, "id" | "issuer" | "clientSecret" | "idTokenSigningAlgs" | "scopes"> {
   /** The Services ID — Sign in with Apple's OAuth `client_id` (and the id_token `aud`). */
   clientId: string;
@@ -527,15 +512,13 @@ interface AppleProviderOptions extends Omit<OidcProviderOptions, "id" | "issuer"
  * capture it, so `displayName` is undefined for Apple. Collect a display name
  * post-signup if you need one.
  */
-declare class AppleProvider extends OidcProvider {
+export declare class AppleProvider extends OidcProvider {
   constructor(opts: AppleProviderOptions);
   /** `email`/`name` scope makes Apple POST the callback — declare `form_post`. */
   protected extraAuthorizationParams(_args: AuthorizationUrlArgs): Record<string, string>;
   /** Coerce Apple's STRING `email_verified` (the base sets only a real boolean). */
   protected normalize(payload: JWTPayload): NormalizedProfile;
 }
-//#endregion
-//#region src/providers/fake.d.ts
 interface FakeIdentityProviderOptions {
   /** Provider id. Default `'fake'`. */
   id?: string;
@@ -553,7 +536,7 @@ interface FakeIdentityProviderOptions {
  * It does NOT verify a nonce — it is the trusted test double; the real §7
  * nonce/JWKS assertions are exercised against {@link OidcProvider} with `jose`.
  */
-declare class FakeIdentityProvider implements IdentityProvider {
+export declare class FakeIdentityProvider implements IdentityProvider {
   readonly id: string;
   private readonly authorizationEndpoint;
   private readonly defaultProfile?;
@@ -564,8 +547,6 @@ declare class FakeIdentityProvider implements IdentityProvider {
   authorizationUrl(args: AuthorizationUrlArgs): Promise<string>;
   exchange(args: ExchangeArgs): Promise<NormalizedProfile>;
 }
-//#endregion
-//#region src/registry.d.ts
 interface OAuthProviderRegistryOptions {
   /** Public origin — `redirect_uri` is built as `baseUrl` + the callback path (§3.7). */
   baseUrl: string;
@@ -595,7 +576,7 @@ interface OAuthProviderRegistryOptions {
  * each provider that implements `applyDefaults`, and builds the per-provider
  * fixed redirect URIs.
  */
-declare class OAuthProviderRegistry {
+export declare class OAuthProviderRegistry {
   readonly baseUrl: string;
   readonly stateSecret: string;
   readonly policy: ResolvedFederatedPolicy;
@@ -628,8 +609,6 @@ declare class OAuthProviderRegistry {
    */
   deriveSeededPkce(seed: string): SeededPkce;
 }
-//#endregion
-//#region src/federated-login-service.d.ts
 interface FederatedLoginServiceDeps<T extends object = object> {
   /** Concrete user orchestrator (RFC: idp depends on the concrete class). */
   users: UserService<T>;
@@ -648,7 +627,7 @@ interface FederatedLoginServiceDeps<T extends object = object> {
  * Generic over the user shape `T` so a consumer's `UserService<DemoUser>` plugs
  * in directly; `resolveUser` only reads base `UserCredentials` fields.
  */
-declare class FederatedLoginService<T extends object = object> {
+export declare class FederatedLoginService<T extends object = object> {
   private readonly users;
   private readonly federated;
   readonly policy: ResolvedFederatedPolicy;
@@ -698,5 +677,4 @@ declare class FederatedLoginService<T extends object = object> {
   private newIdentity;
   private touch;
 }
-//#endregion
-export { AppleProvider, type AppleProviderOptions, type AuthorizationUrlArgs, type ConfigurableProvider, type EmailMatchPolicy, type ExchangeArgs, FakeIdentityProvider, type FakeIdentityProviderOptions, FederatedLoginService, type FederatedLoginServiceDeps, type FederatedPolicy, type FetchLike, type FetchResponseLike, GithubProvider, type GithubProviderOptions, GoogleProvider, type GoogleProviderOptions, type IdentityProvider, type NormalizedProfile, OAuthError, type OAuthErrorType, OAuthProviderRegistry, type OAuthProviderRegistryOptions, type OAuthStatePayload, type OidcDiscoveryDocument, OidcProvider, type OidcProviderOptions, type PkcePair, type ResolveOutcome, type ResolvedFederatedPolicy, type SeededPkce, type SharedProviderConfig, type SignStateOptions, type VerifyStateOptions, createPkcePair, defaultUsernameStrategy, deriveSeededPkce, generateNonce, generateRandomState, isConfigurableProvider, pkceChallengeFor, resolveFederatedPolicy, signState, verifyState };
+export type { AppleProviderOptions, AuthorizationUrlArgs, ConfigurableProvider, EmailMatchPolicy, ExchangeArgs, FakeIdentityProviderOptions, FederatedLoginServiceDeps, FederatedPolicy, FetchLike, FetchResponseLike, GithubProviderOptions, GoogleProviderOptions, IdentityProvider, NormalizedProfile, OAuthErrorType, OAuthProviderRegistryOptions, OAuthStatePayload, OidcDiscoveryDocument, OidcProviderOptions, PkcePair, ResolveOutcome, ResolvedFederatedPolicy, SeededPkce, SharedProviderConfig, SignStateOptions, VerifyStateOptions };

package/dist/index.d.mts

@@ -1,7 +1,6 @@
 import { Clock } from "@aooth/auth";
 import { JWTPayload, JWTVerifyGetKey } from "jose";
 import { FederatedIdentity, FederatedIdentityStore, FederatedProfileSnapshot, UserService } from "@aooth/user";
-//#region src/errors.d.ts
 /**
  * Federated-login failure taxonomy (RFC IDP.md §8). Mirrors `AuthError` /
  * `UserAuthError` — a typed `Error` with a stable `type` code, an optional
@@ -30,14 +29,12 @@ type OAuthErrorType =
 "ID_TOKEN_INVALID" |
 /** Policy needed a verified email but the provider returned none. */
 "EMAIL_UNAVAILABLE";
-declare class OAuthError extends Error {
+export declare class OAuthError extends Error {
   readonly type: OAuthErrorType;
   readonly details?: Record<string, unknown> | undefined;
   readonly name = "OAuthError";
   constructor(type: OAuthErrorType, message?: string, details?: Record<string, unknown> | undefined);
 }
-//#endregion
-//#region src/types.d.ts
 /**
  * A provider profile normalized to a single shape across Google / OIDC / etc.
  * Structural superset of `@aooth/user`'s {@link FederatedProfileSnapshot} (the
@@ -139,7 +136,7 @@ interface ConfigurableProvider extends IdentityProvider {
   applyDefaults(shared: SharedProviderConfig): void;
 }
 /** Structural check used by the registry to feature-detect `applyDefaults`. */
-declare function isConfigurableProvider(p: IdentityProvider): p is ConfigurableProvider;
+export declare function isConfigurableProvider(p: IdentityProvider): p is ConfigurableProvider;
 /**
  * How a federated login that matches an existing local account **by email**
  * is handled (RFC §4 — the account-takeover-sensitive knob).
@@ -166,9 +163,9 @@ interface FederatedPolicy {
 }
 type ResolvedFederatedPolicy = Required<FederatedPolicy>;
 /** Default username strategy: the verified email, else the stable `provider:subject`. */
-declare function defaultUsernameStrategy(p: NormalizedProfile): string;
+export declare function defaultUsernameStrategy(p: NormalizedProfile): string;
 /** Apply RFC §4 safe defaults over a partial policy. */
-declare function resolveFederatedPolicy(policy?: FederatedPolicy): ResolvedFederatedPolicy;
+export declare function resolveFederatedPolicy(policy?: FederatedPolicy): ResolvedFederatedPolicy;
 /**
  * The outcome of {@link FederatedLoginService.resolveUser} (decision #1). A
  * discriminated union — richer than the RFC's `{ userId, isNew }` sketch — so
@@ -205,8 +202,6 @@ type ResolveOutcome =
   kind: "denied";
   reason: "signup-disabled" | "email-unavailable";
 };
-//#endregion
-//#region src/pkce.d.ts
 interface PkcePair {
   /** The high-entropy secret kept server-side (cookie / wf state). */
   verifier: string;
@@ -229,13 +224,13 @@ interface SeededPkce {
  * Mint a fresh PKCE pair. The 32-byte verifier base64url-encodes to 43 chars,
  * comfortably inside RFC 7636's 43–128 range.
  */
-declare function createPkcePair(): PkcePair;
+export declare function createPkcePair(): PkcePair;
 /** Recompute the S256 challenge for a known verifier (verification side). */
-declare function pkceChallengeFor(verifier: string): string;
+export declare function pkceChallengeFor(verifier: string): string;
 /** OIDC `nonce` — minted at `/start`, bound into state, asserted in `exchange()`. */
-declare function generateNonce(bytes?: number): string;
+export declare function generateNonce(bytes?: number): string;
 /** Random component bound into the signed `state` (anti-CSRF / anti-replay). */
-declare function generateRandomState(bytes?: number): string;
+export declare function generateRandomState(bytes?: number): string;
 /**
  * STATELESS PKCE: deterministically DERIVE the code verifier + OIDC nonce from
  * a non-secret `seed` and the server's HMAC `secret`, instead of minting them
@@ -255,9 +250,7 @@ declare function generateRandomState(bytes?: number): string;
  * Same output range as {@link createPkcePair}: a 32-byte HMAC-SHA256 digest →
  * a 43-char base64url verifier, inside RFC 7636's 43–128.
  */
-declare function deriveSeededPkce(secret: string | Uint8Array, seed: string): SeededPkce;
-//#endregion
-//#region src/state.d.ts
+export declare function deriveSeededPkce(secret: string | Uint8Array, seed: string): SeededPkce;
 /**
  * The CSRF/replay binding carried across the OAuth bounce (RFC §7). Signed into
  * a compact HS256 JWT by {@link signState} so it is tamper-evident in the URL
@@ -293,15 +286,13 @@ interface VerifyStateOptions {
  * Sign the binding into a compact HS256 JWT. Field names are abbreviated to
  * keep the URL `state` short; {@link verifyState} maps them back.
  */
-declare function signState(payload: OAuthStatePayload, secret: string | Uint8Array, opts?: SignStateOptions): Promise<string>;
+export declare function signState(payload: OAuthStatePayload, secret: string | Uint8Array, opts?: SignStateOptions): Promise<string>;
 /**
  * Verify + decode the signed state. Pins `HS256` (rejects `alg:none` / key
  * confusion). Throws {@link OAuthError} `STATE_EXPIRED` past TTL,
  * `STATE_INVALID` on any other signature/shape failure.
  */
-declare function verifyState(token: string, secret: string | Uint8Array, opts?: VerifyStateOptions): Promise<OAuthStatePayload>;
-//#endregion
-//#region src/providers/oidc.d.ts
+export declare function verifyState(token: string, secret: string | Uint8Array, opts?: VerifyStateOptions): Promise<OAuthStatePayload>;
 /** The four endpoints the OIDC client needs — discovered or supplied explicitly. */
 interface OidcDiscoveryDocument {
   issuer: string;
@@ -365,7 +356,7 @@ interface OidcProviderOptions {
  *
  * `GoogleProvider` is a thin subclass pinning the issuer + algs.
  */
-declare class OidcProvider implements ConfigurableProvider {
+export declare class OidcProvider implements ConfigurableProvider {
   readonly id: string;
   protected readonly issuer: string;
   protected readonly clientId: string;
@@ -413,8 +404,6 @@ declare class OidcProvider implements ConfigurableProvider {
   private validateDiscovery;
   private getJwks;
 }
-//#endregion
-//#region src/providers/google.d.ts
 /** Google options = OIDC options minus the pinned `id`/`issuer`. */
 type GoogleProviderOptions = Omit<OidcProviderOptions, "id" | "issuer">;
 /**
@@ -422,11 +411,9 @@ type GoogleProviderOptions = Omit<OidcProviderOptions, "id" | "issuer">;
  * (Google's only ID-token alg). Everything else — discovery, JWKS rotation,
  * the full §7 validation — is inherited from {@link OidcProvider}.
  */
-declare class GoogleProvider extends OidcProvider {
+export declare class GoogleProvider extends OidcProvider {
   constructor(opts: GoogleProviderOptions);
 }
-//#endregion
-//#region src/providers/github.d.ts
 interface GithubProviderOptions {
   /** Provider id. Default `'github'`. */
   id?: string;
@@ -457,7 +444,7 @@ interface GithubProviderOptions {
  * Implements {@link ConfigurableProvider} so the registry can inject a shared
  * `fetch` (deterministic tests) / `clock`; a constructor value always wins.
  */
-declare class GithubProvider implements ConfigurableProvider {
+export declare class GithubProvider implements ConfigurableProvider {
   readonly id: string;
   private readonly clientId;
   private readonly clientSecret;
@@ -486,8 +473,6 @@ declare class GithubProvider implements ConfigurableProvider {
   private fetchPrimaryEmail;
   private apiGet;
 }
-//#endregion
-//#region src/providers/apple.d.ts
 interface AppleProviderOptions extends Omit<OidcProviderOptions, "id" | "issuer" | "clientSecret" | "idTokenSigningAlgs" | "scopes"> {
   /** The Services ID — Sign in with Apple's OAuth `client_id` (and the id_token `aud`). */
   clientId: string;
@@ -527,15 +512,13 @@ interface AppleProviderOptions extends Omit<OidcProviderOptions, "id" | "issuer"
  * capture it, so `displayName` is undefined for Apple. Collect a display name
  * post-signup if you need one.
  */
-declare class AppleProvider extends OidcProvider {
+export declare class AppleProvider extends OidcProvider {
   constructor(opts: AppleProviderOptions);
   /** `email`/`name` scope makes Apple POST the callback — declare `form_post`. */
   protected extraAuthorizationParams(_args: AuthorizationUrlArgs): Record<string, string>;
   /** Coerce Apple's STRING `email_verified` (the base sets only a real boolean). */
   protected normalize(payload: JWTPayload): NormalizedProfile;
 }
-//#endregion
-//#region src/providers/fake.d.ts
 interface FakeIdentityProviderOptions {
   /** Provider id. Default `'fake'`. */
   id?: string;
@@ -553,7 +536,7 @@ interface FakeIdentityProviderOptions {
  * It does NOT verify a nonce — it is the trusted test double; the real §7
  * nonce/JWKS assertions are exercised against {@link OidcProvider} with `jose`.
  */
-declare class FakeIdentityProvider implements IdentityProvider {
+export declare class FakeIdentityProvider implements IdentityProvider {
   readonly id: string;
   private readonly authorizationEndpoint;
   private readonly defaultProfile?;
@@ -564,8 +547,6 @@ declare class FakeIdentityProvider implements IdentityProvider {
   authorizationUrl(args: AuthorizationUrlArgs): Promise<string>;
   exchange(args: ExchangeArgs): Promise<NormalizedProfile>;
 }
-//#endregion
-//#region src/registry.d.ts
 interface OAuthProviderRegistryOptions {
   /** Public origin — `redirect_uri` is built as `baseUrl` + the callback path (§3.7). */
   baseUrl: string;
@@ -595,7 +576,7 @@ interface OAuthProviderRegistryOptions {
  * each provider that implements `applyDefaults`, and builds the per-provider
  * fixed redirect URIs.
  */
-declare class OAuthProviderRegistry {
+export declare class OAuthProviderRegistry {
   readonly baseUrl: string;
   readonly stateSecret: string;
   readonly policy: ResolvedFederatedPolicy;
@@ -628,8 +609,6 @@ declare class OAuthProviderRegistry {
    */
   deriveSeededPkce(seed: string): SeededPkce;
 }
-//#endregion
-//#region src/federated-login-service.d.ts
 interface FederatedLoginServiceDeps<T extends object = object> {
   /** Concrete user orchestrator (RFC: idp depends on the concrete class). */
   users: UserService<T>;
@@ -648,7 +627,7 @@ interface FederatedLoginServiceDeps<T extends object = object> {
  * Generic over the user shape `T` so a consumer's `UserService<DemoUser>` plugs
  * in directly; `resolveUser` only reads base `UserCredentials` fields.
  */
-declare class FederatedLoginService<T extends object = object> {
+export declare class FederatedLoginService<T extends object = object> {
   private readonly users;
   private readonly federated;
   readonly policy: ResolvedFederatedPolicy;
@@ -698,5 +677,4 @@ declare class FederatedLoginService<T extends object = object> {
   private newIdentity;
   private touch;
 }
-//#endregion
-export { AppleProvider, type AppleProviderOptions, type AuthorizationUrlArgs, type ConfigurableProvider, type EmailMatchPolicy, type ExchangeArgs, FakeIdentityProvider, type FakeIdentityProviderOptions, FederatedLoginService, type FederatedLoginServiceDeps, type FederatedPolicy, type FetchLike, type FetchResponseLike, GithubProvider, type GithubProviderOptions, GoogleProvider, type GoogleProviderOptions, type IdentityProvider, type NormalizedProfile, OAuthError, type OAuthErrorType, OAuthProviderRegistry, type OAuthProviderRegistryOptions, type OAuthStatePayload, type OidcDiscoveryDocument, OidcProvider, type OidcProviderOptions, type PkcePair, type ResolveOutcome, type ResolvedFederatedPolicy, type SeededPkce, type SharedProviderConfig, type SignStateOptions, type VerifyStateOptions, createPkcePair, defaultUsernameStrategy, deriveSeededPkce, generateNonce, generateRandomState, isConfigurableProvider, pkceChallengeFor, resolveFederatedPolicy, signState, verifyState };
+export type { AppleProviderOptions, AuthorizationUrlArgs, ConfigurableProvider, EmailMatchPolicy, ExchangeArgs, FakeIdentityProviderOptions, FederatedLoginServiceDeps, FederatedPolicy, FetchLike, FetchResponseLike, GithubProviderOptions, GoogleProviderOptions, IdentityProvider, NormalizedProfile, OAuthErrorType, OAuthProviderRegistryOptions, OAuthStatePayload, OidcDiscoveryDocument, OidcProviderOptions, PkcePair, ResolveOutcome, ResolvedFederatedPolicy, SeededPkce, SharedProviderConfig, SignStateOptions, VerifyStateOptions };

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { createHash, createHmac, randomBytes } from "node:crypto";
 import { defaultClock } from "@aooth/auth";
 import { SignJWT, createRemoteJWKSet, errors, importPKCS8, jwtVerify } from "jose";
 import { UserAuthError, pickDefinedProfile } from "@aooth/user";
-//#region src/errors.ts
+// src/errors.ts
 const defaultMessages = {
 	UNKNOWN_PROVIDER: "Unknown identity provider",
 	INVALID_CONFIG: "Invalid OAuth provider configuration",
@@ -24,8 +24,7 @@ var OAuthError = class extends Error {
 		this.details = details;
 	}
 };
-//#endregion
-//#region src/types.ts
+// src/types.ts
 /** Structural check used by the registry to feature-detect `applyDefaults`. */
 function isConfigurableProvider(p) {
 	return typeof p.applyDefaults === "function";
@@ -43,8 +42,7 @@ function resolveFederatedPolicy(policy = {}) {
 		trustEmailVerifiedFrom: policy.trustEmailVerifiedFrom ?? []
 	};
 }
-//#endregion
-//#region src/pkce.ts
+// src/pkce.ts
 /**
 * PKCE / CSRF primitives (RFC 7636 + OIDC nonce). All values are URL-safe
 * base64url with no padding, so they ride in query params and cookies without
@@ -106,8 +104,7 @@ function deriveSeededPkce(secret, seed) {
 		method: "S256"
 	};
 }
-//#endregion
-//#region src/state.ts
+// src/state.ts
 const DEFAULT_TTL_SEC = 600;
 function toKey(secret) {
 	return typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
@@ -162,8 +159,7 @@ async function verifyState(token, secret, opts = {}) {
 	if (typeof payload.uid === "string") out.userId = payload.uid;
 	return out;
 }
-//#endregion
-//#region src/providers/oauth2-shared.ts
+// src/providers/oauth2-shared.ts
 /** Resolve the effective `fetch`: an injected impl, else the global `fetch`. */
 function resolveFetch(impl) {
 	return impl ?? globalThis.fetch;
@@ -212,8 +208,7 @@ function buildAuthorizeUrl(endpoint, args, opts = {}) {
 	for (const [k, v] of Object.entries(opts.extraParams ?? {})) url.searchParams.set(k, v);
 	return url.toString();
 }
-//#endregion
-//#region src/providers/oidc.ts
+// src/providers/oidc.ts
 const DEFAULT_SCOPES$1 = [
 	"openid",
 	"email",
@@ -415,11 +410,11 @@ var OidcProvider = class {
 * token's hash, the hash chosen by the id_token's `alg` (RS256 → SHA-256).
 */
 function atHash(accessToken, alg) {
-	const digest = createHash(alg.endsWith("384") ? "sha384" : alg.endsWith("512") ? "sha512" : "sha256").update(accessToken).digest();
+	const sha = alg.endsWith("384") ? "sha384" : alg.endsWith("512") ? "sha512" : "sha256";
+	const digest = createHash(sha).update(accessToken).digest();
 	return digest.subarray(0, digest.length / 2).toString("base64url");
 }
-//#endregion
-//#region src/providers/google.ts
+// src/providers/google.ts
 /** Google's stable OIDC issuer — endpoints + JWKS are discovered from it. */
 const GOOGLE_ISSUER = "https://accounts.google.com";
 /**
@@ -437,8 +432,7 @@ var GoogleProvider = class extends OidcProvider {
 		});
 	}
 };
-//#endregion
-//#region src/providers/github.ts
+// src/providers/github.ts
 const GITHUB_AUTHORIZE = "https://github.com/login/oauth/authorize";
 const GITHUB_TOKEN = "https://github.com/login/oauth/access_token";
 const GITHUB_USER = "https://api.github.com/user";
@@ -575,8 +569,7 @@ var GithubProvider = class {
 		}, { label: `GitHub API (${url})` });
 	}
 };
-//#endregion
-//#region src/providers/apple.ts
+// src/providers/apple.ts
 /** Apple's stable OIDC issuer — endpoints + JWKS are discovered from it. */
 const APPLE_ISSUER = "https://appleid.apple.com";
 /** Apple ID tokens are always ES256. */
@@ -680,8 +673,7 @@ var AppleProvider = class extends OidcProvider {
 		return profile;
 	}
 };
-//#endregion
-//#region src/providers/fake.ts
+// src/providers/fake.ts
 /**
 * Deterministic, network-free {@link IdentityProvider} for unit tests and the
 * `DEMO_MODE=test` fake-IdP e2e route (RFC §9). `exchange` resolves a `code`
@@ -718,8 +710,7 @@ var FakeIdentityProvider = class {
 		});
 	}
 };
-//#endregion
-//#region src/registry.ts
+// src/registry.ts
 const DEFAULT_CALLBACK_TEMPLATE = "/auth/oauth/:provider/callback";
 /**
 * Holds the configured {@link IdentityProvider}s + {@link FederatedPolicy} +
@@ -801,8 +792,7 @@ var OAuthProviderRegistry = class {
 		return deriveSeededPkce(this.stateSecret, seed);
 	}
 };
-//#endregion
-//#region src/federated-login-service.ts
+// src/federated-login-service.ts
 /**
 * The core federated-login logic (RFC §3.5): map a verified provider profile to
 * an aooth user id. Pure orchestration over `UserService` + `FederatedIdentityStore`
@@ -939,5 +929,4 @@ var FederatedLoginService = class {
 		return this.federated.touchLogin(profile.provider, profile.subject, pickDefinedProfile(profile));
 	}
 };
-//#endregion
 export { AppleProvider, FakeIdentityProvider, FederatedLoginService, GithubProvider, GoogleProvider, OAuthError, OAuthProviderRegistry, OidcProvider, createPkcePair, defaultUsernameStrategy, deriveSeededPkce, generateNonce, generateRandomState, isConfigurableProvider, pkceChallengeFor, resolveFederatedPolicy, signState, verifyState };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/idp",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Framework-agnostic OAuth2 / OIDC federated-login core for aoothjs (provider registry, PKCE/state, ID-token verification, account resolution)",
   "keywords": [
     "aoothjs",
@@ -43,12 +43,10 @@
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@aooth/auth": "0.2.1",
-    "@aooth/user": "0.2.1"
-  },
-  "devDependencies": {
-    "vitest": "npm:@voidzero-dev/vite-plus-test@latest"
+    "@aooth/auth": "0.2.2",
+    "@aooth/user": "0.2.2"
   },
+  "devDependencies": {},
   "scripts": {
     "build": "vp pack",
     "dev": "vp pack --watch",