npm - @authup/client-auth-console - Versions diffs - 1.0.0-beta.62 → 1.0.0-beta.63 - Mend

@authup/client-auth-console 1.0.0-beta.62 → 1.0.0-beta.63

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/client/.vite/ssr-manifest.json +54 -0
package/dist/client/assets/{index-D-9Xc0Mb.js → index-D9LuwbLi.js} +6 -6
package/dist/client/index.html +1 -1
package/dist/server/server.js +291 -46
package/package.json +13 -8
package/src/contract.ts +10 -1

package/dist/client/index.html CHANGED Viewed

@@ -12,7 +12,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Authup</title>
     <!--preload-links-->
-  <script type="module" crossorigin src="/public/assets/index-D-9Xc0Mb.js"></script>
+  <script type="module" crossorigin src="/public/assets/index-D9LuwbLi.js"></script>
   <link rel="stylesheet" crossorigin href="/public/assets/index-8yjUEagG.css">
 </head>
 <body>

package/dist/server/server.js CHANGED Viewed

@@ -32943,7 +32943,7 @@ function isAuthupError(input) {
 	if (!Array.isArray(input["@instanceof"])) return false;
 	return matchesInstanceof(input, AUTHUP_ERROR_INSTANCE);
 }
-ErrorCode$1.OAUTH_CLIENT_INVALID, ErrorCode$1.HTTP_BEARER_TOKEN_MALFORMED, ErrorCode$1.HTTP_HEADER_AUTH_TYPE_UNSUPPORTED, ErrorCode$1.IDENTITY_UNAUTHORIZED, ErrorCode$1.PERMISSION_NOT_FOUND, ErrorCode$1.PERMISSION_DENIED, ErrorCode$1.PERMISSION_EVALUATION_FAILED, ErrorCode$1.ENTITY_NOT_FOUND, ErrorCode$1.JWK_NOT_FOUND, ErrorCode$1.ENTITY_CONFLICT, ErrorCode$1.LOGIN_ATTEMPT_THROTTLED, ErrorCode$1.MFA_ATTEMPT_THROTTLED, ErrorCode$1.INTERNAL_ERROR, ErrorCode$1.UPSTREAM_ERROR, ErrorCode$1.STORAGE_INSUFFICIENT;
+ErrorCode$1.OAUTH_CLIENT_INVALID, ErrorCode$1.HTTP_BEARER_TOKEN_MALFORMED, ErrorCode$1.HTTP_HEADER_AUTH_TYPE_UNSUPPORTED, ErrorCode$1.IDENTITY_UNAUTHORIZED, ErrorCode$1.JWT_EXPIRED, ErrorCode$1.JWT_INACTIVE, ErrorCode$1.JWT_INVALID, ErrorCode$1.PERMISSION_NOT_FOUND, ErrorCode$1.PERMISSION_DENIED, ErrorCode$1.PERMISSION_EVALUATION_FAILED, ErrorCode$1.ENTITY_NOT_FOUND, ErrorCode$1.JWK_NOT_FOUND, ErrorCode$1.ENTITY_CONFLICT, ErrorCode$1.LOGIN_ATTEMPT_THROTTLED, ErrorCode$1.MFA_ATTEMPT_THROTTLED, ErrorCode$1.INTERNAL_ERROR, ErrorCode$1.UPSTREAM_ERROR, ErrorCode$1.STORAGE_INSUFFICIENT;
 //#endregion
 //#region ../../packages/core-kit/src/helpers/name-valid.ts
 function isNameValid(input, options = {}) {
@@ -47475,6 +47475,8 @@ var IdentityProviderOAuth2AttributesValidator = class extends Container {
 		this.mount("authorizeUrl", createValidator(url$1()));
 		this.mount("userInfoUrl", { optional: true }, createValidator(url$1().optional().nullable()));
 		this.mount("scope", { optional: true }, createValidator(string$1().min(3).max(2e3).optional().nullable()));
+		this.mount("requiredAmr", { optional: true }, createValidator(string$1().min(1).max(2e3).regex(/[^\s,]/).optional().nullable()));
+		this.mount("requiredAcr", { optional: true }, createValidator(string$1().min(1).max(2e3).regex(/[^\s,]/).optional().nullable()));
 	}
 };
 //#endregion
@@ -49212,6 +49214,10 @@ var TranslatorTranslationFieldKey = /* @__PURE__ */ function(TranslatorTranslati
 	TranslatorTranslationFieldKey["CLIENT_ID"] = "clientId";
 	TranslatorTranslationFieldKey["CLIENT_SECRET"] = "clientSecret";
 	TranslatorTranslationFieldKey["SCOPE"] = "scope";
+	TranslatorTranslationFieldKey["REQUIRED_AMR"] = "requiredAmr";
+	TranslatorTranslationFieldKey["REQUIRED_AMR_HINT"] = "requiredAmrHint";
+	TranslatorTranslationFieldKey["REQUIRED_ACR"] = "requiredAcr";
+	TranslatorTranslationFieldKey["REQUIRED_ACR_HINT"] = "requiredAcrHint";
 	TranslatorTranslationFieldKey["TOKEN"] = "token";
 	TranslatorTranslationFieldKey["USER_INFO"] = "userInfo";
 	TranslatorTranslationFieldKey["DISCOVERY"] = "discovery";
@@ -49251,6 +49257,7 @@ var TranslatorTranslationActionKey = /* @__PURE__ */ function(TranslatorTranslat
 	TranslatorTranslationActionKey["SHOW"] = "show";
 	TranslatorTranslationActionKey["HIDE"] = "hide";
 	TranslatorTranslationActionKey["REMOVE"] = "remove";
+	TranslatorTranslationActionKey["RETRY"] = "retry";
 	return TranslatorTranslationActionKey;
 }({});
 /**
@@ -49288,6 +49295,7 @@ var TranslatorTranslationCommonKey = /* @__PURE__ */ function(TranslatorTranslat
 	TranslatorTranslationCommonKey["REQUEST"] = "request";
 	TranslatorTranslationCommonKey["DATA"] = "data";
 	TranslatorTranslationCommonKey["BREADCRUMB"] = "breadcrumb";
+	TranslatorTranslationCommonKey["LOAD_FAILED"] = "loadFailed";
 	return TranslatorTranslationCommonKey;
 }({});
 //#endregion
@@ -49310,7 +49318,8 @@ var TranslatorTranslationActionEnglish = {
 	[TranslatorTranslationActionKey.LOOKUP]: "Lookup",
 	[TranslatorTranslationActionKey.SHOW]: "Show",
 	[TranslatorTranslationActionKey.HIDE]: "Hide",
-	[TranslatorTranslationActionKey.REMOVE]: "Remove"
+	[TranslatorTranslationActionKey.REMOVE]: "Remove",
+	[TranslatorTranslationActionKey.RETRY]: "Retry"
 };
 //#endregion
 //#region ../../packages/i18n/src/catalogs/en/app.ts
@@ -49560,7 +49569,8 @@ var TranslatorTranslationCommonEnglish = {
 	[TranslatorTranslationCommonKey.PROCESSING]: "Processing",
 	[TranslatorTranslationCommonKey.REQUEST]: "Request",
 	[TranslatorTranslationCommonKey.DATA]: "Data",
-	[TranslatorTranslationCommonKey.BREADCRUMB]: "Breadcrumb"
+	[TranslatorTranslationCommonKey.BREADCRUMB]: "Breadcrumb",
+	[TranslatorTranslationCommonKey.LOAD_FAILED]: "The content could not be loaded."
 };
 //#endregion
 //#region ../../packages/i18n/src/catalogs/en/entity.ts
@@ -49738,6 +49748,10 @@ var TranslatorTranslationFieldEnglish = {
 	[TranslatorTranslationFieldKey.CLIENT_ID]: "Client ID",
 	[TranslatorTranslationFieldKey.CLIENT_SECRET]: "Client secret",
 	[TranslatorTranslationFieldKey.SCOPE]: "Scope",
+	[TranslatorTranslationFieldKey.REQUIRED_AMR]: "Required amr claim (any of)",
+	[TranslatorTranslationFieldKey.REQUIRED_ACR]: "Required acr value (any of)",
+	[TranslatorTranslationFieldKey.REQUIRED_AMR_HINT]: "Accept the login when the provider token carries any one of these. Empty trusts the provider.",
+	[TranslatorTranslationFieldKey.REQUIRED_ACR_HINT]: "Also sent as acr_values on the authorize request. Empty trusts the provider.",
 	[TranslatorTranslationFieldKey.TOKEN]: "Token",
 	[TranslatorTranslationFieldKey.USER_INFO]: "UserInfo",
 	[TranslatorTranslationFieldKey.DISCOVERY]: "Discovery",
@@ -49794,7 +49808,8 @@ var TranslatorTranslationActionGerman = {
 	[TranslatorTranslationActionKey.LOOKUP]: "Nachschlagen",
 	[TranslatorTranslationActionKey.SHOW]: "Anzeigen",
 	[TranslatorTranslationActionKey.HIDE]: "Verbergen",
-	[TranslatorTranslationActionKey.REMOVE]: "Entfernen"
+	[TranslatorTranslationActionKey.REMOVE]: "Entfernen",
+	[TranslatorTranslationActionKey.RETRY]: "Erneut versuchen"
 };
 //#endregion
 //#region ../../packages/i18n/src/catalogs/de/app.ts
@@ -50044,7 +50059,8 @@ var TranslatorTranslationCommonGerman = {
 	[TranslatorTranslationCommonKey.PROCESSING]: "Wird verarbeitet",
 	[TranslatorTranslationCommonKey.REQUEST]: "Anfrage",
 	[TranslatorTranslationCommonKey.DATA]: "Daten",
-	[TranslatorTranslationCommonKey.BREADCRUMB]: "Navigationspfad"
+	[TranslatorTranslationCommonKey.BREADCRUMB]: "Navigationspfad",
+	[TranslatorTranslationCommonKey.LOAD_FAILED]: "Der Inhalt konnte nicht geladen werden."
 };
 //#endregion
 //#region ../../packages/i18n/src/catalogs/de/entity.ts
@@ -50222,6 +50238,10 @@ var TranslatorTranslationFieldGerman = {
 	[TranslatorTranslationFieldKey.CLIENT_ID]: "Client-ID",
 	[TranslatorTranslationFieldKey.CLIENT_SECRET]: "Client-Secret",
 	[TranslatorTranslationFieldKey.SCOPE]: "Scope",
+	[TranslatorTranslationFieldKey.REQUIRED_AMR]: "Erforderlicher amr-Claim (eines davon)",
+	[TranslatorTranslationFieldKey.REQUIRED_ACR]: "Erforderlicher acr-Wert (einer davon)",
+	[TranslatorTranslationFieldKey.REQUIRED_AMR_HINT]: "Login akzeptieren, wenn das Provider-Token einen dieser Werte trägt. Leer vertraut dem Provider.",
+	[TranslatorTranslationFieldKey.REQUIRED_ACR_HINT]: "Wird auch als acr_values mit der Authorize-Anfrage gesendet. Leer vertraut dem Provider.",
 	[TranslatorTranslationFieldKey.TOKEN]: "Token",
 	[TranslatorTranslationFieldKey.USER_INFO]: "UserInfo",
 	[TranslatorTranslationFieldKey.DISCOVERY]: "Discovery",
@@ -50278,7 +50298,8 @@ var TranslatorTranslationActionFrench = {
 	[TranslatorTranslationActionKey.LOOKUP]: "Rechercher",
 	[TranslatorTranslationActionKey.SHOW]: "Afficher",
 	[TranslatorTranslationActionKey.HIDE]: "Masquer",
-	[TranslatorTranslationActionKey.REMOVE]: "Retirer"
+	[TranslatorTranslationActionKey.REMOVE]: "Retirer",
+	[TranslatorTranslationActionKey.RETRY]: "Réessayer"
 };
 //#endregion
 //#region ../../packages/i18n/src/catalogs/fr/app.ts
@@ -50528,7 +50549,8 @@ var TranslatorTranslationCommonFrench = {
 	[TranslatorTranslationCommonKey.PROCESSING]: "Traitement en cours",
 	[TranslatorTranslationCommonKey.REQUEST]: "Requête",
 	[TranslatorTranslationCommonKey.DATA]: "Données",
-	[TranslatorTranslationCommonKey.BREADCRUMB]: "Fil d'Ariane"
+	[TranslatorTranslationCommonKey.BREADCRUMB]: "Fil d'Ariane",
+	[TranslatorTranslationCommonKey.LOAD_FAILED]: "Le contenu n'a pas pu être chargé."
 };
 //#endregion
 //#region ../../packages/i18n/src/catalogs/fr/entity.ts
@@ -50706,6 +50728,10 @@ var TranslatorTranslationFieldFrench = {
 	[TranslatorTranslationFieldKey.CLIENT_ID]: "ID client",
 	[TranslatorTranslationFieldKey.CLIENT_SECRET]: "Secret du client",
 	[TranslatorTranslationFieldKey.SCOPE]: "Portée",
+	[TranslatorTranslationFieldKey.REQUIRED_AMR]: "Claim amr requis (au choix)",
+	[TranslatorTranslationFieldKey.REQUIRED_ACR]: "Valeur acr requise (au choix)",
+	[TranslatorTranslationFieldKey.REQUIRED_AMR_HINT]: "Accepter la connexion si le jeton du fournisseur porte l'une de ces valeurs. Vide fait confiance au fournisseur.",
+	[TranslatorTranslationFieldKey.REQUIRED_ACR_HINT]: "Également envoyé comme acr_values dans la requête d'autorisation. Vide fait confiance au fournisseur.",
 	[TranslatorTranslationFieldKey.TOKEN]: "Jeton",
 	[TranslatorTranslationFieldKey.USER_INFO]: "UserInfo",
 	[TranslatorTranslationFieldKey.DISCOVERY]: "Découverte",
@@ -50762,7 +50788,8 @@ var TranslatorTranslationActionSpanish = {
 	[TranslatorTranslationActionKey.LOOKUP]: "Buscar",
 	[TranslatorTranslationActionKey.SHOW]: "Mostrar",
 	[TranslatorTranslationActionKey.HIDE]: "Ocultar",
-	[TranslatorTranslationActionKey.REMOVE]: "Quitar"
+	[TranslatorTranslationActionKey.REMOVE]: "Quitar",
+	[TranslatorTranslationActionKey.RETRY]: "Reintentar"
 };
 //#endregion
 //#region ../../packages/i18n/src/catalogs/es/app.ts
@@ -51012,7 +51039,8 @@ var TranslatorTranslationCommonSpanish = {
 	[TranslatorTranslationCommonKey.PROCESSING]: "Procesando",
 	[TranslatorTranslationCommonKey.REQUEST]: "Solicitud",
 	[TranslatorTranslationCommonKey.DATA]: "Datos",
-	[TranslatorTranslationCommonKey.BREADCRUMB]: "Ruta de navegación"
+	[TranslatorTranslationCommonKey.BREADCRUMB]: "Ruta de navegación",
+	[TranslatorTranslationCommonKey.LOAD_FAILED]: "No se pudo cargar el contenido."
 };
 //#endregion
 //#region ../../packages/i18n/src/catalogs/es/entity.ts
@@ -51190,6 +51218,10 @@ var TranslatorTranslationFieldSpanish = {
 	[TranslatorTranslationFieldKey.CLIENT_ID]: "ID de cliente",
 	[TranslatorTranslationFieldKey.CLIENT_SECRET]: "Secreto del cliente",
 	[TranslatorTranslationFieldKey.SCOPE]: "Ámbito",
+	[TranslatorTranslationFieldKey.REQUIRED_AMR]: "Claim amr requerido (cualquiera)",
+	[TranslatorTranslationFieldKey.REQUIRED_ACR]: "Valor acr requerido (cualquiera)",
+	[TranslatorTranslationFieldKey.REQUIRED_AMR_HINT]: "Aceptar el inicio de sesión cuando el token del proveedor lleve alguno de estos valores. Vacío confía en el proveedor.",
+	[TranslatorTranslationFieldKey.REQUIRED_ACR_HINT]: "También se envía como acr_values en la solicitud de autorización. Vacío confía en el proveedor.",
 	[TranslatorTranslationFieldKey.TOKEN]: "Token",
 	[TranslatorTranslationFieldKey.USER_INFO]: "UserInfo",
 	[TranslatorTranslationFieldKey.DISCOVERY]: "Descubrimiento",
@@ -58847,6 +58879,12 @@ var CookieName = /* @__PURE__ */ function(CookieName) {
 	CookieName["ACCESS_TOKEN_EXPIRE_DATE"] = "access_token_expire_date";
 	CookieName["REFRESH_TOKEN"] = "refresh_token";
 	CookieName["ID_TOKEN"] = "id_token";
+	/**
+	* @deprecated No longer written by the client-web-kit store: the record is
+	* unbounded (extra attributes are flattened onto the `/userinfo` response)
+	* and is re-derived by `resolve()`. The name is kept so the store can sweep
+	* copies written by earlier versions.
+	*/
 	CookieName["USER"] = "user";
 	CookieName["REALM"] = "realm";
 	CookieName["REALM_MANAGEMENT"] = "realm_management";
@@ -89325,6 +89363,9 @@ var IdentityProviderAPI = class extends BaseAPI$1 {
 	async createLinkRequest(id) {
 		return (await this.client.post(`identity-providers/${id}/link-request`)).data;
 	}
+	async completeLogin(id) {
+		return (await this.client.post(`identity-providers/${id}/login-complete`)).data;
+	}
 	async confirmLinkRequest(id, handle) {
 		const payload = { handle };
 		return (await this.client.post(`identity-providers/${id}/link-confirm`, payload)).data;
@@ -89704,7 +89745,8 @@ var UserAuthenticatorAPI = class extends BaseAPI$1 {
 		return (await this.client.delete(`users/${userId}/authenticators/${id}`)).data;
 	}
 	async challenge(options) {
-		return (await this.client.get("authenticators/challenge", buildUserAuthenticatorChallengeRequestConfig(options))).data;
+		const url = options && options.acrValues ? `authenticators/challenge?acrValues=${encodeURIComponent(options.acrValues)}` : "authenticators/challenge";
+		return (await this.client.get(url, buildUserAuthenticatorChallengeRequestConfig(options))).data;
 	}
 	async sendChallenge(data, options) {
 		return (await this.client.post("authenticators/challenge/send", data, buildUserAuthenticatorChallengeRequestConfig(options))).data;
@@ -93314,11 +93356,22 @@ function createStore(context) {
 		idToken.value = input;
 		context.dispatcher.emit(StoreDispatcherEventName.ID_TOKEN_UPDATED, input);
 	};
+	/**
+	* The token's subject, narrowed to what is actually rendered: the id every
+	* owner-scoped query filters on, and the name / display name the account
+	* chip and the authorize page's "continue as" label read. A full `User` was
+	* held here once, at the cost of a `/userinfo` round-trip per restore, and
+	* no consumer ever read a field outside these three.
+	*/
 	const user = (0, vue_exports.ref)(null);
 	const userId = (0, vue_exports.computed)(() => user.value ? user.value.id : null);
 	const setUser = (input) => {
-		user.value = input;
-		context.dispatcher.emit(StoreDispatcherEventName.USER_UPDATED, input);
+		user.value = input ? {
+			id: input.id,
+			name: input.name,
+			displayName: input.displayName
+		} : null;
+		context.dispatcher.emit(StoreDispatcherEventName.USER_UPDATED, user.value);
 	};
 	const sessionId = (0, vue_exports.ref)(null);
 	const acr = (0, vue_exports.ref)(null);
@@ -93342,8 +93395,11 @@ function createStore(context) {
 	const realmManagementId = (0, vue_exports.computed)(() => realmManagement.value ? realmManagement.value.id : realmId.value);
 	const realmManagementName = (0, vue_exports.computed)(() => realmManagement.value ? realmManagement.value.name : realmName.value);
 	const setRealmManagement = (input) => {
-		realmManagement.value = input;
-		context.dispatcher.emit(StoreDispatcherEventName.REALM_MANAGEMENT_UPDATED, input);
+		realmManagement.value = input ? {
+			id: input.id,
+			name: input.name
+		} : null;
+		context.dispatcher.emit(StoreDispatcherEventName.REALM_MANAGEMENT_UPDATED, realmManagement.value);
 	};
 	const permissionProvider = new PermissionMemoryProvider();
 	const permissionEvaluator = new PermissionEvaluator({
@@ -93386,21 +93442,49 @@ function createStore(context) {
 		} catch {}
 		return generation;
 	};
-	const fetchTokenIntrospection = async (token) => client.token.introspect({ token }, { authorizationHeader: {
-		type: "Bearer",
-		token
-	} });
-	const fetchUserInfo = async (token) => client.userInfo.get(`Bearer ${token}`);
 	/**
-	* Whether the currently held user IS the subject of the introspected
-	* token. A user that came from anywhere but this token (cookie
-	* hydration, a raw seed) is only as trustworthy as the pairing, and the
-	* two can drift apart (a sibling login on the same origin, an id from a
-	* previous provisioning run). Revalidation re-fetches on a mismatch
-	* instead of carrying the stale identity for the app's lifetime: it is
-	* what the UI renders and what its forms write against.
+	* The `active` check is the point of the wrapper. The endpoint answers 200
+	* with the full payload for a token it will not honour - revoked, or past
+	* its expiry - so reading the claims alone commits a dead token as a live
+	* session: identity set, permissions set, validated true, right up until
+	* the next protected call 401s.
+	*
+	* Rejecting instead of returning a flag hands both staging sites the path
+	* they already have for an introspection that failed outright: a stale
+	* restore falls through to `refreshSession()`, and a fresh grant reverts
+	* and revokes what it staged.
 	*/
-	const isTokenSubject = (value, introspection) => !!value && introspection.sub_kind === OAuth2SubKind.USER && introspection.sub === value.id;
+	const fetchTokenIntrospection = async (token) => {
+		const response = await client.token.introspect({ token }, { authorizationHeader: {
+			type: "Bearer",
+			token
+		} });
+		if (!response.active) throw new OAuth2Error("The access token is not active.");
+		return response;
+	};
+	/**
+	* The introspected token's subject, built from the response itself: the
+	* introspection endpoint resolves the identity server-side and answers
+	* with its OpenID claims (`name`, and `displayName` under `nickname`), so
+	* a second `/userinfo` round-trip fetched a whole entity to restate three
+	* fields the store already had in hand.
+	*
+	* Deriving it also settles the identity question the predecessor had to ask
+	* separately: the held user cannot drift from the token, because it IS the
+	* token's subject on every commit. A non-user subject yields null rather
+	* than a failed lookup — `/userinfo` resolves `@me` through the user
+	* service, which throws for a client actor and took the whole `resolve()`
+	* down with it.
+	*/
+	const buildUser = (introspection) => {
+		if (introspection.sub_kind !== OAuth2SubKind.USER || !introspection.sub) return null;
+		const { name, nickname } = introspection;
+		return {
+			id: introspection.sub,
+			name: name || "",
+			displayName: nickname || null
+		};
+	};
 	const commitSession = (ctx) => {
 		if (ctx.generation !== tokenGeneration.value) return false;
 		if (ctx.grant) applyTokenGrantResponse(ctx.grant);
@@ -93414,7 +93498,8 @@ function createStore(context) {
 			};
 			if (!realmManagement.value) setRealmManagement(realm.value);
 		}
-		if (ctx.user) setUser(ctx.user);
+		const subject = buildUser(ctx.introspection);
+		if (!user.value || user.value.id !== subject?.id) setUser(subject);
 		if (ctx.introspection.permissions) permissionProvider.setMany(ctx.introspection.permissions.map((permission) => ({ permission: {
 			name: permission.name,
 			realmId: permission.realm_id,
@@ -93464,12 +93549,10 @@ function createStore(context) {
 		const token = accessToken.value;
 		if (!token) return;
 		const introspection = await fetchTokenIntrospection(token);
-		const userInfo = isTokenSubject(user.value, introspection) ? void 0 : await fetchUserInfo(token);
 		commitSession({
 			generation,
 			token,
-			introspection,
-			user: userInfo
+			introspection
 		});
 	};
 	const resolveInternal = async () => {
@@ -93496,13 +93579,11 @@ function createStore(context) {
 		let committed = false;
 		try {
 			const introspection = await fetchTokenIntrospection(response.access_token);
-			const userInfo = await fetchUserInfo(response.access_token);
 			committed = commitSession({
 				generation,
 				token: response.access_token,
 				grant: response,
 				introspection,
-				user: userInfo,
 				origin
 			});
 		} finally {
@@ -94155,9 +94236,6 @@ function installStore(app, options = {}) {
 				case CookieName.ID_TOKEN:
 					if (!store.idToken) store.setIdToken(value);
 					break;
-				case CookieName.USER:
-					if (!store.user) store.setUser(value);
-					break;
 				case CookieName.REALM:
 					if (!store.realm) store.setRealm(value);
 					break;
@@ -94193,10 +94271,6 @@ function installStore(app, options = {}) {
 		if (input) cookieSet(CookieName.ID_TOKEN, input, { path: cookiePath });
 		else cookieUnset(CookieName.ID_TOKEN, { path: cookiePath });
 	});
-	storeDispatcher.on(StoreDispatcherEventName.USER_UPDATED, (input) => {
-		if (input) cookieSet(CookieName.USER, input, { path: cookiePath });
-		else cookieUnset(CookieName.USER, { path: cookiePath });
-	});
 	storeDispatcher.on(StoreDispatcherEventName.REALM_UPDATED, (input) => {
 		if (input) cookieSet(CookieName.REALM, input, { path: cookiePath });
 		else cookieUnset(CookieName.REALM, { path: cookiePath });
@@ -94206,6 +94280,26 @@ function installStore(app, options = {}) {
 		else cookieUnset(CookieName.REALM_MANAGEMENT, { path: cookiePath });
 	});
 	dropShadowingCookies();
+	/**
+	* The user record is deliberately NOT persisted.
+	*
+	* Its value was the verbatim `/userinfo` body, and extra attributes are
+	* flattened onto that response AFTER the query projection, so nothing
+	* bounded its size: one operator-defined attribute is enough to push the
+	* cookie past the 4096 byte limit, where the browser drops it silently.
+	* It also carried the email and both names into the header of every
+	* request on the origin, static assets included. The store now builds the
+	* subject from the introspection response `resolve()` already awaits, so
+	* there is nothing to persist and nothing to restore.
+	*
+	* Copies written by earlier versions are swept here rather than left to
+	* expire: they carry no `maxAge`, so an open browser would keep sending one
+	* until it closes. The sweep is conditional because the name is a bare
+	* `user` on the pinned path — an unconditional delete would reach a
+	* same-named cookie belonging to another app on the origin on every single
+	* install, rather than once for a browser carrying the kit's own leftover.
+	*/
+	if (cookieGet(CookieName.USER)) cookieUnset(CookieName.USER, { path: cookiePath });
 	readCookies();
 	provideStoreFactory(storeFactory, app);
 }
@@ -136783,15 +136877,21 @@ var AIdentityProviderOAuth2ClientFields_vue_vue_type_script_lang_default = (0, v
 		const form = (0, vue_exports.reactive)({
 			clientId: "",
 			clientSecret: "",
-			scope: ""
+			scope: "",
+			requiredAmr: "",
+			requiredAcr: ""
 		});
 		const secretShow = (0, vue_exports.ref)(false);
 		const v = useValidup(new IdentityProviderOAuth2AttributesValidator({ pathsToInclude: [
 			"clientId",
 			"clientSecret",
-			"scope"
+			"scope",
+			"requiredAmr",
+			"requiredAcr"
 		] }), form, { name: "client" });
 		const scopeField = v.fields.at("scope");
+		const requiredAmrField = v.fields.at("requiredAmr");
+		const requiredAcrField = v.fields.at("requiredAcr");
 		const scopes = (0, vue_exports.computed)(() => splitOAuth2Scope(scopeField.$model.value));
 		function assign() {
 			assignFormProperties(form, props.entity, { fields: v.fields });
@@ -136811,6 +136911,22 @@ var AIdentityProviderOAuth2ClientFields_vue_vue_type_script_lang_default = (0, v
 				namespace: TranslatorTranslationNamespace.FIELD,
 				key: TranslatorTranslationFieldKey.SCOPE
 			},
+			{
+				namespace: TranslatorTranslationNamespace.FIELD,
+				key: TranslatorTranslationFieldKey.REQUIRED_AMR
+			},
+			{
+				namespace: TranslatorTranslationNamespace.FIELD,
+				key: TranslatorTranslationFieldKey.REQUIRED_AMR_HINT
+			},
+			{
+				namespace: TranslatorTranslationNamespace.FIELD,
+				key: TranslatorTranslationFieldKey.REQUIRED_ACR
+			},
+			{
+				namespace: TranslatorTranslationNamespace.FIELD,
+				key: TranslatorTranslationFieldKey.REQUIRED_ACR_HINT
+			},
 			{
 				namespace: TranslatorTranslationNamespace.ACTION,
 				key: TranslatorTranslationActionKey.SHOW
@@ -136823,6 +136939,8 @@ var AIdentityProviderOAuth2ClientFields_vue_vue_type_script_lang_default = (0, v
 		return {
 			v,
 			scopeField,
+			requiredAmrField,
+			requiredAcrField,
 			scopes,
 			secretShow,
 			secretToggleLabel: (0, vue_exports.computed)(() => secretShow.value ? translations.hide : translations.show),
@@ -136982,6 +137100,82 @@ function _sfc_ssrRender$59(_ctx, _push, _parent, _attrs, $props, $setup, $data,
 		}),
 		_: 1
 	}, _parent));
+	_push((0, server_renderer_exports.ssrRenderComponent)(_component_IFieldValidation, { field: _ctx.requiredAmrField }, {
+		default: (0, vue_exports.withCtx)(({ value }, _push, _parent, _scopeId) => {
+			if (_push) _push((0, server_renderer_exports.ssrRenderComponent)(_component_VCFormGroup, { validation: value }, {
+				label: (0, vue_exports.withCtx)((_, _push, _parent, _scopeId) => {
+					if (_push) _push(`${(0, server_renderer_exports.ssrInterpolate)(_ctx.translations.requiredAmr)}`);
+					else return [(0, vue_exports.createTextVNode)((0, vue_exports.toDisplayString)(_ctx.translations.requiredAmr), 1)];
+				}),
+				hint: (0, vue_exports.withCtx)((_, _push, _parent, _scopeId) => {
+					if (_push) _push(`${(0, server_renderer_exports.ssrInterpolate)(_ctx.translations.requiredAmrHint)}`);
+					else return [(0, vue_exports.createTextVNode)((0, vue_exports.toDisplayString)(_ctx.translations.requiredAmrHint), 1)];
+				}),
+				default: (0, vue_exports.withCtx)((_, _push, _parent, _scopeId) => {
+					if (_push) _push((0, server_renderer_exports.ssrRenderComponent)(_component_VCFormInput, {
+						modelValue: _ctx.requiredAmrField.$model.value,
+						"onUpdate:modelValue": ($event) => _ctx.requiredAmrField.$model.value = $event,
+						placeholder: "mfa, hwk"
+					}, null, _parent, _scopeId));
+					else return [(0, vue_exports.createVNode)(_component_VCFormInput, {
+						modelValue: _ctx.requiredAmrField.$model.value,
+						"onUpdate:modelValue": ($event) => _ctx.requiredAmrField.$model.value = $event,
+						placeholder: "mfa, hwk"
+					}, null, 8, ["modelValue", "onUpdate:modelValue"])];
+				}),
+				_: 2
+			}, _parent, _scopeId));
+			else return [(0, vue_exports.createVNode)(_component_VCFormGroup, { validation: value }, {
+				label: (0, vue_exports.withCtx)(() => [(0, vue_exports.createTextVNode)((0, vue_exports.toDisplayString)(_ctx.translations.requiredAmr), 1)]),
+				hint: (0, vue_exports.withCtx)(() => [(0, vue_exports.createTextVNode)((0, vue_exports.toDisplayString)(_ctx.translations.requiredAmrHint), 1)]),
+				default: (0, vue_exports.withCtx)(() => [(0, vue_exports.createVNode)(_component_VCFormInput, {
+					modelValue: _ctx.requiredAmrField.$model.value,
+					"onUpdate:modelValue": ($event) => _ctx.requiredAmrField.$model.value = $event,
+					placeholder: "mfa, hwk"
+				}, null, 8, ["modelValue", "onUpdate:modelValue"])]),
+				_: 2
+			}, 1032, ["validation"])];
+		}),
+		_: 1
+	}, _parent));
+	_push((0, server_renderer_exports.ssrRenderComponent)(_component_IFieldValidation, { field: _ctx.requiredAcrField }, {
+		default: (0, vue_exports.withCtx)(({ value }, _push, _parent, _scopeId) => {
+			if (_push) _push((0, server_renderer_exports.ssrRenderComponent)(_component_VCFormGroup, { validation: value }, {
+				label: (0, vue_exports.withCtx)((_, _push, _parent, _scopeId) => {
+					if (_push) _push(`${(0, server_renderer_exports.ssrInterpolate)(_ctx.translations.requiredAcr)}`);
+					else return [(0, vue_exports.createTextVNode)((0, vue_exports.toDisplayString)(_ctx.translations.requiredAcr), 1)];
+				}),
+				hint: (0, vue_exports.withCtx)((_, _push, _parent, _scopeId) => {
+					if (_push) _push(`${(0, server_renderer_exports.ssrInterpolate)(_ctx.translations.requiredAcrHint)}`);
+					else return [(0, vue_exports.createTextVNode)((0, vue_exports.toDisplayString)(_ctx.translations.requiredAcrHint), 1)];
+				}),
+				default: (0, vue_exports.withCtx)((_, _push, _parent, _scopeId) => {
+					if (_push) _push((0, server_renderer_exports.ssrRenderComponent)(_component_VCFormInput, {
+						modelValue: _ctx.requiredAcrField.$model.value,
+						"onUpdate:modelValue": ($event) => _ctx.requiredAcrField.$model.value = $event,
+						placeholder: "urn:mace:incommon:iap:silver"
+					}, null, _parent, _scopeId));
+					else return [(0, vue_exports.createVNode)(_component_VCFormInput, {
+						modelValue: _ctx.requiredAcrField.$model.value,
+						"onUpdate:modelValue": ($event) => _ctx.requiredAcrField.$model.value = $event,
+						placeholder: "urn:mace:incommon:iap:silver"
+					}, null, 8, ["modelValue", "onUpdate:modelValue"])];
+				}),
+				_: 2
+			}, _parent, _scopeId));
+			else return [(0, vue_exports.createVNode)(_component_VCFormGroup, { validation: value }, {
+				label: (0, vue_exports.withCtx)(() => [(0, vue_exports.createTextVNode)((0, vue_exports.toDisplayString)(_ctx.translations.requiredAcr), 1)]),
+				hint: (0, vue_exports.withCtx)(() => [(0, vue_exports.createTextVNode)((0, vue_exports.toDisplayString)(_ctx.translations.requiredAcrHint), 1)]),
+				default: (0, vue_exports.withCtx)(() => [(0, vue_exports.createVNode)(_component_VCFormInput, {
+					modelValue: _ctx.requiredAcrField.$model.value,
+					"onUpdate:modelValue": ($event) => _ctx.requiredAcrField.$model.value = $event,
+					placeholder: "urn:mace:incommon:iap:silver"
+				}, null, 8, ["modelValue", "onUpdate:modelValue"])]),
+				_: 2
+			}, 1032, ["validation"])];
+		}),
+		_: 1
+	}, _parent));
 	_push(`</div>`);
 }
 var _sfc_setup$60 = AIdentityProviderOAuth2ClientFields_vue_vue_type_script_lang_default.setup;
@@ -145084,13 +145278,23 @@ var Authorize_vue_vue_type_script_lang_default = (0, vue_exports.defineComponent
 		redirectUriVerified: {
 			type: Boolean,
 			default: false
-		}
+		},
+		/**
+		* The one-time handle a federated callback put on this URL, for the
+		* session it established (plan 094). It is redeemed AFTER mount, so
+		* the resulting lastAuthOrigin change reaches the watch below and
+		* the login counts as fresh: select_account then skips the chooser
+		* (the account was chosen at the provider) and prompt=login does not
+		* demand a second credential entry.
+		*/
+		federatedLogin: { type: Object }
 	},
 	emits: ["redirect", "failed"],
 	setup(props, { emit }) {
 		const httpClient = injectHTTPClient();
 		const store = injectStore();
 		const { acr, loggedIn, lastAuthOrigin, realmId, user } = storeToRefs$1(store);
+		const federatedLoginPending = (0, vue_exports.ref)(!!props.federatedLogin);
 		const switchAccount = () => {
 			store.logout();
 		};
@@ -145115,13 +145319,14 @@ var Authorize_vue_vue_type_script_lang_default = (0, vue_exports.defineComponent
 		const accountConfirmed = (0, vue_exports.computed)(() => accountConfirmedLocal.value);
 		const mfaStatus = (0, vue_exports.ref)(null);
 		const mfaResolving = (0, vue_exports.ref)(false);
+		const challengeOptions = () => ({ acrValues: props.codeRequest?.acr_values });
 		const refreshMfaStatus = async () => {
 			mfaResolving.value = true;
 			try {
-				mfaStatus.value = await httpClient.userAuthenticator.challenge();
+				mfaStatus.value = await httpClient.userAuthenticator.challenge(challengeOptions());
 			} catch {
 				try {
-					mfaStatus.value = await httpClient.userAuthenticator.challenge();
+					mfaStatus.value = await httpClient.userAuthenticator.challenge(challengeOptions());
 				} catch {
 					mfaStatus.value = {
 						required: false,
@@ -145133,6 +145338,29 @@ var Authorize_vue_vue_type_script_lang_default = (0, vue_exports.defineComponent
 				mfaResolving.value = false;
 			}
 		};
+		/**
+		* A redemption that failed is terminal for this render. The person
+		* came back from an external provider, so continuing the ladder
+		* against whatever session the cookies already hold would consent an
+		* application into the WRONG account, silently for a builtIn client.
+		*/
+		const federatedError = (0, vue_exports.ref)(null);
+		(0, vue_exports.onMounted)(async () => {
+			const federated = props.federatedLogin;
+			if (!federated) return;
+			try {
+				const grant = await httpClient.identityProvider.completeLogin(federated.providerId);
+				await store.loginWithTokenGrant(grant);
+			} catch (e) {
+				const ctx = extractErrorContext(e);
+				const message = ctx.message ?? (e instanceof Error ? e.message : String(e));
+				if (ctx.data?.reason !== "identityProviderLoginNotPending") store.logout();
+				federatedError.value = message;
+				emit("failed", message);
+			} finally {
+				federatedLoginPending.value = false;
+			}
+		});
 		const consentStatus = (0, vue_exports.ref)(null);
 		const requestedScopeTokens = (0, vue_exports.computed)(() => unwrapOAuth2Scope(props.codeRequest?.scope ?? []).filter((token) => token.length > 0));
 		const refreshConsentStatus = async () => {
@@ -145231,6 +145459,11 @@ var Authorize_vue_vue_type_script_lang_default = (0, vue_exports.defineComponent
 				const redirect = silentRedirect(silentErrorCode.value);
 				if (redirect) return redirect;
 			}
+			if (federatedLoginPending.value) return wrapChild((0, vue_exports.h)(AuthorizeText_default, { message: loadingText.value }));
+			if (federatedError.value && loggedIn.value) return wrapChild((0, vue_exports.h)(AuthorizeText_default, {
+				message: federatedError.value,
+				isError: true
+			}));
 			const forceReauth = (isReauth || reauthRequired.value) && !accountConfirmed.value;
 			if (!loggedIn.value || forceReauth) {
 				if (isSilent) {
@@ -145247,6 +145480,10 @@ var Authorize_vue_vue_type_script_lang_default = (0, vue_exports.defineComponent
 					}),
 					fallback: () => (0, vue_exports.h)(AuthorizeText_default, { message: loadingText.value })
 				});
+				if (federatedError.value) return wrapChild([(0, vue_exports.h)(AuthorizeText_default, {
+					message: federatedError.value,
+					isError: true
+				}), loginNode]);
 				return wrapChild(forceReauth ? [(0, vue_exports.h)(AuthorizeText_default, { message: reauthText.value }), loginNode] : loginNode);
 			}
 			if (!realmId.value) return wrapChild((0, vue_exports.h)(AuthorizeText_default, { message: loadingText.value }));
@@ -151392,6 +151629,13 @@ var authorize_vue_vue_type_script_lang_default = (0, vue_exports.defineComponent
 	components: { AAuthorize: Authorize_default },
 	setup() {
 		const app = injectPayload();
+		(0, vue_exports.onMounted)(() => {
+			if (typeof window === "undefined") return;
+			const url = new URL(window.location.href);
+			if (!url.searchParams.has("provider")) return;
+			url.searchParams.delete("provider");
+			window.history.replaceState(window.history.state, "", url.href);
+		});
 		const withBasePath = useBasePath();
 		const buildWorkflowLink = (path) => {
 			const params = new URLSearchParams();
@@ -151428,6 +151672,7 @@ function _sfc_ssrRender$6(_ctx, _push, _parent, _attrs, $props, $setup, $data, $
 		error: _ctx.data.error,
 		realm: _ctx.data.realm,
 		"redirect-uri-verified": _ctx.data.redirectUriVerified,
+		"federated-login": _ctx.data.federatedLogin,
 		"register-link": _ctx.registerLink,
 		"password-forgot-link": _ctx.passwordForgotLink,
 		onFailed: _ctx.handleFailed
@@ -151873,7 +152118,7 @@ function createWindowPayloadHTML(payload) {
 * against an older contract would otherwise fail per request on
 * `/authorize` rather than at boot with an actionable message.
 */
-var CONTRACT_VERSION = 2;
+var CONTRACT_VERSION = 3;
 //#endregion
 //#region src/server.ts
 async function render(ctx) {