@crvouga/mockingbird-service-oauth 1.2.1 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog — @crvouga/mockingbird-service-oauth
 
+## 1.4.0 (2026-09-29)
+
+### Features
+
+- opt-in seeded credentials so a seeded run replays byte-for-byte ([7a41166](https://github.com/crvouga/mockingbird/commit/7a41166326791b4fc06627fb544d150d3eaab99c))
+
+### Fixes and improvements
+
+- make the seeded-credentials example self-contained ([64eef9c](https://github.com/crvouga/mockingbird/commit/64eef9ccbaa555f3bc2420961b7f8fc2a92f5058))
+
+## 1.3.0 (2026-09-29)
+
+### Features
+
+- admin read of an account's grant with a client ([90b0279](https://github.com/crvouga/mockingbird/commit/90b0279f53cb4959b18c8992ae64bb00b5de4f96))
+
 ## 1.2.1 (2026-09-29)
 
 ### Fixes and improvements

package/README.md

@@ -150,7 +150,7 @@ tapping `oauth-mock-form-post-continue`; with scripts, the page submits the form
 
 ### Reproducible provider edge cases
 
-Behavioral randomness is **off by default**. Configure exact scenarios or probabilities; these are test frequencies you choose, not estimates of vendor incidence. OAuth credentials, authorization codes and signing keys always use cryptographic randomness.
+Behavioral randomness is **off by default**. Configure exact scenarios or probabilities; these are test frequencies you choose, not estimates of vendor incidence. OAuth credentials, authorization codes and signing keys use cryptographic randomness unless you opt in to [seeded credentials](#seeded-credentials).
 
 ```ts
 import { createRuntime } from "@crvouga/mockingbird-service-oauth"
@@ -198,6 +198,8 @@ curl -X PUT http://localhost:8810/__admin/behavior -H 'content-type: application
 curl http://localhost:8810/__admin/behavior
 curl -X POST http://localhost:8810/__admin/consents/revoke -H 'content-type: application/json' \
   -d '{"clientId":"app","accountId":"ada"}'
+curl 'http://localhost:8810/__admin/grants?clientId=app&accountId=ada'
+curl 'http://localhost:8810/__admin/grants?clientId=app'
 curl -X POST http://localhost:8810/__admin/accounts/delete -H 'content-type: application/json' \
   -d '{"accountId":"ada"}'
 curl -X POST http://localhost:8810/__admin/relay-forwarding -H 'content-type: application/json' \
@@ -206,6 +208,8 @@ curl -X POST http://localhost:8810/__admin/keys/rotate -H 'content-type: applica
   -d '{"retainPrevious":true}'
 ```
 
+`GET /__admin/grants?clientId=<id>&accountId=<id>` (or `&email=<address>`) reads what that client sees for the account, without running a sign-in: `{ subject, granted, scopes, emailChoice, email, isPrivateEmail, userDisclosed }`. `subject` is the id token `sub` the client gets, or would get on a first authorization (it survives a consent revocation). `granted` says whether a consent exists, so whether the consent card is shown next time. `scopes` are the granted scopes, including Google `include_granted_scopes` merges. `emailChoice` is Apple's `"share"` or `"hide"`, and `null` before the first authorization, after a revocation, and on every other profile. `email` is the address the client receives: the relay for Hide My Email, the real address otherwise. `userDisclosed` is whether Apple's first-use `user` payload was already sent. Without `accountId` or `email` it returns `{ "grants": [...] }`, one row (with `accountId`) per account that currently has a grant with the client. An unknown client or account is `404`. Programmatically, `await runtime.instance().grant(clientId, accountId)` returns the same view, or `null`, and `grants(clientId)` the list. The view is read-only and follows namespaces.
+
 These routes use the shared admin-key and namespace controls. `revokeConsent(clientId, accountId)` removes that client's grants and resets first-use disclosure; it does not disable the account. It is async because it can deliver a [server-to-server notification](#sign-in-with-apple-server-to-server-notifications). `rotateSigningKey(true)` retains up to four previous public keys so existing tokens still verify; `false` withdraws them to test stale JWKS caches. Keys themselves are not included in snapshots, so restoring state does not undo a key rotation.
 
 ### Sign in with Apple server-to-server notifications
@@ -220,6 +224,26 @@ Register an Apple client with `apple.notificationUrl` (an HTTP(S) URL; requires
 
 Delivery is awaited by the call that caused it, through `webhooks.fetch` (`createRuntime({ webhooks: { fetch } })`, default global `fetch`), so an in-process suite can route it through its own network model. The admin routes and methods return one `{ clientId, type, delivered, status?, error? }` per notification; a non-2xx response or a thrown error is reported there and never fails the call, and Apple's retries are not modelled. Without an `issuer` option, direct method calls need an `issuer` argument (admin routes derive it from the request). Unknown accounts return 404 from the admin routes and reject from the methods.
 
+### Seeded credentials
+
+For deterministic simulation tests, opt in so every opaque value the provider mints comes from the seed instead of `crypto`, and the same seed with the same requests replays byte-for-byte. It is **off by default**: without it, codes, tokens, transaction ids, nonces, `kid` and signing keys stay cryptographically random.
+
+```ts
+import { createRuntime } from "@crvouga/mockingbird-service-oauth"
+
+const runtime = createRuntime({
+  seed: "s1",
+  deterministicCredentials: true,
+  clients: [{ id: "app", name: "App", redirectUris: ["https://app.test/callback"], secret: "fixture-secret" }],
+  accounts: [{ id: "ada", name: "Ada Lovelace", email: "ada@example.test" }],
+})
+```
+
+- Seeded: authorization codes, access and refresh tokens, `transaction` ids, session ids, grant families, Apple notification `jti`s, CSP nonces (on every page and the `form_post` response), and the RS256 signing key with its `kid`, including the never-published key behind `tokens.idTokenSigningKey: "unpublished"`. Values are guessable; use only in tests. Pin the clock (`clock`) as well when you compare ID tokens, whose `iat` / `exp` come from it.
+- Signing keys are a pure function of the seed and the rotation index, so JWKS, the ID-token header and (RS256 being deterministic) the signature replay too. Deriving a 2048-bit RSA key costs roughly half a second to a couple of seconds once per seed per process; it is cached afterwards.
+- The draw counter is part of the namespace state: it is snapshotted with it, and `reset` restarts both the counter and the key sequence, so a reset replays the run. The seed is not mixed with the namespace, so two namespaces or mounts with one seed mint the same values.
+- `createRuntime({ randomBytes: (length) => bytes })` replaces `crypto.getRandomValues` for every minted value instead (it wins over the seeded source), and `signingKeys: [{ privateJwk, publicJwk, kid }, ...]` supplies RS256 keys used in order: the first is current and each `POST /__admin/keys/rotate` takes the next. When the list runs out, rotation falls back to the seeded or random source. The `nonce` option still takes precedence for the `form_post` response.
+
 ### Shared service controls
 
 The runtime supplies `/health`, `/__admin/reset`, snapshots, mock clock, request journal, metrics, fault injection and namespace isolation. Use `x-mockingbird-namespace` for in-process tests or `/ns/<name>/…` for complete browser flows. Header-selected namespaces alone cannot persist across ordinary browser navigation. State, grants, sessions and consent live in the shared SQLite abstraction; there are no filesystem or Node imports in the main entry.
@@ -230,14 +254,14 @@ The runtime supplies `/health`, `/__admin/reset`, snapshots, mock clock, request
 
 - `createRuntime(options?)`: shared service runtime; `fetch`, `instance`, `reset`, `snapshot`, `restore`, clock, faults and journals.
 - `createMultiRuntime({ mounts })`: exact-path dispatcher for isolated provider runtimes on one origin, with aggregate health and admin controls.
-- `OAuthAPI`: standalone portable handler with `fetch`, `reset`, `seedAccount`, `registerClient`, `accounts`, `clients`, `provider`, `configureBehavior`, `behavior`, `revokeConsent`, `rotateSigningKey`.
+- `OAuthAPI`: standalone portable handler with `fetch`, `reset`, `seedAccount`, `registerClient`, `accounts`, `clients`, `provider`, `configureBehavior`, `behavior`, `revokeConsent`, `rotateSigningKey`, `grant`, `grants`.
 - `OAUTH_PRESETS`: named transport fault presets.
 - `OAUTH_SCENARIOS`: named provider-behavior scenarios.
 - `document`, `operationIds`, `supportedOperationIds`: generated OpenAPI metadata.
 - `createServer(options?)` from `./server`: Node HTTP adapter, returning `url`, `close` and `runtime`.
 - `createMultiServer({ mounts })` from `./server`: Node HTTP adapter for a multi-provider runtime.
 - `DEFAULT_PORT`, `serveTarget` from `./server`: CLI defaults and multi-service launcher integration.
-- Types: `Account`, `Client`, `Provider`, `OAuthAPIOptions`, `OAuthRuntimeOptions`, `OAuthRuntime`, `OAuthServerOptions`, `OAuthMount`, `OAuthMultiRuntimeOptions`, `OAuthMultiRuntime`, `OAuthMultiServerOptions`, `OAuthBehavior`, `BehaviorInput`, `OAuthScenario`, `EdgeCase`, `BehaviorEvent`.
+- Types: `Account`, `Client`, `GrantView`, `Provider`, `OAuthAPIOptions`, `OAuthRuntimeOptions`, `OAuthRuntime`, `OAuthServerOptions`, `OAuthMount`, `OAuthMultiRuntimeOptions`, `OAuthMultiRuntime`, `OAuthMultiServerOptions`, `OAuthBehavior`, `BehaviorInput`, `OAuthScenario`, `EdgeCase`, `BehaviorEvent`.
 
 ## Verification
 
@@ -256,7 +280,7 @@ This is a ready-to-use local/test identity provider, **not a production authenti
 
 Vendor-hosted Google Identity Services/One Tap, native Apple AuthenticationServices, passkeys, MFA, CAPTCHA, password recovery, email delivery/relay forwarding (only Apple's notification of a forwarding change is sent), app-transfer migration, vendor risk engines, tokeninfo/introspection, logout, GitHub Apps installation/device flows, and Microsoft Graph/tenant administration are not implemented. Other configurable OIDC providers can use the generic profile, but their proprietary scopes and claims are not emulated. Scopes are limited to each profile plus explicitly configured additional scopes. Microsoft uses the configured mock issuer, not real Entra tenant routing. GitHub is the OAuth app login surface, not the full REST API.
 
-No implicit flow, dynamic client registration, wildcard redirect matching, persistent signing-key import, or distributed-session coordination is provided. Private-use redirect schemes work only when their complete URI is explicitly registered; executable/local schemes such as `javascript:`, `data:` and `file:` are rejected. Sign-in and consent pages extend CSP `form-action` with the transaction's redirect origin (or custom scheme) so browsers follow the redirect back to the client. Discovery, JWKS, token, userinfo and revoke answer `OPTIONS` preflights and reflect the request `Origin`, so browser (SPA + PKCE) clients can redeem codes directly; the interaction pages send no CORS headers. Snapshot restore is for the same runtime/instance; signing keys are not serialized. The default backing store is in-memory and state disappears when the process exits. A secure browser context and Web Crypto, Fetch and standard Web APIs are required; Node 22+, Bun and modern browsers provide them.
+No implicit flow, dynamic client registration, wildcard redirect matching, persistent signing-key storage (keys are held in memory; supply them through `signingKeys` or derive them from a seed), or distributed-session coordination is provided. Private-use redirect schemes work only when their complete URI is explicitly registered; executable/local schemes such as `javascript:`, `data:` and `file:` are rejected. Sign-in and consent pages extend CSP `form-action` with the transaction's redirect origin (or custom scheme) so browsers follow the redirect back to the client. Discovery, JWKS, token, userinfo and revoke answer `OPTIONS` preflights and reflect the request `Origin`, so browser (SPA + PKCE) clients can redeem codes directly; the interaction pages send no CORS headers. Snapshot restore is for the same runtime/instance; signing keys are not serialized. The default backing store is in-memory and state disappears when the process exits. A secure browser context and Web Crypto, Fetch and standard Web APIs are required; Node 22+, Bun and modern browsers provide them.
 
 References: [Google OpenID Connect](https://developers.google.com/identity/openid-connect/openid-connect), [Apple authorization request](https://developer.apple.com/documentation/signinwithapplerestapi/request-an-authorization-to-the-sign-in-with-apple-server.), and [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html).
 

package/dist/{chunk-2JIADQOV.js → chunk-D4IAZYMT.js}

@@ -2,7 +2,7 @@ import {
   OAUTH_SCENARIOS,
   createMultiRuntime,
   createRuntime
-} from "./chunk-XP2AEPEJ.js";
+} from "./chunk-SYFF4UFD.js";
 
 // src/server.ts
 import { readFile as readFile2 } from "node:fs/promises";
@@ -377,4 +377,4 @@ export {
   createMultiServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-2JIADQOV.js.map
+//# sourceMappingURL=chunk-D4IAZYMT.js.map

package/dist/{chunk-XP2AEPEJ.js → chunk-SYFF4UFD.js}

@@ -1384,7 +1384,7 @@ var restoreNamespace = (sqlite, namespace, snapshot) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "1.2.1" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "1.4.0" : UNRELEASED_VERSION;
 
 // ../core/dist/webhooks.js
 var json2 = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
@@ -2246,18 +2246,22 @@ var encoder = new TextEncoder();
 var base64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 var random = () => base64url(crypto.getRandomValues(new Uint8Array(32)));
 var hash = async (value) => base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value))));
+var RSA = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
 var Signer = class {
-  pair = crypto.subtle.generateKey(
-    {
-      name: "RSASSA-PKCS1-v1_5",
-      modulusLength: 2048,
-      publicExponent: new Uint8Array([1, 0, 1]),
-      hash: "SHA-256"
-    },
-    true,
-    ["sign", "verify"]
-  );
-  kid = random();
+  pair;
+  kid;
+  /** Generates a fresh key pair unless `key` supplies one; `kid` names a generated pair. */
+  constructor(key, kid = random()) {
+    this.kid = key?.kid ?? kid;
+    this.pair = key ? Promise.all([
+      crypto.subtle.importKey("jwk", key.privateJwk, RSA, true, ["sign"]),
+      crypto.subtle.importKey("jwk", key.publicJwk, RSA, true, ["verify"])
+    ]).then(([privateKey, publicKey]) => ({ privateKey, publicKey })) : crypto.subtle.generateKey(
+      { ...RSA, modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]) },
+      true,
+      ["sign", "verify"]
+    );
+  }
   async jwks() {
     const pair = await this.pair;
     return {
@@ -2317,6 +2321,152 @@ async function verifyAppleSecret(token, clientId, apple, now) {
   }
 }
 
+// src/credentials.ts
+var seededBytes = (label, length) => {
+  let a = seedFrom(`${label}:0`);
+  let b = seedFrom(`${label}:1`);
+  let c = seedFrom(`${label}:2`);
+  let d = seedFrom(`${label}:3`);
+  const next = () => {
+    const t = (a + b | 0) + d | 0;
+    d = d + 1 | 0;
+    a = b ^ b >>> 9;
+    b = c + (c << 3) | 0;
+    c = (c << 21 | c >>> 11) + t | 0;
+    return t >>> 0;
+  };
+  for (let i = 0; i < 12; i++) next();
+  const out = new Uint8Array(length);
+  for (let i = 0; i < length; i += 4) {
+    const word = next();
+    for (let j = 0; j < 4 && i + j < length; j++) out[i + j] = word >>> 8 * j & 255;
+  }
+  return out;
+};
+var toBigInt = (bytes) => BigInt(`0x${[...bytes].map((b) => b.toString(16).padStart(2, "0")).join("")}`);
+var fromBigInt = (value) => {
+  const hex = value.toString(16);
+  const padded = hex.length % 2 ? `0${hex}` : hex;
+  return Uint8Array.from(padded.match(/../g) ?? [], (h) => Number.parseInt(h, 16));
+};
+var modPow = (base, exponent, modulus) => {
+  let result = 1n;
+  let b = base % modulus;
+  for (let e = exponent; e > 0n; e >>= 1n) {
+    if (e & 1n) result = result * b % modulus;
+    b = b * b % modulus;
+  }
+  return result;
+};
+var modInverse = (value, modulus) => {
+  let [r0, r1, t0, t1] = [modulus, value % modulus, 0n, 1n];
+  while (r1) {
+    const q = r0 / r1;
+    [r0, r1] = [r1, r0 - q * r1];
+    [t0, t1] = [t1, t0 - q * t1];
+  }
+  return (t0 % modulus + modulus) % modulus;
+};
+var SMALL_PRIMES = Array.from({ length: 2e3 }, (_, i) => i + 2).filter((n, _, all) => all.every((m) => m * m > n || n % m)).map(BigInt);
+var probablePrime = (n) => {
+  if (SMALL_PRIMES.some((p) => n % p === 0n)) return false;
+  let d = n - 1n;
+  let s = 0;
+  while (!(d & 1n)) {
+    d >>= 1n;
+    s++;
+  }
+  return SMALL_PRIMES.slice(0, 16).every((a) => {
+    let x = modPow(a, d, n);
+    if (x === 1n || x === n - 1n) return true;
+    for (let i = 1; i < s; i++) {
+      x = x * x % n;
+      if (x === n - 1n) return true;
+    }
+    return false;
+  });
+};
+var E = 65537n;
+var seededPrime = (label) => {
+  for (let attempt = 0; ; attempt++) {
+    const candidate = toBigInt(seededBytes(`${label}:${attempt}`, 128)) | 3n << 1022n | 1n;
+    if ((candidate - 1n) % E !== 0n && probablePrime(candidate)) return candidate;
+  }
+};
+var keyCache = /* @__PURE__ */ new Map();
+var seededRsa = (label) => {
+  const cached = keyCache.get(label);
+  if (cached) return cached;
+  let p = seededPrime(`${label}:p`);
+  let q = seededPrime(`${label}:q`);
+  for (let i = 0; q === p; i++) q = seededPrime(`${label}:q${i}`);
+  if (p < q) [p, q] = [q, p];
+  const d = modInverse(E, (p - 1n) * (q - 1n));
+  const enc = (v) => base64url(fromBigInt(v));
+  const publicJwk = { kty: "RSA", n: enc(p * q), e: enc(E) };
+  const privateJwk = {
+    ...publicJwk,
+    d: enc(d),
+    p: enc(p),
+    q: enc(q),
+    dp: enc(d % (p - 1n)),
+    dq: enc(d % (q - 1n)),
+    qi: enc(modInverse(q, p))
+  };
+  const pair = { privateJwk, publicJwk };
+  keyCache.set(label, pair);
+  return pair;
+};
+var Credentials = class {
+  constructor(sqlite, namespace, seed, options) {
+    this.options = options;
+    this.draws = new Collection(sqlite, namespace, "oauth_credential_draws");
+    this.seed = String(seed ?? 0);
+  }
+  options;
+  draws;
+  seed;
+  keyIndex = 0;
+  bytes(length) {
+    if (this.options.randomBytes) return this.options.randomBytes(length);
+    if (this.options.deterministicCredentials)
+      return seededBytes(`${this.seed}:${this.draws.nextSequence()}`, length);
+    return crypto.getRandomValues(new Uint8Array(length));
+  }
+  /** Codes, access/refresh tokens, transaction ids, session ids and grant families. */
+  token() {
+    return base64url(this.bytes(32));
+  }
+  /** CSP nonce for interaction pages; a UUID unless credentials are controlled. */
+  nonce() {
+    return this.options.randomBytes || this.options.deterministicCredentials ? base64url(this.bytes(16)) : crypto.randomUUID();
+  }
+  /** The next signing key: injected, else derived from the seed, else freshly generated. */
+  signer() {
+    const index = this.keyIndex++;
+    const injected = this.options.signingKeys?.[index];
+    if (injected) return new Signer(injected);
+    if (!this.options.deterministicCredentials || this.options.randomBytes)
+      return new Signer(void 0, this.token());
+    const kid = this.token();
+    return new Signer({ ...seededRsa(`${this.seed}:key:${index}`), kid });
+  }
+  /**
+   * The key that signs ID tokens but is never published. Never taken from `signingKeys` (those are
+   * published); under a seed it is derived without touching the draw counter.
+   */
+  unpublishedSigner() {
+    if (!this.options.deterministicCredentials || this.options.randomBytes)
+      return new Signer(void 0, this.token());
+    const label = `${this.seed}:unpublished`;
+    return new Signer({ ...seededRsa(label), kid: base64url(seededBytes(`${label}:kid`, 32)) });
+  }
+  /** Start the signing-key sequence over; the draw counter is cleared with the namespace. */
+  restart() {
+    this.keyIndex = 0;
+  }
+};
+
 // src/ui.ts
 var escapeHtml = (value) => value.replace(
   /[&<>"']/g,
@@ -2346,7 +2496,7 @@ function page(title, body, status = 200, action = "'self'", nonce = crypto.rando
     }
   );
 }
-function loginPage(transaction, client, accounts, base, action, signup = false, error = "") {
+function loginPage(transaction, client, accounts, base, action, signup = false, error = "", nonce) {
   const hidden = `<input type="hidden" name="transaction" value="${escapeHtml(transaction)}">`;
   const endpoint = escapeHtml(`${base}/interaction`);
   const intro = `<span class="eyebrow">Sign in</span><h1 id="title">${signup ? "Create your account" : "Choose an account"}</h1><p>${signup ? "Create an account to continue to" : "Choose an account to continue to"}<br><span class="app">${escapeHtml(client)}</span></p>${error ? `<div class="error" role="alert" data-testid="oauth-mock-${signup ? "signup" : "chooser"}-error">${escapeHtml(error)}</div>` : ""}`;
@@ -2356,11 +2506,11 @@ function loginPage(transaction, client, accounts, base, action, signup = false,
     `${intro}${body}<div class="divider"></div><form method="post" action="${endpoint}">${hidden}<button class="secondary" data-testid="oauth-mock-deny" name="action" value="deny">Cancel sign-in</button></form>`,
     error ? 400 : 200,
     action,
-    void 0,
+    nonce,
     signup ? "oauth-mock-signup" : "oauth-mock-chooser"
   );
 }
-function consentPage(transaction, client, account, scopes2, base, action, privacy) {
+function consentPage(transaction, client, account, scopes2, base, action, privacy, nonce) {
   const labels = {
     openid: "Confirm your identity",
     email: "View your email address",
@@ -2378,7 +2528,7 @@ function consentPage(transaction, client, account, scopes2, base, action, privac
     )}</ul><p>You can cancel now without sharing anything.</p><form method="post" action="${escapeHtml(base)}/interaction"><input type="hidden" name="transaction" value="${escapeHtml(transaction)}">${privacyFields}<button class="primary" data-testid="oauth-mock-allow" name="action" value="allow">Allow &amp; continue</button><button class="secondary" data-testid="oauth-mock-deny" name="action" value="deny">Cancel</button></form>`,
     200,
     action,
-    void 0,
+    nonce,
     "oauth-mock-consent"
   );
 }
@@ -2472,6 +2622,24 @@ function createRuntime2(options = {}) {
         );
         return Response.json({ forwarding: input.forwarding, notifications });
       },
+      "GET /grants": async ({ namespace, url }) => {
+        const api = runtime.instance(namespace);
+        const clientId = url.searchParams.get("clientId");
+        const accountId = url.searchParams.get("accountId");
+        const email = url.searchParams.get("email")?.toLowerCase().trim();
+        if (!clientId || accountId !== null && email !== void 0)
+          return Response.json(
+            { error: "clientId is required, with at most one of accountId or email" },
+            { status: 400 }
+          );
+        if (accountId === null && email === void 0) {
+          const grants = await api.grants(clientId);
+          return grants ? Response.json({ grants }) : Response.json({ error: "Unknown client" }, { status: 404 });
+        }
+        const id = accountId ?? api.accounts.list({ where: (a) => a.email.toLowerCase() === email })[0]?.value.id ?? "";
+        const grant = await api.grant(clientId, id);
+        return grant ? Response.json(grant) : Response.json({ error: "Unknown client or account" }, { status: 404 });
+      },
       "POST /keys/rotate": ({ namespace, body }) => {
         const input = body;
         if (input?.retainPrevious !== void 0 && typeof input.retainPrevious !== "boolean")
@@ -2670,6 +2838,8 @@ var OAuthAPI = class {
       options.seed ?? 0,
       options.behavior ?? {}
     );
+    this.credentials = new Credentials(this.sqlite, this.namespace, options.seed, options);
+    this.signer = this.credentials.signer();
     this.seed();
   }
   options;
@@ -2680,7 +2850,8 @@ var OAuthAPI = class {
   tokens;
   sessions;
   consents;
-  signer = new Signer();
+  signer;
+  credentials;
   previousSigners = [];
   /** Never published: signs ID tokens for `tokens.idTokenSigningKey: "unpublished"`. */
   unpublishedSigner;
@@ -2737,6 +2908,12 @@ var OAuthAPI = class {
   async reset() {
     clearNamespace(this.sqlite, this.namespace);
     this.behavior.configure(this.options.behavior ?? {});
+    if (this.options.deterministicCredentials || this.options.signingKeys) {
+      this.credentials.restart();
+      this.previousSigners = [];
+      this.unpublishedSigner = void 0;
+      this.signer = this.credentials.signer();
+    }
     this.seed();
   }
   issuer(request) {
@@ -2748,7 +2925,7 @@ var OAuthAPI = class {
   }
   rotateSigningKey(retainPrevious = true) {
     this.previousSigners = retainPrevious ? [this.signer, ...this.previousSigners].slice(0, 4) : [];
-    this.signer = new Signer();
+    this.signer = this.credentials.signer();
     return { kid: this.signer.kid };
   }
   /**
@@ -2810,7 +2987,7 @@ var OAuthAPI = class {
         iss: iss.replace(/\/$/, ""),
         aud: client.id,
         iat: Math.floor(this.now() / 1e3),
-        jti: random(),
+        jti: this.credentials.token(),
         events: JSON.stringify({
           type,
           sub,
@@ -2857,6 +3034,39 @@ var OAuthAPI = class {
     }))
       this.tokens.delete(row.id);
   }
+  /**
+   * What `clientId` sees for `accountId` (a test control mirroring private provider state), or
+   * `null` for an unknown client or account. For a client that never authorized the account,
+   * `subject` is the id token `sub` it would receive and `email` the real address.
+   */
+  async grant(clientId, accountId) {
+    const client = this.clients.get(clientId);
+    const account = this.accounts.get(accountId);
+    if (!client || !account) return null;
+    const key = this.identityKey(client, account.id);
+    const identity = this.identities.get(key);
+    const consent = this.consents.get(JSON.stringify([clientId, accountId]));
+    return {
+      subject: identity?.sub ?? (this.provider === "apple" || this.provider === "microsoft" ? await hash(key) : account.id),
+      granted: consent !== void 0,
+      scopes: [...scopes(consent?.scope ?? "")],
+      emailChoice: this.provider === "apple" && identity ? identity.privateEmail ? "hide" : "share" : null,
+      email: identity?.email ?? account.email,
+      isPrivateEmail: identity?.privateEmail ?? false,
+      userDisclosed: this.appleDisclosures.has(key)
+    };
+  }
+  /** The grant view of every account that has authorized `clientId`, oldest account first. */
+  async grants(clientId) {
+    if (!this.clients.has(clientId)) return null;
+    const rows = [];
+    for (const { id, value } of this.accounts.list({ order: "oldest" })) {
+      if (!this.consents.has(JSON.stringify([clientId, id]))) continue;
+      const view = await this.grant(clientId, value.id);
+      if (view) rows.push({ accountId: value.id, ...view });
+    }
+    return rows;
+  }
   paths() {
     const paths = {
       google: {
@@ -2986,7 +3196,7 @@ var OAuthAPI = class {
     const skew = tokens?.idTokenClockSkewSeconds ?? 0;
     const iat = Math.floor(this.now() / 1e3) + skew;
     const unpublished = tokens?.idTokenSigningKey === "unpublished";
-    if (unpublished) this.unpublishedSigner ??= new Signer();
+    if (unpublished) this.unpublishedSigner ??= this.credentials.unpublishedSigner();
     return (unpublished && this.unpublishedSigner || this.signer).sign({
       ...this.profile(account, grant),
       iss: issuer,
@@ -3189,7 +3399,10 @@ var OAuthAPI = class {
     if (request.method === "GET" && path === "/")
       return page(
         "Identity sandbox",
-        '<span class="eyebrow">Mockingbird Identity</span><h1 id="title">Make sign-in<br>feel real.</h1><p>Your identity sandbox is ready. Start sign-in from your application to choose an account, create a new identity, and review access.</p><div class="account"><span class="avatar" aria-hidden="true">\u2713</span><span class="identity"><strong>Ready when you are</strong><small>OAuth 2.0 \xB7 OpenID Connect</small></span></div>'
+        '<span class="eyebrow">Mockingbird Identity</span><h1 id="title">Make sign-in<br>feel real.</h1><p>Your identity sandbox is ready. Start sign-in from your application to choose an account, create a new identity, and review access.</p><div class="account"><span class="avatar" aria-hidden="true">\u2713</span><span class="identity"><strong>Ready when you are</strong><small>OAuth 2.0 \xB7 OpenID Connect</small></span></div>',
+        200,
+        void 0,
+        this.credentials.nonce()
       );
     return fail("not_found", "Unknown endpoint", 404);
   }
@@ -3285,7 +3498,7 @@ var OAuthAPI = class {
       if (!granted) return error("consent_required", "Consent is required");
       return this.finish({ ...auth, accountId: current.id, authTime: session.authTime }, issuer);
     }
-    const id = random();
+    const id = this.credentials.token();
     if (current && session && !prompt.has("login") && !prompt.has("select_account")) {
       auth.accountId = current.id;
       auth.authTime = session.authTime;
@@ -3300,7 +3513,16 @@ var OAuthAPI = class {
       accounts.sort(
         (a, b) => Number(b.email === hint || b.id === hint) - Number(a.email === hint || a.id === hint)
       );
-    return loginPage(id, client.name, accounts, issuer, formAction(auth.redirectUri));
+    return loginPage(
+      id,
+      client.name,
+      accounts,
+      issuer,
+      formAction(auth.redirectUri),
+      false,
+      "",
+      this.credentials.nonce()
+    );
   }
   consent(id, client, account, auth, issuer) {
     const existing = this.identities.get(this.identityKey(client, account.id));
@@ -3316,7 +3538,8 @@ var OAuthAPI = class {
       this.provider === "apple" && scopes(auth.scope).has("email") && !existing ? {
         hideEmail: account.privateEmail ?? (this.behavior.config.apple?.emailMode === "hide" || (this.behavior.config.apple?.emailMode ?? "choose") === "choose" && auth.decisions.hideEmail),
         choice: (this.behavior.config.apple?.emailMode ?? "choose") === "choose"
-      } : void 0
+      } : void 0,
+      this.credentials.nonce()
     );
   }
   async interact(request, issuer) {
@@ -3333,7 +3556,7 @@ var OAuthAPI = class {
         '<span class="eyebrow">Let\u2019s try again</span><h1 id="title">This sign-in expired</h1><p>Return to your application and start sign-in again.</p>',
         400,
         void 0,
-        void 0,
+        this.credentials.nonce(),
         "oauth-mock-error"
       );
     const accounts = () => this.accounts.list({ order: "oldest", where: (a) => !a.disabled }).map((a) => a.value);
@@ -3344,7 +3567,9 @@ var OAuthAPI = class {
         accounts(),
         issuer,
         formAction(auth.redirectUri),
-        p.get("screen") === "signup"
+        p.get("screen") === "signup",
+        "",
+        this.credentials.nonce()
       );
     const action = p.get("action");
     if (action === "deny") {
@@ -3364,7 +3589,8 @@ var OAuthAPI = class {
           issuer,
           formAction(auth.redirectUri),
           true,
-          "Enter a full name and a valid email address."
+          "Enter a full name and a valid email address.",
+          this.credentials.nonce()
         );
       if (accounts().some((a) => a.email === email) || this.accounts.list().some((a) => a.value.email === email))
         return loginPage(
@@ -3374,9 +3600,15 @@ var OAuthAPI = class {
           issuer,
           formAction(auth.redirectUri),
           true,
-          "This email already has an account. Go back to choose it."
+          "This email already has an account. Go back to choose it.",
+          this.credentials.nonce()
         );
-      const account = this.seedAccount({ id: random(), email, name, emailVerified: true });
+      const account = this.seedAccount({
+        id: this.credentials.token(),
+        email,
+        name,
+        emailVerified: true
+      });
       auth.accountId = account.id;
       auth.authTime = this.now();
       this.transactions.update(id, auth);
@@ -3392,7 +3624,8 @@ var OAuthAPI = class {
           issuer,
           formAction(auth.redirectUri),
           false,
-          "Choose an available account."
+          "Choose an available account.",
+          this.credentials.nonce()
         );
       auth.accountId = account.id;
       auth.authTime = this.now();
@@ -3428,7 +3661,7 @@ var OAuthAPI = class {
     return fail("invalid_request", "Invalid interaction action");
   }
   startSession(result, accountId, authTime, issuer) {
-    const session = random();
+    const session = this.credentials.token();
     this.sessions.insert(session, { accountId, authTime, expires: this.now() + 864e5 });
     result.headers.append(
       this.options.cookieHeaders?.response ?? "set-cookie",
@@ -3465,14 +3698,14 @@ var OAuthAPI = class {
       });
     const googleRefresh = behavior.google?.refreshToken ?? "first-consent";
     const issueRefresh = this.provider === "google" ? auth.offline && googleRefresh !== "never" && (googleRefresh === "always" || auth.forceConsent || !previous) : this.provider === "apple" || scopes(scope).has("offline_access");
-    const code = random();
+    const code = this.credentials.token();
     const grant = {
       ...auth,
       scope,
       identity,
       issueRefresh,
       expires: this.now() + (behavior.tokens?.codeTtlSeconds ?? 300) * 1e3,
-      family: random()
+      family: this.credentials.token()
     };
     this.codes.insert(code, grant);
     this.consents.insert(key, { scope: [...scopes(`${previous?.scope ?? ""} ${scope}`)].join(" ") });
@@ -3501,7 +3734,7 @@ var OAuthAPI = class {
     if (auth.state) values.state = auth.state;
     const redirect = new URL(auth.redirectUri);
     if (auth.responseMode === "form_post") {
-      const nonce = this.options.nonce?.() ?? crypto.randomUUID();
+      const nonce = this.options.nonce?.() ?? this.credentials.nonce();
       const result = page(
         "Continue to your app",
         `<span class="eyebrow">All set</span><h1 id="title">Back to your app</h1><p>Your sign-in response is ready.</p><form id="callback" method="post" action="${escapeHtml(auth.redirectUri)}">${Object.entries(
@@ -3645,7 +3878,7 @@ var OAuthAPI = class {
     if (type === "refresh_token")
       this.tokens.update(key, { ...stored, kind: "refresh", lastUsed: this.now() });
     const accessTtl = behavior.tokens?.accessTtlSeconds ?? 3600;
-    const access = random();
+    const access = this.credentials.token();
     const result = {
       access_token: access,
       token_type: "Bearer",
@@ -3674,7 +3907,7 @@ var OAuthAPI = class {
     const refreshKey = JSON.stringify([grant.clientId, grant.accountId]);
     const googleEligible = this.provider !== "google" || behavior.google?.refreshToken === "always" || grant.forceConsent || !this.refreshIssued.has(refreshKey);
     if (type === "authorization_code" && grant.issueRefresh && googleEligible || rotating || microsoftRefresh) {
-      const refresh = random();
+      const refresh = this.credentials.token();
       const basicScopes = [
         "openid",
         "email",
@@ -3735,4 +3968,4 @@ export {
   createMultiRuntime,
   OAuthAPI
 };
-//# sourceMappingURL=chunk-XP2AEPEJ.js.map
+//# sourceMappingURL=chunk-SYFF4UFD.js.map