@fluixi/oauth2 1.0.0-alpha.1 → 1.0.0-alpha.10

package/dist/{browser-ONMHX3Z3.mjs → browser-36FHB6KG.mjs}

@@ -1,7 +1,7 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.10 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 import {
   __export
-} from "./chunk-25WE6UWI.mjs";
+} from "./chunk-OGS6MQ3D.mjs";
 
 // ../../node_modules/.pnpm/jose@5.10.0/node_modules/jose/dist/browser/runtime/webcrypto.js
 var webcrypto_default = crypto;

package/dist/browser.cjs

@@ -165,9 +165,11 @@ async function loadJose2() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,

package/dist/browser.mjs

@@ -131,9 +131,11 @@ async function loadJose2() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,

package/dist/callback.cjs

@@ -25,7 +25,7 @@ __export(callback_exports, {
 });
 module.exports = __toCommonJS(callback_exports);
 var import_core = require("@fluixi/core");
-var import_signal = require("@fluixi/reactive/signal");
+var import_signal2 = require("@fluixi/reactive/signal");
 var import_di2 = require("@fluixi/start/di");
 
 // src/tokens.ts
@@ -34,6 +34,7 @@ var AuthServiceToken = (0, import_di.injectionToken)("AuthService");
 var AuthClientToken = (0, import_di.injectionToken)("AuthClient");
 
 // src/service.ts
+var import_signal = require("@fluixi/reactive/signal");
 var import_session = require("@fluixi/session");
 var import_client = require("@fluixi/auth/client");
 function paramsFromUrl(url) {
@@ -55,10 +56,10 @@ function reasonFor(cause) {
 }
 var spent = /* @__PURE__ */ new Set();
 function useOAuthCallback(options = {}) {
-  const stage = (0, import_signal.signal)("waiting");
-  const error = (0, import_signal.signal)(null);
-  const destination = (0, import_signal.signal)(null);
-  const params = (0, import_signal.signal)({});
+  const stage = (0, import_signal2.signal)("waiting");
+  const error = (0, import_signal2.signal)(null);
+  const destination = (0, import_signal2.signal)(null);
+  const params = (0, import_signal2.signal)({});
   let lastQuery = null;
   let injected = null;
   let injectionError = null;

package/dist/callback.mjs

@@ -11,6 +11,7 @@ var AuthServiceToken = injectionToken("AuthService");
 var AuthClientToken = injectionToken("AuthClient");
 
 // src/service.ts
+import { markReactiveScope, openReactiveScope, withReactiveScope } from "@fluixi/reactive/signal";
 import { createSession } from "@fluixi/session";
 import { createAuthHooks } from "@fluixi/auth/client";
 function paramsFromUrl(url) {

package/dist/{chunk-4NSOGPLM.mjs → chunk-F52RUVDM.mjs}

@@ -1,4 +1,4 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.10 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 
 // src/types.ts
 var OAuthError = class extends Error {

package/dist/{chunk-25WE6UWI.mjs → chunk-OGS6MQ3D.mjs}

@@ -1,4 +1,4 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.10 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)

package/dist/{dpop-LVPWWADA.mjs → dpop-GOWCCCFR.mjs}

@@ -1,13 +1,13 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.10 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 import {
   OAuthError
-} from "./chunk-4NSOGPLM.mjs";
-import "./chunk-25WE6UWI.mjs";
+} from "./chunk-F52RUVDM.mjs";
+import "./chunk-OGS6MQ3D.mjs";
 
 // src/dpop.ts
 async function loadJose() {
   try {
-    return await import("./browser-ONMHX3Z3.mjs");
+    return await import("./browser-36FHB6KG.mjs");
   } catch {
     throw new OAuthError(
       "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
@@ -15,9 +15,11 @@ async function loadJose() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,
@@ -26,6 +28,22 @@ async function createDpopKey(alg = "ES256") {
     alg
   };
 }
+async function exportDpopKey(key) {
+  const jose = await loadJose();
+  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+}
+var PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+async function importDpopKey(stored) {
+  const jose = await loadJose();
+  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
+  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg: stored.alg
+  };
+}
 async function thumbprintOf(jwk) {
   const jose = await loadJose();
   return jose.calculateJwkThumbprint(jwk, "sha256");
@@ -73,6 +91,8 @@ function boundKeyOf(claims) {
 export {
   boundKeyOf,
   createDpopKey,
+  exportDpopKey,
+  importDpopKey,
   nonceFrom,
   proofFor,
   thumbprintOf,

package/dist/{dpop-NS7NKOWM.mjs → dpop-YPGCGL7S.mjs}

@@ -14,9 +14,11 @@ async function loadJose() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,
@@ -25,6 +27,22 @@ async function createDpopKey(alg = "ES256") {
     alg
   };
 }
+async function exportDpopKey(key) {
+  const jose = await loadJose();
+  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+}
+var PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+async function importDpopKey(stored) {
+  const jose = await loadJose();
+  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
+  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg: stored.alg
+  };
+}
 async function thumbprintOf(jwk) {
   const jose = await loadJose();
   return jose.calculateJwkThumbprint(jwk, "sha256");
@@ -72,6 +90,8 @@ function boundKeyOf(claims) {
 export {
   boundKeyOf,
   createDpopKey,
+  exportDpopKey,
+  importDpopKey,
   nonceFrom,
   proofFor,
   thumbprintOf,

package/dist/dpop-store.cjs

@@ -56,9 +56,11 @@ async function loadJose() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,

package/dist/dpop-store.mjs

@@ -21,9 +21,11 @@ async function loadJose() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,

package/dist/dpop.cjs

@@ -32,6 +32,8 @@ var dpop_exports = {};
 __export(dpop_exports, {
   boundKeyOf: () => boundKeyOf,
   createDpopKey: () => createDpopKey,
+  exportDpopKey: () => exportDpopKey,
+  importDpopKey: () => importDpopKey,
   nonceFrom: () => nonceFrom,
   proofFor: () => proofFor,
   thumbprintOf: () => thumbprintOf,
@@ -60,9 +62,11 @@ async function loadJose() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,
@@ -71,6 +75,22 @@ async function createDpopKey(alg = "ES256") {
     alg
   };
 }
+async function exportDpopKey(key) {
+  const jose = await loadJose();
+  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+}
+var PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+async function importDpopKey(stored) {
+  const jose = await loadJose();
+  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
+  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg: stored.alg
+  };
+}
 async function thumbprintOf(jwk) {
   const jose = await loadJose();
   return jose.calculateJwkThumbprint(jwk, "sha256");

package/dist/dpop.d.ts

@@ -25,7 +25,24 @@ export interface DpopKey {
  * attacker who can run script can use the key while they are there, and cannot take it
  * away to use later.
  */
-export declare function createDpopKey(alg?: string): Promise<DpopKey>;
+export declare function createDpopKey(alg?: string, options?: {
+    extractable?: boolean;
+}): Promise<DpopKey>;
+/**
+ * A key as a server session stores it: the private JWK and its algorithm.
+ *
+ * Only for a key held by a server, inside an encrypted httpOnly cookie. There it is bytes
+ * no page can read, and the session has nowhere else to keep it between requests. A
+ * browser key stays non-extractable in IndexedDB instead.
+ */
+export interface StoredDpopKey {
+    jwk: Record<string, unknown>;
+    alg: string;
+}
+/** Export a key made with `extractable: true`, for a server session to store. */
+export declare function exportDpopKey(key: DpopKey): Promise<StoredDpopKey>;
+/** Rebuild a key a server session stored. The thumbprint comes out the same, which is the point. */
+export declare function importDpopKey(stored: StoredDpopKey): Promise<DpopKey>;
 /** The thumbprint of a public JWK, for comparing against a token's `cnf.jkt`. */
 export declare function thumbprintOf(jwk: Record<string, unknown>): Promise<string>;
 export interface ProofOptions {

package/dist/dpop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../src/dpop.ts"],"names":[],"mappings":"AAkBA,6EAA6E;AAC7E,MAAM,WAAW,OAAO;IACtB,iEAAiE;IACjE,UAAU,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,gGAAgG;IAChG,GAAG,EAAE,MAAM,CAAC;CACb;AAcD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,GAAG,SAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnE;AAED,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhF;AAED,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAsCnF;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAGvE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAGzE"}
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../src/dpop.ts"],"names":[],"mappings":"AAkBA,6EAA6E;AAC7E,MAAM,WAAW,OAAO;IACtB,iEAAiE;IACjE,UAAU,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,gGAAgG;IAChG,GAAG,EAAE,MAAM,CAAC;CACb;AAcD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,GAAG,SAAU,EACb,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,iFAAiF;AACjF,wBAAsB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAGxE;AAID,oGAAoG;AACpG,wBAAsB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAW3E;AAED,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhF;AAED,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAsCnF;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAGvE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAGzE"}

package/dist/dpop.js

@@ -35,9 +35,11 @@ async function loadJose() {
  * attacker who can run script can use the key while they are there, and cannot take it
  * away to use later.
  */
-export async function createDpopKey(alg = 'ES256') {
+export async function createDpopKey(alg = 'ES256', options = {}) {
     const jose = await loadJose();
-    const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+    const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+        extractable: options.extractable ?? false,
+    });
     const publicJwk = { ...(await jose.exportJWK(publicKey)) };
     return {
         privateKey: privateKey,
@@ -46,6 +48,25 @@ export async function createDpopKey(alg = 'ES256') {
         alg,
     };
 }
+/** Export a key made with `extractable: true`, for a server session to store. */
+export async function exportDpopKey(key) {
+    const jose = await loadJose();
+    return { jwk: { ...(await jose.exportJWK(key.privateKey)) }, alg: key.alg };
+}
+const PRIVATE_MEMBERS = new Set(['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth']);
+/** Rebuild a key a server session stored. The thumbprint comes out the same, which is the point. */
+export async function importDpopKey(stored) {
+    const jose = await loadJose();
+    const privateKey = (await jose.importJWK(stored.jwk, stored.alg));
+    // The public half is the private JWK without its private members (RFC 7518 §6.2.2, §6.3.2).
+    const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+    return {
+        privateKey,
+        publicJwk,
+        thumbprint: await jose.calculateJwkThumbprint(publicJwk, 'sha256'),
+        alg: stored.alg,
+    };
+}
 /** The thumbprint of a public JWK, for comparing against a token's `cnf.jkt`. */
 export async function thumbprintOf(jwk) {
     const jose = await loadJose();

package/dist/dpop.mjs

@@ -21,9 +21,11 @@ async function loadJose() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,
@@ -32,6 +34,22 @@ async function createDpopKey(alg = "ES256") {
     alg
   };
 }
+async function exportDpopKey(key) {
+  const jose = await loadJose();
+  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+}
+var PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+async function importDpopKey(stored) {
+  const jose = await loadJose();
+  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
+  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg: stored.alg
+  };
+}
 async function thumbprintOf(jwk) {
   const jose = await loadJose();
   return jose.calculateJwkThumbprint(jwk, "sha256");
@@ -79,6 +97,8 @@ function boundKeyOf(claims) {
 export {
   boundKeyOf,
   createDpopKey,
+  exportDpopKey,
+  importDpopKey,
   nonceFrom,
   proofFor,
   thumbprintOf,

package/dist/index.cjs

@@ -1,4 +1,4 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.10 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -35,6 +35,7 @@ __export(index_exports, {
   AuthServiceToken: () => AuthServiceToken,
   COOKIE_SESSION: () => COOKIE_SESSION,
   OAuthError: () => OAuthError,
+  authModule: () => authModule,
   boundKeyOf: () => boundKeyOf,
   clearDiscoveryCache: () => clearDiscoveryCache,
   createAuthService: () => createAuthService,
@@ -55,6 +56,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/service.ts
+var import_signal = require("@fluixi/reactive/signal");
 var import_session = require("@fluixi/session");
 var import_client = require("@fluixi/auth/client");
 
@@ -212,9 +214,11 @@ async function loadJose2() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,
@@ -861,6 +865,13 @@ function clientFor(options) {
   return options.config.tokens === "server" ? createServerClient(options.config) : createBrowserClient(options.config);
 }
 function createAuthService(options) {
+  const tokens = options.config.tokens;
+  const scope = (0, import_signal.openReactiveScope)({ kind: "service", name: "AuthService", ...tokens ? { detail: `tokens: ${tokens}` } : {} });
+  const service = (0, import_signal.withReactiveScope)(scope, () => buildAuthService(options));
+  (0, import_signal.markReactiveScope)(service, scope);
+  return service;
+}
+function buildAuthService(options) {
   const client = clientFor(options);
   let latest = null;
   const session = (0, import_session.createSession)({
@@ -938,3 +949,17 @@ function createAuthService(options) {
 var import_di = require("@fluixi/start/di");
 var AuthServiceToken = (0, import_di.injectionToken)("AuthService");
 var AuthClientToken = (0, import_di.injectionToken)("AuthClient");
+
+// src/module.ts
+var import_app = require("@fluixi/start/app");
+function authModule(auth) {
+  return (0, import_app.defineModule)({
+    name: "oauth2",
+    providers: [
+      // One instance for every request on the server. It holds no per-visitor state there:
+      // the signed-in user comes from request locals, which `sessionLocals` fills per request.
+      { provide: AuthServiceToken, useValue: auth },
+      { provide: AuthClientToken, useValue: auth.client }
+    ]
+  });
+}

package/dist/index.d.ts

@@ -101,4 +101,5 @@ export type { ReturnToOptions } from './return-to.js';
 export { OAuthError } from './types.js';
 export type { AuthClient, AuthConfig, BaseConfig, BrowserConfig, CallbackParams, Endpoints, LoginOptions, ServerConfig, Tokens, } from './types.js';
 export { AuthServiceToken, AuthClientToken } from './tokens.js';
+export { authModule } from './module.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAExE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9E,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,YAAY,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,cAAc,EACd,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,MAAM,GACP,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAExE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9E,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,YAAY,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,cAAc,EACd,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,MAAM,GACP,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -97,5 +97,6 @@ export { createDpopKey, proofFor, thumbprintOf, boundKeyOf } from './dpop.js';
 export { safeReturnTo } from './return-to.js';
 export { OAuthError } from './types.js';
 export { AuthServiceToken, AuthClientToken } from './tokens.js';
+export { authModule } from './module.js';
 // Token verification lives on `@fluixi/oauth2/verify`, so a browser bundle never pulls in
 // `jose` just because the package was imported.

package/dist/index.mjs

@@ -1,7 +1,8 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
-import "./chunk-25WE6UWI.mjs";
+/*! @fluixi/oauth2 v1.0.0-alpha.10 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+import "./chunk-OGS6MQ3D.mjs";
 
 // src/service.ts
+import { markReactiveScope, openReactiveScope, withReactiveScope } from "@fluixi/reactive/signal";
 import { createSession } from "@fluixi/session";
 import { createAuthHooks } from "@fluixi/auth/client";
 
@@ -111,7 +112,7 @@ function resolveMethod(auth) {
 }
 async function loadJose() {
   try {
-    return await import("./browser-ONMHX3Z3.mjs");
+    return await import("./browser-36FHB6KG.mjs");
   } catch {
     throw new OAuthError(
       "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",
@@ -151,7 +152,7 @@ async function applyClientAuth(auth, endpoint, headers, form) {
 // src/dpop.ts
 async function loadJose2() {
   try {
-    return await import("./browser-ONMHX3Z3.mjs");
+    return await import("./browser-36FHB6KG.mjs");
   } catch {
     throw new OAuthError(
       "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
@@ -159,9 +160,11 @@ async function loadJose2() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,
@@ -808,6 +811,13 @@ function clientFor(options) {
   return options.config.tokens === "server" ? createServerClient(options.config) : createBrowserClient(options.config);
 }
 function createAuthService(options) {
+  const tokens = options.config.tokens;
+  const scope = openReactiveScope({ kind: "service", name: "AuthService", ...tokens ? { detail: `tokens: ${tokens}` } : {} });
+  const service = withReactiveScope(scope, () => buildAuthService(options));
+  markReactiveScope(service, scope);
+  return service;
+}
+function buildAuthService(options) {
   const client = clientFor(options);
   let latest = null;
   const session = createSession({
@@ -885,11 +895,26 @@ function createAuthService(options) {
 import { injectionToken } from "@fluixi/start/di";
 var AuthServiceToken = injectionToken("AuthService");
 var AuthClientToken = injectionToken("AuthClient");
+
+// src/module.ts
+import { defineModule } from "@fluixi/start/app";
+function authModule(auth) {
+  return defineModule({
+    name: "oauth2",
+    providers: [
+      // One instance for every request on the server. It holds no per-visitor state there:
+      // the signed-in user comes from request locals, which `sessionLocals` fills per request.
+      { provide: AuthServiceToken, useValue: auth },
+      { provide: AuthClientToken, useValue: auth.client }
+    ]
+  });
+}
 export {
   AuthClientToken,
   AuthServiceToken,
   COOKIE_SESSION,
   OAuthError,
+  authModule,
   boundKeyOf,
   clearDiscoveryCache,
   createAuthService,

package/dist/module.cjs

@@ -0,0 +1,44 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/module.ts
+var module_exports = {};
+__export(module_exports, {
+  authModule: () => authModule
+});
+module.exports = __toCommonJS(module_exports);
+var import_app = require("@fluixi/start/app");
+
+// src/tokens.ts
+var import_di = require("@fluixi/start/di");
+var AuthServiceToken = (0, import_di.injectionToken)("AuthService");
+var AuthClientToken = (0, import_di.injectionToken)("AuthClient");
+
+// src/module.ts
+function authModule(auth) {
+  return (0, import_app.defineModule)({
+    name: "oauth2",
+    providers: [
+      // One instance for every request on the server. It holds no per-visitor state there:
+      // the signed-in user comes from request locals, which `sessionLocals` fills per request.
+      { provide: AuthServiceToken, useValue: auth },
+      { provide: AuthClientToken, useValue: auth.client }
+    ]
+  });
+}

package/dist/module.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The app-module half of this package, listed in `src/app.config.ts`.
+ *
+ * Registers the app's service under `AuthServiceToken` and its client under
+ * `AuthClientToken` on both sides. Package code reaches the service through those tokens,
+ * `OAuthCallback` among it, because a package cannot import the app. The server half, the
+ * routes and session middleware of `tokens: 'server'`, is `authServerModule` in
+ * `@fluixi/oauth2/server`, for `app.config.server.ts`.
+ */
+import { type AppModule } from '@fluixi/start/app';
+import type { AuthService } from './service.js';
+export declare function authModule<U, P, Q>(auth: AuthService<U, P, Q>): AppModule;
+//# sourceMappingURL=module.d.ts.map

package/dist/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,wBAAgB,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAUzE"}