@fluixi/oauth2 1.0.0-alpha.1 → 1.0.0-alpha.10

package/dist/server.mjs

@@ -1,5 +1,5 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
-import "./chunk-25WE6UWI.mjs";
+/*! @fluixi/oauth2 v1.0.0-alpha.10 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+import "./chunk-OGS6MQ3D.mjs";
 
 // src/server.ts
 import { createSessionCookie } from "@fluixi/session/server";
@@ -53,7 +53,7 @@ function resolveMethod(auth) {
 }
 async function loadJose() {
   try {
-    return await import("./browser-ONMHX3Z3.mjs");
+    return await import("./browser-36FHB6KG.mjs");
   } catch {
     throw new OAuthError(
       "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",
@@ -173,7 +173,106 @@ function expiryFrom(expiresIn, now = Date.now()) {
   return Number.isFinite(seconds) && seconds > 0 ? now + seconds * 1e3 : void 0;
 }
 
+// src/dpop.ts
+async function loadJose2() {
+  try {
+    return await import("./browser-36FHB6KG.mjs");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256", options = {}) {
+  const jose = await loadJose2();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function exportDpopKey(key) {
+  const jose = await loadJose2();
+  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+}
+var PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+async function importDpopKey(stored) {
+  const jose = await loadJose2();
+  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
+  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg: stored.alg
+  };
+}
+async function proofFor(key, options) {
+  const jose = await loadJose2();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+
 // src/server.ts
+import { defineModule } from "@fluixi/start/app";
+var dpopNonces = /* @__PURE__ */ new Map();
+async function prove(headers, key, method, url, accessToken) {
+  headers.dpop = await proofFor(key, { method, url, accessToken, nonce: dpopNonces.get(new URL(url).origin) });
+}
+function learnNonce(url, response) {
+  const offered = nonceFrom(response);
+  if (!offered) return false;
+  const origin = new URL(url).origin;
+  const fresh = offered !== dpopNonces.get(origin);
+  dpopNonces.set(origin, offered);
+  return fresh && !response.ok;
+}
+async function withToken(url, session) {
+  const key = session.dpop && session.tokenType?.toLowerCase() === "dpop" ? await importDpopKey(session.dpop) : null;
+  const send = async () => {
+    const headers = {
+      authorization: `${key ? "DPoP" : "Bearer"} ${session.accessToken}`
+    };
+    if (key) await prove(headers, key, "GET", url, session.accessToken);
+    return fetch(url, { headers });
+  };
+  let response = await send();
+  if (key && learnNonce(url, response)) response = await send();
+  return response;
+}
 function oauthRoutes(config) {
   const base = (config.basePath ?? "/auth").replace(/\/$/, "");
   const scopes = config.scopes ?? ["openid", "profile", "email"];
@@ -205,14 +304,19 @@ function oauthRoutes(config) {
     keyId: config.keyId,
     assertionAlgorithm: config.assertionAlgorithm
   };
-  async function tokenRequest(body) {
+  async function tokenRequest(body, key = null) {
     const { token } = await resolve();
-    const headers = {
-      "content-type": "application/x-www-form-urlencoded"
+    const attempt = async () => {
+      const headers = {
+        "content-type": "application/x-www-form-urlencoded"
+      };
+      const form = new URLSearchParams(body);
+      await applyClientAuth(clientAuth, token, headers, form);
+      if (key) await prove(headers, key, "POST", token);
+      return fetch(token, { method: "POST", headers, body: form.toString() });
     };
-    const form = new URLSearchParams(body);
-    await applyClientAuth(clientAuth, token, headers, form);
-    const response = await fetch(token, { method: "POST", headers, body: form.toString() });
+    let response = await attempt();
+    if (key && learnNonce(token, response)) response = await attempt();
     const payload = await response.json().catch(() => ({}));
     if (!response.ok) {
       throw new OAuthError(
@@ -279,17 +383,23 @@ function oauthRoutes(config) {
       if (!pending || !state || !timingSafeEqual(pending.state, state)) {
         return json({ error: "state_mismatch" }, 400);
       }
-      const payload = await tokenRequest({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: config.redirectUri,
-        code_verifier: pending.verifier
-      });
+      const key = config.dpop ? await createDpopKey(config.dpopAlgorithm, { extractable: true }) : null;
+      const payload = await tokenRequest(
+        {
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: config.redirectUri,
+          code_verifier: pending.verifier
+        },
+        key
+      );
       const signedIn = await cookie.write({
         accessToken: String(payload.access_token ?? ""),
         refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : void 0,
         idToken: typeof payload.id_token === "string" ? payload.id_token : void 0,
-        expiresAt: expiryFrom(payload.expires_in)
+        expiresAt: expiryFrom(payload.expires_in),
+        tokenType: typeof payload.token_type === "string" ? payload.token_type : void 0,
+        dpop: key ? await exportDpopKey(key) : void 0
       });
       return new Response(null, {
         status: 302,
@@ -309,17 +419,20 @@ function oauthRoutes(config) {
     if (route === "/refresh") {
       const current = await session();
       if (!current?.refreshToken) return json({ error: "no_session" }, 401);
-      const payload = await tokenRequest({
-        grant_type: "refresh_token",
-        refresh_token: current.refreshToken
-      });
+      const key = current.dpop ? await importDpopKey(current.dpop) : null;
+      const payload = await tokenRequest(
+        { grant_type: "refresh_token", refresh_token: current.refreshToken },
+        key
+      );
       const refreshed = await cookie.write({
         accessToken: String(payload.access_token ?? ""),
         // A provider that rotates refresh tokens sends a new one; one that does not
         // expects the old one to keep working.
         refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : current.refreshToken,
         idToken: current.idToken,
-        expiresAt: expiryFrom(payload.expires_in)
+        expiresAt: expiryFrom(payload.expires_in),
+        tokenType: typeof payload.token_type === "string" ? payload.token_type : current.tokenType,
+        dpop: current.dpop
       });
       return json({ ok: true }, 200, { "set-cookie": refreshed });
     }
@@ -328,9 +441,7 @@ function oauthRoutes(config) {
       if (!current?.accessToken) return json({ error: "no_session" }, 401);
       const { userinfo } = await resolve();
       if (!userinfo) return json({ error: "no_userinfo" }, 501);
-      const response = await fetch(userinfo, {
-        headers: { authorization: `Bearer ${current.accessToken}` }
-      });
+      const response = await withToken(userinfo, current);
       if (!response.ok) return json({ error: "userinfo_failed" }, response.status);
       const claims = await response.json();
       return json(config.mapUser ? config.mapUser(claims, current.accessToken) : claims);
@@ -420,9 +531,7 @@ function sessionLocals(config) {
     try {
       const endpoints = config.endpoints ?? (config.issuer ? await discover(config.issuer) : null);
       if (endpoints?.userinfo) {
-        const response = await fetch(endpoints.userinfo, {
-          headers: { authorization: `Bearer ${session.accessToken}` }
-        });
+        const response = await withToken(endpoints.userinfo, session);
         if (response.ok) {
           const claims = await response.json();
           user = config.mapUser ? config.mapUser(claims, session.accessToken) : claims;
@@ -435,7 +544,11 @@ function sessionLocals(config) {
     return next();
   };
 }
+function authServerModule(config) {
+  return defineModule({ name: "oauth2-server", middleware: [oauthRoutes(config), sessionLocals(config)] });
+}
 export {
+  authServerModule,
   oauthRoutes,
   sessionLocals
 };

package/dist/service-client.cjs

@@ -1,4 +1,4 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.10 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;

package/dist/service-client.mjs

@@ -1,5 +1,5 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
-import "./chunk-25WE6UWI.mjs";
+/*! @fluixi/oauth2 v1.0.0-alpha.10 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+import "./chunk-OGS6MQ3D.mjs";
 
 // src/types.ts
 var OAuthError = class extends Error {
@@ -42,7 +42,7 @@ function assertUsable(auth, who) {
 }
 async function loadJose() {
   try {
-    return await import("./browser-ONMHX3Z3.mjs");
+    return await import("./browser-36FHB6KG.mjs");
   } catch {
     throw new OAuthError(
       "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",

package/dist/service.cjs

@@ -34,6 +34,7 @@ __export(service_exports, {
   paramsFromUrl: () => paramsFromUrl
 });
 module.exports = __toCommonJS(service_exports);
+var import_signal = require("@fluixi/reactive/signal");
 var import_session = require("@fluixi/session");
 var import_client = require("@fluixi/auth/client");
 
@@ -191,9 +192,11 @@ async function loadJose2() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,
@@ -829,6 +832,13 @@ function clientFor(options) {
   return options.config.tokens === "server" ? createServerClient(options.config) : createBrowserClient(options.config);
 }
 function createAuthService(options) {
+  const tokens = options.config.tokens;
+  const scope = (0, import_signal.openReactiveScope)({ kind: "service", name: "AuthService", ...tokens ? { detail: `tokens: ${tokens}` } : {} });
+  const service = (0, import_signal.withReactiveScope)(scope, () => buildAuthService(options));
+  (0, import_signal.markReactiveScope)(service, scope);
+  return service;
+}
+function buildAuthService(options) {
   const client = clientFor(options);
   let latest = null;
   const session = (0, import_session.createSession)({

package/dist/service.d.ts

@@ -1,19 +1,5 @@
-/**
- * The application-facing half.
- *
- * `AuthClient` knows the protocol. This knows the application: who is signed in, whether
- * the session is still good, when to refresh, and where to send someone who is not
- * allowed in. It is built on `@fluixi/session`, which already owns that state machine,
- * rather than a second one written here.
- *
- * The mapping onto a session adapter is the part worth explaining. `createSession`'s
- * `login(creds)` means "turn these credentials into a token". In a redirect flow the
- * credential is the authorization code on the callback URL, so `login` is the code
- * exchange and the redirect itself is a separate call that never returns. Everything
- * else lines up directly: `fetchUser`, `refresh`, `logout` and `getExpiry`.
- */
 import { type AccessControl, type Session } from '@fluixi/session';
-import { createAuthHooks } from '@fluixi/auth/client';
+import { createAuthHooks, type AuthHooksOptions } from '@fluixi/auth/client';
 import type { AuthClient, AuthConfig, CallbackParams, LoginOptions } from './types.js';
 /** The credential a redirect flow produces. */
 export type AuthCredentials = CallbackParams;
@@ -55,9 +41,7 @@ export interface AuthServiceOptions<U, P = unknown, Q = (p: P) => boolean> {
      * client-side navigation; leave it out and it assigns `location`, which reloads the
      * document and discards the reactive tree.
      */
-    navigate?: {
-        handler: () => (to: string, options?: unknown) => void;
-    };
+    navigate?: AuthHooksOptions['navigate'];
     /** Where a signed-out visitor is sent. Default `/login`. */
     loginPath?: string;
     /** Where a signed-in visitor is sent from a guest-only page. Default `/`. */

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAMtD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAU,MAAM,YAAY,CAAC;AAE/F,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC;AAE7C,MAAM,WAAW,kBAAkB,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO;IACvE,mDAAmD;IACnD,MAAM,EAAE,UAAU,CAAC;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAChD,+FAA+F;IAC/F,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,qCAAqC;IACrC,WAAW,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAE/C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAC;IACtE,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,CAChE,SAAQ,OAAO,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,EAChD,IAAI,CACF,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAC3C,gBAAgB,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CACxE;IACH,oFAAoF;IACpF,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,cAAc,CAWhE;AAUD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,EACrE,OAAO,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACnC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CA0FtB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAeA,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAM7E,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAU,MAAM,YAAY,CAAC;AAE/F,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC;AAE7C,MAAM,WAAW,kBAAkB,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO;IACvE,mDAAmD;IACnD,MAAM,EAAE,UAAU,CAAC;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAChD,+FAA+F;IAC/F,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,qCAAqC;IACrC,WAAW,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAE/C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,CAChE,SAAQ,OAAO,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,EAChD,IAAI,CACF,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAC3C,gBAAgB,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CACxE;IACH,oFAAoF;IACpF,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,cAAc,CAWhE;AAUD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,EACrE,OAAO,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACnC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAStB"}

package/dist/service.js

@@ -12,6 +12,7 @@
  * exchange and the redirect itself is a separate call that never returns. Everything
  * else lines up directly: `fetchUser`, `refresh`, `logout` and `getExpiry`.
  */
+import { markReactiveScope, openReactiveScope, withReactiveScope } from '@fluixi/reactive/signal';
 import { createSession } from '@fluixi/session';
 import { createAuthHooks } from '@fluixi/auth/client';
 import { expiryFromJwt } from './pkce.js';
@@ -48,6 +49,16 @@ function clientFor(options) {
         : createBrowserClient(options.config);
 }
 export function createAuthService(options) {
+    // One group in the devtools graph for everything the service holds: the session's `user`,
+    // `token`, `status` and the rest. Marked on the instance, so `authModule(auth)` places the
+    // group under the module that provides it.
+    const tokens = options.config.tokens;
+    const scope = openReactiveScope({ kind: 'service', name: 'AuthService', ...(tokens ? { detail: `tokens: ${tokens}` } : {}) });
+    const service = withReactiveScope(scope, () => buildAuthService(options));
+    markReactiveScope(service, scope);
+    return service;
+}
+function buildAuthService(options) {
     const client = clientFor(options);
     // Held so `getExpiry` can answer for a token the session hands back, and so a
     // server-mode session has something to report when the token is a cookie.

package/dist/service.mjs

@@ -1,6 +1,7 @@
 import "./chunk-7P6ASYW6.mjs";
 
 // src/service.ts
+import { markReactiveScope, openReactiveScope, withReactiveScope } from "@fluixi/reactive/signal";
 import { createSession } from "@fluixi/session";
 import { createAuthHooks } from "@fluixi/auth/client";
 
@@ -158,9 +159,11 @@ async function loadJose2() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,
@@ -796,6 +799,13 @@ function clientFor(options) {
   return options.config.tokens === "server" ? createServerClient(options.config) : createBrowserClient(options.config);
 }
 function createAuthService(options) {
+  const tokens = options.config.tokens;
+  const scope = openReactiveScope({ kind: "service", name: "AuthService", ...tokens ? { detail: `tokens: ${tokens}` } : {} });
+  const service = withReactiveScope(scope, () => buildAuthService(options));
+  markReactiveScope(service, scope);
+  return service;
+}
+function buildAuthService(options) {
   const client = clientFor(options);
   let latest = null;
   const session = createSession({