@maronn-openid-connect/cli 0.3.0 → 0.4.0

package/dist/frameworks/hono/templates.js

@@ -92,7 +92,8 @@ import { deviceApp } from './routes/device.js';\n`
         ? `  deviceAuthorizationStore,\n`
         : '';
     const refreshStorageContext = features.refreshToken
-        ? `    c.set('refreshTokenResolver', storeResolvers.refreshTokenResolver);\n`
+        ? `    c.set('refreshTokenResolver', storeResolvers.refreshTokenResolver);
+    c.set('authenticationSessionResolver', storeResolvers.authenticationSessionResolver);\n`
         : '';
     const introspectionStorageContext = features.introspection
         ? `    c.set('introspectionAccessTokenResolver', storeResolvers.introspectionAccessTokenResolver);
@@ -333,11 +334,33 @@ export function configTemplate(corePkg, features = DEFAULT_FEATURES) {
    * 設定例: 90 日 = 7776000。
    */
   refreshTokenAbsoluteLifetime: number;
+  /**
+   * online refresh token（\`offline_access\` が付与されていない grant にも発行する
+   * Refresh Token）を有効にするか。
+   *
+   * OIDC Core 1.0 §11 は \`offline_access\` を「End-User が居ない（not logged in）ときにも
+   * 使える Refresh Token」と定義したうえで、Refresh Token の利用がその用途に限られない
+   * ことを明示している（"The use of Refresh Tokens is not exclusive to the
+   * \`offline_access\` use case. The Authorization Server MAY grant Refresh Tokens in
+   * other contexts that are beyond the scope of this specification."）。本 OP はその
+   * 「other contexts」を online refresh token として実装する。
+   *
+   * - \`true\`（既定）: \`grant_types\` に \`refresh_token\` を登録したクライアントには、
+   *   \`offline_access\` が無くても Refresh Token を発行する。ただし発行元のログイン
+   *   セッションへ束縛され、セッションが終われば \`invalid_grant\` になる。ブラウザ
+   *   セッションを持たない経路（device authorization grant）では発行しない。
+   * - \`false\`: Refresh Token は \`offline_access\` が付与された grant にだけ発行する。
+   *   ログアウトしても使い続けられる offline refresh token だけになる。
+   */
+  onlineRefreshTokenEnabled: boolean;
 `
         : '';
     const refreshTokenLifetimeDefault = features.refreshToken
         ? `  // OAuth 2.1 §6.1: refresh token は initial issuance から 90 日（7776000 秒）で必ず失効する。
   refreshTokenAbsoluteLifetime: 7776000,
+  // OIDC Core 1.0 §11: offline_access 無しの Refresh Token（online refresh token）も
+  // 発行する。ログインセッションに束縛されるため、ログアウトすると使えなくなる。
+  onlineRefreshTokenEnabled: true,
 `
         : '';
     const allowNonPkceDefault = features.pkce
@@ -367,12 +390,22 @@ export function configTemplate(corePkg, features = DEFAULT_FEATURES) {
     const exampleClientGrantTypes = [
         `'authorization_code'`,
         ...(features.refreshToken ? [`'refresh_token'`] : []),
-        ...(features.tokenExchange ? [`'urn:ietf:params:oauth:grant-type:token-exchange'`] : []),
+        ...(features.tokenExchange || features.idJag
+            ? [`'urn:ietf:params:oauth:grant-type:token-exchange'`]
+            : []),
+        ...(features.idJag ? [`'urn:ietf:params:oauth:grant-type:jwt-bearer'`] : []),
     ].join(', ');
     const exampleClientExchangeComment = features.tokenExchange
         ? `      // EXPERIMENTAL (RFC 8693): registering the token-exchange URN is what lets
       // this confidential client exchange its access tokens. Remove it to forbid
       // exchanges for this client; public clients are rejected either way.
+`
+        : '';
+    const exampleClientIdJagComment = features.idJag
+        ? `      // EXPERIMENTAL (ID-JAG draft §4.3 / §4.4): the token-exchange URN lets this
+      // confidential client request an ID-JAG for a trusted resource authorization
+      // server, and the jwt-bearer URN lets it redeem an ID-JAG issued by a trusted
+      // identity provider. Remove either to forbid that half of Cross-App Access.
 `
         : '';
     const noRefreshGrantComment = features.tokenExchange
@@ -383,12 +416,14 @@ export function configTemplate(corePkg, features = DEFAULT_FEATURES) {
       // grant is disabled in this generated provider, so only authorization_code is registered.
 `;
     const exampleClientGrantFields = features.refreshToken
-        ? `      offlineAccessAllowed: true,
-      // RFC 7591 §2: grant_types default is ["authorization_code"]. This client uses
-      // offline_access (refresh tokens), so it must explicitly register refresh_token.
-${exampleClientExchangeComment}      grantTypes: [${exampleClientGrantTypes}],
+        ? `      // RFC 7591 §2: grant_types default is ["authorization_code"]. Registering
+      // refresh_token is the single switch that lets this client receive refresh
+      // tokens at all: an online refresh token (bound to the login session) on every
+      // authorization, and an offline one (usable after logout) when offline_access
+      // is granted per OIDC Core 1.0 §11. Remove it and neither is issued.
+${exampleClientExchangeComment}${exampleClientIdJagComment}      grantTypes: [${exampleClientGrantTypes}],
 `
-        : `${noRefreshGrantComment}${exampleClientExchangeComment}      grantTypes: [${exampleClientGrantTypes}],
+        : `${noRefreshGrantComment}${exampleClientExchangeComment}${exampleClientIdJagComment}      grantTypes: [${exampleClientGrantTypes}],
 `;
     return `import type {
   ClientInfo,
@@ -459,9 +494,14 @@ export function createProviderConfig(
 }
 
 /**
- * Extended client info with offline_access permission.
- * offlineAccessAllowed: controls whether the client may request refresh tokens
- * via the offline_access scope (OAuth 2.1 / OIDC offline_access).
+ * Extended client info for this provider.
+ *
+ * Whether a client may receive refresh tokens is decided by the standard
+ * \`grantTypes\` registration metadata (RFC 7591 §2 / OIDC Dynamic Client
+ * Registration 1.0 §2) it already carries through TokenClientInfo — there is no
+ * separate provider-specific switch. \`grantTypes\` containing \`refresh_token\`
+ * gates both refresh token flavors; OIDC Core 1.0 §11 (prompt=consent) decides
+ * which flavor the authorization produces.
  *
  * userinfoSignedResponseAlg: when set, the UserInfo endpoint returns a signed JWT
  * with content-type \`application/jwt\` (OIDC Core 1.0 Section 5.3.2 — client metadata
@@ -478,7 +518,6 @@ export function createProviderConfig(
  * rejected as a server configuration error.
  */
 export type RegisteredClient = ClientInfo & TokenClientInfo & {
-  offlineAccessAllowed?: boolean;
   userinfoSignedResponseAlg?: 'RS256' | 'ES256';
   idTokenSignedResponseAlg?: 'RS256' | 'ES256';
 };
@@ -1018,6 +1057,12 @@ export class RefreshTokenStore {
 export interface AuthSessionInfo {
   subject: string;
   authTime: number;
+  /**
+   * このログインで確立（または再利用）したブラウザセッションの識別子。
+   * consent 画面を経て発行する認可コードへ引き継ぎ、online refresh token を
+   * そのセッションへ束縛するために使う。
+   */
+  sessionId?: string;
 }
 
 export class AuthSessionStore {
@@ -1085,8 +1130,8 @@ export function parseSessionId(cookieHeader: string | null): string | undefined
 
 /**
  * Build the Set-Cookie value for the browser session.
- * Attributes per study-material/http-security-headers-and-tls.md:
- * HttpOnly (no JS access), Secure (HTTPS only), SameSite=Lax. SameSite=Strict
+ * Security attributes: HttpOnly (no JS access), Secure (HTTPS only),
+ * SameSite=Lax. SameSite=Strict
  * would drop the cookie on the cross-site authorization redirect return and
  * break the flow, so Lax is required.
  */
@@ -1655,6 +1700,8 @@ export function resolversTemplate(corePkg, features = DEFAULT_FEATURES) {
     const refreshTypeImports = features.refreshToken
         ? `  RefreshTokenResolver,
   RefreshTokenInfo,
+  AuthenticationSessionResolver,
+  AuthenticationSessionInfo,
 `
         : '';
     const introspectionTypeImports = features.introspection
@@ -1682,10 +1729,31 @@ export function resolversTemplate(corePkg, features = DEFAULT_FEATURES) {
 
 `
         : '';
-    const refreshReturnField = features.refreshToken ? `    refreshTokenResolver,
-` : '';
+    const refreshReturnField = features.refreshToken
+        ? `    refreshTokenResolver,
+    authenticationSessionResolver,
+`
+        : '';
     const refreshExport = features.refreshToken
         ? `export const refreshTokenResolver = defaultStoreResolvers.refreshTokenResolver;
+export const authenticationSessionResolver =
+  defaultStoreResolvers.authenticationSessionResolver;
+`
+        : '';
+    const authenticationSessionResolverBlock = features.refreshToken
+        ? `  // online refresh token の束縛先セッションを sessionId から引く。sessionResolver は
+  // Cookie を持つブラウザリクエストから引く入口で、トークンエンドポイントには End-User の
+  // Cookie が届かないため、保存された sessionId から直接引くこちらが要る。
+  // 終了したセッションでは必ず null を返すこと。返し続けると online refresh token が
+  // ログアウト後も使えてしまう。
+  const authenticationSessionResolver: AuthenticationSessionResolver = {
+    async findSession(sessionId: string): Promise<AuthenticationSessionInfo | null> {
+      const session = await browserSessionStore.get(sessionId);
+      if (!session) return null;
+      return { subject: session.subject, authTime: session.authTime };
+    },
+  };
+
 `
         : '';
     const introspectionResolversBlock = features.introspection
@@ -1820,11 +1888,13 @@ ${introspectionResolversBlock}${revocationResolversBlock}  const sessionResolver
       if (!sessionId) return null;
       const session = await browserSessionStore.get(sessionId);
       if (!session) return null;
-      return { subject: session.subject, authTime: session.authTime };
+      // sessionId まで返すのは online refresh token のため。認可コードへ引き継ぎ、
+      // トークンエンドポイントが Refresh Token をこのセッションへ束縛する。
+      return { subject: session.subject, authTime: session.authTime, sessionId };
     },
   };
 
-  const revokeConsentAndTokens = async (subject: string, clientId: string): Promise<void> => {
+${authenticationSessionResolverBlock}  const revokeConsentAndTokens = async (subject: string, clientId: string): Promise<void> => {
     const grantIds = await consentStore.revoke(subject, clientId);
     for (const grantId of grantIds) {
       await authorizationCodeResolver.revokeTokensByGrantId?.(grantId);
@@ -2283,18 +2353,20 @@ function buildErrorRedirect(
         ? `jarmResponse ? { ...transaction, jarmResponseMode: 'query.jwt' } : transaction,`
         : `transaction,`;
     const offlineAccessStep = features.refreshToken
-        ? `    // OIDC Core 1.0 §11: offline_access requires prompt=consent (or another
-    // granting condition). The default policy drops offline_access from scope
-    // unless prompt=consent is present. To inject your own grant policy (e.g.
-    // honor a previously recorded user consent), pass a callback:
-    //   scope = await applyOfflineAccessPolicy(scope, effectiveParams, prompt,
+        ? `    // offline_access は 2 つの独立した条件を両方満たしたときだけ残る。
+    // - OIDC Core 1.0 §11: エンドユーザーの同意（prompt=consent）
+    // - RFC 7591 §2: クライアント登録の grant_types に refresh_token があること
+    //   （既定は ["authorization_code"]）。無いまま offline_access を通すと、発行した
+    //   Refresh Token が unauthorized_client で拒否されるだけの死んだ資格情報になる。
+    // 独自の許可条件を差し込むならコールバックを渡す（client も受け取れる）:
+    //   scope = await applyOfflineAccessPolicy(scope, effectiveParams, prompt, client,
     //     (req, { promptValues }) => promptValues.includes('consent') || hasStoredConsent(req));
-    scope = await applyOfflineAccessPolicy(scope, effectiveParams, prompt);
+    scope = await applyOfflineAccessPolicy(scope, effectiveParams, prompt, client);
 `
         : `    // The refresh_token feature is disabled in this generated provider:
     // the callback always returns false, so offline_access is never granted
     // (OIDC Core 1.0 §11 requires ignoring the request in that case).
-    scope = await applyOfflineAccessPolicy(scope, effectiveParams, prompt, () => false);
+    scope = await applyOfflineAccessPolicy(scope, effectiveParams, prompt, client, () => false);
 `;
     return `import { Hono } from 'hono';
 import {
@@ -2616,12 +2688,11 @@ ${bindingSecretStep}    const transactionId = await generateRandomString(32);
         return c.redirect(${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'login_required', transaction.state, 'Session exceeds the requested max_age; re-authentication required', issuer));
       }
 
-      // Filter offline_access if the client does not allow it
-      const clientConfig = await clientResolver.findClient(transaction.clientId);
-      const grantedScope = transaction.scope.split(' ').filter((s: string) => {
-        if (s === 'offline_access' && !clientConfig?.offlineAccessAllowed) return false;
-        return Boolean(s);
-      });
+      // transaction.scope は認可リクエスト検証時に applyOfflineAccessPolicy を通した
+      // 後の値。offline_access の可否（OIDC Core 1.0 §11 の prompt=consent と、
+      // クライアント登録 grant_types に refresh_token があるか）はそこで判定済みなので、
+      // ここで再フィルタしない。
+      const grantedScope = transaction.scope.split(' ').filter(Boolean);
 
       // Generate authorization code via core helper
       const responseParams = await completeAuthTransaction(
@@ -2633,6 +2704,9 @@ ${bindingSecretStep}    const transactionId = await generateRandomString(32);
         authorizationResponse: { ...responseParams, scope: grantedScope },
         subject: session.subject,
         authTime: session.authTime,
+        // online refresh token をこのログインセッションへ束縛するために引き継ぐ。
+        // セッションが終われば、その RT は invalid_grant になる。
+        sessionId: session.sessionId,
         // OIDC Core 1.0 §3.1.3.1: TTL は ProviderConfig から設定可能（既定 300 秒）。
         ttlSeconds: config.authorizationCodeTtl,
       });
@@ -2685,12 +2759,9 @@ ${promptNoneSuccessRedirect}
             ));
 
           if (consentAlreadyGranted) {
-            // Filter offline_access if the client does not allow it
-            const clientConfig = await clientResolver.findClient(transaction.clientId);
-            const grantedScope = transaction.scope.split(' ').filter((s: string) => {
-              if (s === 'offline_access' && !clientConfig?.offlineAccessAllowed) return false;
-              return Boolean(s);
-            });
+            // transaction.scope は applyOfflineAccessPolicy 通過後の値（prompt=consent と
+            // クライアントの grant_types で offline_access の可否は判定済み）。再フィルタしない。
+            const grantedScope = transaction.scope.split(' ').filter(Boolean);
 
             const responseParams = await completeAuthTransaction(
               transactionId,
@@ -2701,6 +2772,8 @@ ${promptNoneSuccessRedirect}
               authorizationResponse: { ...responseParams, scope: grantedScope },
               subject: existingSession.subject,
               authTime: existingSession.authTime,
+              // online refresh token を、この SSO で再利用したログインセッションへ束縛する。
+              sessionId: existingSession.sessionId,
               // OIDC Core 1.0 §3.1.3.1: TTL は ProviderConfig から設定可能（既定 300 秒）。
               ttlSeconds: config.authorizationCodeTtl,
             });
@@ -2718,8 +2791,19 @@ ${ssoSuccessRedirect}
           await authSessionStore.set(transactionId, {
             subject: existingSession.subject,
             authTime: existingSession.authTime,
+            // consent 画面を経由しても online refresh token の束縛先を見失わないよう、
+            // login → consent の受け渡しに sessionId も載せる。
+            sessionId: existingSession.sessionId,
           });
-${bindingCookieOnConsentRedirect}          const consentUrl = new URL('/consent', c.req.url);
+${bindingCookieOnConsentRedirect}          // Internal redirects (/login, /consent) are built on config.issuer, never
+          // on the request URL: some runtimes derive the request URL from the Host
+          // header, which would let the sender pick the redirect origin and receive
+          // transaction_id there (RFC 9700 §2.1: redirect only to trusted URIs).
+          // OIDC Discovery 1.0 §3 makes the advertised issuer the source of truth
+          // for URLs that point at the OP itself. A subpath issuer contributes only
+          // its origin here ('/consent' is an absolute path) — subpath mounting is
+          // not supported by the generated routes.
+          const consentUrl = new URL('/consent', config.issuer);
           consentUrl.searchParams.set('transaction_id', transactionId);
           return c.redirect(consentUrl.toString());
         }
@@ -2727,7 +2811,9 @@ ${bindingCookieOnConsentRedirect}          const consentUrl = new URL('/consent'
     }
 
     // Redirect to login page (prompt=login forces re-authentication; handled in login route)
-${bindingCookieOnLoginRedirect}    const loginUrl = new URL('/login', c.req.url);
+${bindingCookieOnLoginRedirect}    // config.issuer, not the request URL, decides the redirect origin — see the
+    // /consent redirect above (OIDC Discovery 1.0 §3 / RFC 9700 §2.1).
+    const loginUrl = new URL('/login', config.issuer);
     loginUrl.searchParams.set('transaction_id', transactionId);
     return c.redirect(loginUrl.toString());
   } catch (error) {
@@ -3348,8 +3434,7 @@ deviceApp.post('/login', async (c) => {
   if (!user) {
     // Per-record throttling only. An attacker holding a device-grant client can
     // mint unlimited records, so the aggregate password-guess budget is the same
-    // as the one on /login — subject-scoped throttling is tracked separately in
-    // tasks/p2-login-attempt-throttling-subject-scope.md.
+    // as the one on /login. Subject-scoped throttling is a separate concern.
     const failure = await recordDeviceLoginFailure(
       record,
       deviceStore,
@@ -3494,7 +3579,8 @@ assertJarmLifetimeSeconds(jarmConfig.jarmResponseLifetimeSeconds);
 export function tokenRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
     const refreshResolverImport = features.refreshToken
         ? `
-  refreshTokenResolver as defaultRefreshTokenResolver,`
+  refreshTokenResolver as defaultRefreshTokenResolver,
+  authenticationSessionResolver as defaultAuthenticationSessionResolver,`
         : '';
     const refreshStoreImport = features.refreshToken
         ? `
@@ -3503,6 +3589,10 @@ export function tokenRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
     const refreshResolverConst = features.refreshToken
         ? `    const refreshTokenResolver =
       c.get('refreshTokenResolver') ?? defaultRefreshTokenResolver;
+    // online refresh token の束縛先セッションを sessionId から引く。差し替えると
+    // 「セッションが生きているか」の判定そのものを差し替えられる。
+    const authenticationSessionResolver =
+      c.get('authenticationSessionResolver') ?? defaultAuthenticationSessionResolver;
 `
         : '';
     const refreshStoreConst = features.refreshToken
@@ -3543,6 +3633,12 @@ export function tokenRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
       // to enable it, or remove this step if your experiment has no idle lifetime.
       validateRefreshTokenIdleTimeout(refreshTokenInfo, undefined);
 
+      // online refresh token（sessionId を持つ RT）は、束縛先のログインセッションが
+      // 生きている間だけ使える。ログアウト・別ユーザーでの再ログインでセッションが
+      // 消えれば invalid_grant になる。offline_access が付与された RT は sessionId を
+      // 持たないため、このステップを素通りしてログアウト後も使い続けられる。
+      await validateRefreshTokenSession(refreshTokenInfo, authenticationSessionResolver);
+
       // RFC 6749 §6: requested scope may only narrow the original grant.
       const effectiveScope = validateRefreshTokenScope(
         params.scope,
@@ -3630,10 +3726,21 @@ export function tokenRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
   validateRefreshTokenExpiration,
   validateRefreshTokenIdleTimeout,
   validateRefreshTokenScope,
+  validateRefreshTokenSession,
+  clientAllowsRefreshTokenGrant,
   buildValidatedRefreshTokenRequest,`
         : '';
     const grantHasOfflineAccessBlock = features.refreshToken
-        ? `    // RFC 6749 §6 / OIDC Core 1.0 §11: refresh 時の scope 縮小は当該リクエストの access token /
+        ? `    // --- Refresh Token を発行するかの判定 -------------------------------------
+    //
+    // RFC 7591 §2 / OIDC Dynamic Client Registration 1.0 §2: grant_types の既定は
+    // ["authorization_code"]。refresh_token を登録していないクライアントへ RT を渡しても、
+    // 次に grant_type=refresh_token を出した瞬間 validateClientGrantType が
+    // unauthorized_client で拒否する。一度も使えない長期資格情報を保存させるだけなので
+    // （RFC 9700 §4.14）、登録が無ければ発行しない。
+    const clientAllowsRefreshGrant = clientAllowsRefreshTokenGrant(tokenClient);
+
+    // RFC 6749 §6 / OIDC Core 1.0 §11: refresh 時の scope 縮小は当該リクエストの access token /
     // ID Token の権限縮小として扱い、refresh token rotation の可否とは切り離す。rotation 可否は
     // 「元の grant が offline_access を持っていたか」で判断する。
     // - authorization_code grant: 今回付与された scope に offline_access があるか。
@@ -3641,14 +3748,33 @@ export function tokenRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
     //   (validatedRequest.hadOfflineAccess)。縮小後 scope から offline_access を落としても
     //   元 grant の権限は失われないため rotation を継続する。
     const grantHasOfflineAccess =
-      validatedRequest.grantType === 'refresh_token'
+      clientAllowsRefreshGrant &&
+      (validatedRequest.grantType === 'refresh_token'
         ? validatedRequest.hadOfflineAccess
-        : validatedRequest.scope.includes('offline_access');
+        : validatedRequest.scope.includes('offline_access'));
+
+    // online refresh token の束縛先セッション。
+    // OIDC Core 1.0 §11 は offline_access を「End-User が居ない（not logged in）ときにも
+    // 使える Refresh Token」と定義したうえで、Refresh Token の利用がその用途に限られない
+    // ことも明示している（"The Authorization Server MAY grant Refresh Tokens in other
+    // contexts"）。この OP はその other contexts を online refresh token として実装し、
+    // ログインセッションへ束縛する。offline_access がある grant は束縛しない。
+    // - authorization_code grant: 認可コードが持つ sessionId（ログイン時に確立したもの）。
+    // - refresh_token grant: 元 RT の束縛をそのまま引き継ぎ、rotation で外れないようにする。
+    const boundSessionId = grantHasOfflineAccess ? undefined : validatedRequest.sessionId;
+
+    // 束縛先が分からなければ online refresh token は発行しない。ブラウザセッションを
+    // 持たない経路（device authorization grant）が該当する。ログアウトで止まる保証を
+    // 付けられない RT を配らないための fail-closed。
+    const issueRefreshToken =
+      clientAllowsRefreshGrant &&
+      (grantHasOfflineAccess ||
+        (config.onlineRefreshTokenEnabled && boundSessionId !== undefined));
 
 `
         : '';
     const refreshTokenValueExpression = features.refreshToken
-        ? `grantHasOfflineAccess ? generateRandomString(32) : undefined`
+        ? `issueRefreshToken ? generateRandomString(32) : undefined`
         : `undefined /* the refresh_token feature is disabled: never issue one */`;
     const randomStringImport = features.refreshToken
         ? `
@@ -3707,6 +3833,9 @@ export function tokenRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
         acr: validatedRequest.grantType === 'refresh_token' ? validatedRequest.acr : resolvedAcr,
         amr: validatedRequest.grantType === 'refresh_token' ? validatedRequest.amr : resolvedAmr,
         azp: validatedRequest.grantType === 'refresh_token' ? validatedRequest.azp : undefined,
+        // online refresh token の束縛。undefined なら offline refresh token として
+        // セッションから独立し、ログアウト後も使える。
+        sessionId: boundSessionId,
       });
     }
 
@@ -4089,6 +4218,349 @@ ${deviceRefreshTokenBlock}
         error.statusCode,
       );
     }
+`
+        : '';
+    const idJagTokenExchangeConstImport = features.idJag && !features.tokenExchange
+        ? `
+  ID_JAG_TOKEN_TYPE,
+  TOKEN_EXCHANGE_GRANT_TYPE,`
+        : '';
+    const idJagImports = features.idJag
+        ? `
+import {
+  IdJagError,
+  JWT_BEARER_GRANT_TYPE,${idJagTokenExchangeConstImport}
+  TOKEN_TYPE_ID_TOKEN,
+  matchesIdJagIssuanceRequest,
+  processIdJagIssuanceRequest,
+  processIdJagRedemptionRequest,
+  resolveIdJagActor,
+  type IdJagAccessTokenInfo,
+  type IdJagActorTokenResolver,
+  type IdJagTrustedIdentityProvider,
+} from '${EXPERIMENTAL_PACKAGE}/id-jag';
+import type { JwkSet } from '${corePkg}';`
+        : '';
+    const idJagRefreshConfigDoc = features.idJag && features.refreshToken
+        ? `
+ * - allowRefreshTokenSubjects: whether a refresh token this OP issued may stand
+ *   in for the ID Token as the subject_token (draft §4.3 MAY), so a client can
+ *   request a fresh ID-JAG after its ID Token expired without a new SSO round
+ *   trip. Validated exactly like the standard refresh_token grant (rotation
+ *   reuse revokes the token family; online tokens require the login session to
+ *   be alive); the refresh token is NOT consumed. Grants without the openid
+ *   scope are refused — their refresh token replaces no identity assertion.`
+        : '';
+    const idJagRefreshConfigField = features.idJag && features.refreshToken
+        ? `
+  allowRefreshTokenSubjects: true,`
+        : '';
+    const idJagConfigBlock = features.idJag
+        ? `
+/**
+ * EXPERIMENTAL — Cross-App Access (XAA) / ID-JAG settings
+ * (draft-ietf-oauth-identity-assertion-authz-grant-04).
+ *
+ * Issuing side (this OP as the IdP, draft §4.3):
+ * - allowedAudiences: resource authorization server issuers this IdP may issue
+ *   an ID-JAG for. Empty by default (fail safe): every issuance request is
+ *   rejected with invalid_target until you list the peer AS issuers here.
+ *   Adding an entry grants that cross-app connection on behalf of every user —
+ *   there is no per-user consent screen in this flow.
+ * - idJagLifetimeSeconds: ID-JAG lifetime. Keep it short (draft example: 300);
+ *   clients are expected to request a fresh one instead of holding it.
+ * - allowedScopes: optional cap on the scopes an ID-JAG may carry. undefined
+ *   passes the requested scopes through (the resource AS applies its own
+ *   policy again on redemption).${idJagRefreshConfigDoc}
+ * - allowActorTokens: whether an actor_token (identifying who acts on the
+ *   subject's behalf) is accepted and recorded as the ID-JAG's act claim
+ *   (RFC 8693 §4.1). The draft defines no normative actor processing (§9.7
+ *   sketches extensions), so this is an opt-in extension and defaults to
+ *   false — an actor_token is rejected until you flip it, whatever else is
+ *   configured. Every token type identifier RFC 8693 §3 defines is accepted
+ *   the same way; the type alone decides nothing.
+ * - actorTokenResolver: validates the actor_token's CONTENT (signature,
+ *   revocation, whose token it is) — for every accepted type, this OP's own
+ *   ID Tokens included. The library only checks the request structure and the
+ *   shape of what you return. Return the act value ({ sub, act? }) for a valid
+ *   token, null for an invalid one (answered with a fixed invalid_request), or
+ *   throw IdJagError to pick the response yourself. The default below handles
+ *   ID Tokens this OP issued to the authenticated client; extend or replace it
+ *   to cover the other types. Clearing it rejects every actor_token.
+ *
+ * Consuming side (this OP as the resource authorization server, draft §4.4):
+ * - trustedIdentityProviders: the IdPs whose ID-JAGs are accepted on the
+ *   jwt-bearer grant. Empty by default (fail safe). Keys come from the inline
+ *   \`jwks\` when present, otherwise from \`jwksUri\` (fetched and cached below).
+ *   Never derive the key source from the assertion itself.
+ */
+const defaultIdJagActorTokenResolver: IdJagActorTokenResolver = async ({
+  actorToken,
+  actorTokenType,
+  clientId,
+  issuer,
+  jwks,
+}) =>
+  actorTokenType === TOKEN_TYPE_ID_TOKEN
+    ? resolveIdJagActor({ actorToken, issuer, clientId, jwks })
+    : null;
+
+export const idJagConfig = {
+  allowedAudiences: [] as string[],
+  idJagLifetimeSeconds: 300,
+  allowedScopes: undefined as string[] | undefined,${idJagRefreshConfigField}
+  allowActorTokens: false,
+  actorTokenResolver: defaultIdJagActorTokenResolver as IdJagActorTokenResolver | undefined,
+  trustedIdentityProviders: [] as Array<{ issuer: string; jwksUri?: string; jwks?: JwkSet }>,
+};
+
+/**
+ * EXPERIMENTAL — jwks_uri cache for trusted identity providers.
+ *
+ * A fetched JWKS is reused for 300 seconds, so a signing-key rotation at the
+ * IdP can take up to that long to be picked up (a verification that fails
+ * within the window is answered as an untrusted assertion). The fetch target
+ * comes exclusively from the static idJagConfig above — never from request or
+ * assertion content — which is what keeps this endpoint SSRF-free.
+ */
+const idJagJwksCache = new Map<string, { jwks: JwkSet; expiresAt: number }>();
+const ID_JAG_JWKS_CACHE_TTL_MS = 300_000;
+
+async function resolveTrustedIdentityProviders(): Promise<IdJagTrustedIdentityProvider[]> {
+  const resolved: IdJagTrustedIdentityProvider[] = [];
+  for (const entry of idJagConfig.trustedIdentityProviders) {
+    if (entry.jwks !== undefined) {
+      resolved.push({ issuer: entry.issuer, jwks: entry.jwks });
+      continue;
+    }
+    if (entry.jwksUri === undefined) {
+      // An entry with neither jwks nor jwksUri can never verify anything; skip
+      // it so the assertion is answered with the fixed untrusted description.
+      continue;
+    }
+    const cached = idJagJwksCache.get(entry.jwksUri);
+    if (cached !== undefined && cached.expiresAt > Date.now()) {
+      resolved.push({ issuer: entry.issuer, jwks: cached.jwks });
+      continue;
+    }
+    // A failed fetch propagates: the generic catch turns it into server_error,
+    // which is honest — the assertion was never evaluated, so invalid_grant
+    // would wrongly blame the client for an outage on this side.
+    const response = await fetch(entry.jwksUri);
+    if (!response.ok) {
+      throw new Error(\`Fetching the JWKS of trusted IdP \${entry.issuer} failed with status \${response.status}\`);
+    }
+    const jwks = (await response.json()) as JwkSet;
+    idJagJwksCache.set(entry.jwksUri, { jwks, expiresAt: Date.now() + ID_JAG_JWKS_CACHE_TTL_MS });
+    resolved.push({ issuer: entry.issuer, jwks });
+  }
+  return resolved;
+}
+`
+        : '';
+    const idJagRefreshSubjectArgs = features.idJag && features.refreshToken
+        ? `
+        ...(idJagConfig.allowRefreshTokenSubjects
+          ? { refreshTokenResolver, authenticationSessionResolver }
+          : {}),`
+        : '';
+    const idJagTokenExchangeFallbackStep = features.idJag && !features.tokenExchange
+        ? `
+    // Generated without --enable token-exchange: the exchange grant exists here
+    // only to issue ID-JAGs, so any other requested_token_type is answered with
+    // a pointer instead of falling through to unsupported_grant_type (discovery
+    // does advertise the exchange grant in this build).
+    if (params.grant_type === TOKEN_EXCHANGE_GRANT_TYPE) {
+      c.header('Cache-Control', 'no-store');
+      c.header('Pragma', 'no-cache');
+      return c.json(
+        {
+          error: 'invalid_request',
+          error_description: \`This authorization server only supports requested_token_type \${ID_JAG_TOKEN_TYPE} for token exchange\`,
+        },
+        400,
+      );
+    }
+`
+        : '';
+    const idJagIssuanceDispatchStep = features.idJag
+        ? `
+    // --- EXPERIMENTAL: ID-JAG issuance (Cross-App Access, draft §4.3) ------
+    // A token-exchange request whose requested_token_type is the ID-JAG URN.
+    // Dispatched right after client authentication and BEFORE the plain
+    // token-exchange branch (same grant_type URN) and core's
+    // validateGrantTypeSupported. The subject_token must be an ID Token this OP
+    // issued to the authenticated client; the result is a signed grant JWT for
+    // the resource authorization server named by \`audience\` — not an access
+    // token (the response carries token_type N_A).
+    //
+    // Backed by ${EXPERIMENTAL_PACKAGE}, whose API is NOT stable: it may change
+    // in a breaking way between releases. The underlying specification is an
+    // IETF draft (-04) and may itself change. Do not build production code on
+    // this without pinning versions.
+    if (matchesIdJagIssuanceRequest(params)) {
+      const idJagIssuanceConfig = c.get('config');
+      // The ID-JAG is signed with a registered RS256 key so the peer AS can
+      // verify it against this OP's JWKS endpoint (same key-selection contract
+      // as JARM: RS256 is pinned, the active key may be a different alg).
+      const idJagSigningKeys = (c.get('signingKeys') as SigningKey[] | undefined) ?? [];
+      let idJagSigningKey: SigningKey;
+      try {
+        idJagSigningKey = selectSigningKeyByAlg(idJagSigningKeys, 'RS256');
+      } catch {
+        c.header('Cache-Control', 'no-store');
+        c.header('Pragma', 'no-cache');
+        return c.json(
+          { error: 'server_error', error_description: 'No RS256 signing key registered for ID-JAG issuance' },
+          500,
+        );
+      }
+      // The subject_token is verified against the same JWKS that id_token_hint
+      // uses (the OP's own ID Token signing keys) — draft §4.3.3 requires the
+      // assertion's audience to be the authenticated client, which
+      // processIdJagIssuanceRequest checks.
+      const idJagJwks = await c.get('jwksProvider')();
+
+      const idJagIssuanceResponse = await processIdJagIssuanceRequest({
+        params,
+        client: tokenClient,
+        issuer: idJagIssuanceConfig.issuer,
+        jwks: idJagJwks,
+        signingKey: idJagSigningKey,
+        allowedAudiences: idJagConfig.allowedAudiences,
+        allowedScopes: idJagConfig.allowedScopes,
+        lifetimeSeconds: idJagConfig.idJagLifetimeSeconds,
+        // Extension (draft §9.7): when enabled, an actor_token is recorded as
+        // the ID-JAG's act claim. Every accepted token type goes through the
+        // same resolver, which owns the content validation.
+        allowActorTokens: idJagConfig.allowActorTokens,
+        ...(idJagConfig.actorTokenResolver === undefined
+          ? {}
+          : { actorTokenResolver: idJagConfig.actorTokenResolver }),${idJagRefreshSubjectArgs}
+      });
+
+      // RFC 6749 §5.1: token responses MUST NOT be cached. The ID-JAG itself is
+      // not persisted — it is a self-contained signed grant the peer AS
+      // verifies by signature and exp.
+      c.header('Cache-Control', 'no-store');
+      c.header('Pragma', 'no-cache');
+      return c.json(idJagIssuanceResponse);
+    }
+${idJagTokenExchangeFallbackStep}`
+        : '';
+    const idJagRedemptionDispatchStep = features.idJag
+        ? `
+    // --- EXPERIMENTAL: ID-JAG redemption (Cross-App Access, draft §4.4) ----
+    // The jwt-bearer grant (RFC 7523 §2.1). The assertion must be an ID-JAG
+    // (typ oauth-id-jag+jwt) issued by one of idJagConfig.trustedIdentityProviders
+    // for THIS issuer and for the authenticated client. This OP then issues its
+    // own access token — the IdP never mints tokens for this AS.
+    //
+    // No ID Token is issued (this is not an OIDC authentication flow: the
+    // openid scope only grants UserInfo access) and no refresh token is issued
+    // (draft §4.4.3 SHOULD NOT — re-presenting the still-valid ID-JAG replaces
+    // the refresh token).
+    if (params.grant_type === JWT_BEARER_GRANT_TYPE) {
+      const idJagRedemptionConfig = c.get('config');
+      const idJagIdentityProviders = await resolveTrustedIdentityProviders();
+
+      const idJagGrant = await processIdJagRedemptionRequest({
+        params,
+        client: tokenClient,
+        issuer: idJagRedemptionConfig.issuer,
+        identityProviders: idJagIdentityProviders,
+        configuredExpiresIn: idJagRedemptionConfig.accessTokenExpiresIn,
+      });
+
+      // config / privateKey / keyId are bound further down for the standard
+      // grants. This branch reads them on its own so the generated output is
+      // unchanged when the feature is off; it returns, so nothing runs twice.
+      const idJagTokenIssuer: AccessTokenIssuer =
+        idJagRedemptionConfig.accessTokenFormat === 'opaque'
+          ? createOpaqueAccessTokenIssuer()
+          : createJwtAccessTokenIssuer();
+
+      // Same aud policy as the standard token route: the UserInfo endpoint
+      // stays a permanent member (RFC 9068 §3); the ID-JAG's resource claim
+      // (RFC 8707) contributes the requested resources.
+      const idJagAudience = buildAccessTokenAudience({
+        userInfoEndpoint: \`\${idJagRedemptionConfig.issuer}/userinfo\`,
+        requested: idJagGrant.requestedResources,
+        issuer: idJagRedemptionConfig.issuer,
+      });
+
+      const idJagIssuedAt = Math.floor(Date.now() / 1000);
+      const idJagAccessTokenPayload = buildAccessTokenPayload({
+        issuer: idJagRedemptionConfig.issuer,
+        subject: idJagGrant.subject,
+        clientId: idJagGrant.clientId,
+        scope: idJagGrant.scope,
+        audience: idJagAudience,
+        expiresIn: idJagGrant.expiresIn,
+        issuedAt: idJagIssuedAt,
+      });
+      const idJagAccessToken = await idJagTokenIssuer.issue({
+        payload: {
+          ...idJagAccessTokenPayload,
+          // RFC 8693 §4.1: an act claim carried by the ID-JAG is preserved on
+          // the issued access token, so downstream services still see WHO acts
+          // on the subject's behalf (dropping it would silently turn the
+          // delegation into impersonation).
+          ...(idJagGrant.actor === undefined ? {} : { act: idJagGrant.actor }),
+        },
+        privateKey: c.get('privateKey'),
+        keyId: c.get('keyId'),
+      });
+
+      const idJagAccessTokenMetadata: IdJagAccessTokenInfo = {
+        // draft §4.4.1: the ID-JAG's sub is used as the local subject directly
+        // (subject resolution by identical sub; JIT provisioning is out of scope).
+        sub: idJagGrant.subject,
+        clientId: idJagGrant.clientId,
+        scope: idJagGrant.scope,
+        expiresAt: idJagIssuedAt + idJagGrant.expiresIn,
+        // Each redemption is its own grant: revoking one issued token must not
+        // affect tokens from other redemptions of the same (re-presentable)
+        // ID-JAG, so the payload's own jti doubles as the grant id.
+        grantId: idJagAccessTokenPayload.jti,
+        iat: idJagIssuedAt,
+        nbf: idJagIssuedAt,
+        audience: idJagAudience,
+        issuer: idJagRedemptionConfig.issuer,
+        jti: idJagAccessTokenPayload.jti,
+        // The actor record is persisted too, so opaque-token introspection and
+        // store-based tooling can surface it just like the JWT claim.
+        ...(idJagGrant.actor === undefined ? {} : { act: idJagGrant.actor }),
+      };
+      await accessTokenStore.set(idJagAccessToken, idJagAccessTokenMetadata);
+
+      // RFC 6749 §5.1: token responses MUST NOT be cached.
+      c.header('Cache-Control', 'no-store');
+      c.header('Pragma', 'no-cache');
+      return c.json({
+        access_token: idJagAccessToken,
+        token_type: 'Bearer' as const,
+        expires_in: idJagGrant.expiresIn,
+        scope: idJagGrant.scope.join(' '),
+      });
+    }
+`
+        : '';
+    const idJagCatchBranch = features.idJag
+        ? `    if (error instanceof IdJagError) {
+      // ID-JAG errors use the RFC 6749 §5.2 shape and are always 400 — a 401
+      // can only come from client authentication, which runs before both
+      // branches and throws core's TokenError. Issuance failures map to
+      // invalid_request / invalid_target / invalid_scope / unauthorized_client
+      // (RFC 8693 §2.2.2); assertion failures on redemption map to
+      // invalid_grant (RFC 7521 §4.1).
+      c.header('Cache-Control', 'no-store');
+      c.header('Pragma', 'no-cache');
+      return c.json(
+        { error: error.code, error_description: error.errorDescription },
+        error.statusCode,
+      );
+    }
 `
         : '';
     return `import { Hono } from 'hono';
@@ -4132,8 +4604,8 @@ import {
   accessTokenStore as defaultAccessTokenStore,
   authCodeStore as defaultAuthCodeStore,${refreshStoreImport}
 } from '../store.js';
-import type { RegisteredClient } from '../config.js';${tokenExchangeImports}${deviceGrantImports}
-${tokenExchangeConfigBlock}
+import type { RegisteredClient } from '../config.js';${tokenExchangeImports}${idJagImports}${deviceGrantImports}
+${tokenExchangeConfigBlock}${idJagConfigBlock}
 export const tokenApp = new Hono<{ Variables: Record<string, any> }>();
 
 /**
@@ -4243,7 +4715,7 @@ ${refreshStoreConst}
     await verifyClientSecret(tokenClient, presentedCredentials.clientSecret);
 
     const authenticatedClientId = presentedCredentials.clientId;
-${tokenExchangeDispatchStep}${deviceCodeDispatchStep}
+${idJagIssuanceDispatchStep}${idJagRedemptionDispatchStep}${tokenExchangeDispatchStep}${deviceCodeDispatchStep}
     // --- Token request validation pipeline --------------------------------
     // Each step below is an independent core function, called in the same order
     // as core's validateTokenRequest(). Delete a call to drop that validation,
@@ -4478,7 +4950,7 @@ ${refreshTokenPersistenceBlock}    c.header('Cache-Control', 'no-store');
     c.header('Pragma', 'no-cache');
     return c.json(tokenResponse);
   } catch (error) {
-${tokenExchangeCatchBranch}${deviceGrantCatchBranch}    if (error instanceof TokenError) {
+${idJagCatchBranch}${tokenExchangeCatchBranch}${deviceGrantCatchBranch}    if (error instanceof TokenError) {
       const status = error.statusCode as 400 | 401;
       // RFC 6750 Section 3 / OAuth 2.1 Section 5.2: 401 responses include WWW-Authenticate
       if (error.wwwAuthenticate) {
@@ -4841,7 +5313,10 @@ export function discoveryRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
     const supportedGrantTypes = [
         `'authorization_code'`,
         ...(features.refreshToken ? [`'refresh_token'`] : []),
-        ...(features.tokenExchange ? [`'urn:ietf:params:oauth:grant-type:token-exchange'`] : []),
+        ...(features.tokenExchange || features.idJag
+            ? [`'urn:ietf:params:oauth:grant-type:token-exchange'`]
+            : []),
+        ...(features.idJag ? [`'urn:ietf:params:oauth:grant-type:jwt-bearer'`] : []),
         ...(features.deviceAuthorizationGrant
             ? [`'urn:ietf:params:oauth:grant-type:device_code'`]
             : []),
@@ -4927,6 +5402,16 @@ import { parConfig } from './par.js';`
     // EXPERIMENTAL — RFC 8628 §4 metadata.
     device_authorization_endpoint: \`\${issuer}/device_authorization\`,`
         : '';
+    const idJagDiscoveryMetadata = features.idJag
+        ? `
+    // EXPERIMENTAL — ID-JAG draft §7.1: this OP can issue an ID-JAG via token
+    // exchange (identity-chaining requested token type).
+    identity_chaining_requested_token_types_supported: ['urn:ietf:params:oauth:token-type:id-jag'],
+    // EXPERIMENTAL — ID-JAG draft §7.2: this OP can process the ID-JAG grant
+    // profile on the jwt-bearer grant. Which issuers are actually trusted is
+    // local policy and is not disclosed here (draft §9.4).
+    authorization_grant_profiles_supported: ['urn:ietf:params:oauth:grant-profile:id-jag'],`
+        : '';
     return `import { Hono } from 'hono';
 import { buildProviderMetadata, getJwaAlgorithm, type SigningKey } from '${corePkg}';
 import { defaultProviderConfig } from '../config.js';${parDiscoveryImport}
@@ -5039,7 +5524,7 @@ ${rfc8414Comment}${introspectionMetadata}${revocationMetadata}  });
   // not in OIDC Discovery, so it is added separately.
   return c.json({
     ...metadata,
-    code_challenge_methods_supported: ['S256'],${parDiscoveryMetadata}${deviceDiscoveryMetadata}${jarmDiscoveryMetadata}
+    code_challenge_methods_supported: ['S256'],${parDiscoveryMetadata}${deviceDiscoveryMetadata}${jarmDiscoveryMetadata}${idJagDiscoveryMetadata}
   });
 });
 `;
@@ -5132,6 +5617,7 @@ import {
   parseSessionId,${bindingStoreImport}
   userStore,
 } from '../store.js';
+import { defaultProviderConfig } from '../config.js';
 import { defaultViews, renderView } from '../views.js';
 
 export const loginApp = new Hono<{ Variables: Record<string, any> }>();
@@ -5215,12 +5701,6 @@ ${bindingCheckBeforeLoginCsrf}  validateCsrfToken(transaction, csrfToken);
 
   const authTime = Math.floor(Date.now() / 1000);
 
-  // Store authenticated subject for the consent step (per-transaction handoff).
-  await authSessionStore.set(transactionId, {
-    subject: user.sub,
-    authTime,
-  });
-
   // Establish a persistent browser (OP) session and set the session cookie so
   // SSO / prompt=none / max_age work on subsequent authorization requests
   // (OIDC Core 1.0 Section 3.1.2.3).
@@ -5228,8 +5708,21 @@ ${bindingCheckBeforeLoginCsrf}  validateCsrfToken(transaction, csrfToken);
   await browserSessionStore.set(sessionId, { subject: user.sub, authTime });
   c.header('Set-Cookie', buildSessionCookie(sessionId));
 
-  // Redirect to consent page
-  const consentUrl = new URL('/consent', c.req.url);
+  // Store authenticated subject for the consent step (per-transaction handoff).
+  // sessionId も渡すのは online refresh token のため。consent 経由で発行する認可
+  // コードにこのセッションを引き継ぎ、ログアウトで使えなくなる RT を作る。
+  await authSessionStore.set(transactionId, {
+    subject: user.sub,
+    authTime,
+    sessionId,
+  });
+
+  // Redirect to consent page. config.issuer, not the request URL, decides the
+  // redirect origin: some runtimes derive the request URL from the Host header,
+  // which would let the sender pick where transaction_id lands (OIDC Discovery
+  // 1.0 §3 / RFC 9700 §2.1).
+  const config = c.get('config') ?? defaultProviderConfig;
+  const consentUrl = new URL('/consent', config.issuer);
   consentUrl.searchParams.set('transaction_id', transactionId);
   return c.redirect(consentUrl.toString());
 });
@@ -5466,7 +5959,6 @@ import {
   createAuthorizationCode,${jarmConsentCoreImports}
 } from '${corePkg}';
 import {
-  clientResolver as defaultClientResolver,
   consentResolver as defaultConsentResolver,
 } from '../resolvers.js';
 import {
@@ -5514,7 +6006,6 @@ consentApp.post('/', async (c) => {
   const transactionStore = c.get('transactionStore') ?? defaultTransactionStore;
   const authCodeStore = c.get('authCodeStore') ?? defaultAuthCodeStore;
   const authSessionStore = c.get('authSessionStore') ?? defaultAuthSessionStore;
-  const clientResolver = c.get('clientResolver') ?? defaultClientResolver;
 
   const transaction = await getAuthTransaction(transactionId, transactionStore);
 ${bindingCheckBeforeConsentCsrf}  validateCsrfToken(transaction, csrfToken);
@@ -5561,12 +6052,10 @@ ${consentDenyRedirect}
     transactionStore,
   );
 
-  // Filter offline_access if the client does not allow it
-  const clientConfig = await clientResolver.findClient(transaction.clientId);
-  const grantedScope = transaction.scope.split(' ').filter((s) => {
-    if (s === 'offline_access' && !clientConfig?.offlineAccessAllowed) return false;
-    return Boolean(s);
-  });
+  // transaction.scope は認可リクエスト検証時に applyOfflineAccessPolicy を通した後の値。
+  // offline_access の可否（OIDC Core 1.0 §11 の prompt=consent と、クライアント登録
+  // grant_types に refresh_token があるか）はそこで確定しているので再フィルタしない。
+  const grantedScope = transaction.scope.split(' ').filter(Boolean);
 
   // Generate authorization code via core helper
   // OIDC Core 1.0 Section 3.1.3.1: TTL is configurable via ProviderConfig
@@ -5575,6 +6064,9 @@ ${consentDenyRedirect}
     authorizationResponse: { ...responseParams, scope: grantedScope },
     subject: session.subject,
     authTime: session.authTime,
+    // online refresh token をこのログインセッションへ束縛する（login route が
+    // authSessionStore へ載せた値）。ログアウトすれば RT も使えなくなる。
+    sessionId: session.sessionId,
     ttlSeconds: config.authorizationCodeTtl,
   });
   await authCodeStore.set(authCodeData.code, authCodeData);
@@ -5650,7 +6142,8 @@ import { deviceApp } from './routes/device.js';\n`
         ? `  deviceAuthorizationStore,\n`
         : '';
     const refreshStorageContext = features.refreshToken
-        ? `    c.set('refreshTokenResolver', storeResolvers.refreshTokenResolver);\n`
+        ? `    c.set('refreshTokenResolver', storeResolvers.refreshTokenResolver);
+    c.set('authenticationSessionResolver', storeResolvers.authenticationSessionResolver);\n`
         : '';
     const introspectionStorageContext = features.introspection
         ? `    c.set('introspectionAccessTokenResolver', storeResolvers.introspectionAccessTokenResolver);
@@ -7695,7 +8188,6 @@ function deviceAuthorizationConformanceClients(features) {
     responseTypes: ['code'],
     grantTypes: ${deviceGrantTypes},
     tokenEndpointAuthMethod: 'client_secret_post',
-    offlineAccessAllowed: true,
   }],
   ['c-device-other', {
     clientId: 'c-device-other',
@@ -7746,6 +8238,46 @@ function tokenExchangeConformanceClients(features) {
   }],
 `;
 }
+function idJagConformanceClients(features) {
+    if (!features.idJag)
+        return '';
+    const idJagClientGrantTypes = features.refreshToken
+        ? `['authorization_code', 'refresh_token', 'urn:ietf:params:oauth:grant-type:token-exchange', 'urn:ietf:params:oauth:grant-type:jwt-bearer']`
+        : `['authorization_code', 'urn:ietf:params:oauth:grant-type:token-exchange', 'urn:ietf:params:oauth:grant-type:jwt-bearer']`;
+    return `  // EXPERIMENTAL (ID-JAG draft): the Cross-App Access fixtures. c-idjag plays
+  // the requesting app for both halves (issuance via token exchange, redemption
+  // via jwt-bearer); c-idjag-other holds the jwt-bearer grant so the
+  // client-continuity contract (draft §4.4.1) can present someone else's
+  // ID-JAG; the public fixture pins that registering the URNs does not lift the
+  // confidential-client requirement.
+  ['c-idjag', {
+    clientId: 'c-idjag',
+    clientSecret: 's',
+    redirectUris: [REDIRECT_URI],
+    clientType: 'confidential' as const,
+    responseTypes: ['code'],
+    grantTypes: ${idJagClientGrantTypes},
+    tokenEndpointAuthMethod: 'client_secret_post',
+  }],
+  ['c-idjag-other', {
+    clientId: 'c-idjag-other',
+    clientSecret: 's',
+    redirectUris: [REDIRECT_URI],
+    clientType: 'confidential' as const,
+    responseTypes: ['code'],
+    grantTypes: ['urn:ietf:params:oauth:grant-type:jwt-bearer'],
+    tokenEndpointAuthMethod: 'client_secret_post',
+  }],
+  ['c-public-idjag', {
+    clientId: 'c-public-idjag',
+    redirectUris: [REDIRECT_URI],
+    clientType: 'public' as const,
+    responseTypes: ['code'],
+    grantTypes: ['urn:ietf:params:oauth:grant-type:token-exchange', 'urn:ietf:params:oauth:grant-type:jwt-bearer'],
+    tokenEndpointAuthMethod: 'none',
+  }],
+`;
+}
 export function authorizationCodeConformanceHelper(features) {
     if (!features.introspection)
         return '';
@@ -7845,12 +8377,13 @@ export function conformanceTestClientsBlock(features) {
     grantTypes: ['authorization_code'],
     tokenEndpointAuthMethod: 'client_secret_basic',
   }],
-${tokenExchangeConformanceClients(features)}${deviceAuthorizationConformanceClients(features)}]);
+${tokenExchangeConformanceClients(features)}${deviceAuthorizationConformanceClients(features)}${idJagConformanceClients(features)}]);
 `;
     }
     return `const testClients = new Map<string, RegisteredClient>([
-  // offlineAccessAllowed + refresh_token grant so the reuse-cascade tests can drive
-  // the full code/refresh flow and observe revocation across the grant.
+  // RFC 7591 §2: registering the refresh_token grant is what makes this client
+  // eligible for refresh tokens at all, so the reuse-cascade tests can drive the
+  // full code/refresh flow and observe revocation across the grant.
   ['c-conf', {
     clientId: 'c-conf',
     clientSecret: 's',
@@ -7859,7 +8392,6 @@ ${tokenExchangeConformanceClients(features)}${deviceAuthorizationConformanceClie
     responseTypes: ['code'],
     grantTypes: ['authorization_code', 'refresh_token'],
     tokenEndpointAuthMethod: 'client_secret_post',
-    offlineAccessAllowed: true,
   }],
   ['c-public', {
     clientId: 'c-public',
@@ -7868,7 +8400,6 @@ ${tokenExchangeConformanceClients(features)}${deviceAuthorizationConformanceClie
     responseTypes: ['code'],
     grantTypes: ['authorization_code', 'refresh_token'],
     tokenEndpointAuthMethod: 'none',
-    offlineAccessAllowed: true,
   }],
   // A confidential client registered for client_secret_basic so the conformance
   // suite can drive Authorization: Basic authentication (RFC 6749 §2.3.1).
@@ -7880,9 +8411,20 @@ ${tokenExchangeConformanceClients(features)}${deviceAuthorizationConformanceClie
     responseTypes: ['code'],
     grantTypes: ['authorization_code', 'refresh_token'],
     tokenEndpointAuthMethod: 'client_secret_basic',
-    offlineAccessAllowed: true,
   }],
-${tokenExchangeConformanceClients(features)}${deviceAuthorizationConformanceClients(features)}]);
+  // RFC 7591 §2 の既定（grant_types = ["authorization_code"]）そのままのクライアント。
+  // Refresh Token を一切受け取れないこと、offline_access が付与 scope から落ちることを
+  // 契約として固定するために置く。
+  ['c-conf-no-refresh', {
+    clientId: 'c-conf-no-refresh',
+    clientSecret: 's',
+    redirectUris: [REDIRECT_URI],
+    clientType: 'confidential' as const,
+    responseTypes: ['code'],
+    grantTypes: ['authorization_code'],
+    tokenEndpointAuthMethod: 'client_secret_post',
+  }],
+${tokenExchangeConformanceClients(features)}${deviceAuthorizationConformanceClients(features)}${idJagConformanceClients(features)}]);
 `;
 }
 export function scopesSupportedConformanceTest(features) {
@@ -8531,6 +9073,148 @@ export function tokenEndpointAuthMethodsConformanceBlock() {
 
 `;
 }
+export function internalRedirectOriginConformanceBlock() {
+    return `
+  describe('Internal redirect origin (OIDC Discovery 1.0 §3 / RFC 9700 §2.1)', () => {
+    // RFC 7636 Appendix B example PKCE challenge.
+    const REDIRECT_PKCE_CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+
+    function issuerAuthorizeUrl(origin: string, overrides: Record<string, string> = {}): string {
+      return origin + '/authorize?' + new URLSearchParams({
+        response_type: 'code',
+        client_id: 'c-conf',
+        redirect_uri: REDIRECT_URI,
+        scope: 'openid',
+        state: 'redirect-origin',
+        code_challenge: REDIRECT_PKCE_CHALLENGE,
+        code_challenge_method: 'S256',
+        ...overrides,
+      }).toString();
+    }
+
+    function redirectOriginCsrf(html: string): string {
+      return html.match(/name="csrf_token" value="([^"]+)"/)?.[1] ?? '';
+    }
+
+    function redirectOriginCookie(res: Response): string {
+      return (res.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
+    }
+
+    // Drives authorize -> login POST from an attacker origin and returns each
+    // Location plus the session cookie login handed out. The transaction cookie
+    // is carried forward exactly as a browser would, so this works with or
+    // without --enable transaction-binding. Pure fetch-and-parse: every check
+    // stays in the it() blocks as an expect().
+    async function loginFromOrigin(origin: string): Promise<{
+      loginRedirect: string;
+      consentRedirect: string;
+      sessionCookie: string;
+    }> {
+      const authorizeRes = await app.request(issuerAuthorizeUrl(origin), {
+        headers: { Host: 'attacker.example' },
+      });
+      const loginRedirect = authorizeRes.headers.get('Location') ?? '';
+      const bindingCookie = redirectOriginCookie(authorizeRes);
+      const loginUrl = new URL(loginRedirect, 'http://localhost');
+      const transactionId = loginUrl.searchParams.get('transaction_id') ?? '';
+
+      const loginGet = await app.request(origin + loginUrl.pathname + loginUrl.search, {
+        headers: { Cookie: bindingCookie },
+      });
+      const loginRes = await app.request(origin + '/login', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          Cookie: bindingCookie,
+          Host: 'attacker.example',
+        },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: redirectOriginCsrf(await loginGet.text()),
+          username: 'testuser',
+          password: 'password',
+        }).toString(),
+      });
+
+      return {
+        loginRedirect,
+        consentRedirect: loginRes.headers.get('Location') ?? '',
+        sessionCookie: redirectOriginCookie(loginRes),
+      };
+    }
+
+    it('should build the login redirect Location on the configured issuer origin', async () => {
+      const res = await app.request(issuerAuthorizeUrl('http://localhost:3000'));
+      const location = new URL(res.headers.get('Location') ?? '');
+
+      expect(res.status).toBe(302);
+      expect(location.origin).toBe('http://localhost:3000');
+      expect(location.pathname).toBe('/login');
+      expect(location.searchParams.has('transaction_id')).toBe(true);
+    });
+
+    it('should ignore the Host header when building the login redirect Location', async () => {
+      // Runtimes such as @hono/node-server build the request URL from the Host
+      // header, so an attacker-controlled Host arrives here as an attacker-origin
+      // request URL. Both are sent; neither may reach the Location.
+      const res = await app.request(issuerAuthorizeUrl('http://attacker.example'), {
+        headers: { Host: 'attacker.example' },
+      });
+      const location = new URL(res.headers.get('Location') ?? '');
+
+      expect(res.status).toBe(302);
+      expect(location.origin).toBe('http://localhost:3000');
+      expect(location.pathname).toBe('/login');
+    });
+
+    it('should build the consent redirect Location on the configured issuer origin', async () => {
+      // SSO path: an established OP session makes /authorize redirect straight
+      // to /consent (OIDC Core 1.0 §3.1.2.3). prompt=consent forces the consent
+      // screen (OIDC Core 1.0 §3.1.2.1), so this stays on the /consent redirect
+      // even when another test already recorded a consent grant in the shared
+      // store. The attacker origin on this second request must not leak into
+      // that Location either.
+      const first = await loginFromOrigin('http://attacker.example');
+      const res = await app.request(
+        issuerAuthorizeUrl('http://attacker.example', { prompt: 'consent' }),
+        { headers: { Cookie: first.sessionCookie, Host: 'attacker.example' } },
+      );
+      const location = new URL(res.headers.get('Location') ?? '');
+
+      expect(res.status).toBe(302);
+      expect(location.origin).toBe('http://localhost:3000');
+      expect(location.pathname).toBe('/consent');
+    });
+
+    it('should build the consent redirect Location on the configured issuer origin after login', async () => {
+      const flow = await loginFromOrigin('http://attacker.example');
+      const location = new URL(flow.consentRedirect);
+
+      expect(new URL(flow.loginRedirect).origin).toBe('http://localhost:3000');
+      expect(location.origin).toBe('http://localhost:3000');
+      expect(location.pathname).toBe('/consent');
+    });
+
+    it('should keep the login redirect Location on the issuer origin for a subpath issuer', async () => {
+      // '/login' is an absolute path, so a subpath issuer contributes only its
+      // origin — the same result the express/fastify/nextjs adapters produce
+      // when they rebase request URLs onto the issuer. Subpath mounting of the
+      // generated routes is a separate, unsupported concern.
+      const subpathApp = createApp({
+        signingKeyProvider,
+        clientResolver: createInMemoryClientResolver(testClients),
+        config: { issuer: 'https://op.example.com/op' },
+      });
+      const res = await subpathApp.request(issuerAuthorizeUrl('https://op.example.com'));
+      const location = new URL(res.headers.get('Location') ?? '');
+
+      expect(res.status).toBe(302);
+      expect(location.origin).toBe('https://op.example.com');
+      expect(location.pathname).toBe('/login');
+    });
+  });
+`;
+}
 export function endpointBehaviorConformanceBlock(features, includeHonoApplyParity = false) {
     const introspectionMethodTest = features.introspection
         ? `
@@ -9104,9 +9788,44 @@ export function consentWithdrawalConformanceBlock(features) {
   });
 `;
 }
-export function persistentStorageConformanceBlock() {
-    return `  describe('Persistent storage contract', () => {
-    it('should share state across provider store instances backed by the same backend', async () => {
+export function onlineRefreshTokenConformanceStoreImport(features) {
+    return features.refreshToken ? ' parseSessionId,' : '';
+}
+export function onlineRefreshTokenConformanceBlock(features) {
+    if (!features.refreshToken)
+        return '';
+    return `
+  // OIDC Core 1.0 §11 は offline_access を「End-User が居ない（not logged in）ときにも
+  // 使える Refresh Token を要求する scope」と定義し、Refresh Token の利用がその用途に
+  // 限られないことも明示している（"The use of Refresh Tokens is not exclusive to the
+  // offline_access use case. The Authorization Server MAY grant Refresh Tokens in other
+  // contexts that are beyond the scope of this specification."）。
+  //
+  // この生成 OP はその other contexts を online refresh token として実装する。何が
+  // 発行されるかは次の 2 つで決まる。
+  //
+  // | grant_types に refresh_token | offline_access の付与 | 発行される Refresh Token |
+  // |---|---|---|
+  // | 無し | -    | 発行しない（使えない長期資格情報を配らない）|
+  // | 有り | 無し | online: ログインセッションに束縛。セッションが終われば invalid_grant |
+  // | 有り | 有り | offline: セッション非依存。ログアウト後も使える |
+  describe('Online and offline refresh tokens (OIDC Core 1.0 §11)', () => {
+    // RFC 7636 Appendix B example PKCE pair (verifier -> its S256 challenge).
+    const PKCE_VERIFIER = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+    const PKCE_CHALLENGE_S256 = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+
+    function relativeFrom(location: string | null): string {
+      const url = new URL(location ?? '', 'http://localhost');
+      return url.pathname + url.search;
+    }
+
+    function csrfFrom(html: string): string {
+      return /name="csrf_token" value="([^"]+)"/.exec(html)?.[1] ?? '';
+    }
+
+    // 各テストが自分だけのストアを持つ provider を作る。ブラウザセッションを直接消せる
+    // ので、「ログアウトしたら online refresh token が止まる」を実フロー越しに固定できる。
+    function createIsolatedProvider() {
       const values = new Map<string, unknown>();
       const backend: JsonStoreBackend = {
         async get<T>(key: string): Promise<T | null> {
@@ -9124,10 +9843,273 @@ export function persistentStorageConformanceBlock() {
             .map(([key, value]) => ({ key, value: value as T }));
         },
       };
-      const writerStores = createJsonProviderStores(backend);
-      await writerStores.authSessionStore.set('persistent-transaction', {
-        subject: 'testuser',
-        authTime: 1700000000,
+      const stores = createJsonProviderStores(backend);
+      const provider = createApp({
+        signingKeyProvider,
+        clientResolver: createInMemoryClientResolver(testClients),
+        storage: stores,
+      });
+      return { provider, stores };
+    }
+
+    // authorize -> login -> consent を実際に往復し、認可コードと、そのログインで確立した
+    // セッション id を返す。sessionId はログアウトを再現するために使う。
+    async function authorize(
+      provider: ReturnType<typeof createApp>,
+      options: { clientId: string; scope: string; prompt?: string },
+    ): Promise<{ code: string; sessionId: string }> {
+      const authorizeUrl =
+        '/authorize?response_type=code&client_id=' + options.clientId +
+        '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+        '&scope=' + encodeURIComponent(options.scope) +
+        '&state=online-rt' +
+        (options.prompt === undefined ? '' : '&prompt=' + options.prompt) +
+        '&code_challenge=' + PKCE_CHALLENGE_S256 + '&code_challenge_method=S256';
+
+      const authorizeRes = await provider.request(authorizeUrl);
+      const loginPath = relativeFrom(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would
+      // (the per-transaction binding secret when that feature is enabled).
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
+      const transactionId =
+        new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
+
+      const loginGet = await provider.request(loginPath, { headers: { Cookie: bindingCookie } });
+      const loginRes = await provider.request('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: csrfFrom(await loginGet.text()),
+          username: 'testuser',
+          password: 'password',
+        }).toString(),
+      });
+      // /login sets exactly one cookie: the browser (OP) session. Its value is the
+      // session an online refresh token gets bound to.
+      const sessionId = parseSessionId(loginRes.headers.get('Set-Cookie')) ?? '';
+
+      const consentPath = relativeFrom(loginRes.headers.get('Location'));
+      const consentGet = await provider.request(consentPath, { headers: { Cookie: bindingCookie } });
+      const consentRes = await provider.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: csrfFrom(await consentGet.text()),
+          action: 'approve',
+        }).toString(),
+      });
+      const callback = new URL(consentRes.headers.get('Location') ?? '', 'http://localhost');
+
+      return { code: callback.searchParams.get('code') ?? '', sessionId };
+    }
+
+    async function exchangeCode(
+      provider: ReturnType<typeof createApp>,
+      clientId: string,
+      code: string,
+    ): Promise<Response> {
+      return provider.request('/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code,
+          redirect_uri: REDIRECT_URI,
+          code_verifier: PKCE_VERIFIER,
+          client_id: clientId,
+          client_secret: 's',
+        }).toString(),
+      });
+    }
+
+    async function refresh(
+      provider: ReturnType<typeof createApp>,
+      clientId: string,
+      refreshToken: string,
+    ): Promise<Response> {
+      return provider.request('/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'refresh_token',
+          refresh_token: refreshToken,
+          client_id: clientId,
+          client_secret: 's',
+        }).toString(),
+      });
+    }
+
+    it('should issue a refresh token without offline_access when the client registers the refresh_token grant', async () => {
+      const { provider } = createIsolatedProvider();
+      const { code } = await authorize(provider, { clientId: 'c-conf', scope: 'openid' });
+
+      const res = await exchangeCode(provider, 'c-conf', code);
+      const body = await res.json();
+
+      expect(res.status).toBe(200);
+      expect(typeof body.refresh_token).toBe('string');
+      // offline_access は要求していないので付与 scope にも入らない。
+      expect(body.scope).toBe('openid');
+    });
+
+    it('should keep the online refresh token usable while the login session is alive', async () => {
+      const { provider } = createIsolatedProvider();
+      const { code } = await authorize(provider, { clientId: 'c-conf', scope: 'openid' });
+      const issued = await (await exchangeCode(provider, 'c-conf', code)).json();
+
+      const res = await refresh(provider, 'c-conf', issued.refresh_token as string);
+      const body = await res.json();
+
+      expect(res.status).toBe(200);
+      expect(body.scope).toBe('openid');
+    });
+
+    it('should reject the online refresh token after the login session ended', async () => {
+      const { provider, stores } = createIsolatedProvider();
+      const { code, sessionId } = await authorize(provider, { clientId: 'c-conf', scope: 'openid' });
+      const issued = await (await exchangeCode(provider, 'c-conf', code)).json();
+
+      // ログアウト相当: ブラウザ (OP) セッションを終了させる。
+      await stores.browserSessionStore.delete(sessionId);
+
+      const res = await refresh(provider, 'c-conf', issued.refresh_token as string);
+      const body = await res.json();
+
+      expect(res.status).toBe(400);
+      expect(body.error).toBe('invalid_grant');
+    });
+
+    it('should keep the online refresh token bound to the session across rotation', async () => {
+      const { provider, stores } = createIsolatedProvider();
+      const { code, sessionId } = await authorize(provider, { clientId: 'c-conf', scope: 'openid' });
+      const issued = await (await exchangeCode(provider, 'c-conf', code)).json();
+
+      // 1 回ローテーションしても束縛は外れない（外れると 1 リフレッシュで offline 化する）。
+      const rotated = await (await refresh(provider, 'c-conf', issued.refresh_token as string)).json();
+      await stores.browserSessionStore.delete(sessionId);
+
+      const res = await refresh(provider, 'c-conf', rotated.refresh_token as string);
+      const body = await res.json();
+
+      expect(res.status).toBe(400);
+      expect(body.error).toBe('invalid_grant');
+    });
+
+    it('should keep the offline refresh token usable after the login session ended', async () => {
+      const { provider, stores } = createIsolatedProvider();
+      // OIDC Core 1.0 §11: offline_access needs prompt=consent.
+      const { code, sessionId } = await authorize(provider, {
+        clientId: 'c-conf',
+        scope: 'openid offline_access',
+        prompt: 'consent',
+      });
+      const issued = await (await exchangeCode(provider, 'c-conf', code)).json();
+
+      await stores.browserSessionStore.delete(sessionId);
+
+      const res = await refresh(provider, 'c-conf', issued.refresh_token as string);
+      const body = await res.json();
+
+      expect(res.status).toBe(200);
+      expect(body.scope).toBe('openid offline_access');
+    });
+
+    it('should not issue a refresh token to a client that does not register the refresh_token grant', async () => {
+      // RFC 7591 §2: grant_types の既定は ["authorization_code"]。発行しても
+      // unauthorized_client で拒否されるだけの Refresh Token は配らない。
+      const { provider } = createIsolatedProvider();
+      const { code } = await authorize(provider, { clientId: 'c-conf-no-refresh', scope: 'openid' });
+
+      const res = await exchangeCode(provider, 'c-conf-no-refresh', code);
+      const body = await res.json();
+
+      expect(res.status).toBe(200);
+      expect(body.refresh_token).toBe(undefined);
+    });
+
+    it('should drop offline_access for a client that does not register the refresh_token grant', async () => {
+      const { provider } = createIsolatedProvider();
+      const { code } = await authorize(provider, {
+        clientId: 'c-conf-no-refresh',
+        scope: 'openid offline_access',
+        prompt: 'consent',
+      });
+
+      const res = await exchangeCode(provider, 'c-conf-no-refresh', code);
+      const body = await res.json();
+
+      expect(res.status).toBe(200);
+      expect(body.scope).toBe('openid');
+      expect(body.refresh_token).toBe(undefined);
+    });
+
+    it('should issue only offline refresh tokens when onlineRefreshTokenEnabled is false', async () => {
+      const values = new Map<string, unknown>();
+      const backend: JsonStoreBackend = {
+        async get<T>(key: string): Promise<T | null> {
+          return (values.get(key) as T | undefined) ?? null;
+        },
+        async put<T>(key: string, value: T): Promise<void> {
+          values.set(key, value);
+        },
+        async delete(key: string): Promise<void> {
+          values.delete(key);
+        },
+        async list<T>(prefix: string): Promise<Array<{ key: string; value: T }>> {
+          return [...values.entries()]
+            .filter(([key]) => key.startsWith(prefix))
+            .map(([key, value]) => ({ key, value: value as T }));
+        },
+      };
+      const provider = createApp({
+        signingKeyProvider,
+        clientResolver: createInMemoryClientResolver(testClients),
+        storage: createJsonProviderStores(backend),
+        config: { onlineRefreshTokenEnabled: false },
+      });
+
+      const online = await authorize(provider, { clientId: 'c-conf', scope: 'openid' });
+      const onlineBody = await (await exchangeCode(provider, 'c-conf', online.code)).json();
+      expect(onlineBody.refresh_token).toBe(undefined);
+
+      const offline = await authorize(provider, {
+        clientId: 'c-conf',
+        scope: 'openid offline_access',
+        prompt: 'consent',
+      });
+      const offlineBody = await (await exchangeCode(provider, 'c-conf', offline.code)).json();
+      expect(typeof offlineBody.refresh_token).toBe('string');
+    });
+  });
+
+`;
+}
+export function persistentStorageConformanceBlock() {
+    return `  describe('Persistent storage contract', () => {
+    it('should share state across provider store instances backed by the same backend', async () => {
+      const values = new Map<string, unknown>();
+      const backend: JsonStoreBackend = {
+        async get<T>(key: string): Promise<T | null> {
+          return (values.get(key) as T | undefined) ?? null;
+        },
+        async put<T>(key: string, value: T): Promise<void> {
+          values.set(key, value);
+        },
+        async delete(key: string): Promise<void> {
+          values.delete(key);
+        },
+        async list<T>(prefix: string): Promise<Array<{ key: string; value: T }>> {
+          return [...values.entries()]
+            .filter(([key]) => key.startsWith(prefix))
+            .map(([key, value]) => ({ key, value: value as T }));
+        },
+      };
+      const writerStores = createJsonProviderStores(backend);
+      await writerStores.authSessionStore.set('persistent-transaction', {
+        subject: 'testuser',
+        authTime: 1700000000,
       });
 
       const readerStores = createJsonProviderStores(backend);
@@ -9532,302 +10514,1271 @@ export function tokenExchangeConformanceBlock(features) {
           actor_token_type: ACCESS_TOKEN_TYPE,
         });
 
-        expect(res.status).toBe(400);
-        expect(await res.json()).toEqual({
-          error: 'invalid_request',
-          error_description: 'actor_token_type must not be present without actor_token',
-        });
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: 'actor_token_type must not be present without actor_token',
+        });
+      });
+
+      it('should reject an unsupported actor_token_type with invalid_request', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        const res = await exchangeRequest({
+          subject_token: subjectToken,
+          actor_token: subjectToken,
+          actor_token_type: 'urn:ietf:params:oauth:token-type:id_token',
+        });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description:
+            'Unsupported actor_token_type. Only urn:ietf:params:oauth:token-type:access_token is supported.',
+        });
+      });
+
+      // The actor_token failure description is fixed for the same oracle-
+      // elimination reason as the subject_token one.
+      it('should reject an unknown actor_token with the fixed description', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        const res = await exchangeRequest({
+          subject_token: subjectToken,
+          actor_token: 'not-a-real-token',
+          actor_token_type: ACCESS_TOKEN_TYPE,
+        });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: ACTOR_INVALID_DESCRIPTION,
+        });
+      });
+
+      // RFC 8693 §2.1: resource MUST be an absolute URI without a fragment.
+      it('should reject a relative resource with invalid_request', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        const res = await exchangeRequest({ subject_token: subjectToken, resource: '/api' });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: 'resource must be an absolute URI without a fragment component',
+        });
+      });
+
+      it('should reject a resource carrying a fragment with invalid_request', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        const res = await exchangeRequest({
+          subject_token: subjectToken,
+          resource: 'https://api.example.com/x#frag',
+        });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: 'resource must be an absolute URI without a fragment component',
+        });
+      });
+
+      // RFC 6749 §3.2: repeated token endpoint parameters are refused, which is
+      // why this OP supports only a single audience / resource value.
+      it('should reject a repeated resource parameter', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        const res = await app.request('/token', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body:
+            'client_id=c-exchange&client_secret=s&grant_type=' +
+            encodeURIComponent(EXCHANGE_GRANT_TYPE) +
+            '&subject_token=' + encodeURIComponent(subjectToken) +
+            '&subject_token_type=' + encodeURIComponent(ACCESS_TOKEN_TYPE) +
+            '&resource=https%3A%2F%2Fa.example.com&resource=https%3A%2F%2Fb.example.com',
+        });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: 'Parameter "resource" must not be repeated',
+        });
+      });
+
+      // RFC 8693 §2.2.2 sends invalid subject tokens to invalid_request, NOT to
+      // invalid_grant as the authorization_code / refresh_token grants would.
+      it('should reject an unknown subject_token with invalid_request', async () => {
+        const res = await exchangeRequest({ subject_token: 'not-a-real-token' });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: SUBJECT_INVALID_DESCRIPTION,
+        });
+      });
+
+      it('should report a revoked subject_token exactly like an unknown one', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        await app.request('/revoke', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: new URLSearchParams({
+            client_id: 'c-exchange',
+            client_secret: 's',
+            token: subjectToken,
+          }).toString(),
+        });
+        const revoked = await exchangeRequest({ subject_token: subjectToken });
+        const unknown = await exchangeRequest({ subject_token: 'not-a-real-token' });
+
+        expect(revoked.status).toBe(400);
+        expect(await revoked.json()).toEqual(await unknown.json());
+      });
+    });
+
+    describe('Scope narrowing', () => {
+      it('should reject a scope that exceeds the subject token scope', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        const res = await exchangeRequest({ subject_token: subjectToken, scope: 'openid profile' });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_scope',
+          error_description: 'The requested scope exceeds the scope of the subject_token',
+        });
+      });
+
+      it('should grant exactly the requested subset', async () => {
+        const subjectToken = await subjectTokenFor('openid profile email');
+        const res = await exchangeRequest({ subject_token: subjectToken, scope: 'email' });
+
+        expect(res.status).toBe(200);
+        expect((await res.json()).scope).toBe('email');
+      });
+    });
+
+    describe('Delegation (RFC 8693 §4.1)', () => {
+      // sub stays the subject; the actor appears only in the act claim.
+      it('should record the actor in the act claim of the issued token', async () => {
+        const subjectToken = await subjectTokenFor('openid profile');
+        const actorToken = await actorTokenFor('openid');
+        const res = await exchangeRequest({
+          subject_token: subjectToken,
+          actor_token: actorToken,
+          actor_token_type: ACCESS_TOKEN_TYPE,
+        });
+        const body = await res.json();
+        const payload = decodeJwtPayload(body.access_token as string);
+
+        expect(res.status).toBe(200);
+        expect(payload.sub).toBe('testuser');
+        expect(payload.act).toEqual({ sub: 'otheruser' });
+      });
+
+      it('should not add an act claim to an impersonation exchange', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        const body = await (await exchangeRequest({ subject_token: subjectToken })).json();
+        const payload = decodeJwtPayload(body.access_token as string);
+
+        expect(payload.act).toBe(undefined);
+      });
+
+      // RFC 8693 §4.1: exchanging a delegated token again pushes the prior
+      // actor one level down; the outermost act names the current actor.
+      it('should nest the prior actor when a delegated token is exchanged again', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        const firstActor = await actorTokenFor('openid');
+        const delegated = (await (
+          await exchangeRequest({
+            subject_token: subjectToken,
+            actor_token: firstActor,
+            actor_token_type: ACCESS_TOKEN_TYPE,
+          })
+        ).json()).access_token as string;
+        const secondActor = await actorTokenFor('openid');
+        const res = await exchangeRequest({
+          subject_token: delegated,
+          actor_token: secondActor,
+          actor_token_type: ACCESS_TOKEN_TYPE,
+        });
+        const payload = decodeJwtPayload((await res.json()).access_token as string);
+
+        expect(res.status).toBe(200);
+        expect(payload.act).toEqual({ sub: 'otheruser', act: { sub: 'otheruser' } });
+      });
+
+      // A delegated token is an ordinary access token of the subject: the
+      // UserInfo endpoint answers for the subject, not the actor.
+      it('should answer UserInfo for the subject of a delegated token', async () => {
+        const subjectToken = await subjectTokenFor('openid profile');
+        const actorToken = await actorTokenFor('openid');
+        const delegated = (await (
+          await exchangeRequest({
+            subject_token: subjectToken,
+            actor_token: actorToken,
+            actor_token_type: ACCESS_TOKEN_TYPE,
+          })
+        ).json()).access_token as string;
+        const res = await app.request('/userinfo', {
+          headers: { Authorization: 'Bearer ' + delegated },
+        });
+
+        expect(res.status).toBe(200);
+        expect((await res.json()).sub).toBe('testuser');
+      });
+    });
+
+    describe('Target policy (allowedTargets)', () => {
+      // The generated default is an empty list, so any named target is refused
+      // until the operator opts in. The list is restored after each test.
+      it('should reject an audience that is not in allowedTargets', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        const res = await exchangeRequest({
+          subject_token: subjectToken,
+          audience: 'https://internal.example.com',
+        });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_target',
+          error_description: TARGET_REJECTED_DESCRIPTION,
+        });
+      });
+
+      it('should reject a resource that is not in allowedTargets', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        const res = await exchangeRequest({
+          subject_token: subjectToken,
+          resource: 'https://internal.example.com/api',
+        });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_target',
+          error_description: TARGET_REJECTED_DESCRIPTION,
+        });
+      });
+
+      it('should issue a token for an allowed audience', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        tokenExchangeConfig.allowedTargets = ['https://internal.example.com'];
+        const res = await exchangeRequest({
+          subject_token: subjectToken,
+          audience: 'https://internal.example.com',
+        });
+        const body = await res.json();
+        tokenExchangeConfig.allowedTargets = [];
+
+        expect(res.status).toBe(200);
+        expect(body.token_type).toBe('Bearer');
+      });
+
+      // The UserInfo endpoint stays a permanent aud member (RFC 9068 §3), so an
+      // exchanged token keeps working against this OP as well as the new target.
+      it('should add the allowed audience alongside the UserInfo endpoint', async () => {
+        const subjectToken = await subjectTokenFor('openid');
+        tokenExchangeConfig.allowedTargets = ['https://internal.example.com'];
+        const exchanged = (await (
+          await exchangeRequest({
+            subject_token: subjectToken,
+            audience: 'https://internal.example.com',
+          })
+        ).json()).access_token as string;
+        tokenExchangeConfig.allowedTargets = [];
+        const introspection = await (
+          await app.request('/introspect', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+              client_id: 'c-exchange',
+              client_secret: 's',
+              token: exchanged,
+            }).toString(),
+          })
+        ).json();
+
+        expect(introspection.aud).toEqual([
+          'http://localhost:3000/userinfo',
+          'https://internal.example.com',
+        ]);
+      });
+    });
+
+    describe('Discovery', () => {
+      it('should advertise the exchange grant in grant_types_supported', async () => {
+        const metadata = await (await app.request('/.well-known/openid-configuration')).json();
+
+        expect(metadata.grant_types_supported.includes(EXCHANGE_GRANT_TYPE)).toBe(true);
+      });
+    });
+  });
+
+`;
+}
+export function idJagConformanceBlock(features) {
+    if (!features.idJag)
+        return '';
+    const unsupportedSubjectTypeMessage = features.refreshToken
+        ? 'Unsupported subject_token_type for ID-JAG issuance. Only urn:ietf:params:oauth:token-type:id_token or urn:ietf:params:oauth:token-type:refresh_token is supported.'
+        : 'Unsupported subject_token_type for ID-JAG issuance. Only urn:ietf:params:oauth:token-type:id_token is supported.';
+    const refreshSubjectContract = features.refreshToken
+        ? `
+      // draft §4.3 MAY: a refresh token of this OP may stand in for the ID Token.
+      it('should issue an ID-JAG from a refresh token subject', async () => {
+        const tokens = await xaaCodeFlowTokens('c-idjag');
+        const res = await withIssuanceAudience(() =>
+          issuanceRequest({
+            subject_token: tokens.refresh_token,
+            subject_token_type: 'urn:ietf:params:oauth:token-type:refresh_token',
+          }),
+        );
+        const body = (await res.json()) as Record<string, unknown>;
+
+        expect(res.status).toBe(200);
+        expect(body.token_type).toBe('N_A');
+        const claims = xaaDecodeJwtSegment(String(body.access_token).split('.')[1] ?? '');
+        // The subject claims come from the refresh token's stored grant context.
+        expect(claims.iss).toBe(XAA_OWN_ISSUER);
+        expect(claims.sub).toBe('testuser');
+        expect(claims.aud).toBe(XAA_PEER_AS_ISSUER);
+        expect(typeof claims.auth_time).toBe('number');
+      });
+
+      it('should not consume the refresh token when issuing an ID-JAG', async () => {
+        // The exchange is not the refresh grant: no rotation happens, so the
+        // same refresh token mints a second ID-JAG (draft §4.4.3's renewal path).
+        const tokens = await xaaCodeFlowTokens('c-idjag');
+        const first = await withIssuanceAudience(() =>
+          issuanceRequest({
+            subject_token: tokens.refresh_token,
+            subject_token_type: 'urn:ietf:params:oauth:token-type:refresh_token',
+          }),
+        );
+        const second = await withIssuanceAudience(() =>
+          issuanceRequest({
+            subject_token: tokens.refresh_token,
+            subject_token_type: 'urn:ietf:params:oauth:token-type:refresh_token',
+          }),
+        );
+
+        expect(first.status).toBe(200);
+        expect(second.status).toBe(200);
+      });
+
+      it('should reject a rotated refresh token subject with the fixed description', async () => {
+        // OAuth 2.1 §4.3.1: presenting a rotated-out token is validated exactly
+        // like the standard refresh grant would.
+        const tokens = await xaaCodeFlowTokens('c-idjag');
+        await postXaaToken({
+          client_id: 'c-idjag',
+          client_secret: 's',
+          grant_type: 'refresh_token',
+          refresh_token: tokens.refresh_token,
+        });
+
+        const res = await withIssuanceAudience(() =>
+          issuanceRequest({
+            subject_token: tokens.refresh_token,
+            subject_token_type: 'urn:ietf:params:oauth:token-type:refresh_token',
+          }),
+        );
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: XAA_SUBJECT_INVALID_DESCRIPTION,
+        });
+      });
+
+      it('should reject a refresh token subject while allowRefreshTokenSubjects is off', async () => {
+        const tokens = await xaaCodeFlowTokens('c-idjag');
+        idJagConfig.allowRefreshTokenSubjects = false;
+        try {
+          const res = await withIssuanceAudience(() =>
+            issuanceRequest({
+              subject_token: tokens.refresh_token,
+              subject_token_type: 'urn:ietf:params:oauth:token-type:refresh_token',
+            }),
+          );
+
+          expect(res.status).toBe(400);
+          expect(await res.json()).toEqual({
+            error: 'invalid_request',
+            error_description:
+              'Unsupported subject_token_type for ID-JAG issuance. Only urn:ietf:params:oauth:token-type:id_token is supported.',
+          });
+        } finally {
+          idJagConfig.allowRefreshTokenSubjects = true;
+        }
+      });
+`
+        : '';
+    const introspectionContract = features.introspection
+        ? `
+      it('should report a redeemed access token active with the ID-JAG subject and client', async () => {
+        const assertion = await mintExternalIdJag({});
+        const redeemed = await withTrustedIdp(() => redeemRequest({ assertion }));
+        const redeemedBody = (await redeemed.json()) as Record<string, string>;
+
+        const res = await postXaaToken({}, '/introspect', {
+          token: redeemedBody.access_token,
+          client_id: 'c-idjag',
+          client_secret: 's',
+        });
+        const body = (await res.json()) as Record<string, unknown>;
+
+        expect(res.status).toBe(200);
+        expect(body.active).toBe(true);
+        // draft §4.4.1: the ID-JAG sub becomes the local subject directly, and
+        // the token is bound to the client that redeemed the grant.
+        expect(body.sub).toBe('testuser');
+        expect(body.client_id).toBe('c-idjag');
+        expect(body.scope).toBe('openid profile');
+      });
+`
+        : '';
+    return `
+  // EXPERIMENTAL — Cross-App Access / ID-JAG
+  // (draft-ietf-oauth-identity-assertion-authz-grant-04). Generated because this
+  // provider was created with --enable id-jag. These tests pin the contract the
+  // repository guarantees for both halves of XAA: issuing an ID-JAG on the
+  // token-exchange grant (draft §4.3) and redeeming one on the jwt-bearer grant
+  // (draft §4.4). Change the behavior and they fail, which is how a customized
+  // OP learns it drifted.
+  describe('Cross-App Access / ID-JAG (draft-ietf-oauth-identity-assertion-authz-grant)', () => {
+    // RFC 7636 Appendix B example PKCE pair (verifier -> its S256 challenge).
+    const XAA_PKCE_VERIFIER = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+    const XAA_PKCE_CHALLENGE_S256 = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+    const XAA_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+    const XAA_JWT_BEARER_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+    const XAA_ID_JAG_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:id-jag';
+    const XAA_ID_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:id_token';
+    // This OP's own issuer (createApp above runs on the default config).
+    const XAA_OWN_ISSUER = 'http://localhost:3000';
+    // The peer resource authorization server ID-JAGs are issued for.
+    const XAA_PEER_AS_ISSUER = 'https://peer-as.conformance.example';
+    // The fake external IdP whose signed ID-JAGs this OP redeems.
+    const XAA_TRUSTED_IDP_ISSUER = 'https://trusted-idp.conformance.example';
+    // Every unusable subject_token is rejected with this one description, and
+    // an untrusted issuer is indistinguishable from a broken signature, so the
+    // responses cannot be used as an existence / trust-list oracle.
+    const XAA_SUBJECT_INVALID_DESCRIPTION = 'The provided subject_token is not valid';
+    const XAA_ASSERTION_UNTRUSTED_DESCRIPTION =
+      'The assertion issuer is not trusted or the assertion signature is invalid';
+
+    let externalIdpPrivateKey: CryptoKey;
+    let externalIdpJwk: Awaited<ReturnType<typeof exportPublicJwk>>;
+
+    beforeAll(async () => {
+      // The fake external IdP: its public JWK is trust-listed inline by the
+      // tests below, so no jwks_uri fetch happens inside this suite.
+      const externalIdpKeyPair = await crypto.subtle.generateKey(
+        { name: 'RSASSA-PKCS1-v1_5', modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' },
+        true,
+        ['sign', 'verify'],
+      );
+      externalIdpPrivateKey = externalIdpKeyPair.privateKey;
+      externalIdpJwk = await exportPublicJwk(externalIdpKeyPair.publicKey, 'external-idp-key');
+    });
+
+    // Pure helpers: they fetch, sign and parse only. Every assertion lives in an it().
+    function xaaRelativeFrom(location: string | null): string {
+      const url = new URL(location ?? '', 'http://localhost');
+      return url.pathname + url.search;
+    }
+
+    function xaaCsrfFrom(html: string): string {
+      return html.match(/name="csrf_token" value="([^"]+)"/)?.[1] ?? '';
+    }
+
+    function xaaB64Url(bytes: Uint8Array): string {
+      let binary = '';
+      for (const byte of bytes) binary += String.fromCharCode(byte);
+      return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');
+    }
+
+    function xaaB64UrlJson(value: Record<string, unknown>): string {
+      return xaaB64Url(new TextEncoder().encode(JSON.stringify(value)));
+    }
+
+    function xaaDecodeJwtSegment(segment: string): Record<string, unknown> {
+      const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');
+      const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+      return JSON.parse(atob(padded)) as Record<string, unknown>;
+    }
+
+    function postXaaToken(
+      fields: Record<string, string>,
+      path = '/token',
+      base: Record<string, string> = {},
+    ): Promise<Response> {
+      return app.request(path, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ ...base, ...fields }).toString(),
+      });
+    }
+
+    // Drive authorize -> login -> consent over HTTP and hand back the code. No
+    // assertions and no branching here: the flow contract lives in the it()s.
+    async function xaaAuthorizeFlow(
+      clientId: string,
+      scope: string,
+      username = 'testuser',
+    ): Promise<string> {
+      const authorizeUrl =
+        '/authorize?response_type=code&client_id=' + clientId +
+        '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+        '&scope=' + encodeURIComponent(scope) +
+        '&state=xaa-state&nonce=xaa-nonce' +
+        '&code_challenge=' + XAA_PKCE_CHALLENGE_S256 + '&code_challenge_method=S256';
+
+      const authorizeRes = await app.request(authorizeUrl);
+      const loginPath = xaaRelativeFrom(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would
+      // (with --enable transaction-binding it is the binding secret).
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
+      const transactionId =
+        new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
+
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
+      const loginRes = await app.request('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: xaaCsrfFrom(await loginGet.text()),
+          username,
+          password: 'password',
+        }).toString(),
+      });
+      const consentPath = xaaRelativeFrom(loginRes.headers.get('Location'));
+
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
+      const consentRes = await app.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: xaaCsrfFrom(await consentGet.text()),
+          action: 'approve',
+        }).toString(),
+      });
+      const callback = new URL(consentRes.headers.get('Location') ?? '', 'http://localhost');
+      return callback.searchParams.get('code') ?? '';
+    }
+
+    // The identity assertion the issuance half consumes: an ID Token from the
+    // ordinary Authorization Code Flow of the given client.
+    async function xaaCodeFlowTokens(
+      clientId: string,
+      username = 'testuser',
+    ): Promise<Record<string, string>> {
+      const code = await xaaAuthorizeFlow(clientId, 'openid profile', username);
+      const res = await postXaaToken({
+        client_id: clientId,
+        client_secret: 's',
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: REDIRECT_URI,
+        code_verifier: XAA_PKCE_VERIFIER,
+      });
+      return (await res.json()) as Record<string, string>;
+    }
+
+    function issuanceRequest(overrides: Record<string, string> = {}): Promise<Response> {
+      return postXaaToken(overrides, '/token', {
+        client_id: 'c-idjag',
+        client_secret: 's',
+        grant_type: XAA_EXCHANGE_GRANT_TYPE,
+        requested_token_type: XAA_ID_JAG_TOKEN_TYPE,
+        subject_token_type: XAA_ID_TOKEN_TYPE,
+        audience: XAA_PEER_AS_ISSUER,
+        scope: 'openid profile',
+      });
+    }
+
+    function redeemRequest(
+      overrides: Record<string, string> = {},
+      clientId = 'c-idjag',
+    ): Promise<Response> {
+      return postXaaToken(overrides, '/token', {
+        client_id: clientId,
+        client_secret: 's',
+        grant_type: XAA_JWT_BEARER_GRANT_TYPE,
+      });
+    }
+
+    // Sign an ID-JAG as the fake external IdP. An override set to undefined
+    // removes the member (JSON.stringify drops undefined values).
+    async function mintExternalIdJag(
+      claims: Record<string, unknown>,
+      header: Record<string, unknown> = {},
+    ): Promise<string> {
+      const nowSeconds = Math.floor(Date.now() / 1000);
+      const encodedHeader = xaaB64UrlJson({
+        alg: 'RS256',
+        typ: 'oauth-id-jag+jwt',
+        kid: 'external-idp-key',
+        ...header,
+      });
+      const encodedPayload = xaaB64UrlJson({
+        iss: XAA_TRUSTED_IDP_ISSUER,
+        sub: 'testuser',
+        aud: XAA_OWN_ISSUER,
+        client_id: 'c-idjag',
+        jti: 'conformance-jag',
+        exp: nowSeconds + 300,
+        iat: nowSeconds,
+        scope: 'openid profile offline_access',
+        ...claims,
+      });
+      const signingInput = encodedHeader + '.' + encodedPayload;
+      const signature = await crypto.subtle.sign(
+        'RSASSA-PKCS1-v1_5',
+        externalIdpPrivateKey,
+        new TextEncoder().encode(signingInput),
+      );
+      return signingInput + '.' + xaaB64Url(new Uint8Array(signature));
+    }
+
+    // Config helpers: flip the generated allow lists for one call and always
+    // restore them, so the fail-safe empty defaults stay pinned by other tests.
+    async function withIssuanceAudience<T>(fn: () => Promise<T>): Promise<T> {
+      idJagConfig.allowedAudiences = [XAA_PEER_AS_ISSUER];
+      try {
+        return await fn();
+      } finally {
+        idJagConfig.allowedAudiences = [];
+      }
+    }
+
+    async function withTrustedIdp<T>(fn: () => Promise<T>): Promise<T> {
+      idJagConfig.trustedIdentityProviders = [
+        { issuer: XAA_TRUSTED_IDP_ISSUER, jwks: { keys: [externalIdpJwk] } },
+      ];
+      try {
+        return await fn();
+      } finally {
+        idJagConfig.trustedIdentityProviders = [];
+      }
+    }
+
+    describe('ID-JAG issuance (draft §4.3)', () => {
+      it('should issue an ID-JAG with the §3.1 claims and the §4.3.4 response members', async () => {
+        const idToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        const res = await withIssuanceAudience(() =>
+          issuanceRequest({ subject_token: idToken }),
+        );
+        const body = (await res.json()) as Record<string, unknown>;
+
+        expect(res.status).toBe(200);
+        expect(res.headers.get('Cache-Control')).toBe('no-store');
+        expect(res.headers.get('Pragma')).toBe('no-cache');
+        expect(Object.keys(body).sort()).toEqual([
+          'access_token',
+          'expires_in',
+          'issued_token_type',
+          'scope',
+          'token_type',
+        ]);
+        expect(body.issued_token_type).toBe(XAA_ID_JAG_TOKEN_TYPE);
+        // draft §4.3.4: the issued grant is NOT an access token.
+        expect(body.token_type).toBe('N_A');
+        expect(body.expires_in).toBe(300);
+        expect(body.scope).toBe('openid profile');
+
+        const segments = String(body.access_token).split('.');
+        const header = xaaDecodeJwtSegment(segments[0] ?? '');
+        const claims = xaaDecodeJwtSegment(segments[1] ?? '');
+        // draft §3.1 / RFC 8725 §3.11: explicit typing, RS256, published kid.
+        expect(header.typ).toBe('oauth-id-jag+jwt');
+        expect(header.alg).toBe('RS256');
+        expect(header.kid).toBe('test-key');
+        expect(claims.iss).toBe(XAA_OWN_ISSUER);
+        expect(claims.sub).toBe('testuser');
+        expect(claims.aud).toBe(XAA_PEER_AS_ISSUER);
+        expect(claims.client_id).toBe('c-idjag');
+        expect(claims.scope).toBe('openid profile');
+        expect(typeof claims.jti).toBe('string');
+        expect((claims.exp as number) - (claims.iat as number)).toBe(300);
+      });
+
+      it('should omit the scope claim and return an empty scope when none is requested', async () => {
+        const idToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        const res = await withIssuanceAudience(() =>
+          issuanceRequest({ subject_token: idToken, scope: '' }),
+        );
+        const body = (await res.json()) as Record<string, unknown>;
+
+        expect(res.status).toBe(200);
+        expect(body.scope).toBe('');
+        const claims = xaaDecodeJwtSegment(String(body.access_token).split('.')[1] ?? '');
+        expect('scope' in claims).toBe(false);
+      });
+
+      it('should reject an audience outside the allow list with invalid_target', async () => {
+        const idToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        // The generated default allow list is empty (fail safe), so the same
+        // audience that succeeds above is rejected without the config flip.
+        const res = await issuanceRequest({ subject_token: idToken });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_target',
+          error_description: 'The requested audience is not allowed for ID-JAG issuance',
+        });
+      });
+
+      it('should reject this issuer itself as audience with invalid_target', async () => {
+        const idToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        // draft §9.3: cross-domain only — even an allow-listed own issuer is refused.
+        idJagConfig.allowedAudiences = [XAA_OWN_ISSUER];
+        try {
+          const res = await issuanceRequest({ subject_token: idToken, audience: XAA_OWN_ISSUER });
+
+          expect(res.status).toBe(400);
+          expect(await res.json()).toEqual({
+            error: 'invalid_target',
+            error_description:
+              'The requested audience must belong to a different trust domain than this authorization server',
+          });
+        } finally {
+          idJagConfig.allowedAudiences = [];
+        }
+      });
+
+      it('should reject an ID Token issued to another client with the fixed description', async () => {
+        // draft §4.3.3: the assertion audience must be the authenticated client.
+        const foreignIdToken = (await xaaCodeFlowTokens('c-conf')).id_token;
+        const res = await withIssuanceAudience(() =>
+          issuanceRequest({ subject_token: foreignIdToken }),
+        );
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: XAA_SUBJECT_INVALID_DESCRIPTION,
+        });
+      });
+
+      it('should reject an access token presented as the subject with the same fixed description', async () => {
+        const accessToken = (await xaaCodeFlowTokens('c-idjag')).access_token;
+        const res = await withIssuanceAudience(() =>
+          issuanceRequest({ subject_token: accessToken }),
+        );
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: XAA_SUBJECT_INVALID_DESCRIPTION,
+        });
+      });
+
+      it('should reject a saml2 subject_token_type with invalid_request', async () => {
+        const res = await issuanceRequest({
+          subject_token: 'unused',
+          subject_token_type: 'urn:ietf:params:oauth:token-type:saml2',
+        });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: '${unsupportedSubjectTypeMessage}',
+        });
+      });
+
+      it('should reject an actor_token with invalid_request', async () => {
+        const res = await issuanceRequest({
+          subject_token: 'unused',
+          actor_token: 'unused',
+          actor_token_type: XAA_ID_TOKEN_TYPE,
+        });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'invalid_request',
+          error_description: 'actor_token is not supported for ID-JAG issuance',
+        });
+      });
+
+      it('should reject a client without the token-exchange grant with unauthorized_client', async () => {
+        // c-conf authenticates fine (client_secret_post) but never registered
+        // the exchange URN.
+        const res = await issuanceRequest({
+          subject_token: 'unused',
+          client_id: 'c-conf',
+        });
+
+        expect(res.status).toBe(400);
+        expect(((await res.json()) as Record<string, unknown>).error).toBe('unauthorized_client');
+      });
+
+      it('should reject a public client with unauthorized_client', async () => {
+        const res = await postXaaToken({
+          client_id: 'c-public-idjag',
+          grant_type: XAA_EXCHANGE_GRANT_TYPE,
+          requested_token_type: XAA_ID_JAG_TOKEN_TYPE,
+          subject_token: 'unused',
+          subject_token_type: XAA_ID_TOKEN_TYPE,
+          audience: XAA_PEER_AS_ISSUER,
+        });
+
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'unauthorized_client',
+          error_description: 'Public clients are not allowed to request an ID-JAG',
+        });
+      });
+
+      it('should cap the issued scopes at idJagConfig.allowedScopes with invalid_scope', async () => {
+        const idToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        idJagConfig.allowedScopes = ['openid'];
+        try {
+          const res = await withIssuanceAudience(() =>
+            issuanceRequest({ subject_token: idToken, scope: 'openid profile' }),
+          );
+
+          expect(res.status).toBe(400);
+          expect(await res.json()).toEqual({
+            error: 'invalid_scope',
+            error_description: 'The requested scope exceeds the scopes allowed for ID-JAG issuance',
+          });
+        } finally {
+          idJagConfig.allowedScopes = undefined;
+        }
+      });
+${refreshSubjectContract}
+      // Extension (draft §9.7): actor tokens are an explicit opt-in; the
+      // generated default keeps them off.
+      it('should record the actor in the act claim when actor tokens are enabled', async () => {
+        const subjectIdToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        const actorIdToken = (await xaaCodeFlowTokens('c-idjag', 'otheruser')).id_token;
+        idJagConfig.allowActorTokens = true;
+        try {
+          const res = await withIssuanceAudience(() =>
+            issuanceRequest({
+              subject_token: subjectIdToken,
+              actor_token: actorIdToken,
+              actor_token_type: XAA_ID_TOKEN_TYPE,
+            }),
+          );
+          const body = (await res.json()) as Record<string, unknown>;
+
+          expect(res.status).toBe(200);
+          const claims = xaaDecodeJwtSegment(String(body.access_token).split('.')[1] ?? '');
+          // RFC 8693 §4.1: sub stays the resource owner; the actor appears only in act.
+          expect(claims.sub).toBe('testuser');
+          expect(claims.act).toEqual({ sub: 'otheruser' });
+        } finally {
+          idJagConfig.allowActorTokens = false;
+        }
+      });
+
+      it('should reject an actor ID Token issued to another client with the fixed description', async () => {
+        const subjectIdToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        const foreignActorToken = (await xaaCodeFlowTokens('c-conf')).id_token;
+        idJagConfig.allowActorTokens = true;
+        try {
+          const res = await withIssuanceAudience(() =>
+            issuanceRequest({
+              subject_token: subjectIdToken,
+              actor_token: foreignActorToken,
+              actor_token_type: XAA_ID_TOKEN_TYPE,
+            }),
+          );
+
+          expect(res.status).toBe(400);
+          expect(await res.json()).toEqual({
+            error: 'invalid_request',
+            error_description: 'The provided actor_token is not valid',
+          });
+        } finally {
+          idJagConfig.allowActorTokens = false;
+        }
+      });
+
+      // Every token type identifier RFC 8693 §3 defines is accepted the same
+      // way; idJagConfig.actorTokenResolver decides what is valid. The
+      // generated default resolves this OP's own ID Tokens and nothing else.
+      it('should reject an actor token type the configured resolver does not accept', async () => {
+        const subjectIdToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        idJagConfig.allowActorTokens = true;
+        try {
+          const res = await withIssuanceAudience(() =>
+            issuanceRequest({
+              subject_token: subjectIdToken,
+              actor_token: 'opaque-actor-token',
+              actor_token_type: 'urn:ietf:params:oauth:token-type:access_token',
+            }),
+          );
+
+          expect(res.status).toBe(400);
+          expect(await res.json()).toEqual({
+            error: 'invalid_request',
+            error_description: 'The provided actor_token is not valid',
+          });
+        } finally {
+          idJagConfig.allowActorTokens = false;
+        }
+      });
+
+      it('should reject an actor_token_type outside the registered identifiers', async () => {
+        const subjectIdToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        idJagConfig.allowActorTokens = true;
+        try {
+          const res = await withIssuanceAudience(() =>
+            issuanceRequest({
+              subject_token: subjectIdToken,
+              actor_token: 'opaque-actor-token',
+              actor_token_type: 'urn:example:token-type:badge',
+            }),
+          );
+
+          expect(res.status).toBe(400);
+          expect(await res.json()).toEqual({
+            error: 'invalid_request',
+            error_description:
+              'Unsupported actor_token_type for ID-JAG issuance. Supported values are urn:ietf:params:oauth:token-type:access_token, urn:ietf:params:oauth:token-type:refresh_token, urn:ietf:params:oauth:token-type:id_token, urn:ietf:params:oauth:token-type:jwt, urn:ietf:params:oauth:token-type:saml1, urn:ietf:params:oauth:token-type:saml2.',
+          });
+        } finally {
+          idJagConfig.allowActorTokens = false;
+        }
+      });
+
+      it('should record the act chain resolved by the deployment actor token resolver', async () => {
+        const subjectIdToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        const defaultResolver = idJagConfig.actorTokenResolver;
+        idJagConfig.allowActorTokens = true;
+        idJagConfig.actorTokenResolver = async ({ actorToken, actorTokenType, clientId }) =>
+          actorTokenType === 'urn:ietf:params:oauth:token-type:access_token' &&
+          actorToken === 'badge-7' &&
+          clientId === 'c-idjag'
+            ? { sub: 'badge-actor', act: { sub: 'upstream-actor' } }
+            : null;
+        try {
+          const res = await withIssuanceAudience(() =>
+            issuanceRequest({
+              subject_token: subjectIdToken,
+              actor_token: 'badge-7',
+              actor_token_type: 'urn:ietf:params:oauth:token-type:access_token',
+            }),
+          );
+          const body = (await res.json()) as Record<string, unknown>;
+
+          expect(res.status).toBe(200);
+          const claims = xaaDecodeJwtSegment(String(body.access_token).split('.')[1] ?? '');
+          // The subject stays the resource owner; the resolver's chain lands in act.
+          expect(claims.sub).toBe('testuser');
+          expect(claims.act).toEqual({ sub: 'badge-actor', act: { sub: 'upstream-actor' } });
+        } finally {
+          idJagConfig.allowActorTokens = false;
+          idJagConfig.actorTokenResolver = defaultResolver;
+        }
+      });
+
+      it('should answer a null from the actor token resolver with the fixed description', async () => {
+        const subjectIdToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        const actorIdToken = (await xaaCodeFlowTokens('c-idjag', 'otheruser')).id_token;
+        const defaultResolver = idJagConfig.actorTokenResolver;
+        idJagConfig.allowActorTokens = true;
+        idJagConfig.actorTokenResolver = async () => null;
+        try {
+          const res = await withIssuanceAudience(() =>
+            issuanceRequest({
+              subject_token: subjectIdToken,
+              actor_token: actorIdToken,
+              actor_token_type: XAA_ID_TOKEN_TYPE,
+            }),
+          );
+
+          expect(res.status).toBe(400);
+          expect(await res.json()).toEqual({
+            error: 'invalid_request',
+            error_description: 'The provided actor_token is not valid',
+          });
+        } finally {
+          idJagConfig.allowActorTokens = false;
+          idJagConfig.actorTokenResolver = defaultResolver;
+        }
+      });
+
+      // The resolver owns every type, ID Tokens included — there is no
+      // separate built-in lane the deployment cannot reach.
+      it('should route id_token actors through the configured resolver as well', async () => {
+        const subjectIdToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        const seenTypes: string[] = [];
+        const defaultResolver = idJagConfig.actorTokenResolver;
+        idJagConfig.allowActorTokens = true;
+        idJagConfig.actorTokenResolver = async ({ actorTokenType }) => {
+          seenTypes.push(actorTokenType);
+          return { sub: 'resolver-decided' };
+        };
+        try {
+          const res = await withIssuanceAudience(() =>
+            issuanceRequest({
+              subject_token: subjectIdToken,
+              actor_token: 'opaque-actor-token',
+              actor_token_type: XAA_ID_TOKEN_TYPE,
+            }),
+          );
+          const body = (await res.json()) as Record<string, unknown>;
+
+          expect(res.status).toBe(200);
+          const claims = xaaDecodeJwtSegment(String(body.access_token).split('.')[1] ?? '');
+          expect(claims.act).toEqual({ sub: 'resolver-decided' });
+          expect(seenTypes).toEqual([XAA_ID_TOKEN_TYPE]);
+        } finally {
+          idJagConfig.allowActorTokens = false;
+          idJagConfig.actorTokenResolver = defaultResolver;
+        }
+      });
+
+      it('should reject every actor token once the resolver is cleared', async () => {
+        const subjectIdToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        const actorIdToken = (await xaaCodeFlowTokens('c-idjag', 'otheruser')).id_token;
+        const defaultResolver = idJagConfig.actorTokenResolver;
+        idJagConfig.allowActorTokens = true;
+        idJagConfig.actorTokenResolver = undefined;
+        try {
+          const res = await withIssuanceAudience(() =>
+            issuanceRequest({
+              subject_token: subjectIdToken,
+              actor_token: actorIdToken,
+              actor_token_type: XAA_ID_TOKEN_TYPE,
+            }),
+          );
+
+          expect(res.status).toBe(400);
+          expect(await res.json()).toEqual({
+            error: 'invalid_request',
+            error_description: 'The provided actor_token is not valid',
+          });
+        } finally {
+          idJagConfig.allowActorTokens = false;
+          idJagConfig.actorTokenResolver = defaultResolver;
+        }
+      });
+    });
+
+    describe('ID-JAG redemption (draft §4.4)', () => {
+      it('should redeem a trusted ID-JAG for an access token of this AS', async () => {
+        const assertion = await mintExternalIdJag({});
+        const res = await withTrustedIdp(() => redeemRequest({ assertion }));
+        const body = (await res.json()) as Record<string, unknown>;
+
+        expect(res.status).toBe(200);
+        expect(res.headers.get('Cache-Control')).toBe('no-store');
+        expect(res.headers.get('Pragma')).toBe('no-cache');
+        // draft §4.4.2 / §4.4.3: a plain token response — no refresh_token (the
+        // re-presentable ID-JAG replaces it) and no id_token (this is not an
+        // OIDC authentication flow).
+        expect(Object.keys(body).sort()).toEqual([
+          'access_token',
+          'expires_in',
+          'scope',
+          'token_type',
+        ]);
+        expect(body.token_type).toBe('Bearer');
+        expect(body.expires_in).toBe(3600);
+        // offline_access is always dropped: no refresh token is ever issued here.
+        expect(body.scope).toBe('openid profile');
+
+        const claims = xaaDecodeJwtSegment(String(body.access_token).split('.')[1] ?? '');
+        // The access token is this AS's own (draft §1: the IdP never mints
+        // tokens for the resource AS), for the ID-JAG's subject and client.
+        expect(claims.iss).toBe(XAA_OWN_ISSUER);
+        expect(claims.sub).toBe('testuser');
+        expect(claims.client_id).toBe('c-idjag');
       });
 
-      it('should reject an unsupported actor_token_type with invalid_request', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        const res = await exchangeRequest({
-          subject_token: subjectToken,
-          actor_token: subjectToken,
-          actor_token_type: 'urn:ietf:params:oauth:token-type:id_token',
-        });
+      it('should let the redeemed access token pass the UserInfo endpoint', async () => {
+        const assertion = await mintExternalIdJag({});
+        const redeemed = await withTrustedIdp(() => redeemRequest({ assertion }));
+        const accessToken = ((await redeemed.json()) as Record<string, string>).access_token;
 
-        expect(res.status).toBe(400);
-        expect(await res.json()).toEqual({
-          error: 'invalid_request',
-          error_description:
-            'Unsupported actor_token_type. Only urn:ietf:params:oauth:token-type:access_token is supported.',
+        const res = await app.request('/userinfo', {
+          headers: { Authorization: 'Bearer ' + accessToken },
         });
+        const body = (await res.json()) as Record<string, unknown>;
+
+        expect(res.status).toBe(200);
+        expect(body.sub).toBe('testuser');
       });
+${introspectionContract}
+      it('should accept the same ID-JAG again while it is valid', async () => {
+        // draft §4.4.3: re-presenting the still-valid grant replaces the refresh
+        // token, so a second redemption MUST succeed (no jti replay store).
+        const assertion = await mintExternalIdJag({});
+        const first = await withTrustedIdp(() => redeemRequest({ assertion }));
+        const second = await withTrustedIdp(() => redeemRequest({ assertion }));
 
-      // The actor_token failure description is fixed for the same oracle-
-      // elimination reason as the subject_token one.
-      it('should reject an unknown actor_token with the fixed description', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        const res = await exchangeRequest({
-          subject_token: subjectToken,
-          actor_token: 'not-a-real-token',
-          actor_token_type: ACCESS_TOKEN_TYPE,
-        });
+        expect(first.status).toBe(200);
+        expect(second.status).toBe(200);
+      });
 
-        expect(res.status).toBe(400);
-        expect(await res.json()).toEqual({
-          error: 'invalid_request',
-          error_description: ACTOR_INVALID_DESCRIPTION,
-        });
+      it('should answer an untrusted issuer and a broken signature identically', async () => {
+        const untrusted = await mintExternalIdJag({ iss: 'https://unknown-idp.example.org' });
+        const [h, p] = (await mintExternalIdJag({})).split('.');
+        const tampered = h + '.' + p + '.AAAA';
+
+        const untrustedRes = await withTrustedIdp(() => redeemRequest({ assertion: untrusted }));
+        const tamperedRes = await withTrustedIdp(() => redeemRequest({ assertion: tampered }));
+        const expected = {
+          error: 'invalid_grant',
+          error_description: XAA_ASSERTION_UNTRUSTED_DESCRIPTION,
+        };
+
+        expect(untrustedRes.status).toBe(400);
+        expect(tamperedRes.status).toBe(400);
+        expect(await untrustedRes.json()).toEqual(expected);
+        expect(await tamperedRes.json()).toEqual(expected);
       });
 
-      // RFC 8693 §2.1: resource MUST be an absolute URI without a fragment.
-      it('should reject a relative resource with invalid_request', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        const res = await exchangeRequest({ subject_token: subjectToken, resource: '/api' });
+      it('should reject every assertion when no identity provider is trusted', async () => {
+        // The generated default trust list is empty (fail safe).
+        const assertion = await mintExternalIdJag({});
+        const res = await redeemRequest({ assertion });
 
         expect(res.status).toBe(400);
         expect(await res.json()).toEqual({
-          error: 'invalid_request',
-          error_description: 'resource must be an absolute URI without a fragment component',
+          error: 'invalid_grant',
+          error_description: XAA_ASSERTION_UNTRUSTED_DESCRIPTION,
         });
       });
 
-      it('should reject a resource carrying a fragment with invalid_request', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        const res = await exchangeRequest({
-          subject_token: subjectToken,
-          resource: 'https://api.example.com/x#frag',
-        });
+      it('should reject an ID-JAG addressed to another authorization server with invalid_grant', async () => {
+        const assertion = await mintExternalIdJag({ aud: 'https://other-as.example.org' });
+        const res = await withTrustedIdp(() => redeemRequest({ assertion }));
 
         expect(res.status).toBe(400);
         expect(await res.json()).toEqual({
-          error: 'invalid_request',
-          error_description: 'resource must be an absolute URI without a fragment component',
+          error: 'invalid_grant',
+          error_description: 'The assertion audience does not match this authorization server',
         });
       });
 
-      // RFC 6749 §3.2: repeated token endpoint parameters are refused, which is
-      // why this OP supports only a single audience / resource value.
-      it('should reject a repeated resource parameter', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        const res = await app.request('/token', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-          body:
-            'client_id=c-exchange&client_secret=s&grant_type=' +
-            encodeURIComponent(EXCHANGE_GRANT_TYPE) +
-            '&subject_token=' + encodeURIComponent(subjectToken) +
-            '&subject_token_type=' + encodeURIComponent(ACCESS_TOKEN_TYPE) +
-            '&resource=https%3A%2F%2Fa.example.com&resource=https%3A%2F%2Fb.example.com',
-        });
+      it('should reject an ID-JAG bound to another client with invalid_grant', async () => {
+        // draft §4.4.1 client continuity: c-idjag-other authenticates correctly
+        // but presents a grant that names c-idjag.
+        const assertion = await mintExternalIdJag({});
+        const res = await withTrustedIdp(() => redeemRequest({ assertion }, 'c-idjag-other'));
 
         expect(res.status).toBe(400);
         expect(await res.json()).toEqual({
-          error: 'invalid_request',
-          error_description: 'Parameter "resource" must not be repeated',
+          error: 'invalid_grant',
+          error_description: 'The assertion client_id does not match the authenticated client',
         });
       });
 
-      // RFC 8693 §2.2.2 sends invalid subject tokens to invalid_request, NOT to
-      // invalid_grant as the authorization_code / refresh_token grants would.
-      it('should reject an unknown subject_token with invalid_request', async () => {
-        const res = await exchangeRequest({ subject_token: 'not-a-real-token' });
+      it('should reject a JWT without the ID-JAG typ with invalid_grant', async () => {
+        // RFC 8725 §3.11 explicit typing: an ID Token (typ JWT) can never be
+        // redeemed as an ID-JAG even with otherwise plausible claims.
+        const assertion = await mintExternalIdJag({}, { typ: 'JWT' });
+        const res = await withTrustedIdp(() => redeemRequest({ assertion }));
 
         expect(res.status).toBe(400);
         expect(await res.json()).toEqual({
-          error: 'invalid_request',
-          error_description: SUBJECT_INVALID_DESCRIPTION,
-        });
-      });
-
-      it('should report a revoked subject_token exactly like an unknown one', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        await app.request('/revoke', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-          body: new URLSearchParams({
-            client_id: 'c-exchange',
-            client_secret: 's',
-            token: subjectToken,
-          }).toString(),
+          error: 'invalid_grant',
+          error_description: 'The assertion typ must be oauth-id-jag+jwt',
         });
-        const revoked = await exchangeRequest({ subject_token: subjectToken });
-        const unknown = await exchangeRequest({ subject_token: 'not-a-real-token' });
-
-        expect(revoked.status).toBe(400);
-        expect(await revoked.json()).toEqual(await unknown.json());
       });
-    });
 
-    describe('Scope narrowing', () => {
-      it('should reject a scope that exceeds the subject token scope', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        const res = await exchangeRequest({ subject_token: subjectToken, scope: 'openid profile' });
+      it('should reject an expired ID-JAG with invalid_grant', async () => {
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const assertion = await mintExternalIdJag({ exp: nowSeconds - 120, iat: nowSeconds - 400 });
+        const res = await withTrustedIdp(() => redeemRequest({ assertion }));
 
         expect(res.status).toBe(400);
         expect(await res.json()).toEqual({
-          error: 'invalid_scope',
-          error_description: 'The requested scope exceeds the scope of the subject_token',
+          error: 'invalid_grant',
+          error_description: 'The assertion has expired',
         });
       });
 
-      it('should grant exactly the requested subset', async () => {
-        const subjectToken = await subjectTokenFor('openid profile email');
-        const res = await exchangeRequest({ subject_token: subjectToken, scope: 'email' });
+      it('should reject a client without the jwt-bearer grant with unauthorized_client', async () => {
+        // c-conf authenticates fine (client_secret_post) but never registered
+        // the jwt-bearer URN.
+        const res = await redeemRequest({ assertion: 'unused', client_id: 'c-conf' });
 
-        expect(res.status).toBe(200);
-        expect((await res.json()).scope).toBe('email');
+        expect(res.status).toBe(400);
+        expect(((await res.json()) as Record<string, unknown>).error).toBe('unauthorized_client');
       });
-    });
 
-    describe('Delegation (RFC 8693 §4.1)', () => {
-      // sub stays the subject; the actor appears only in the act claim.
-      it('should record the actor in the act claim of the issued token', async () => {
-        const subjectToken = await subjectTokenFor('openid profile');
-        const actorToken = await actorTokenFor('openid');
-        const res = await exchangeRequest({
-          subject_token: subjectToken,
-          actor_token: actorToken,
-          actor_token_type: ACCESS_TOKEN_TYPE,
+      it('should reject a public client with unauthorized_client', async () => {
+        const res = await postXaaToken({
+          client_id: 'c-public-idjag',
+          grant_type: XAA_JWT_BEARER_GRANT_TYPE,
+          assertion: 'unused',
         });
-        const body = await res.json();
-        const payload = decodeJwtPayload(body.access_token as string);
-
-        expect(res.status).toBe(200);
-        expect(payload.sub).toBe('testuser');
-        expect(payload.act).toEqual({ sub: 'otheruser' });
-      });
-
-      it('should not add an act claim to an impersonation exchange', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        const body = await (await exchangeRequest({ subject_token: subjectToken })).json();
-        const payload = decodeJwtPayload(body.access_token as string);
-
-        expect(payload.act).toBe(undefined);
-      });
 
-      // RFC 8693 §4.1: exchanging a delegated token again pushes the prior
-      // actor one level down; the outermost act names the current actor.
-      it('should nest the prior actor when a delegated token is exchanged again', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        const firstActor = await actorTokenFor('openid');
-        const delegated = (await (
-          await exchangeRequest({
-            subject_token: subjectToken,
-            actor_token: firstActor,
-            actor_token_type: ACCESS_TOKEN_TYPE,
-          })
-        ).json()).access_token as string;
-        const secondActor = await actorTokenFor('openid');
-        const res = await exchangeRequest({
-          subject_token: delegated,
-          actor_token: secondActor,
-          actor_token_type: ACCESS_TOKEN_TYPE,
+        expect(res.status).toBe(400);
+        expect(await res.json()).toEqual({
+          error: 'unauthorized_client',
+          error_description: 'Public clients are not allowed to use the jwt-bearer grant type',
         });
-        const payload = decodeJwtPayload((await res.json()).access_token as string);
-
-        expect(res.status).toBe(200);
-        expect(payload.act).toEqual({ sub: 'otheruser', act: { sub: 'otheruser' } });
       });
 
-      // A delegated token is an ordinary access token of the subject: the
-      // UserInfo endpoint answers for the subject, not the actor.
-      it('should answer UserInfo for the subject of a delegated token', async () => {
-        const subjectToken = await subjectTokenFor('openid profile');
-        const actorToken = await actorTokenFor('openid');
-        const delegated = (await (
-          await exchangeRequest({
-            subject_token: subjectToken,
-            actor_token: actorToken,
-            actor_token_type: ACCESS_TOKEN_TYPE,
-          })
-        ).json()).access_token as string;
-        const res = await app.request('/userinfo', {
-          headers: { Authorization: 'Bearer ' + delegated },
-        });
+      it('should preserve the act claim of an actor-bearing ID-JAG on the issued access token', async () => {
+        // RFC 8693 §4.1: the actor record survives the redemption, on the JWT
+        // and in the store alike — dropping it would hide who actually acts.
+        const assertion = await mintExternalIdJag({ act: { sub: 'external-actor' } });
+        const res = await withTrustedIdp(() => redeemRequest({ assertion }));
+        const body = (await res.json()) as Record<string, unknown>;
 
         expect(res.status).toBe(200);
-        expect((await res.json()).sub).toBe('testuser');
+        const claims = xaaDecodeJwtSegment(String(body.access_token).split('.')[1] ?? '');
+        expect(claims.sub).toBe('testuser');
+        expect(claims.act).toEqual({ sub: 'external-actor' });
       });
-    });
 
-    describe('Target policy (allowedTargets)', () => {
-      // The generated default is an empty list, so any named target is refused
-      // until the operator opts in. The list is restored after each test.
-      it('should reject an audience that is not in allowedTargets', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        const res = await exchangeRequest({
-          subject_token: subjectToken,
-          audience: 'https://internal.example.com',
-        });
+      it('should reject a malformed act claim with invalid_grant', async () => {
+        const assertion = await mintExternalIdJag({ act: { role: 'admin' } });
+        const res = await withTrustedIdp(() => redeemRequest({ assertion }));
 
         expect(res.status).toBe(400);
         expect(await res.json()).toEqual({
-          error: 'invalid_target',
-          error_description: TARGET_REJECTED_DESCRIPTION,
+          error: 'invalid_grant',
+          error_description: 'The assertion act claim is malformed',
         });
       });
 
-      it('should reject a resource that is not in allowedTargets', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        const res = await exchangeRequest({
-          subject_token: subjectToken,
-          resource: 'https://internal.example.com/api',
-        });
+      it('should refuse to redeem an ID-JAG this authorization server issued itself', async () => {
+        // draft §9.3: the full chain — a real ID-JAG issued by this OP (for the
+        // peer AS) must not be exchangeable for this OP's own access token,
+        // whatever the trust list says.
+        const idToken = (await xaaCodeFlowTokens('c-idjag')).id_token;
+        const issued = await withIssuanceAudience(() =>
+          issuanceRequest({ subject_token: idToken }),
+        );
+        const selfIssuedJag = ((await issued.json()) as Record<string, string>).access_token;
+
+        const res = await withTrustedIdp(() => redeemRequest({ assertion: selfIssuedJag }));
 
         expect(res.status).toBe(400);
         expect(await res.json()).toEqual({
-          error: 'invalid_target',
-          error_description: TARGET_REJECTED_DESCRIPTION,
-        });
-      });
-
-      it('should issue a token for an allowed audience', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        tokenExchangeConfig.allowedTargets = ['https://internal.example.com'];
-        const res = await exchangeRequest({
-          subject_token: subjectToken,
-          audience: 'https://internal.example.com',
+          error: 'invalid_grant',
+          error_description: 'An assertion issued by this authorization server cannot be redeemed here',
         });
-        const body = await res.json();
-        tokenExchangeConfig.allowedTargets = [];
-
-        expect(res.status).toBe(200);
-        expect(body.token_type).toBe('Bearer');
-      });
-
-      // The UserInfo endpoint stays a permanent aud member (RFC 9068 §3), so an
-      // exchanged token keeps working against this OP as well as the new target.
-      it('should add the allowed audience alongside the UserInfo endpoint', async () => {
-        const subjectToken = await subjectTokenFor('openid');
-        tokenExchangeConfig.allowedTargets = ['https://internal.example.com'];
-        const exchanged = (await (
-          await exchangeRequest({
-            subject_token: subjectToken,
-            audience: 'https://internal.example.com',
-          })
-        ).json()).access_token as string;
-        tokenExchangeConfig.allowedTargets = [];
-        const introspection = await (
-          await app.request('/introspect', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-              client_id: 'c-exchange',
-              client_secret: 's',
-              token: exchanged,
-            }).toString(),
-          })
-        ).json();
-
-        expect(introspection.aud).toEqual([
-          'http://localhost:3000/userinfo',
-          'https://internal.example.com',
-        ]);
       });
     });
 
-    describe('Discovery', () => {
-      it('should advertise the exchange grant in grant_types_supported', async () => {
-        const metadata = await (await app.request('/.well-known/openid-configuration')).json();
-
-        expect(metadata.grant_types_supported.includes(EXCHANGE_GRANT_TYPE)).toBe(true);
+    describe('Discovery advertisement (draft §7)', () => {
+      it('should advertise both XAA grant types and the profile metadata', async () => {
+        const res = await app.request('/.well-known/openid-configuration');
+        const metadata = (await res.json()) as Record<string, unknown>;
+        const grantTypes = metadata.grant_types_supported as string[];
+
+        expect(grantTypes.includes(XAA_EXCHANGE_GRANT_TYPE)).toBe(true);
+        expect(grantTypes.includes(XAA_JWT_BEARER_GRANT_TYPE)).toBe(true);
+        // draft §7.1 / §7.2: profile support only — the trusted-IdP list and the
+        // audience allow list are deliberately NOT disclosed (draft §9.4).
+        expect(metadata.identity_chaining_requested_token_types_supported).toEqual([
+          'urn:ietf:params:oauth:token-type:id-jag',
+        ]);
+        expect(metadata.authorization_grant_profiles_supported).toEqual([
+          'urn:ietf:params:oauth:grant-profile:id-jag',
+        ]);
       });
     });
   });
-
 `;
 }
 export function parConformanceBlock(features) {
@@ -11689,7 +13640,7 @@ export function consentDecisionConformanceBlock() {
 `;
 }
 export function conformanceTestTemplate(corePkg, features = DEFAULT_FEATURES) {
-    const exportPublicJwkImport = features.requestObject
+    const exportPublicJwkImport = features.requestObject || features.idJag
         ? `import { exportPublicJwk } from '${corePkg}';\n`
         : '';
     const responseModesSupportedExpectation = features.jarm
@@ -11711,16 +13662,20 @@ import { parConfig } from './routes/par.js';`
         ? `
 import { tokenExchangeConfig } from './routes/token.js';`
         : '';
+    const idJagConformanceImports = features.idJag
+        ? `
+import { idJagConfig } from './routes/token.js';`
+        : '';
     return `import { describe, it, expect, beforeAll } from 'vitest';
 import type { SigningKeyProvider, SigningKey } from '${corePkg}';
 import { Hono } from 'hono';
 ${exportPublicJwkImport}import { createApp, validateSigningKeySet } from './app.js';
 import { applyOidc } from './apply.js';
 import { createInMemoryClientResolver, type RegisteredClient } from './config.js';
-import { accessTokenStore, authSessionStore, consentStore, createJsonProviderStores, refreshTokenStore, transactionStore, type JsonStoreBackend } from './store.js';
+import { accessTokenStore, authSessionStore, consentStore, createJsonProviderStores,${onlineRefreshTokenConformanceStoreImport(features)} refreshTokenStore, transactionStore, type JsonStoreBackend } from './store.js';
 import { consentResolver } from './resolvers.js';
 import { defaultViews } from './views.js';
-import { renderView } from './views.js';${parConformanceImports}${tokenExchangeConformanceImports}
+import { renderView } from './views.js';${parConformanceImports}${tokenExchangeConformanceImports}${idJagConformanceImports}
 
 /**
  * HTTP conformance smoke tests for the generated OpenID Connect Provider.
@@ -12199,7 +14154,7 @@ ${introspectionConformanceBlock(features)}
       });
     });
   });
-${transactionBindingConformanceBlock(features)}${customViewConformanceTestBlock()}${endpointBehaviorConformanceBlock(features, true)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}${deviceAuthorizationConformanceBlock(features)}${jarmConformanceBlock(features)}${consentDecisionConformanceBlock()}});
+${transactionBindingConformanceBlock(features)}${customViewConformanceTestBlock()}${internalRedirectOriginConformanceBlock()}${endpointBehaviorConformanceBlock(features, true)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features)}${onlineRefreshTokenConformanceBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}${idJagConformanceBlock(features)}${deviceAuthorizationConformanceBlock(features)}${jarmConformanceBlock(features)}${consentDecisionConformanceBlock()}});
 `;
 }
 //# sourceMappingURL=templates.js.map