@maronn-openid-connect/cli 0.5.0 → 0.7.0

package/dist/frameworks/hono/templates.js

@@ -1,5 +1,6 @@
 import { DEFAULT_FEATURES } from '../../features.js';
 export const EXPERIMENTAL_PACKAGE = '@maronn-openid-connect/experimental';
+export const GOOGLE_LOGIN_PACKAGE = '@maronn-openid-connect/google-login';
 function singleQuoted(value) {
     return value.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
 }
@@ -23,14 +24,21 @@ function oidcMethodGuardTemplate(features) {
   '/ciba/login': ['POST'],
   '/ciba/approve': ['POST'],\n`
         : '';
+    const logoutMethods = features.rpInitiatedLogout
+        ? `  '/logout': ['GET', 'POST'],
+  '/logout/approve': ['POST'],\n`
+        : '';
+    const googleLoginMethods = features.googleLogin
+        ? `  '/login/google': ['POST'],\n`
+        : '';
     return `const OIDC_ENDPOINT_METHODS: Readonly<Record<string, readonly string[]>> = {
   '/authorize': ['GET', 'POST'],
   '/token': ['POST'],
   '/userinfo': ['GET', 'POST'],
-${introspectionMethod}${revocationMethod}${parMethod}${deviceMethods}${cibaMethods}  '/.well-known/jwks.json': ['GET'],
+${introspectionMethod}${revocationMethod}${parMethod}${deviceMethods}${cibaMethods}${logoutMethods}  '/.well-known/jwks.json': ['GET'],
   '/.well-known/openid-configuration': ['GET'],
   '/login': ['GET', 'POST'],
-  '/consent': ['GET', 'POST'],
+${googleLoginMethods}  '/consent': ['GET', 'POST'],
 };
 
 async function enforceOidcEndpointMethod(c: any, next: () => Promise<void>): Promise<Response | void> {
@@ -85,14 +93,14 @@ export function appTemplate(_corePkg, features = DEFAULT_FEATURES) {
         : '';
     const deviceImport = features.deviceAuthorizationGrant
         ? `import { deviceAuthorizationApp } from './routes/device-authorization.js';
-import { deviceApp } from './routes/device.js';\n`
+import { devicePage } from './pages/device.js';\n`
         : '';
     const deviceCors = features.deviceAuthorizationGrant
         ? `  app.use('/device_authorization', protectedCors);\n`
         : '';
     const deviceMount = features.deviceAuthorizationGrant
         ? `  app.route('/device_authorization', deviceAuthorizationApp);
-  app.route('/device', deviceApp);\n`
+  app.route('/device', devicePage);\n`
         : '';
     const deviceStorageContext = features.deviceAuthorizationGrant
         ? `    c.set('deviceAuthorizationStore', deviceAuthorizationStore);\n`
@@ -102,14 +110,14 @@ import { deviceApp } from './routes/device.js';\n`
         : '';
     const cibaImport = features.ciba
         ? `import { backchannelAuthenticationApp } from './routes/backchannel-authentication.js';
-import { cibaApp } from './routes/ciba-verification.js';\n`
+import { cibaPage } from './pages/ciba.js';\n`
         : '';
     const cibaCors = features.ciba
         ? `  app.use('/backchannel_authentication', protectedCors);\n`
         : '';
     const cibaMount = features.ciba
         ? `  app.route('/backchannel_authentication', backchannelAuthenticationApp);
-  app.route('/ciba', cibaApp);\n`
+  app.route('/ciba', cibaPage);\n`
         : '';
     const cibaStorageContext = features.ciba
         ? `    c.set('cibaAuthenticationRequestStore', cibaAuthenticationRequestStore);
@@ -132,6 +140,44 @@ import { cibaApp } from './routes/ciba-verification.js';\n`
   cibaUserResolver?: (
     loginHint: string,
   ) => Promise<{ subject: string } | null> | { subject: string } | null;
+`
+        : '';
+    const logoutImport = features.rpInitiatedLogout
+        ? `import { logoutPage } from './pages/logout.js';\n`
+        : '';
+    const logoutMount = features.rpInitiatedLogout
+        ? `  app.route('/logout', logoutPage);\n`
+        : '';
+    const googleLoginImport = features.googleLogin
+        ? `import {
+  getDefaultGoogleIdTokenVerifier,
+  type GoogleAccountResolver,
+  type GoogleIdTokenPayload,
+  type GoogleIdTokenVerifier,
+} from '${GOOGLE_LOGIN_PACKAGE}';\n`
+        : '';
+    const googleLoginStorageContext = features.googleLogin
+        ? `    c.set('googleLoginNonceStore', stores.googleLoginNonceStore);
+    c.set('googleIdTokenVerifier', options.googleIdTokenVerifier ?? getDefaultGoogleIdTokenVerifier());
+    c.set('googleAccountResolver', options.googleAccountResolver ?? {
+      resolveSubject: async (account: GoogleIdTokenPayload) =>
+        (await stores.userStore.linkGoogleAccount(account)).sub,
+    });\n`
+        : '';
+    const googleLoginOptionsFields = features.googleLogin
+        ? `  /**
+   * EXTENSION (google-login): verifier for the ID token Google posts to
+   * /login/google. Defaults to google-auth-library (OAuth2Client.verifyIdToken)
+   * with a process-wide certificate cache; inject a custom one for tests or a
+   * proxied environment.
+   */
+  googleIdTokenVerifier?: GoogleIdTokenVerifier;
+  /**
+   * EXTENSION (google-login): map a verified Google account to the OP subject.
+   * Defaults to just-in-time provisioning through the user store
+   * (userStore.linkGoogleAccount), keyed by the Google \`sub\`.
+   */
+  googleAccountResolver?: GoogleAccountResolver;
 `
         : '';
     const refreshStorageContext = features.refreshToken
@@ -148,13 +194,13 @@ import { cibaApp } from './routes/ciba-verification.js';\n`
     const methodGuard = oidcMethodGuardTemplate(features);
     return `import { Hono } from 'hono';
 import { cors } from 'hono/cors';
-import { authorizeApp } from './routes/authorize.js';
+import { authorizePage } from './pages/authorize.js';
 import { tokenApp } from './routes/token.js';
 import { userinfoApp } from './routes/userinfo.js';
-${introspectionImport}${revocationImport}${parImport}${deviceImport}${cibaImport}import { jwksApp } from './routes/jwks.js';
+${introspectionImport}${revocationImport}${parImport}${deviceImport}${cibaImport}${logoutImport}import { jwksApp } from './routes/jwks.js';
 import { discoveryApp } from './routes/discovery.js';
-import { loginApp } from './routes/login.js';
-import { consentApp } from './routes/consent.js';
+import { loginPage } from './pages/login.js';
+import { consentPage } from './pages/consent.js';
 import {
   createInMemoryClientResolver,
   createProviderConfig,
@@ -169,7 +215,7 @@ ${parStoreImport}${deviceStoreImport}${cibaStoreImport}  type ProviderStores,
   type ProviderStoresFactory,
 } from './store.js';
 import { createViews, type Views } from './views.js';
-import {
+${googleLoginImport}import {
   assertHasRs256Key,
   assertKeyStrength,
   assertKidStrategyConsistent,
@@ -231,7 +277,7 @@ export interface CreateAppOptions {
    * Override only when hints are signed by a different key set.
    */
   jwksProvider?: () => Promise<JwkSet> | JwkSet;
-${cibaOptionsField}  corsOrigins?: CorsOrigins;
+${cibaOptionsField}${googleLoginOptionsFields}  corsOrigins?: CorsOrigins;
 }
 
 export function validateSigningKeySet(
@@ -328,7 +374,7 @@ ${introspectionCors}${revocationCors}${parCors}${deviceCors}${cibaCors}  app.use
     c.set('authCodeResolver', storeResolvers.authorizationCodeResolver);
     c.set('accessTokenResolver', storeResolvers.accessTokenResolver);
     c.set('userClaimsResolver', storeResolvers.userClaimsResolver);
-${refreshStorageContext}${introspectionStorageContext}${revocationStorageContext}${parStorageContext}${deviceStorageContext}${cibaStorageContext}
+${refreshStorageContext}${introspectionStorageContext}${revocationStorageContext}${parStorageContext}${deviceStorageContext}${cibaStorageContext}${googleLoginStorageContext}
     // P1: default cookie-based session + consent resolvers so prompt=none /
     // max_age / SSO work out of the box (OIDC Core 1.0 Section 3.1.2.1 / 3.1.2.3).
     c.set('sessionResolver', options.sessionResolver ?? storeResolvers.sessionResolver);
@@ -346,13 +392,15 @@ ${refreshStorageContext}${introspectionStorageContext}${revocationStorageContext
     await next();
   });
 
-  app.route('/authorize', authorizeApp);
+  // Browser-facing surfaces are mounted from pages/: every GET and POST of a
+  // screen lives there, and the logic they call is in routes/.
+  app.route('/authorize', authorizePage);
   app.route('/token', tokenApp);
   app.route('/userinfo', userinfoApp);
-${introspectionMount}${revocationMount}${parMount}${deviceMount}${cibaMount}  app.route('/.well-known/jwks.json', jwksApp);
+${introspectionMount}${revocationMount}${parMount}${deviceMount}${cibaMount}${logoutMount}  app.route('/.well-known/jwks.json', jwksApp);
   app.route('/.well-known/openid-configuration', discoveryApp);
-  app.route('/login', loginApp);
-  app.route('/consent', consentApp);
+  app.route('/login', loginPage);
+  app.route('/consent', consentPage);
 
   return app;
 }
@@ -584,13 +632,49 @@ ${exampleClientExchangeComment}${exampleClientIdJagComment}${exampleClientCibaCo
 `
         : `${noRefreshGrantComment}${exampleClientExchangeComment}${exampleClientIdJagComment}${exampleClientCibaComment}      grantTypes: [${exampleClientGrantTypes}],
 `;
+    const googleLoginConfigTypes = features.googleLogin
+        ? `
+/**
+ * EXTENSION (google-login): Sign in with Google (Google Identity Services,
+ * redirect mode) as a login method. See @maronn-openid-connect/google-login.
+ */
+export interface GoogleLoginConfig {
+  /**
+   * OAuth 2.0 client ID (type: Web application) from the Google Cloud console.
+   * The ID token's \`aud\` must equal it. Register \`<issuer>/login/google\` as an
+   * authorized redirect URI of this client, and the login page origin as an
+   * authorized JavaScript origin.
+   */
+  clientId: string;
+  /**
+   * Optional: only accept Google Workspace accounts of these hosted domains
+   * (\`hd\` claim). A personal Google account has no \`hd\` and is rejected.
+   */
+  hostedDomain?: string | string[];
+  /**
+   * Optional: reject accounts whose email Google has not verified
+   * (\`email_verified !== true\`). Off by default; users are keyed by the Google
+   * \`sub\`, never by email, so an unverified email cannot hijack another user.
+   */
+  requireVerifiedEmail?: boolean;
+}
+`
+        : '';
+    const googleLoginConfigField = features.googleLogin
+        ? `  /**
+   * EXTENSION (google-login): Sign in with Google. Leave undefined to render no
+   * Google button; the login page then only offers the username / password form.
+   */
+  googleLogin?: GoogleLoginConfig;
+`
+        : '';
     return `import type {
   ClientInfo,
   ClientResolver,
   TokenClientInfo,
   TokenClientResolver,
 } from '${corePkg}';
-
+${googleLoginConfigTypes}
 export interface ProviderConfig {
   issuer: string;
   accessTokenExpiresIn: number;
@@ -627,7 +711,7 @@ ${allowUnsignedField}  /**
    * 有無に関わらず常に 400 の OAuth error JSON を返す。
    */
   authorizationErrorRedirectPath?: string;
-}
+${googleLoginConfigField}}
 
 /**
  * Optional defaults for quick local testing.
@@ -1129,6 +1213,247 @@ export const cibaAuthenticationRequestStore: CibaAuthenticationRequestStore =
 export const cibaLoginTransactionStore: CibaLoginTransactionStore =
   (cibaStoreRegistry.__oidcCibaLoginTransactionStore ??=
     createInMemoryCibaLoginTransactionStore());
+`
+        : '';
+    const googleLoginStoreTypeImport = features.googleLogin
+        ? `
+import type {
+  GoogleIdTokenPayload,
+  GoogleLoginNonceRecord,
+  GoogleLoginNonceStore,
+} from '${GOOGLE_LOGIN_PACKAGE}';`
+        : '';
+    const googleUsersField = features.googleLogin
+        ? `  // EXTENSION (google-login): users provisioned from a verified Google account,
+  // keyed by their OP subject ('google:' + Google sub). They have no password.
+  private googleUsers = new Map<string, UserClaims>();
+
+`
+        : '';
+    const userStoreGoogleFallback = features.googleLogin ? 'this.googleUsers.get(sub)' : 'undefined';
+    const userStoreGoogleMethods = features.googleLogin
+        ? `
+  /**
+   * EXTENSION (google-login): create or refresh the OP user for a verified Google
+   * account (just-in-time provisioning) and return its claims. The subject is
+   * 'google:' + the Google sub — never the email, which a Google account can
+   * change — so the same person always maps to the same OP user.
+   */
+  linkGoogleAccount(account: GoogleIdTokenPayload): UserClaims {
+    const claims = googleAccountToClaims(account);
+    this.googleUsers.set(claims.sub, claims);
+    return claims;
+  }
+`
+        : '';
+    const googleLoginStoreImplementation = features.googleLogin
+        ? `/**
+ * EXTENSION (google-login): OP subject prefix for users provisioned from Google.
+ */
+export const GOOGLE_SUBJECT_PREFIX = 'google:';
+
+/**
+ * EXTENSION (google-login): the OP user record derived from a verified Google
+ * ID token. Only the profile / email claims Google supplied are copied, so the
+ * UserInfo endpoint returns exactly what Google asserted about the account.
+ */
+export function googleAccountToClaims(account: GoogleIdTokenPayload): UserClaims {
+  const claims: UserClaims = { sub: GOOGLE_SUBJECT_PREFIX + account.sub };
+  if (account.name !== undefined) claims.name = account.name;
+  if (account.given_name !== undefined) claims.given_name = account.given_name;
+  if (account.family_name !== undefined) claims.family_name = account.family_name;
+  if (account.picture !== undefined) claims.picture = account.picture;
+  if (account.locale !== undefined) claims.locale = account.locale;
+  if (account.email !== undefined) claims.email = account.email;
+  if (account.email_verified !== undefined) claims.email_verified = account.email_verified;
+  return claims;
+}
+
+/**
+ * EXTENSION (google-login): in-memory store for the nonce that binds a
+ * "Sign in with Google" click to the authorization transaction it started from
+ * (see @maronn-openid-connect/google-login). An entry lives as long as its
+ * transaction and is consumed on first use by the callback.
+ */
+export class InMemoryGoogleLoginNonceStore implements GoogleLoginNonceStore {
+  private records = new Map<string, { value: GoogleLoginNonceRecord; expiresAt: number }>();
+
+  async get(key: string): Promise<GoogleLoginNonceRecord | null> {
+    const entry = this.records.get(key);
+    if (!entry) return null;
+    if (Date.now() > entry.expiresAt) {
+      this.records.delete(key);
+      return null;
+    }
+    return entry.value;
+  }
+
+  async put(key: string, value: GoogleLoginNonceRecord, ttlSeconds: number): Promise<void> {
+    this.records.set(key, { value, expiresAt: Date.now() + (ttlSeconds * 1000) });
+  }
+
+  async delete(key: string): Promise<void> {
+    this.records.delete(key);
+  }
+}
+
+`
+        : '';
+    const userStorageGoogleMember = features.googleLogin
+        ? `  /** EXTENSION (google-login): provision / refresh the user for a verified Google account. */
+  linkGoogleAccount(account: GoogleIdTokenPayload): Awaitable<UserClaims>;
+`
+        : '';
+    const providerStoresGoogleMember = features.googleLogin
+        ? `  /** EXTENSION (google-login): nonce -> transaction binding for the Google callback. */
+  googleLoginNonceStore: GoogleLoginNonceStore;
+`
+        : '';
+    const googleLoginPrefixes = features.googleLogin
+        ? `
+const GOOGLE_USER_PREFIX = 'google-user:';
+const GOOGLE_LOGIN_NONCE_PREFIX = 'google-login-nonce:';`
+        : '';
+    const jsonUserStoreGoogleFallback = features.googleLogin ? 'this.findGoogleUser(sub)' : 'undefined';
+    const jsonUserStoreGoogleMethods = features.googleLogin
+        ? `
+  /**
+   * EXTENSION (google-login): provision / refresh the user for a verified Google
+   * account under its own key prefix, so it never collides with a password user.
+   */
+  async linkGoogleAccount(account: GoogleIdTokenPayload): Promise<UserClaims> {
+    const claims = googleAccountToClaims(account);
+    await this.backend.put(GOOGLE_USER_PREFIX + claims.sub, claims);
+    return claims;
+  }
+
+  private async findGoogleUser(sub: string): Promise<UserClaims | undefined> {
+    return (await this.backend.get<UserClaims>(GOOGLE_USER_PREFIX + sub)) ?? undefined;
+  }
+`
+        : '';
+    const jsonGoogleNonceStore = features.googleLogin
+        ? `class JsonGoogleLoginNonceStore implements GoogleLoginNonceStore {
+  constructor(private readonly backend: JsonStoreBackend) {}
+
+  async get(key: string): Promise<GoogleLoginNonceRecord | null> {
+    return this.backend.get<GoogleLoginNonceRecord>(GOOGLE_LOGIN_NONCE_PREFIX + key);
+  }
+
+  async put(key: string, value: GoogleLoginNonceRecord, ttlSeconds: number): Promise<void> {
+    await this.backend.put(GOOGLE_LOGIN_NONCE_PREFIX + key, value, ttlSeconds);
+  }
+
+  async delete(key: string): Promise<void> {
+    await this.backend.delete(GOOGLE_LOGIN_NONCE_PREFIX + key);
+  }
+}
+
+`
+        : '';
+    const jsonStoresGoogleEntry = features.googleLogin
+        ? `    googleLoginNonceStore: new JsonGoogleLoginNonceStore(backend),
+`
+        : '';
+    const defaultStoresGoogleEntry = features.googleLogin
+        ? `  googleLoginNonceStore: new InMemoryGoogleLoginNonceStore(),
+`
+        : '';
+    const googleLoginStoreExport = features.googleLogin
+        ? `
+export const googleLoginNonceStore = defaultProviderStores.googleLoginNonceStore;`
+        : '';
+    const rpInitiatedLogoutHelpers = features.rpInitiatedLogout
+        ? `
+/**
+ * EXPERIMENTAL — RP-Initiated Logout confirmation cookie
+ * (RP-Initiated Logout 1.0 §2).
+ *
+ * Rendering the logout confirmation screen mints a fresh secret and hands it
+ * to that one browser twice: in this HttpOnly cookie and in the form's hidden
+ * csrf_token. POST /logout/approve runs only when both come back carrying the
+ * same secret. An attacker can collect a valid pair in their own browser, but
+ * cannot set this cookie in the victim's browser, so a forged cross-site POST
+ * fails the comparison (and SameSite=Lax drops the cookie from a cross-site
+ * POST to begin with). Neither half alone is ever accepted — the same model
+ * as the device verification binding cookie above.
+ *
+ * The cookie also carries the OP-computed post-logout redirect target
+ * (base64url of the exact registered URL, or empty when there is none), so
+ * the redirect decision survives the confirmation round-trip inside an
+ * HttpOnly channel instead of a tamperable hidden form field — and the
+ * id_token_hint itself is never echoed into the page.
+ */
+export const LOGOUT_CONFIRMATION_COOKIE = 'oidc_logout_confirm';
+
+/** What one rendered confirmation screen carries across to its approve POST. */
+export interface LogoutConfirmation {
+  /** Secret pairing the HttpOnly cookie with the form's hidden csrf_token. */
+  csrfSecret: string;
+  /** Registered redirect URL resolved at render time, or null for the completed page. */
+  redirectTo: string | null;
+}
+
+export function buildLogoutConfirmationCookie(confirmation: LogoutConfirmation): string {
+  const bytes = new TextEncoder().encode(confirmation.redirectTo ?? '');
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join('');
+  const encodedRedirect = btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');
+  return (
+    LOGOUT_CONFIRMATION_COOKIE + '=' + confirmation.csrfSecret + '.' + encodedRedirect +
+    // 10 minutes: enough to read the screen and click, short enough that an
+    // abandoned confirmation does not leave a long-lived pre-auth cookie.
+    '; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=600'
+  );
+}
+
+/** Clear the confirmation cookie once the approve POST consumed it. */
+export function buildClearedLogoutConfirmationCookie(): string {
+  return LOGOUT_CONFIRMATION_COOKIE + '=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0';
+}
+
+/**
+ * Parse the confirmation cookie back. Returns null when the cookie is absent
+ * or malformed in any way, which the approve POST answers with 400 and,
+ * crucially, without deleting anything.
+ */
+export function parseLogoutConfirmation(cookieHeader: string | null): LogoutConfirmation | null {
+  if (!cookieHeader) return null;
+  let value: string | null = null;
+  for (const part of cookieHeader.split(';')) {
+    const trimmed = part.trim();
+    const eq = trimmed.indexOf('=');
+    if (eq === -1) continue;
+    if (trimmed.slice(0, eq) === LOGOUT_CONFIRMATION_COOKIE) {
+      value = trimmed.slice(eq + 1);
+      break;
+    }
+  }
+  if (value === null) return null;
+  const dot = value.indexOf('.');
+  if (dot === -1) return null;
+  const csrfSecret = value.slice(0, dot);
+  if (csrfSecret === '') return null;
+  const encodedRedirect = value.slice(dot + 1);
+  if (encodedRedirect === '') return { csrfSecret, redirectTo: null };
+  if (!/^[A-Za-z0-9_-]+$/.test(encodedRedirect)) return null;
+  try {
+    const base64 = encodedRedirect.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const bytes = Uint8Array.from(atob(padded), (char) => char.charCodeAt(0));
+    return { csrfSecret, redirectTo: new TextDecoder().decode(bytes) };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Build the Set-Cookie value that removes the browser session cookie. The
+ * logout routes pair it with browserSessionStore.delete(): the store entry
+ * and the cookie go away together (RP-Initiated Logout 1.0 §2).
+ */
+export function buildClearedSessionCookie(): string {
+  return SESSION_COOKIE_NAME + '=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0';
+}
 `
         : '';
     return `import type {
@@ -1138,7 +1463,7 @@ export const cibaLoginTransactionStore: CibaLoginTransactionStore =
   AccessTokenInfo,
   RefreshTokenInfo,
   UserClaims,
-} from '${corePkg}';${parStoreTypeImport}${deviceStoreTypeImport}${cibaStoreTypeImport}
+} from '${corePkg}';${parStoreTypeImport}${deviceStoreTypeImport}${cibaStoreTypeImport}${googleLoginStoreTypeImport}
 
 /**
  * In-memory Authorization Transaction Store.
@@ -1400,7 +1725,7 @@ export function parseSessionId(cookieHeader: string | null): string | undefined
 export function buildSessionCookie(sessionId: string): string {
   return SESSION_COOKIE_NAME + '=' + sessionId + '; HttpOnly; Secure; SameSite=Lax; Path=/';
 }
-${transactionBindingHelpers}
+${transactionBindingHelpers}${rpInitiatedLogoutHelpers}
 /**
  * In-memory consent store. Records that a user granted a set of scopes to a
  * client so prompt=none can confirm consent without showing UI
@@ -1459,7 +1784,7 @@ export class ConsentStore {
 export class UserStore {
   private users = new Map<string, UserClaims & { password: string }>();
 
-  constructor() {
+${googleUsersField}  constructor() {
     // Example user for development.
     // Carries the standard claims for every scope advertised in Discovery
     // (profile / email / address / phone — OIDC Core 1.0 §5.4) so the OIDF
@@ -1524,13 +1849,13 @@ export class UserStore {
 
   getClaims(sub: string): UserClaims | undefined {
     const user = this.users.get(sub);
-    if (!user) return undefined;
+    if (!user) return ${userStoreGoogleFallback};
     const { password: _, ...claims } = user;
     return claims;
   }
-}
+${userStoreGoogleMethods}}
 
-export type Awaitable<T> = T | Promise<T>;
+${googleLoginStoreImplementation}export type Awaitable<T> = T | Promise<T>;
 
 export interface JsonStoreEntry<T> {
   key: string;
@@ -1598,7 +1923,7 @@ export interface UserStorage {
     password: string,
   ): Awaitable<(UserClaims & { password: string }) | undefined>;
   getClaims(sub: string): Awaitable<UserClaims | undefined>;
-}
+${userStorageGoogleMember}}
 
 export interface ProviderStores {
   transactionStore: AuthTransactionStore;
@@ -1609,7 +1934,7 @@ export interface ProviderStores {
   browserSessionStore: BrowserSessionStorage;
   consentStore: ConsentStorage;
   userStore: UserStorage;
-}
+${providerStoresGoogleMember}}
 
 export type ProviderStoresFactory = (
   context: any,
@@ -1622,7 +1947,7 @@ const REFRESH_TOKEN_PREFIX = 'refresh-token:';
 const AUTH_SESSION_PREFIX = 'auth-session:';
 const BROWSER_SESSION_PREFIX = 'browser-session:';
 const CONSENT_PREFIX = 'consent:';
-const USER_PREFIX = 'user:';
+const USER_PREFIX = 'user:';${googleLoginPrefixes}
 
 class JsonTransactionStore implements AuthTransactionStore {
   constructor(private readonly backend: JsonStoreBackend) {}
@@ -1835,7 +2160,7 @@ class JsonUserStore implements UserStorage {
 
   async getClaims(sub: string): Promise<UserClaims | undefined> {
     const user = await this.findOrSeed(sub);
-    if (!user) return undefined;
+    if (!user) return ${jsonUserStoreGoogleFallback};
     const { password: _, ...claims } = user;
     return claims;
   }
@@ -1849,9 +2174,9 @@ class JsonUserStore implements UserStorage {
     await this.backend.put(key, fixture);
     return fixture;
   }
-}
+${jsonUserStoreGoogleMethods}}
 
-/** Create all OP stores over one deployment-native JSON backend. */
+${jsonGoogleNonceStore}/** Create all OP stores over one deployment-native JSON backend. */
 export function createJsonProviderStores(backend: JsonStoreBackend): ProviderStores {
   return {
     transactionStore: new JsonTransactionStore(backend),
@@ -1862,7 +2187,7 @@ export function createJsonProviderStores(backend: JsonStoreBackend): ProviderSto
     browserSessionStore: new JsonBrowserSessionStore(backend),
     consentStore: new JsonConsentStore(backend),
     userStore: new JsonUserStore(backend),
-  };
+${jsonStoresGoogleEntry}  };
 }
 
 function epochSeconds(): number {
@@ -1946,7 +2271,7 @@ export const defaultProviderStores = (storeRegistry.__oidcProviderStores ??= {
   browserSessionStore: new BrowserSessionStore(),
   consentStore: new ConsentStore(),
   userStore: new UserStore(),
-});
+${defaultStoresGoogleEntry}});
 
 export const transactionStore = defaultProviderStores.transactionStore;
 export const authCodeStore = defaultProviderStores.authCodeStore;
@@ -1955,7 +2280,7 @@ export const refreshTokenStore = defaultProviderStores.refreshTokenStore;
 export const authSessionStore = defaultProviderStores.authSessionStore;
 export const browserSessionStore = defaultProviderStores.browserSessionStore;
 export const consentStore = defaultProviderStores.consentStore;
-export const userStore = defaultProviderStores.userStore;
+export const userStore = defaultProviderStores.userStore;${googleLoginStoreExport}
 ${parStoreImplementation}${deviceStoreImplementation}${cibaStoreImplementation}`;
 }
 export function resolversTemplate(corePkg, features = DEFAULT_FEATURES) {
@@ -2276,23 +2601,9 @@ import { findUnsupportedScopes, resolveGrantableScopes } from '../scopes.js';`
 `
         : `    const transaction = createAuthTransaction(validatedRequest, csrfToken);
 `;
-    const bindingCookieOnConsentRedirect = features.transactionBinding
-        ? `          // Hand the binding secret to this browser before the interactive steps.
-          // Only paths that continue in the browser get the cookie; paths that
-          // redirect straight back to the client never needed one.
-          c.header(
-            'Set-Cookie',
-            buildTransactionBindingCookie(transactionId, bindingSecret, transactionTtlSeconds),
-          );
-`
-        : '';
-    const bindingCookieOnLoginRedirect = features.transactionBinding
-        ? `    c.header(
-      'Set-Cookie',
-      buildTransactionBindingCookie(transactionId, bindingSecret, transactionTtlSeconds),
-    );
-`
-        : '';
+    const browserStepCookies = features.transactionBinding
+        ? '[buildTransactionBindingCookie(transactionId, bindingSecret, transactionTtlSeconds)]'
+        : '[]';
     const requestObjectImports = features.requestObject
         ? `
   resolveRequestObjectParams,
@@ -2375,27 +2686,7 @@ import { parStore as defaultParStore } from '../store.js';`
       // non-redirect path as AuthorizationError below. Every failure kind
       // (unknown / used / expired / wrong client) returns the identical code and
       // description so the response cannot be used as an existence oracle.
-      const acceptsJson = (c.req.header('Accept') ?? '').includes('application/json');
-      if (acceptsJson) {
-        return c.json({ error: error.code, error_description: error.errorDescription }, 400);
-      }
-      const parErrorPagePath = c.get('config').authorizationErrorRedirectPath;
-      if (parErrorPagePath && parErrorPagePath.startsWith('/') && !parErrorPagePath.startsWith('//')) {
-        const parErrorParams = new URLSearchParams({
-          error: error.code,
-          error_description: error.errorDescription,
-        });
-        return c.redirect(\`\${parErrorPagePath}?\${parErrorParams.toString()}\`, 303);
-      }
-      const parViews = c.get('views') ?? defaultViews;
-      return renderView(
-        parViews.errorPage({
-          error: error.code,
-          errorDescription: error.errorDescription,
-          statusCode: 400,
-        }),
-        { status: 400 },
-      );
+      return { kind: 'error', error: error.code, errorDescription: error.errorDescription };
     }
 `
         : '';
@@ -2596,37 +2887,39 @@ function buildErrorRedirect(
   return url.toString();
 }`;
     const promptNoneSuccessRedirect = features.jarm
-        ? `      return c.redirect(
-        await buildSuccessRedirect(
+        ? `      return {
+      kind: 'authorization_response',
+      location: await buildSuccessRedirect(
           jarmResponse,
           transaction.redirectUri,
           authCodeData.code,
           transaction.state,
           issuer,
         ),
-      );`
+      };`
         : `      const redirectUrl = new URL(transaction.redirectUri);
       redirectUrl.searchParams.set('code', authCodeData.code);
       if (transaction.state) redirectUrl.searchParams.set('state', transaction.state);
       // RFC 9207 §2: include iss in success responses too.
       redirectUrl.searchParams.set('iss', issuer);
-      return c.redirect(redirectUrl.toString());`;
+      return { kind: 'authorization_response', location: redirectUrl.toString() };`;
     const ssoSuccessRedirect = features.jarm
-        ? `            return c.redirect(
-              await buildSuccessRedirect(
+        ? `            return {
+            kind: 'authorization_response',
+            location: await buildSuccessRedirect(
                 jarmResponse,
                 transaction.redirectUri,
                 authCodeData.code,
                 transaction.state,
                 issuer,
               ),
-            );`
+            };`
         : `            const redirectUrl = new URL(transaction.redirectUri);
             redirectUrl.searchParams.set('code', authCodeData.code);
             if (transaction.state) redirectUrl.searchParams.set('state', transaction.state);
             // RFC 9207 §2: include iss in success responses.
             redirectUrl.searchParams.set('iss', issuer);
-            return c.redirect(redirectUrl.toString());`;
+            return { kind: 'authorization_response', location: redirectUrl.toString() };`;
     const catchErrorRedirect = features.jarm
         ? `      if (error.redirectUri) {
         // RFC 9207 §2: include iss on error redirects so the client can
@@ -2637,8 +2930,9 @@ function buildErrorRedirect(
         // signed JWT and no plain parameter is added. jarmResponse is undefined
         // for errors thrown before response_mode was interpreted (unknown
         // client, unsupported JWT mode), which is why those stay plain.
-        return c.redirect(
-          await buildErrorRedirect(
+        return {
+        kind: 'authorization_response',
+        location: await buildErrorRedirect(
             jarmResponse,
             error.redirectUri,
             error.error,
@@ -2646,7 +2940,7 @@ function buildErrorRedirect(
             error.errorDescription,
             c.get('config').issuer,
           ),
-        );
+        };
       }`
         : `      if (error.redirectUri) {
         const redirectUrl = new URL(error.redirectUri);
@@ -2662,7 +2956,7 @@ function buildErrorRedirect(
         // middleware; reread it here because the early-bound issuer is
         // scoped to the try block.
         redirectUrl.searchParams.set('iss', c.get('config').issuer);
-        return c.redirect(redirectUrl.toString());
+        return { kind: 'authorization_response', location: redirectUrl.toString() };
       }`;
     const jarmTransactionPutArg = features.jarm
         ? `jarmResponse ? { ...transaction, jarmResponseMode: 'query.jwt' } : transaction,`
@@ -2683,7 +2977,16 @@ function buildErrorRedirect(
     // (OIDC Core 1.0 §11 requires ignoring the request in that case).
     scope = await applyOfflineAccessPolicy(scope, effectiveParams, prompt, client, () => false);
 `;
-    return `import { Hono } from 'hono';
+    return `/**
+ * Authorization endpoint (API layer: logic only).
+ *
+ * processAuthorizationRequest() runs the whole OIDC Core 1.0 §3.1.2 pipeline —
+ * request validation, the transaction, id_token_hint, prompt=none, SSO — and
+ * reports what the endpoint decided as an outcome: the authorization response
+ * URL for the client, "continue on the login / consent screen", or an error
+ * that must stay on the OP. It never builds a Response; pages/authorize.ts,
+ * which owns GET|POST /authorize, turns the outcome into HTTP.
+ */
 import {
   resolveClientForAuthorization,
   validateRegisteredRedirectUris,${requestObjectImports}
@@ -2718,10 +3021,25 @@ import {
   transactionStore as defaultTransactionStore,
   authCodeStore as defaultAuthCodeStore,
   authSessionStore as defaultAuthSessionStore,${bindingStoreImport}
-} from '../store.js';
-import { defaultViews, renderView } from '../views.js';${parImports}${jarmImports}${customScopeImports}
+} from '../store.js';${parImports}${jarmImports}${customScopeImports}
 
-export const authorizeApp = new Hono<{ Variables: Record<string, any> }>();
+/** What the authorization endpoint decided; pages/authorize.ts turns it into HTTP. */
+export type AuthorizationOutcome =
+  /** Malformed transport: OAuth error JSON (400), no transaction exists yet. */
+  | { kind: 'bad_request'; error: string; errorDescription: string }
+  /**
+   * The authorization response for the client — code, redirectable error or
+   * (EXPERIMENTAL JARM) signed response JWT — ready in the URL.
+   */
+  | { kind: 'authorization_response'; location: string }
+  /** Interactive authentication is needed: continue on the login screen. */
+  | { kind: 'login'; transactionId: string; cookies: string[] }
+  /** The End-User is signed in but consent is needed: continue on the consent screen. */
+  | { kind: 'consent'; transactionId: string; cookies: string[] }
+  /** OIDC Core 1.0 §3.1.2.2: the error cannot be redirected and stays on the OP. */
+  | { kind: 'error'; error: string; errorDescription?: string }
+  /** An unexpected failure: OAuth error JSON (500). */
+  | { kind: 'server_error' };
 
 /**
  * Narrows raw query-string params to the typed AuthorizationRequestParams.
@@ -2783,25 +3101,25 @@ async function parseAuthorizationRequestParams(
 }
 
 /**
- * Authorization Endpoint handler shared by GET and POST.
- * OIDC Core 1.0 Section 3.1.2
+ * Process one authorization request (OIDC Core 1.0 Section 3.1.2). Shared by
+ * GET and POST /authorize (pages/authorize.ts).
  */
-const handleAuthorizationRequest = async (c: any) => {
+export async function processAuthorizationRequest(c: any): Promise<AuthorizationOutcome> {
   const parsed = await parseAuthorizationRequestParams(c);
 
   if (parsed === null) {
-    return c.json({ error: 'invalid_request', error_description: 'Authorization POST requests must use application/x-www-form-urlencoded' }, 400);
+    return { kind: 'bad_request', error: 'invalid_request', errorDescription: 'Authorization POST requests must use application/x-www-form-urlencoded' };
   }
 
   // OIDC Core 1.0 §3.1.2.1 / RFC 6749 §3.1: request parameters MUST NOT be repeated.
   if (parsed.duplicateKey !== undefined) {
-    return c.json({ error: 'invalid_request', error_description: \`Parameter "\${parsed.duplicateKey}" must not be repeated\` }, 400);
+    return { kind: 'bad_request', error: 'invalid_request', errorDescription: \`Parameter "\${parsed.duplicateKey}" must not be repeated\` };
   }
 
   const rawParams = parsed.params;
 
   if (!isAuthorizationRequestParams(rawParams)) {
-    return c.json({ error: 'invalid_request', error_description: 'Missing required parameter: client_id' }, 400);
+    return { kind: 'bad_request', error: 'invalid_request', errorDescription: 'Missing required parameter: client_id' };
   }
 
 ${parParamsBinding}${jarmResponseBinding}
@@ -2911,7 +3229,7 @@ ${bindingSecretStep}    const transactionId = await generateRandomString(32);
     // prompt=none must not be combined with other values (OIDC Core 1.0 Section 3.1.2.1)
     if (promptValues.includes('none') && promptValues.length > 1) {
       await transactionStore.delete('auth_txn:' + transactionId);
-      return c.redirect(${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'invalid_request', transaction.state, 'prompt=none must not be combined with other prompt values', issuer));
+      return { kind: 'authorization_response', location: ${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'invalid_request', transaction.state, 'prompt=none must not be combined with other prompt values', issuer) };
     }
 
     // OIDC Core 1.0 §3.1.2.1: the id_token_hint rule ("if the End-User identified
@@ -2927,7 +3245,7 @@ ${bindingSecretStep}    const transactionId = await generateRandomString(32);
       if (!jwksProvider) {
         // jwksProvider 未提供では hint を検証できない → login_required で拒否
         await transactionStore.delete('auth_txn:' + transactionId);
-        return c.redirect(${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'login_required', transaction.state, 'jwksProvider is not configured; cannot verify id_token_hint', issuer));
+        return { kind: 'authorization_response', location: ${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'login_required', transaction.state, 'jwksProvider is not configured; cannot verify id_token_hint', issuer) };
       }
       try {
         const jwks = await jwksProvider();
@@ -2940,7 +3258,7 @@ ${bindingSecretStep}    const transactionId = await generateRandomString(32);
       } catch (hintError) {
         await transactionStore.delete('auth_txn:' + transactionId);
         const code = hintError instanceof IdTokenHintError ? hintError.error : 'login_required';
-        return c.redirect(${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, code, transaction.state, hintError instanceof Error && hintError.message ? hintError.message : 'id_token_hint verification failed', issuer));
+        return { kind: 'authorization_response', location: ${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, code, transaction.state, hintError instanceof Error && hintError.message ? hintError.message : 'id_token_hint verification failed', issuer) };
       }
     }
 
@@ -2953,14 +3271,14 @@ ${bindingSecretStep}    const transactionId = await generateRandomString(32);
       // No sessionResolver configured → cannot verify session → login_required
       if (!sessionResolver) {
         await transactionStore.delete('auth_txn:' + transactionId);
-        return c.redirect(${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'login_required', transaction.state, 'sessionResolver is not configured; cannot satisfy prompt=none', issuer));
+        return { kind: 'authorization_response', location: ${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'login_required', transaction.state, 'sessionResolver is not configured; cannot satisfy prompt=none', issuer) };
       }
 
       // No consentResolver configured → cannot confirm consent → consent_required
       // (OIDC Core 1.0 Section 3.1.2.1: prompt=none must not display consent screen)
       if (!consentResolver) {
         await transactionStore.delete('auth_txn:' + transactionId);
-        return c.redirect(${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'consent_required', transaction.state, 'consentResolver is not configured; cannot satisfy prompt=none', issuer));
+        return { kind: 'authorization_response', location: ${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'consent_required', transaction.state, 'consentResolver is not configured; cannot satisfy prompt=none', issuer) };
       }
 
       let session;
@@ -2987,20 +3305,20 @@ ${promptNoneUserScopeStep}
       } catch (promptError) {
         await transactionStore.delete('auth_txn:' + transactionId);
         if (promptError instanceof AuthorizationError) {
-          return c.redirect(${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, promptError.error, transaction.state, promptError.errorDescription, issuer));
+          return { kind: 'authorization_response', location: ${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, promptError.error, transaction.state, promptError.errorDescription, issuer) };
         }
         const serverDescription =
           promptError instanceof Error && promptError.message
             ? promptError.message
             : 'Unexpected error while evaluating prompt=none';
-        return c.redirect(${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'server_error', transaction.state, serverDescription, issuer));
+        return { kind: 'authorization_response', location: ${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'server_error', transaction.state, serverDescription, issuer) };
       }
 
       // Check max_age: if session is too old, prompt=none cannot trigger re-authentication
       // OIDC Core 1.0 Section 3.1.2.1
       if (transaction.maxAge !== undefined && requiresReauthentication(transaction.maxAge, session.authTime)) {
         await transactionStore.delete('auth_txn:' + transactionId);
-        return c.redirect(${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'login_required', transaction.state, 'Session exceeds the requested max_age; re-authentication required', issuer));
+        return { kind: 'authorization_response', location: ${jarmAwait}buildErrorRedirect(${jarmErrorArg}transaction.redirectUri, 'login_required', transaction.state, 'Session exceeds the requested max_age; re-authentication required', issuer) };
       }
 
       // transaction.scope は認可リクエスト検証時に applyOfflineAccessPolicy を通した
@@ -3110,75 +3428,31 @@ ${ssoSuccessRedirect}
             // login → consent の受け渡しに sessionId も載せる。
             sessionId: existingSession.sessionId,
           });
-${bindingCookieOnConsentRedirect}          // Internal redirects (/login, /consent) are built on config.issuer, never
-          // on the request URL: some runtimes derive the request URL from the Host
-          // header, which would let the sender pick the redirect origin and receive
-          // transaction_id there (RFC 9700 §2.1: redirect only to trusted URIs).
-          // OIDC Discovery 1.0 §3 makes the advertised issuer the source of truth
-          // for URLs that point at the OP itself. A subpath issuer contributes only
-          // its origin here ('/consent' is an absolute path) — subpath mounting is
-          // not supported by the generated routes.
-          const consentUrl = new URL('/consent', config.issuer);
-          consentUrl.searchParams.set('transaction_id', transactionId);
-          return c.redirect(consentUrl.toString());
+          // Continue on the consent screen (pages/consent.ts); the binding
+          // cookie, when enabled, travels with this answer.
+          return { kind: 'consent', transactionId, cookies: ${browserStepCookies} };
         }
       }
     }
 
-    // Redirect to login page (prompt=login forces re-authentication; handled in login route)
-${bindingCookieOnLoginRedirect}    // config.issuer, not the request URL, decides the redirect origin — see the
-    // /consent redirect above (OIDC Discovery 1.0 §3 / RFC 9700 §2.1).
-    const loginUrl = new URL('/login', config.issuer);
-    loginUrl.searchParams.set('transaction_id', transactionId);
-    return c.redirect(loginUrl.toString());
+    // Interactive authentication: continue on the login screen (pages/login.ts;
+    // prompt=login forces re-authentication there). The binding cookie, when
+    // enabled, travels with this answer.
+    return { kind: 'login', transactionId, cookies: ${browserStepCookies} };
   } catch (error) {
 ${parCatchBranch}    if (error instanceof AuthorizationError) {
 ${catchErrorRedirect}
       // OIDC Core 1.0 §3.1.2.2: errors that cannot be redirected (unknown
       // client_id, unregistered redirect_uri, redirect_uri with a fragment) MUST
-      // NOT redirect to the supplied redirect_uri. Browser callers get an HTML
-      // error page (so the OIDF Conformance Suite can submit a screenshot for
-      // oidcc-ensure-registered-redirect-uri); programmatic callers that ask for
-      // JSON via the Accept header still receive the OAuth error JSON.
-      const acceptsJson = (c.req.header('Accept') ?? '').includes('application/json');
-      if (acceptsJson) {
-        return c.json({ error: error.error, error_description: error.errorDescription }, 400);
-      }
-      // OP 内部のエラーページパスが設定されている場合（Next.js sample のように
-      // error.tsx などの framework-native なエラー画面へ委ねたいケース）は、HTML を
-      // 直接返さず 303 でそのパスへ遷移する。未登録 redirect_uri へは決して飛ばさず、
-      // OP 自身のパスにのみ遷移する。遷移先ページは 200 を返すため元の HTTP 400 は
-      // 失われるが、ブラウザにエラー画面を見せる（OIDF の screenshot 要件）目的は満たす。
-      // error / error_description は URLSearchParams でエンコードして渡す。
-      // 安全性のため遷移先は OP 内部の root-relative path（'/' 始まりかつ
-      // protocol-relative '//host' でない）に限定する。絶対 URL や '//host' を
-      // 設定された場合は open redirect 化を防ぐため redirect せず、安全側の
-      // HTML error page にフォールバックする。
-      const errorPagePath = c.get('config').authorizationErrorRedirectPath;
-      if (errorPagePath && errorPagePath.startsWith('/') && !errorPagePath.startsWith('//')) {
-        const params = new URLSearchParams({ error: error.error });
-        if (error.errorDescription) {
-          params.set('error_description', error.errorDescription);
-        }
-        return c.redirect(\`\${errorPagePath}?\${params.toString()}\`, 303);
-      }
-      const views = c.get('views') ?? defaultViews;
-      return renderView(
-        views.errorPage({
-          error: error.error,
-          errorDescription: error.errorDescription,
-          statusCode: 400,
-        }),
-        { status: 400 },
-      );
+      // NOT redirect to the supplied redirect_uri. They stay on the OP:
+      // pages/authorize.ts answers programmatic callers (Accept:
+      // application/json) with the OAuth error JSON and browsers with the OP's
+      // own error page.
+      return { kind: 'error', error: error.error, errorDescription: error.errorDescription };
     }
-    return c.json({ error: 'server_error' }, 500);
+    return { kind: 'server_error' };
   }
-};
-
-// OIDC Core 1.0 Section 3.1.2.1: Authorization Endpoint must support both GET and POST.
-authorizeApp.get('/', handleAuthorizationRequest);
-authorizeApp.post('/', handleAuthorizationRequest);
+}
 `;
 }
 export function parRouteTemplate(corePkg) {
@@ -3578,9 +3852,9 @@ import { resolveGrantableScopes } from '../scopes.js';`
         : '';
     return `/**
  * EXPERIMENTAL — OAuth 2.0 Device Authorization Grant, verification UI
- * (RFC 8628 §3.3).
+ * (RFC 8628 §3.3), API layer: logic only.
  *
- * This route was generated because the OP was created with
+ * This module was generated because the OP was created with
  * \`--enable device-authorization-grant\`. It is backed by
  * ${EXPERIMENTAL_PACKAGE}, whose API is NOT stable: it may change in a breaking
  * way between releases. Do not build production code on it without pinning the
@@ -3590,22 +3864,25 @@ import { resolveGrantableScopes } from '../scopes.js';`
  * device is showing, signs in, and approves or denies. The device learns the
  * outcome only by polling the token endpoint — there is no push channel.
  *
- * ## Why every POST here demands a binding cookie
+ * The three functions below are the three state-changing steps of that UI.
+ * None of them builds a Response: each returns an outcome (which screen comes
+ * next, with which cookies), and pages/device.ts — which also owns GET /device
+ * and the POST routes — turns it into HTTP.
+ *
+ * ## Why every step here demands a binding cookie
  *
  * The user_code is known to whoever started the flow, and that party can be the
  * attacker. A CSRF token stored on the record is therefore not a defense: the
- * attacker can fetch a valid one by POSTing /device with their own code. What
- * stops both consent coercion (a forged /device/approve that ships the victim's
- * tokens to the attacker's device) and login CSRF (a forged /device/login that
- * plants the attacker's session in the victim's browser) is the binding cookie
- * minted below — see buildDeviceBindingCookie() in store.ts for the full model.
- * The hidden csrf_token is kept as defense in depth, never as the only check.
+ * attacker can fetch a valid one by submitting their own code. What stops both
+ * consent coercion (a forged approval that ships the victim's tokens to the
+ * attacker's device) and login CSRF (a forged sign-in that plants the
+ * attacker's session in the victim's browser) is the binding cookie minted
+ * below — see buildDeviceBindingCookie() in store.ts for the full model. The
+ * hidden csrf_token is kept as defense in depth, never as the only check.
  */
-import { Hono } from 'hono';
 import {
   DeviceAuthorizationError,
   DeviceVerificationError,
-  INVALID_USER_CODE_MESSAGE,
   approveDeviceAuthorization,
   denyDeviceAuthorization,
   findPendingRecordByUserCode,
@@ -3625,26 +3902,51 @@ import {
   parseSessionId,
   userStore,
 } from '../store.js';
-import { defaultViews, renderView } from '../views.js';
 import { deviceAuthorizationConfig } from './device-authorization.js';${customScopeImport}
 
-export const deviceApp = new Hono<{ Variables: Record<string, any> }>();
+/** What a verification step decided; pages/device.ts turns it into the next screen. */
+export type DeviceOutcome =
+  /**
+   * The code did not match. RFC 8628 §5.1: unknown, expired and already-used
+   * codes share one reason-free answer so the UI cannot reveal which codes exist.
+   */
+  | { kind: 'invalid_user_code'; userCode: string }
+  /** A binding or CSRF failure the OP shows on its own error page. */
+  | { kind: 'error'; error: string; statusCode: number }
+  /** The decision step needs an OP session this browser does not have (401). */
+  | { kind: 'session_required' }
+  /** recordDeviceLoginFailure() denied the record: no further attempt is accepted (429). */
+  | { kind: 'locked_out' }
+  /** Show the sign-in form; cookies carries the binding its submission needs. */
+  | { kind: 'login'; userCode: string; csrfToken: string; cookies: string[] }
+  /** Wrong credentials: show the sign-in form again with the attempts left. */
+  | { kind: 'invalid_credentials'; userCode: string; csrfToken: string; remainingAttempts: number }
+  /** Show the approve / deny screen; cookies carries the binding and/or the new OP session. */
+  | {
+      kind: 'approval';
+      userCode: string;
+      csrfToken: string;
+      clientId: string;
+      scopes: string[];
+      cookies: string[];
+    }
+  /** The decision is recorded; cookies clears the binding. */
+  | { kind: 'completed'; approved: boolean; clientId: string; cookies: string[] };
 
-/**
- * Attach a Set-Cookie to a Response a view already produced.
- *
- * renderView() builds its own Response, so headers staged on the framework
- * context never reach it. Rebuilding the Response is the framework-neutral way
- * to add the cookie without making views cookie-aware.
- */
-function withCookie(response: Response, cookie: string): Response {
-  const headers = new Headers(response.headers);
-  headers.append('Set-Cookie', cookie);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-  });
+/** The fields of the sign-in form. */
+export interface DeviceLoginSubmission {
+  userCode: string;
+  csrfToken: string;
+  username: string;
+  password: string;
+}
+
+/** The fields of the approve / deny form. */
+export interface DeviceDecisionSubmission {
+  userCode: string;
+  csrfToken: string;
+  /** 'approve' or anything else (treated as deny). */
+  decision: string;
 }
 
 /**
@@ -3657,69 +3959,32 @@ function remainingTtlSeconds(record: DeviceAuthorizationRecord): number {
   return Math.max(0, Math.ceil((record.expiresAt.getTime() - Date.now()) / 1000));
 }
 
-/**
- * Re-render the code entry form with the single, reason-free failure message.
- *
- * RFC 8628 §5.1: unknown, expired and already-used codes must be
- * indistinguishable, otherwise the response itself confirms which codes exist.
- */
-function renderInvalidUserCode(views: typeof defaultViews, userCode: string): Response {
-  return renderView(
-    views.deviceVerificationPage({ userCode, error: INVALID_USER_CODE_MESSAGE }),
-    { status: 400 },
-  );
-}
-
-/** Map a verification failure to its error page; anything else is re-thrown. */
-function renderVerificationError(views: typeof defaultViews, error: unknown): Response {
+/** Map a verification failure to the error to show; anything else is re-thrown. */
+function verificationFailure(error: unknown): DeviceOutcome {
   if (error instanceof DeviceVerificationError) {
-    return renderView(
-      views.errorPage({ error: error.message, statusCode: error.statusCode }),
-      { status: error.statusCode },
-    );
+    return { kind: 'error', error: error.message, statusCode: error.statusCode };
   }
   if (error instanceof DeviceAuthorizationError) {
-    return renderView(
-      views.errorPage({ error: error.errorDescription, statusCode: 400 }),
-      { status: 400 },
-    );
+    return { kind: 'error', error: error.errorDescription, statusCode: 400 };
   }
   throw error;
 }
 
 /**
- * User code entry form - GET
- * RFC 8628 §3.3 / §3.3.1
- *
- * Unauthenticated and side-effect free. A user_code in the query string
- * (verification_uri_complete) only pre-fills the field: nothing is looked up or
- * mutated until the form is submitted, so following the complete URI never
- * consumes or reveals anything.
- */
-deviceApp.get('/', (c) => {
-  const views = c.get('views') ?? defaultViews;
-  return renderView(views.deviceVerificationPage({ userCode: c.req.query('user_code') ?? '' }));
-});
-
-/**
- * User code submission - POST
+ * User code submission (POST /device)
  * RFC 8628 §3.3
  *
  * On a match this is where the browser binding is minted, so this is also the
- * first response that may carry a csrf_token. Everything downstream requires the
- * cookie this response sets.
+ * first answer that may carry a csrf_token. Everything downstream requires the
+ * cookie this outcome sets.
  */
-deviceApp.post('/', async (c) => {
-  const body = await c.req.parseBody();
-  const submittedUserCode = String(body['user_code'] ?? '');
-
-  const views = c.get('views') ?? defaultViews;
+export async function submitDeviceUserCode(c: any, submittedUserCode: string): Promise<DeviceOutcome> {
   const deviceStore = c.get('deviceAuthorizationStore');
   const browserSessionStore = c.get('browserSessionStore') ?? defaultBrowserSessionStore;
 
   const record = await findPendingRecordByUserCode(submittedUserCode, deviceStore);
   if (!record) {
-    return renderInvalidUserCode(views, submittedUserCode);
+    return { kind: 'invalid_user_code', userCode: submittedUserCode };
   }
 
   // Rotate the binding secret and the csrf token together. A second browser
@@ -3735,36 +4000,35 @@ deviceApp.post('/', async (c) => {
   const sessionId = parseSessionId(c.req.header('Cookie') ?? null);
   const session = sessionId ? await browserSessionStore.get(sessionId) : undefined;
   if (session) {
-    return withCookie(renderView(views.deviceApprovalPage({
+    return {
+      kind: 'approval',
       userCode: record.userCodeDisplay,
       csrfToken,
       clientId: record.clientId,
       scopes: ${approvalPageScopes('session.subject')},
-    })), cookie);
+      cookies: [cookie],
+    };
   }
 
-  return withCookie(renderView(views.deviceLoginPage({
+  return {
+    kind: 'login',
     userCode: record.userCodeDisplay,
     csrfToken,
-  })), cookie);
-});
+    cookies: [cookie],
+  };
+}
 
 /**
- * Device login - POST
+ * Device login (POST /device/login)
  * RFC 8628 §3.3
  *
  * Binding first, then CSRF, then credentials: the binding is what proves this is
  * the browser that submitted the user_code, and it must gate the step that would
  * otherwise let a forged POST establish an OP session in the victim's browser.
  */
-deviceApp.post('/login', async (c) => {
-  const body = await c.req.parseBody();
-  const submittedUserCode = String(body['user_code'] ?? '');
-  const csrfToken = String(body['csrf_token'] ?? '');
-  const username = String(body['username'] ?? '');
-  const password = String(body['password'] ?? '');
-
-  const views = c.get('views') ?? defaultViews;
+export async function submitDeviceLogin(c: any, input: DeviceLoginSubmission): Promise<DeviceOutcome> {
+  const { userCode: submittedUserCode, csrfToken, username, password } = input;
+
   const deviceStore = c.get('deviceAuthorizationStore');
   const browserSessionStore = c.get('browserSessionStore') ?? defaultBrowserSessionStore;
   const authenticateUser =
@@ -3773,7 +4037,7 @@ deviceApp.post('/login', async (c) => {
 
   const record = await findPendingRecordByUserCode(submittedUserCode, deviceStore);
   if (!record) {
-    return renderInvalidUserCode(views, submittedUserCode);
+    return { kind: 'invalid_user_code', userCode: submittedUserCode };
   }
 
   try {
@@ -3783,7 +4047,7 @@ deviceApp.post('/login', async (c) => {
     );
     validateVerificationCsrfToken(record, csrfToken);
   } catch (error) {
-    return renderVerificationError(views, error);
+    return verificationFailure(error);
   }
 
   // Swap point: replace this with your own credential check (LDAP, WebAuthn, an
@@ -3800,64 +4064,58 @@ deviceApp.post('/login', async (c) => {
     );
     if (!failure.canRetry) {
       // The record is now denied: the device gets access_denied on its next poll.
-      return renderView(views.errorPage({
-        error: 'Too many login attempts',
-        statusCode: 429,
-      }), { status: 429 });
+      return { kind: 'locked_out' };
     }
-    return renderView(views.deviceLoginPage({
+    return {
+      kind: 'invalid_credentials',
       userCode: record.userCodeDisplay,
       csrfToken,
-      error: 'Invalid credentials',
       remainingAttempts: failure.remainingAttempts,
-    }));
+    };
   }
 
   const authTime = Math.floor(Date.now() / 1000);
   const sessionId = generateRandomString(32);
   await browserSessionStore.set(sessionId, { subject: user.sub, authTime });
 
-  // Two cookies on one response: the new OP session, and the binding cookie the
-  // approval POST will have to present again.
-  const withSession = withCookie(renderView(views.deviceApprovalPage({
+  // The new OP session travels with the approval screen; the approval step
+  // will have to present the binding cookie again as well.
+  return {
+    kind: 'approval',
     userCode: record.userCodeDisplay,
     csrfToken,
     clientId: record.clientId,
     scopes: ${approvalPageScopes('user.sub')},
-  })), buildSessionCookie(sessionId));
-  return withSession;
-});
+    cookies: [buildSessionCookie(sessionId)],
+  };
+}
 
 /**
- * Approve or deny - POST
+ * Approve or deny (POST /device/approve)
  * RFC 8628 §3.3
  *
  * The only state-changing step of the UI, so it demands all three: an OP
  * session, the binding cookie, and the csrf_token.
  */
-deviceApp.post('/approve', async (c) => {
-  const body = await c.req.parseBody();
-  const submittedUserCode = String(body['user_code'] ?? '');
-  const csrfToken = String(body['csrf_token'] ?? '');
-  const decision = String(body['decision'] ?? '');
+export async function submitDeviceDecision(
+  c: any,
+  input: DeviceDecisionSubmission,
+): Promise<DeviceOutcome> {
+  const { userCode: submittedUserCode, csrfToken, decision } = input;
 
-  const views = c.get('views') ?? defaultViews;
   const deviceStore = c.get('deviceAuthorizationStore');
   const browserSessionStore = c.get('browserSessionStore') ?? defaultBrowserSessionStore;
   const consentResolver = c.get('consentResolver');
 
   const record = await findPendingRecordByUserCode(submittedUserCode, deviceStore);
   if (!record) {
-    return renderInvalidUserCode(views, submittedUserCode);
+    return { kind: 'invalid_user_code', userCode: submittedUserCode };
   }
 
   const sessionId = parseSessionId(c.req.header('Cookie') ?? null);
   const session = sessionId ? await browserSessionStore.get(sessionId) : undefined;
   if (!session) {
-    return renderView(views.errorPage({
-      error: 'Sign in again to approve this device',
-      statusCode: 401,
-    }), { status: 401 });
+    return { kind: 'session_required' };
   }
 
   const clearCookie = buildClearedDeviceBindingCookie(record.userCode);
@@ -3885,58 +4143,258 @@ ${approveNarrowStep}      // Record the consent the same way /consent does, so a
         approved.approvedScope ?? approved.scope,
       );
       await consentResolver?.recordGrant?.(approved.subject, approved.clientId, approved.grantId);
-      return withCookie(renderView(views.deviceCompletedPage({
-        approved: true,
-        clientId: approved.clientId,
-      })), clearCookie);
+      return { kind: 'completed', approved: true, clientId: approved.clientId, cookies: [clearCookie] };
     }
 
     await denyDeviceAuthorization({ record, store: deviceStore, csrfToken });
-    return withCookie(renderView(views.deviceCompletedPage({
-      approved: false,
-      clientId: record.clientId,
-    })), clearCookie);
+    return { kind: 'completed', approved: false, clientId: record.clientId, cookies: [clearCookie] };
   } catch (error) {
-    return renderVerificationError(views, error);
+    return verificationFailure(error);
   }
-});
+}
 `;
 }
-export function backchannelAuthenticationRouteTemplate(corePkg, features = DEFAULT_FEATURES, scopes = []) {
-    const refreshTokenFeatureEnabled = features.refreshToken ? 'true' : 'false';
-    const customScopesDeclared = scopes.length > 0;
-    const customScopeImport = customScopesDeclared
-        ? `
-import { findUnsupportedScopes } from '../scopes.js';`
-        : '';
-    const customScopeStep = customScopesDeclared
-        ? `    // RFC 6749 §3.3: reject a scope this OP never declared, the same allow list
-    // /authorize uses (scopes.ts). Checked before the pipeline so a request for
-    // an unknown scope never reaches the store. offline_access is left out of
-    // the check: the pipeline applies its own policy and ignores it when it
-    // cannot be granted (OIDC Core 1.0 §11), which must not become an error.
-    const unsupportedScopes = findUnsupportedScopes(
-      (params['scope'] ?? '')
-        .split(' ')
-        .filter((scope) => scope.length > 0 && scope !== 'offline_access'),
-    );
-    if (unsupportedScopes.length > 0) {
-      throw new BackchannelAuthenticationError(
-        'invalid_scope',
-        'Unsupported scope: ' + unsupportedScopes.join(' '),
-      );
-    }
-
-`
-        : '';
+export function endSessionRouteTemplate(corePkg) {
     return `/**
- * EXPERIMENTAL — OpenID Connect Client-Initiated Backchannel Authentication
- * (CIBA Core 1.0), poll mode.
- *
- * This route was generated because the OP was created with \`--enable ciba\`.
- * It is backed by ${EXPERIMENTAL_PACKAGE}, whose API is NOT stable: it may
- * change in a breaking way between releases. Do not build production code on it
- * without pinning the version.
+ * EXPERIMENTAL — OpenID Connect RP-Initiated Logout 1.0, end_session_endpoint
+ * — API layer: logic only.
+ *
+ * This module was generated because the OP was created with
+ * \`--enable rp-initiated-logout\`. It is backed by
+ * ${EXPERIMENTAL_PACKAGE}, whose API is NOT stable: it may change in a breaking
+ * way between releases. Do not build production code on it without pinning the
+ * version.
+ *
+ * The RP sends the user agent to /logout (GET or POST, §2 MUST) to end the OP
+ * browser session. A request whose id_token_hint verifies against this OP's
+ * keys AND matches the current session's End-User logs out immediately; every
+ * other request — no hint, an invalid or expired hint, a client_id that
+ * mismatches the hint audience, no session, another user's session — falls to
+ * one shared confirmation screen (§2 MUST; §7: an unauthenticated logout link
+ * would otherwise be a denial-of-service primitive). The failure reason is
+ * never disclosed anywhere: a reason would turn this endpoint into an oracle
+ * for session state.
+ *
+ * Neither function below builds a Response: each returns an outcome (which
+ * screen or redirect comes next, with which cookies), and pages/logout.ts —
+ * which owns the GET and POST routes — turns it into HTTP.
+ *
+ * ## Why the confirmation approve step demands a cookie + token pair
+ *
+ * The approve POST ends a session, so a forged cross-site POST must not drive
+ * it. When the confirmation screen is shown the OP mints a fresh secret and
+ * hands it to that one browser twice: in an HttpOnly cookie and in the form's
+ * hidden csrf_token. approveLogout() runs only when both come back equal. An
+ * attacker can obtain a valid pair in their own browser but cannot plant that
+ * cookie into the victim's, so the forged POST fails the comparison — the
+ * same model as the device verification binding cookie (see store.ts).
+ *
+ * The cookie also carries the OP-computed post-logout redirect target, so the
+ * confirmation flow never round-trips the id_token_hint (or any redirect
+ * parameter) through the HTML page: the only value the form submits back is
+ * the csrf_token itself.
+ */
+import {
+  decideLogoutFlow,
+  extractIdTokenHintAudience,
+  parseEndSessionRequest,
+  resolvePostLogoutRedirect,
+} from '${EXPERIMENTAL_PACKAGE}/rp-initiated-logout';
+import { IdTokenHintError, generateRandomString, validateIdTokenHint } from '${corePkg}';
+import {
+  browserSessionStore as defaultBrowserSessionStore,
+  buildClearedLogoutConfirmationCookie,
+  buildClearedSessionCookie,
+  buildLogoutConfirmationCookie,
+  parseLogoutConfirmation,
+  parseSessionId,
+} from '../store.js';
+import { defaultProviderConfig } from '../config.js';
+
+/**
+ * EXPERIMENTAL — settings for RP-Initiated Logout.
+ *
+ * postLogoutRedirectUris is the registry §3 checks against: client_id → the
+ * exact post_logout_redirect_uri values that client registered (a registry of
+ * its own — the authorize redirect_uris are NOT reused). A requested URI is
+ * used only on an exact string match for the client the id_token_hint
+ * verified for; everything else falls back to the completed page
+ * (fail-closed). The default is empty, so no logout redirect happens until
+ * you register one here.
+ */
+export const rpInitiatedLogoutConfig = {
+  postLogoutRedirectUris: {} as Record<string, string[]>,
+};
+
+/** What a logout step decided; pages/logout.ts turns it into HTTP. */
+export type LogoutOutcome =
+  /** Forged, replayed or expired confirmation: nothing was deleted (400). */
+  | { kind: 'invalid_confirmation' }
+  /** §2 MUST: ask first. cookies pairs the HttpOnly secret with the form's csrf_token. */
+  | { kind: 'confirmation'; csrfToken: string; cookies: string[] }
+  /** Logged out; §3: return to the registered post_logout_redirect_uri (state appended). */
+  | { kind: 'redirect'; location: string; cookies: string[] }
+  /** Logged out; no registered redirect applied, so show the completed screen. */
+  | { kind: 'completed'; cookies: string[] };
+
+/**
+ * Interpret one end_session request (§2). GET and POST share this function —
+ * they differ only in where the parameters come from.
+ */
+export async function processEndSessionRequest(c: any, params: URLSearchParams): Promise<LogoutOutcome> {
+  const browserSessionStore = c.get('browserSessionStore') ?? defaultBrowserSessionStore;
+  const config = c.get('config') ?? defaultProviderConfig;
+  const request = parseEndSessionRequest(params);
+  // logout_hint and ui_locales are accepted but unused (OPTIONAL, §2): the
+  // hint is not read past parsing and is never logged — it can identify the
+  // End-User. The same goes for the id_token_hint value itself.
+
+  // §2: verify the hint (signature / iss / aud / exp) against the same key
+  // set id_token_hint uses elsewhere (context jwksProvider). The expected
+  // audience is the client_id parameter when present, otherwise it is
+  // extracted — unverified — from the hint payload; trust comes from
+  // validateIdTokenHint afterwards.
+  let verifiedHint: { sub: string; [key: string]: unknown } | null = null;
+  let expectedAudience: string | null = null;
+  if (request.idTokenHint !== undefined) {
+    expectedAudience = request.clientId ?? extractIdTokenHintAudience(request.idTokenHint);
+    if (expectedAudience !== null) {
+      try {
+        const jwks = await c.get('jwksProvider')();
+        verifiedHint = await validateIdTokenHint(request.idTokenHint, {
+          expectedIss: config.issuer,
+          expectedAud: expectedAudience,
+          jwks,
+        });
+      } catch (error) {
+        // An expired, tampered or foreign hint is not an error to report — it
+        // just fails to prove logout authority, so the request falls to the
+        // confirmation path (§2 MUST) with no reason disclosed. Anything that
+        // is not a hint-validation failure (e.g. the JWKS provider itself
+        // failing) is rethrown: masking an outage as \"invalid hint\" would
+        // silently degrade every logout into a confirmation.
+        if (!(error instanceof IdTokenHintError)) throw error;
+        verifiedHint = null;
+      }
+    }
+  }
+
+  const sessionId = parseSessionId(c.req.header('Cookie') ?? null);
+  const session = sessionId ? await browserSessionStore.get(sessionId) : undefined;
+
+  const decision = decideLogoutFlow({
+    verifiedHint,
+    expectedAudience,
+    clientIdParam: request.clientId,
+    sessionSubject: session ? session.subject : null,
+  });
+
+  // §3: redirect only to the verified client's exactly-matching registered
+  // URI, with state appended. Resolved before the branch because the
+  // confirmation flow honors the same result after approval — the redirect
+  // condition is the hint and the exact match, not which path the logout took.
+  const redirectTo = resolvePostLogoutRedirect({
+    postLogoutRedirectUri: request.postLogoutRedirectUri,
+    state: request.state,
+    verifiedClientId: decision.verifiedClientId,
+    registeredUris:
+      decision.verifiedClientId === null
+        ? []
+        : rpInitiatedLogoutConfig.postLogoutRedirectUris[decision.verifiedClientId] ?? [],
+  });
+
+  if (decision.requiresConfirmation) {
+    // §2 MUST. Nothing is deleted here, and the screen's wording never varies
+    // with session state. The minted secret pairs the HttpOnly cookie with the
+    // form's hidden csrf_token; the redirect target rides inside the cookie.
+    const csrfSecret = generateRandomString(32);
+    return {
+      kind: 'confirmation',
+      csrfToken: csrfSecret,
+      cookies: [buildLogoutConfirmationCookie({ csrfSecret, redirectTo })],
+    };
+  }
+
+  // Immediate logout: a valid hint for the current session's End-User (§2).
+  // Delete the store entry and expire the cookie together.
+  if (sessionId) {
+    await browserSessionStore.delete(sessionId);
+  }
+  const cookies = [buildClearedSessionCookie()];
+  if (redirectTo !== null) {
+    return { kind: 'redirect', location: redirectTo, cookies };
+  }
+  return { kind: 'completed', cookies };
+}
+
+/**
+ * Confirmation approve (POST /logout/approve)
+ *
+ * Runs only for the browser that saw the confirmation screen: the HttpOnly
+ * cookie and the hidden csrf_token must present the same secret (neither
+ * alone is accepted). On success the session is deleted and the redirect
+ * decision computed when the screen was shown — carried in the cookie, never
+ * in the form — is honored (§3).
+ */
+export async function approveLogout(c: any, csrfToken: string): Promise<LogoutOutcome> {
+  const browserSessionStore = c.get('browserSessionStore') ?? defaultBrowserSessionStore;
+
+  const confirmation = parseLogoutConfirmation(c.req.header('Cookie') ?? null);
+  if (confirmation === null || csrfToken === '' || confirmation.csrfSecret !== csrfToken) {
+    // Forged, replayed or expired confirmation: delete nothing.
+    return { kind: 'invalid_confirmation' };
+  }
+
+  // The End-User explicitly approved (§2). When the session is already gone
+  // there is nothing to delete and the answer is the same either way — the
+  // confirmation flow is not an oracle for whether a session existed.
+  const sessionId = parseSessionId(c.req.header('Cookie') ?? null);
+  if (sessionId) {
+    await browserSessionStore.delete(sessionId);
+  }
+  const cookies = [buildClearedSessionCookie(), buildClearedLogoutConfirmationCookie()];
+  if (confirmation.redirectTo !== null) {
+    return { kind: 'redirect', location: confirmation.redirectTo, cookies };
+  }
+  return { kind: 'completed', cookies };
+}
+`;
+}
+export function backchannelAuthenticationRouteTemplate(corePkg, features = DEFAULT_FEATURES, scopes = []) {
+    const refreshTokenFeatureEnabled = features.refreshToken ? 'true' : 'false';
+    const customScopesDeclared = scopes.length > 0;
+    const customScopeImport = customScopesDeclared
+        ? `
+import { findUnsupportedScopes } from '../scopes.js';`
+        : '';
+    const customScopeStep = customScopesDeclared
+        ? `    // RFC 6749 §3.3: reject a scope this OP never declared, the same allow list
+    // /authorize uses (scopes.ts). Checked before the pipeline so a request for
+    // an unknown scope never reaches the store. offline_access is left out of
+    // the check: the pipeline applies its own policy and ignores it when it
+    // cannot be granted (OIDC Core 1.0 §11), which must not become an error.
+    const unsupportedScopes = findUnsupportedScopes(
+      (params['scope'] ?? '')
+        .split(' ')
+        .filter((scope) => scope.length > 0 && scope !== 'offline_access'),
+    );
+    if (unsupportedScopes.length > 0) {
+      throw new BackchannelAuthenticationError(
+        'invalid_scope',
+        'Unsupported scope: ' + unsupportedScopes.join(' '),
+      );
+    }
+
+`
+        : '';
+    return `/**
+ * EXPERIMENTAL — OpenID Connect Client-Initiated Backchannel Authentication
+ * (CIBA Core 1.0), poll mode.
+ *
+ * This route was generated because the OP was created with \`--enable ciba\`.
+ * It is backed by ${EXPERIMENTAL_PACKAGE}, whose API is NOT stable: it may
+ * change in a breaking way between releases. Do not build production code on it
+ * without pinning the version.
  *
  * The consumption device (a call-center console, a kiosk, a smart speaker
  * backend) POSTs here — back channel, client-authenticated — with a login_hint
@@ -4133,7 +4591,7 @@ export function cibaVerificationRouteTemplate(corePkg, scopes = []) {
 import { resolveGrantableScopes } from '../scopes.js';`
         : '';
     const pendingRequestRows = customScopesDeclared
-        ? `  const requests = await Promise.all(
+        ? `  return Promise.all(
     pending.map(async (record) => ({
       authReqId: record.authReqId,
       clientId: record.clientId,
@@ -4143,17 +4601,14 @@ import { resolveGrantableScopes } from '../scopes.js';`
       expiresInSeconds: remainingSeconds(record.expiresAt),
       csrfToken: record.csrfToken ?? '',
     })),
-  );
-  return renderView(views.cibaPendingRequestsPage({ requests }));`
-        : `  return renderView(views.cibaPendingRequestsPage({
-    requests: pending.map((record) => ({
-      authReqId: record.authReqId,
-      clientId: record.clientId,
-      scopes: record.scope,
-      bindingMessage: record.bindingMessage,
-      expiresInSeconds: remainingSeconds(record.expiresAt),
-      csrfToken: record.csrfToken ?? '',
-    })),
+  );`
+        : `  return pending.map((record) => ({
+    authReqId: record.authReqId,
+    clientId: record.clientId,
+    scopes: record.scope,
+    bindingMessage: record.bindingMessage,
+    expiresInSeconds: remainingSeconds(record.expiresAt),
+    csrfToken: record.csrfToken ?? '',
   }));`;
     const approveNarrowStep = customScopesDeclared
         ? `      // Apply the scope policy to what was approved. approveCibaRequest()
@@ -4171,9 +4626,9 @@ import { resolveGrantableScopes } from '../scopes.js';`
         : '';
     return `/**
  * EXPERIMENTAL — OpenID Connect Client-Initiated Backchannel Authentication
- * (CIBA Core 1.0), authentication device UI.
+ * (CIBA Core 1.0), authentication device UI — API layer: logic only.
  *
- * This route was generated because the OP was created with \`--enable ciba\`.
+ * This module was generated because the OP was created with \`--enable ciba\`.
  * It is backed by ${EXPERIMENTAL_PACKAGE}, whose API is NOT stable: it may
  * change in a breaking way between releases. Do not build production code on it
  * without pinning the version.
@@ -4186,6 +4641,11 @@ import { resolveGrantableScopes } from '../scopes.js';`
  * outcome only by polling the token endpoint — there is no push channel in
  * poll mode.
  *
+ * The three functions below are the three steps of that UI. None of them
+ * builds a Response: each returns an outcome (which screen comes next, with
+ * which cookies), and pages/ciba.ts — which owns the GET and POST routes —
+ * turns it into HTTP.
+ *
  * ## Why the login form demands a binding cookie
  *
  * A successful login establishes an OP session, whose reach goes beyond CIBA
@@ -4203,7 +4663,6 @@ import { resolveGrantableScopes } from '../scopes.js';`
  * ever rendered on the session-gated listing. Knowing an auth_req_id gives an
  * attacker no step to forge.
  */
-import { Hono } from 'hono';
 import {
   CibaVerificationError,
   approveCibaRequest,
@@ -4225,35 +4684,66 @@ import {
   parseSessionId,
   userStore,
 } from '../store.js';
-import { defaultViews, renderView } from '../views.js';
 import { cibaConfig } from './backchannel-authentication.js';${customScopeImport}
 
-export const cibaApp = new Hono<{ Variables: Record<string, any> }>();
+/** One pending backchannel authentication request, as the approval screen shows it. */
+export interface CibaPendingRequest {
+  /** auth_req_id; posted back by the decision form. */
+  authReqId: string;
+  clientId: string;
+  /** Scopes this End-User is asked to grant (already narrowed by the scope policy). */
+  scopes: string[];
+  /** CIBA Core 1.0 §7.1 binding_message, client-supplied: escape before rendering. */
+  bindingMessage?: string;
+  expiresInSeconds: number;
+  /** Per-record CSRF token; posted back by the decision form. */
+  csrfToken: string;
+}
+
+/** What a step of the UI decided; pages/ciba.ts turns it into the next screen. */
+export type CibaOutcome =
+  /** A binding or CSRF failure the OP shows on its own error page. */
+  | { kind: 'error'; error: string; statusCode: number }
+  /** The decision step needs an OP session this browser does not have (401). */
+  | { kind: 'session_required' }
+  /** decision was neither approve nor deny (400). */
+  | { kind: 'invalid_decision' }
+  /** recordCibaLoginFailure() discarded the login transaction: no further attempt (429). */
+  | { kind: 'locked_out' }
+  /** Show the sign-in form; cookies carries the binding its submission needs. */
+  | { kind: 'login'; loginTransactionId: string; csrfToken: string; cookies: string[] }
+  /** Wrong credentials: show the sign-in form again with the attempts left. */
+  | {
+      kind: 'invalid_credentials';
+      loginTransactionId: string;
+      csrfToken: string;
+      remainingAttempts: number;
+    }
+  /** Show the signed-in user's pending requests; cookies carries a new OP session, if any. */
+  | { kind: 'pending_requests'; requests: CibaPendingRequest[]; cookies: string[] }
+  /** The decision is recorded. */
+  | { kind: 'completed'; approved: boolean; clientId: string };
 
-/**
- * Attach a Set-Cookie to a Response a view already produced.
- *
- * renderView() builds its own Response, so headers staged on the framework
- * context never reach it. Rebuilding the Response is the framework-neutral way
- * to add the cookie without making views cookie-aware.
- */
-function withCookie(response: Response, cookie: string): Response {
-  const headers = new Headers(response.headers);
-  headers.append('Set-Cookie', cookie);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-  });
+/** The fields of the sign-in form. */
+export interface CibaLoginSubmission {
+  loginTransactionId: string;
+  csrfToken: string;
+  username: string;
+  password: string;
+}
+
+/** The fields of the approve / deny form. */
+export interface CibaDecisionSubmission {
+  authReqId: string;
+  csrfToken: string;
+  /** 'approve' or 'deny'. */
+  decision: string;
 }
 
-/** Map a verification failure to its error page; anything else is re-thrown. */
-function renderVerificationError(views: typeof defaultViews, error: unknown): Response {
+/** Map a verification failure to the error to show; anything else is re-thrown. */
+function verificationFailure(error: unknown): CibaOutcome {
   if (error instanceof CibaVerificationError) {
-    return renderView(
-      views.errorPage({ error: error.message, statusCode: error.statusCode }),
-      { status: error.statusCode },
-    );
+    return { kind: 'error', error: error.message, statusCode: error.statusCode };
   }
   throw error;
 }
@@ -4264,26 +4754,23 @@ function remainingSeconds(expiresAt: Date): number {
 }
 
 /**
- * Render the session subject's pending requests with freshly rotated CSRF
- * tokens (the only place those tokens are ever exposed, and it is
- * session-gated).
+ * The session subject's pending requests with freshly rotated CSRF tokens (the
+ * only place those tokens are ever exposed, and it is session-gated).
  */
-async function renderPendingRequests(c: any, subject: string): Promise<Response> {
-  const views = c.get('views') ?? defaultViews;
+async function listPendingRequests(c: any, subject: string): Promise<CibaPendingRequest[]> {
   const cibaStore = c.get('cibaAuthenticationRequestStore') ?? defaultCibaAuthenticationRequestStore;
   const pending = await listPendingCibaRequests({ subject, store: cibaStore });
 ${pendingRequestRows}
 }
 
 /**
- * Listing / login form - GET
+ * Listing / login form (GET /ciba)
  *
- * With an OP session: list the pending requests addressed to the signed-in
- * user. Without one: mint a login transaction and show the sign-in form, with
- * the binding cookie this response sets.
+ * With an OP session: the pending requests addressed to the signed-in user.
+ * Without one: mint a login transaction and describe the sign-in form, with the
+ * binding cookie its submission needs.
  */
-cibaApp.get('/', async (c) => {
-  const views = c.get('views') ?? defaultViews;
+export async function prepareCibaDevice(c: any): Promise<CibaOutcome> {
   const browserSessionStore = c.get('browserSessionStore') ?? defaultBrowserSessionStore;
   const loginTransactionStore =
     c.get('cibaLoginTransactionStore') ?? defaultCibaLoginTransactionStore;
@@ -4291,7 +4778,7 @@ cibaApp.get('/', async (c) => {
   const sessionId = parseSessionId(c.req.header('Cookie') ?? null);
   const session = sessionId ? await browserSessionStore.get(sessionId) : undefined;
   if (session) {
-    return renderPendingRequests(c, session.subject);
+    return { kind: 'pending_requests', requests: await listPendingRequests(c, session.subject), cookies: [] };
   }
 
   const { record, bindingSecret } = await createCibaLoginTransaction(loginTransactionStore);
@@ -4300,28 +4787,25 @@ cibaApp.get('/', async (c) => {
     bindingSecret,
     remainingSeconds(record.expiresAt),
   );
-  return withCookie(renderView(views.cibaLoginPage({
+  return {
+    kind: 'login',
     loginTransactionId: record.id,
     csrfToken: record.csrfToken,
-  })), cookie);
-});
+    cookies: [cookie],
+  };
+}
 
 /**
- * Sign in - POST
+ * Sign in (POST /ciba/login)
  *
  * Binding first, then CSRF, then credentials: the binding is what proves this
  * is the browser the login form was issued to, and it must gate the step that
  * would otherwise let a forged POST establish an OP session in the victim's
  * browser.
  */
-cibaApp.post('/login', async (c) => {
-  const body = await c.req.parseBody();
-  const transactionId = String(body['login_transaction_id'] ?? '');
-  const csrfToken = String(body['csrf_token'] ?? '');
-  const username = String(body['username'] ?? '');
-  const password = String(body['password'] ?? '');
-
-  const views = c.get('views') ?? defaultViews;
+export async function submitCibaLogin(c: any, input: CibaLoginSubmission): Promise<CibaOutcome> {
+  const { loginTransactionId: transactionId, csrfToken, username, password } = input;
+
   const browserSessionStore = c.get('browserSessionStore') ?? defaultBrowserSessionStore;
   const loginTransactionStore =
     c.get('cibaLoginTransactionStore') ?? defaultCibaLoginTransactionStore;
@@ -4338,7 +4822,7 @@ cibaApp.post('/login', async (c) => {
       store: loginTransactionStore,
     });
   } catch (error) {
-    return renderVerificationError(views, error);
+    return verificationFailure(error);
   }
 
   // Swap point: replace this with your own credential check (LDAP, WebAuthn, an
@@ -4356,17 +4840,14 @@ cibaApp.post('/login', async (c) => {
     );
     if (!failure.canRetry) {
       // The transaction is gone: this form cannot be retried at all.
-      return renderView(views.errorPage({
-        error: 'Too many login attempts',
-        statusCode: 429,
-      }), { status: 429 });
+      return { kind: 'locked_out' };
     }
-    return renderView(views.cibaLoginPage({
+    return {
+      kind: 'invalid_credentials',
       loginTransactionId: transaction.id,
       csrfToken: transaction.csrfToken,
-      error: 'Invalid credentials',
       remainingAttempts: failure.remainingAttempts,
-    }));
+    };
   }
 
   // The transaction is single-use: a successful login consumes it, and the
@@ -4377,29 +4858,25 @@ cibaApp.post('/login', async (c) => {
   const sessionId = generateRandomString(32);
   await browserSessionStore.set(sessionId, { subject: user.sub, authTime });
 
-  // Two cookies on one response: the new OP session, and the cleared login
-  // binding (it is single-use and would otherwise linger until Max-Age).
-  const listing = await renderPendingRequests(c, user.sub);
-  return withCookie(
-    withCookie(listing, buildSessionCookie(sessionId)),
-    buildClearedCibaLoginBindingCookie(transaction.id),
-  );
-});
+  // Two cookies travel with the listing: the new OP session, and the cleared
+  // login binding (it is single-use and would otherwise linger until Max-Age).
+  return {
+    kind: 'pending_requests',
+    requests: await listPendingRequests(c, user.sub),
+    cookies: [buildSessionCookie(sessionId), buildClearedCibaLoginBindingCookie(transaction.id)],
+  };
+}
 
 /**
- * Approve or deny - POST
+ * Approve or deny (POST /ciba/approve)
  *
  * The only state-changing step of the UI. It demands an OP session whose
  * subject owns the record, plus the per-record csrf_token from the
  * session-gated listing.
  */
-cibaApp.post('/approve', async (c) => {
-  const body = await c.req.parseBody();
-  const authReqId = String(body['auth_req_id'] ?? '');
-  const csrfToken = String(body['csrf_token'] ?? '');
-  const decision = String(body['decision'] ?? '');
+export async function submitCibaDecision(c: any, input: CibaDecisionSubmission): Promise<CibaOutcome> {
+  const { authReqId, csrfToken, decision } = input;
 
-  const views = c.get('views') ?? defaultViews;
   const browserSessionStore = c.get('browserSessionStore') ?? defaultBrowserSessionStore;
   const cibaStore = c.get('cibaAuthenticationRequestStore') ?? defaultCibaAuthenticationRequestStore;
   const consentResolver = c.get('consentResolver');
@@ -4407,18 +4884,11 @@ cibaApp.post('/approve', async (c) => {
   const sessionId = parseSessionId(c.req.header('Cookie') ?? null);
   const session = sessionId ? await browserSessionStore.get(sessionId) : undefined;
   if (!session) {
-    return renderView(views.errorPage({
-      error: 'Sign in again to review this request',
-      statusCode: 401,
-    }), { status: 401 });
+    return { kind: 'session_required' };
   }
 
   if (decision !== 'approve' && decision !== 'deny') {
-    return renderView(views.errorPage({
-      error: 'invalid_request',
-      errorDescription: 'decision must be approve or deny',
-      statusCode: 400,
-    }), { status: 400 });
+    return { kind: 'invalid_decision' };
   }
 
   try {
@@ -4442,10 +4912,7 @@ ${approveNarrowStep}      // Record the consent the same way /consent does, so a
         approved.approvedScope ?? approved.scope,
       );
       await consentResolver?.recordGrant?.(approved.subject, approved.clientId, approved.grantId);
-      return renderView(views.cibaCompletedPage({
-        approved: true,
-        clientId: approved.clientId,
-      }));
+      return { kind: 'completed', approved: true, clientId: approved.clientId };
     }
 
     const record = await cibaStore.findByAuthReqId(authReqId);
@@ -4455,14 +4922,11 @@ ${approveNarrowStep}      // Record the consent the same way /consent does, so a
       csrfToken,
       store: cibaStore,
     });
-    return renderView(views.cibaCompletedPage({
-      approved: false,
-      clientId: record?.clientId ?? '',
-    }));
+    return { kind: 'completed', approved: false, clientId: record?.clientId ?? '' };
   } catch (error) {
-    return renderVerificationError(views, error);
+    return verificationFailure(error);
   }
-});
+}
 `;
 }
 export function jarmConfigTemplate() {
@@ -6583,6 +7047,11 @@ import { parConfig } from './par.js';`
     // introspection_signed_response_alg), so exactly one alg is advertised.
     introspection_signing_alg_values_supported: ['RS256'],`
         : '';
+    const rpInitiatedLogoutDiscoveryMetadata = features.rpInitiatedLogout
+        ? `
+    // EXPERIMENTAL — RP-Initiated Logout 1.0 §2.1 metadata.
+    end_session_endpoint: \`\${issuer}/logout\`,`
+        : '';
     return `import { Hono } from 'hono';
 import { buildProviderMetadata, getJwaAlgorithm, type SigningKey } from '${corePkg}';
 import { defaultProviderConfig } from '../config.js';${parDiscoveryImport}${customScopeImport}
@@ -6695,17 +7164,16 @@ ${rfc8414Comment}${introspectionMetadata}${revocationMetadata}  });
   // not in OIDC Discovery, so it is added separately.
   return c.json({
     ...metadata,
-    code_challenge_methods_supported: ['S256'],${parDiscoveryMetadata}${deviceDiscoveryMetadata}${cibaDiscoveryMetadata}${jarmDiscoveryMetadata}${idJagDiscoveryMetadata}${jwtIntrospectionResponseDiscoveryMetadata}
+    code_challenge_methods_supported: ['S256'],${parDiscoveryMetadata}${deviceDiscoveryMetadata}${cibaDiscoveryMetadata}${jarmDiscoveryMetadata}${idJagDiscoveryMetadata}${jwtIntrospectionResponseDiscoveryMetadata}${rpInitiatedLogoutDiscoveryMetadata}
   });
 });
 `;
 }
 export function loginRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
-    const bindingImports = features.transactionBinding
+    const bindingCoreImports = features.transactionBinding
         ? `
   validateTransactionBinding,
-  AuthTransactionError,
-  type AuthTransaction,`
+  AuthTransactionError,`
         : '';
     const bindingStoreImport = features.transactionBinding
         ? `
@@ -6715,48 +7183,39 @@ export function loginRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
         ? `
 /**
  * Enforce that this step comes from the User-Agent that started the transaction
- * (OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4). Returns an error Response to send
- * back, or undefined when the binding holds.
+ * (OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4). Returns the error to show, or
+ * undefined when the binding holds.
  *
- * The failure is rendered by the OP itself and never redirected to the client's
+ * The failure is shown by the OP itself and never redirected to the client's
  * redirect_uri: at this point we cannot tell whose transaction this is, so
  * answering the client would leak that a transaction exists — and, in the
  * lured-victim case, would hand the attacker's client a code for the victim.
  * See buildTransactionBindingCookie() in store.ts for the full threat model.
  */
 async function rejectUnboundTransaction(
+  c: any,
   transaction: AuthTransaction,
   transactionId: string,
-  cookieHeader: string | null,
-  views: typeof defaultViews,
-): Promise<Response | undefined> {
+): Promise<LoginError | undefined> {
   try {
     await validateTransactionBinding(
       transaction,
-      parseTransactionBindingSecret(cookieHeader, transactionId),
+      parseTransactionBindingSecret(c.req.header('Cookie') ?? null, transactionId),
     );
     return undefined;
   } catch (error) {
     if (!(error instanceof AuthTransactionError)) throw error;
-    return renderView(views.errorPage({
-      error: error.message,
-      statusCode: error.httpStatusCode,
-    }), { status: error.httpStatusCode });
+    return { kind: 'error', error: error.message, statusCode: error.httpStatusCode };
   }
 }
 `
         : '';
     const bindingCheckBeforeLoginForm = features.transactionBinding
         ? `
-  // Checked BEFORE rendering: the login page embeds csrf_token, so anyone who
-  // could load this page with a leaked transaction_id would obtain the token
-  // that the POST handlers validate.
-  const bindingError = await rejectUnboundTransaction(
-    transaction,
-    transactionId,
-    c.req.header('Cookie') ?? null,
-    views,
-  );
+  // Checked BEFORE the form is described: the login page embeds csrf_token, so
+  // anyone who could load it with a leaked transaction_id would obtain the
+  // token that submitLogin() validates.
+  const bindingError = await rejectUnboundTransaction(c, transaction, transactionId);
   if (bindingError) return bindingError;
 `
         : '';
@@ -6764,105 +7223,170 @@ async function rejectUnboundTransaction(
         ? `  // Checked before validateCsrfToken: the CSRF token only proves the request
   // carries a value from the form, and that form is reachable by anyone holding
   // transaction_id. The binding proves it is the same browser.
-  const bindingError = await rejectUnboundTransaction(
-    transaction,
-    transactionId,
-    c.req.header('Cookie') ?? null,
-    views,
-  );
+  const bindingError = await rejectUnboundTransaction(c, transaction, transactionId);
   if (bindingError) return bindingError;
 `
         : '';
-    return `import { Hono } from 'hono';
+    const googleLoginImports = features.googleLogin
+        ? `
 import {
-  getAuthTransaction,
-  validateCsrfToken,${bindingImports}
-  handleLoginFailure,
-  generateRandomString,
-} from '${corePkg}';
+  handleGoogleLoginRedirect,
+  issueGoogleLoginNonce,
+  resolveGoogleLoginSubject,
+  GoogleLoginError,
+  type GoogleIdTokenPayload,
+} from '${GOOGLE_LOGIN_PACKAGE}';
 import {
-  transactionStore as defaultTransactionStore,
-  authSessionStore as defaultAuthSessionStore,
-  browserSessionStore as defaultBrowserSessionStore,
-  buildSessionCookie,
-  parseSessionId,${bindingStoreImport}
-  userStore,
-} from '../store.js';
-import { defaultProviderConfig } from '../config.js';
-import { defaultViews, renderView } from '../views.js';
-
-export const loginApp = new Hono<{ Variables: Record<string, any> }>();
-${bindingGuard}
+  buildGoogleSignInAttributes,
+  type GoogleSignInAttributes,
+} from '${GOOGLE_LOGIN_PACKAGE}/sign-in';`
+        : '';
+    const googleStoreImport = features.googleLogin
+        ? `
+  googleLoginNonceStore as defaultGoogleLoginNonceStore,`
+        : '';
+    const googleConfigImport = features.googleLogin
+        ? `
+import { defaultProviderConfig, type GoogleLoginConfig } from '../config.js';`
+        : '';
+    const googleScreenField = features.googleLogin
+        ? `
+  /**
+   * EXTENSION (google-login): the GIS configuration (g_id_onload attributes) of
+   * the "Sign in with Google" button; undefined until config.googleLogin is set.
+   */
+  googleSignIn?: GoogleSignInAttributes;`
+        : '';
+    const googleScreenValue = features.googleLogin
+        ? `
+    googleSignIn: await buildGoogleSignIn(c, transactionId, transaction),`
+        : '';
+    const screenContextParam = features.googleLogin ? '  c: any,\n' : '';
+    const screenContextArg = features.googleLogin ? 'c, ' : '';
+    const googleLoginHelpers = features.googleLogin
+        ? `
 /**
- * Login Page - GET
- * Displays the login form for user authentication.
+ * EXTENSION (google-login): build the GIS configuration (the g_id_onload
+ * attributes) for this transaction, or undefined when config.googleLogin is not
+ * set. Rendering is the view's job (views.ts): the package generates no UI.
+ * Every description of the form issues a fresh nonce bound to the transaction:
+ * Google echoes it in the ID token, which is how completeGoogleLogin() finds
+ * its way back to this authorization request (the redirect-mode POST carries
+ * nothing else).
  */
-loginApp.get('/', async (c) => {
-  const transactionId = c.req.query('transaction_id');
-  if (!transactionId) {
-    return c.text('Missing transaction_id', 400);
-  }
-
-  const views = c.get('views') ?? defaultViews;
-  const transactionStore = c.get('transactionStore') ?? defaultTransactionStore;
-  const transaction = await getAuthTransaction(transactionId, transactionStore);
-${bindingCheckBeforeLoginForm}
-  return renderView(views.loginPage({
+async function buildGoogleSignIn(
+  c: any,
+  transactionId: string,
+  transaction: AuthTransaction,
+): Promise<GoogleSignInAttributes | undefined> {
+  const config = c.get('config') ?? defaultProviderConfig;
+  const googleLogin: GoogleLoginConfig | undefined = config.googleLogin;
+  if (!googleLogin) return undefined;
+  const nonceStore = c.get('googleLoginNonceStore') ?? defaultGoogleLoginNonceStore;
+  const nonce = await issueGoogleLoginNonce({
     transactionId,
-    csrfToken: transaction.csrfToken,
-    // OIDC Core 1.0 §3.1.2.1: pre-fill the login form with login_hint (RECOMMENDED).
+    expiresAt: transaction.expiresAt,
+    store: nonceStore,
+  });
+  return buildGoogleSignInAttributes({
+    clientId: googleLogin.clientId,
+    // Must equal an authorized redirect URI of the Google OAuth client. Built on
+    // config.issuer for the same reason as the /consent redirect (RFC 9700 §2.1).
+    loginUri: new URL('/login/google', config.issuer).toString(),
+    nonce,
+    // OIDC Core 1.0 §3.1.2.1: pass login_hint on so Google can preselect the account.
     loginHint: transaction.loginHint,
-  }));
-});
+    hostedDomain: typeof googleLogin.hostedDomain === 'string' ? googleLogin.hostedDomain : undefined,
+  });
+}
 
 /**
- * Login Handler - POST
- * Processes the login form submission.
+ * EXTENSION (google-login): run the callback checks and map the Google account
+ * to an OP subject. Returns the error to show on failure so a failed Google
+ * callback is never redirected to a client — until the nonce is verified the
+ * OP cannot tell whose transaction this is.
+ */
+async function verifyGoogleLoginCallback(
+  c: any,
+  googleLogin: GoogleLoginConfig,
+): Promise<{ transactionId: string; subject: string } | LoginError> {
+  const nonceStore = c.get('googleLoginNonceStore') ?? defaultGoogleLoginNonceStore;
+  const verifier = c.get('googleIdTokenVerifier');
+  const accountResolver = c.get('googleAccountResolver') ?? {
+    resolveSubject: async (account: GoogleIdTokenPayload) =>
+      (await userStore.linkGoogleAccount(account)).sub,
+  };
+  try {
+    // Double Submit Cookie -> google-auth-library verification -> nonce lookup,
+    // in the order Google's server-side verification guide prescribes.
+    const login = await handleGoogleLoginRedirect({
+      params: await c.req.parseBody(),
+      cookieHeader: c.req.header('Cookie') ?? null,
+      clientId: googleLogin.clientId,
+      verifier,
+      nonceStore,
+      hostedDomain: googleLogin.hostedDomain,
+      requireVerifiedEmail: googleLogin.requireVerifiedEmail,
+    });
+    const subject = await resolveGoogleLoginSubject(login.account, accountResolver);
+    return { transactionId: login.transactionId, subject };
+  } catch (error) {
+    if (!(error instanceof GoogleLoginError)) throw error;
+    return {
+      kind: 'error',
+      error: error.code,
+      errorDescription: error.message,
+      statusCode: error.httpStatusCode,
+    };
+  }
+}
+`
+        : '';
+    const googleBindingNote = features.transactionBinding
+        ? `
+ *
+ * Transaction binding is deliberately NOT checked here: Google's POST is a
+ * cross-site navigation, so the browser withholds the SameSite=Lax binding
+ * cookie. The single-use nonce stands in for it — it was issued to the login
+ * page, which only the bound browser could fetch.`
+        : '';
+    const googleLoginOutcome = features.googleLogin
+        ? `
+/** What the Google login callback decided; pages/login.ts turns it into HTTP. */
+export type GoogleLoginOutcome =
+  | LoginError
+  /** config.googleLogin is not set: the callback does not exist (404). */
+  | { kind: 'not_configured' }
+  /** Signed in: the OP session cookie(s) to set, then continue to the consent step. */
+  | { kind: 'authenticated'; transactionId: string; cookies: string[] };
+`
+        : '';
+    const googleLoginFunction = features.googleLogin
+        ? `
+/**
+ * EXTENSION (google-login) — the Google login callback (login_uri), POST /login/google.
+ *
+ * Sign in with Google (redirect mode) posts the ID token here once the user
+ * picks an account. After the callback checks, this continues exactly like a
+ * successful password login: same session cookie, same consent hand-off.${googleBindingNote}
  */
-loginApp.post('/', async (c) => {
-  const body = await c.req.parseBody();
-  const transactionId = String(body['transaction_id'] ?? '');
-  const csrfToken = String(body['csrf_token'] ?? '');
-  const username = String(body['username'] ?? '');
-  const password = String(body['password'] ?? '');
-
-  const views = c.get('views') ?? defaultViews;
+export async function completeGoogleLogin(c: any): Promise<GoogleLoginOutcome> {
+  const config = c.get('config') ?? defaultProviderConfig;
+  if (!config.googleLogin) {
+    return { kind: 'not_configured' };
+  }
+
+  const verified = await verifyGoogleLoginCallback(c, config.googleLogin);
+  if ('kind' in verified) return verified;
+  const { transactionId, subject } = verified;
+
   const transactionStore = c.get('transactionStore') ?? defaultTransactionStore;
   const authSessionStore = c.get('authSessionStore') ?? defaultAuthSessionStore;
   const browserSessionStore = c.get('browserSessionStore') ?? defaultBrowserSessionStore;
-  const authenticateUser =
-    c.get('authenticateUser') ??
-    ((u: string, p: string) => userStore.authenticate(u, p));
-
   const transaction = await getAuthTransaction(transactionId, transactionStore);
-${bindingCheckBeforeLoginCsrf}  validateCsrfToken(transaction, csrfToken);
-
-  // Authenticate user
-  const user = await authenticateUser(username, password);
-  if (!user) {
-    const failureResult = await handleLoginFailure(
-      transactionId,
-      transaction,
-      transactionStore,
-    );
-    if (!failureResult.canRetry) {
-      return renderView(views.errorPage({
-        error: 'Too many login attempts',
-        statusCode: 429,
-      }), { status: 429 });
-    }
-    return renderView(views.loginPage({
-      transactionId,
-      csrfToken: transaction.csrfToken,
-      error: 'Invalid credentials',
-      remainingAttempts: failureResult.maxAttempts - failureResult.failedAttempts,
-      loginHint: transaction.loginHint,
-    }));
-  }
 
-  // prompt=login (and prompt=select_account in Phase 1) requires fresh
-  // authentication: discard any existing transaction handoff AND browser session.
-  // OIDC Core 1.0 Section 3.1.2.1 — prompt is a space-delimited list, use includes()
+  // prompt=login / select_account requires fresh authentication: discard any
+  // existing transaction handoff AND browser session (OIDC Core 1.0 Section 3.1.2.1).
   const loginPromptValues = transaction.prompt?.trim().split(/\\s+/).filter(Boolean) ?? [];
   if (loginPromptValues.includes('login') || loginPromptValues.includes('select_account')) {
     await authSessionStore.delete(transactionId);
@@ -6872,32 +7396,169 @@ ${bindingCheckBeforeLoginCsrf}  validateCsrfToken(transaction, csrfToken);
 
   const authTime = Math.floor(Date.now() / 1000);
 
-  // Establish a persistent browser (OP) session and set the session cookie so
-  // SSO / prompt=none / max_age work on subsequent authorization requests
-  // (OIDC Core 1.0 Section 3.1.2.3).
+  // Establish the browser (OP) session and the per-transaction handoff exactly
+  // as the password login does (OIDC Core 1.0 Section 3.1.2.3).
   const sessionId = await generateRandomString(32);
-  await browserSessionStore.set(sessionId, { subject: user.sub, authTime });
-  c.header('Set-Cookie', buildSessionCookie(sessionId));
+  await browserSessionStore.set(sessionId, { subject, authTime });
+  await authSessionStore.set(transactionId, { subject, authTime, sessionId });
 
-  // Store authenticated subject for the consent step (per-transaction handoff).
-  // sessionId も渡すのは online refresh token のため。consent 経由で発行する認可
-  // コードにこのセッションを引き継ぎ、ログアウトで使えなくなる RT を作る。
-  await authSessionStore.set(transactionId, {
-    subject: user.sub,
-    authTime,
-    sessionId,
-  });
+  return { kind: 'authenticated', transactionId, cookies: [buildSessionCookie(sessionId)] };
+}
+`
+        : '';
+    return `/**
+ * Login step (API layer: logic only).
+ *
+ * Everything the login screen has to decide lives here as plain functions:
+ * loading the transaction, the User-Agent binding, the credential check, the
+ * lockout, the OP session cookie and the hand-off to the consent step. None of
+ * them builds a Response — each returns an outcome, and pages/login.ts turns
+ * that outcome into a screen or a redirect. The UI can therefore be changed
+ * without touching this file.
+ */
+import {
+  getAuthTransaction,
+  validateCsrfToken,${bindingCoreImports}
+  handleLoginFailure,
+  generateRandomString,
+  type AuthTransaction,
+} from '${corePkg}';${googleLoginImports}
+import {
+  transactionStore as defaultTransactionStore,
+  authSessionStore as defaultAuthSessionStore,
+  browserSessionStore as defaultBrowserSessionStore,
+  buildSessionCookie,
+  parseSessionId,${bindingStoreImport}${googleStoreImport}
+  userStore,
+} from '../store.js';${googleConfigImport}
 
-  // Redirect to consent page. config.issuer, not the request URL, decides the
-  // redirect origin: some runtimes derive the request URL from the Host header,
-  // which would let the sender pick where transaction_id lands (OIDC Discovery
-  // 1.0 §3 / RFC 9700 §2.1).
-  const config = c.get('config') ?? defaultProviderConfig;
-  const consentUrl = new URL('/consent', config.issuer);
-  consentUrl.searchParams.set('transaction_id', transactionId);
-  return c.redirect(consentUrl.toString());
-});
-`;
+/** What the login form needs: prepared for GET /login and again after a failed attempt. */
+export interface LoginScreen {
+  kind: 'screen';
+  transactionId: string;
+  /** Must be posted back as the csrf_token field. */
+  csrfToken: string;
+  /**
+   * OIDC Core 1.0 §3.1.2.1 login_hint: untrusted external value the OP MAY use
+   * to pre-fill the login form.
+   */
+  loginHint?: string;${googleScreenField}
+}
+
+/** A failure the OP shows on its own error page (never redirected to the client). */
+export interface LoginError {
+  kind: 'error';
+  error: string;
+  errorDescription?: string;
+  statusCode: number;
+}
+
+/** What POST /login decided; pages/login.ts turns it into HTTP. */
+export type LoginOutcome =
+  | LoginError
+  /** handleLoginFailure() locked the transaction: no further attempt is accepted (429). */
+  | { kind: 'locked_out' }
+  /** Wrong credentials: show the form again with the attempts left. */
+  | { kind: 'invalid_credentials'; screen: LoginScreen; remainingAttempts: number }
+  /** Signed in: the OP session cookie(s) to set, then continue to the consent step. */
+  | { kind: 'authenticated'; transactionId: string; cookies: string[] };
+${googleLoginOutcome}
+/** The fields of the login form. */
+export interface LoginSubmission {
+  transactionId: string;
+  csrfToken: string;
+  username: string;
+  password: string;
+}
+${bindingGuard}${googleLoginHelpers}
+/** Describe the form for a transaction (the shared part of GET and a failed POST). */
+async function describeLoginScreen(
+${screenContextParam}  transactionId: string,
+  transaction: AuthTransaction,
+): Promise<LoginScreen> {
+  return {
+    kind: 'screen',
+    transactionId,
+    csrfToken: transaction.csrfToken,
+    loginHint: transaction.loginHint,${googleScreenValue}
+  };
+}
+
+/**
+ * GET /login: load the transaction and describe the form, or the error to show
+ * instead when this browser may not see it.
+ */
+export async function prepareLogin(c: any, transactionId: string): Promise<LoginScreen | LoginError> {
+  const transactionStore = c.get('transactionStore') ?? defaultTransactionStore;
+  const transaction = await getAuthTransaction(transactionId, transactionStore);
+${bindingCheckBeforeLoginForm}
+  return describeLoginScreen(${screenContextArg}transactionId, transaction);
+}
+
+/**
+ * POST /login: check the credentials and, on success, establish the OP session.
+ */
+export async function submitLogin(c: any, input: LoginSubmission): Promise<LoginOutcome> {
+  const { transactionId, csrfToken, username, password } = input;
+
+  const transactionStore = c.get('transactionStore') ?? defaultTransactionStore;
+  const authSessionStore = c.get('authSessionStore') ?? defaultAuthSessionStore;
+  const browserSessionStore = c.get('browserSessionStore') ?? defaultBrowserSessionStore;
+  const authenticateUser =
+    c.get('authenticateUser') ??
+    ((u: string, p: string) => userStore.authenticate(u, p));
+
+  const transaction = await getAuthTransaction(transactionId, transactionStore);
+${bindingCheckBeforeLoginCsrf}  validateCsrfToken(transaction, csrfToken);
+
+  // Authenticate user
+  const user = await authenticateUser(username, password);
+  if (!user) {
+    const failureResult = await handleLoginFailure(
+      transactionId,
+      transaction,
+      transactionStore,
+    );
+    if (!failureResult.canRetry) {
+      return { kind: 'locked_out' };
+    }
+    return {
+      kind: 'invalid_credentials',
+      screen: await describeLoginScreen(${screenContextArg}transactionId, transaction),
+      remainingAttempts: failureResult.maxAttempts - failureResult.failedAttempts,
+    };
+  }
+
+  // prompt=login (and prompt=select_account in Phase 1) requires fresh
+  // authentication: discard any existing transaction handoff AND browser session.
+  // OIDC Core 1.0 Section 3.1.2.1 — prompt is a space-delimited list, use includes()
+  const loginPromptValues = transaction.prompt?.trim().split(/\\s+/).filter(Boolean) ?? [];
+  if (loginPromptValues.includes('login') || loginPromptValues.includes('select_account')) {
+    await authSessionStore.delete(transactionId);
+    const existingSessionId = parseSessionId(c.req.header('Cookie') ?? null);
+    if (existingSessionId) await browserSessionStore.delete(existingSessionId);
+  }
+
+  const authTime = Math.floor(Date.now() / 1000);
+
+  // Establish a persistent browser (OP) session; its cookie travels with the
+  // answer so SSO / prompt=none / max_age work on subsequent authorization
+  // requests (OIDC Core 1.0 Section 3.1.2.3).
+  const sessionId = await generateRandomString(32);
+  await browserSessionStore.set(sessionId, { subject: user.sub, authTime });
+
+  // Store authenticated subject for the consent step (per-transaction handoff).
+  // sessionId も渡すのは online refresh token のため。consent 経由で発行する認可
+  // コードにこのセッションを引き継ぎ、ログアウトで使えなくなる RT を作る。
+  await authSessionStore.set(transactionId, {
+    subject: user.sub,
+    authTime,
+    sessionId,
+  });
+
+  return { kind: 'authenticated', transactionId, cookies: [buildSessionCookie(sessionId)] };
+}
+${googleLoginFunction}`;
 }
 export function consentRouteTemplate(corePkg, features = DEFAULT_FEATURES, scopes = []) {
     const customScopesDeclared = scopes.length > 0;
@@ -6906,10 +7567,10 @@ export function consentRouteTemplate(corePkg, features = DEFAULT_FEATURES, scope
 import { resolveGrantableScopes } from '../scopes.js';`
         : '';
     const consentGetScopeResolution = customScopesDeclared
-        ? `  // Display only what THIS End-User can actually grant. The subject comes from
-  // the auth session that /login (or the SSO fast path) stored for this
+        ? `  // Describe only what THIS End-User can actually grant. The subject comes
+  // from the auth session that /login (or the SSO fast path) stored for this
   // transaction; without one there is nothing to apply the policy to, so the
-  // request is shown as-is and POST /consent stops on the same missing session.
+  // request is shown as-is and submitConsent() stops on the same missing session.
   const authSessionStore = c.get('authSessionStore') ?? defaultAuthSessionStore;
   const consentSession = await authSessionStore.get(transactionId);
   const requestedScopes = transaction.scope.split(' ').filter(Boolean);
@@ -6933,7 +7594,7 @@ import { resolveGrantableScopes } from '../scopes.js';`
     session.subject,
   );`
         : `  const grantedScope = transaction.scope.split(' ').filter(Boolean);`;
-    const bindingImports = features.transactionBinding
+    const bindingCoreImports = features.transactionBinding
         ? `
   validateTransactionBinding,
   AuthTransactionError,
@@ -6948,47 +7609,38 @@ import { resolveGrantableScopes } from '../scopes.js';`
         ? `
 /**
  * Enforce that this step comes from the User-Agent that started the transaction
- * (OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4). Returns an error Response to send
- * back, or undefined when the binding holds.
+ * (OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4). Returns the error to show, or
+ * undefined when the binding holds.
  *
- * The failure is rendered by the OP itself and never redirected to the client's
+ * The failure is shown by the OP itself and never redirected to the client's
  * redirect_uri: without a verified owner, answering the client would let an
  * attacker who lured a victim into their own transaction collect a code for the
  * victim's identity. See buildTransactionBindingCookie() in store.ts.
  */
 async function rejectUnboundTransaction(
+  c: any,
   transaction: AuthTransaction,
   transactionId: string,
-  cookieHeader: string | null,
-  views: typeof defaultViews,
-): Promise<Response | undefined> {
+): Promise<ConsentError | undefined> {
   try {
     await validateTransactionBinding(
       transaction,
-      parseTransactionBindingSecret(cookieHeader, transactionId),
+      parseTransactionBindingSecret(c.req.header('Cookie') ?? null, transactionId),
     );
     return undefined;
   } catch (error) {
     if (!(error instanceof AuthTransactionError)) throw error;
-    return renderView(views.errorPage({
-      error: error.message,
-      statusCode: error.httpStatusCode,
-    }), { status: error.httpStatusCode });
+    return { kind: 'error', error: error.message, statusCode: error.httpStatusCode };
   }
 }
 `
         : '';
     const bindingCheckBeforeConsentForm = features.transactionBinding
         ? `
-  // Checked BEFORE rendering: the consent page embeds csrf_token, so a third
-  // party holding a leaked transaction_id must not be able to read it here and
-  // then complete POST /consent on the End-User's behalf.
-  const bindingError = await rejectUnboundTransaction(
-    transaction,
-    transactionId,
-    c.req.header('Cookie') ?? null,
-    views,
-  );
+  // Checked BEFORE the form is described: the consent page embeds csrf_token,
+  // so a third party holding a leaked transaction_id must not be able to read
+  // it and then complete the consent step on the End-User's behalf.
+  const bindingError = await rejectUnboundTransaction(c, transaction, transactionId);
   if (bindingError) return bindingError;
 `
         : '';
@@ -6996,28 +7648,13 @@ async function rejectUnboundTransaction(
         ? `  // Checked before validateCsrfToken and before any decision is acted on: this
   // is the step that mints the authorization code, so an unbound caller must not
   // reach it — neither to approve nor to deny on the End-User's behalf.
-  const bindingError = await rejectUnboundTransaction(
-    transaction,
-    transactionId,
-    c.req.header('Cookie') ?? null,
-    views,
-  );
+  const bindingError = await rejectUnboundTransaction(c, transaction, transactionId);
   if (bindingError) return bindingError;
 `
         : '';
-    const clearBindingCookieOnDeny = features.transactionBinding
-        ? `    // The transaction is over; drop its binding cookie so the browser does not
-    // keep one cookie per finished flow.
-    c.header('Set-Cookie', buildClearedTransactionBindingCookie(transactionId));
-`
-        : '';
-    const clearBindingCookieOnSuccess = features.transactionBinding
-        ? `  // The transaction is over; drop its binding cookie so the browser does not
-  // keep one cookie per finished flow.
-  c.header('Set-Cookie', buildClearedTransactionBindingCookie(transactionId));
-
-`
-        : '';
+    const finishedCookies = features.transactionBinding
+        ? '[buildClearedTransactionBindingCookie(transactionId)]'
+        : '[]';
     const jarmConsentImports = features.jarm
         ? `
 import {
@@ -7042,8 +7679,8 @@ import { jarmConfig } from './jarm.js';`
 /**
  * EXPERIMENTAL — JARM (JWT Secured Authorization Response Mode).
  *
- * The authorize route recorded the requested response mode on the transaction
- * (jarmResponseMode). This route only ever sees the transaction it read back
+ * The authorize step recorded the requested response mode on the transaction
+ * (jarmResponseMode). This step only ever sees the transaction it read back
  * from the store, so the auth transaction store MUST persist fields it does not
  * know about — otherwise a client that asked for a JWT response silently gets a
  * plain query response instead. conformance.test.ts pins that round trip.
@@ -7114,19 +7751,21 @@ async function buildConsentRedirect(
 }
 `
         : '';
-    const consentDenyRedirect = features.jarm
+    const consentDenyResponse = features.jarm
         ? `  if (action === 'deny') {
     await transactionStore.delete('auth_txn:' + transactionId);
     await authSessionStore.delete(transactionId);
-${clearBindingCookieOnDeny}    // EXPERIMENTAL (JARM §2.1): a request that asked for response_mode=query.jwt
+    // EXPERIMENTAL (JARM §2.1): a request that asked for response_mode=query.jwt
     // gets its error as a signed JWT too, so the client can verify that the OP
     // it trusts is the one that denied the request.
-    return c.redirect(
-      await buildConsentRedirect(resolveJarmResponse(c, transaction), transaction.redirectUri, {
+    return {
+      kind: 'authorization_response',
+      location: await buildConsentRedirect(resolveJarmResponse(c, transaction), transaction.redirectUri, {
         error: 'access_denied',
         state: transaction.state,
       }, issuer),
-    );
+      cookies: ${finishedCookies},
+    };
   }`
         : `  if (action === 'deny') {
     const redirectUrl = new URL(transaction.redirectUri);
@@ -7137,28 +7776,40 @@ ${clearBindingCookieOnDeny}    // EXPERIMENTAL (JARM §2.1): a request that aske
     redirectUrl.searchParams.set('iss', issuer);
     await transactionStore.delete('auth_txn:' + transactionId);
     await authSessionStore.delete(transactionId);
-${clearBindingCookieOnDeny}    return c.redirect(redirectUrl.toString());
+    return { kind: 'authorization_response', location: redirectUrl.toString(), cookies: ${finishedCookies} };
   }`;
-    const consentSuccessRedirect = features.jarm
-        ? `${clearBindingCookieOnSuccess}  // Redirect back to client with authorization code
-  return c.redirect(
-    await buildConsentRedirect(resolveJarmResponse(c, transaction), responseParams.redirectUri, {
+    const consentSuccessResponse = features.jarm
+        ? `  // Back to the client with the authorization code
+  return {
+    kind: 'authorization_response',
+    location: await buildConsentRedirect(resolveJarmResponse(c, transaction), responseParams.redirectUri, {
       code: authCodeData.code,
       state: responseParams.state,
     }, issuer),
-  );`
-        : `${clearBindingCookieOnSuccess}  // Redirect back to client with authorization code
+    cookies: ${finishedCookies},
+  };`
+        : `  // Back to the client with the authorization code
   const redirectUrl = new URL(responseParams.redirectUri);
   redirectUrl.searchParams.set('code', authCodeData.code);
   if (responseParams.state) {
     redirectUrl.searchParams.set('state', responseParams.state);
   }
   redirectUrl.searchParams.set('iss', issuer);
-  return c.redirect(redirectUrl.toString());`;
-    return `import { Hono } from 'hono';
+  return { kind: 'authorization_response', location: redirectUrl.toString(), cookies: ${finishedCookies} };`;
+    return `/**
+ * Consent step (API layer: logic only).
+ *
+ * Everything the consent screen has to decide lives here as plain functions:
+ * loading the transaction, the User-Agent binding, the scope policy, the
+ * authorization decision, the authorization code, the consent record and the
+ * authorization response URL (RFC 6749 §4.1.2 / RFC 9207 iss / JARM). None of
+ * them builds a Response — each returns an outcome, and pages/consent.ts turns
+ * that outcome into a screen or a redirect. The UI can therefore be changed
+ * without touching this file.
+ */
 import {
   getAuthTransaction,
-  validateCsrfToken,${bindingImports}
+  validateCsrfToken,${bindingCoreImports}
   completeAuthTransaction,
   createAuthorizationCode,${jarmConsentCoreImports}
 } from '${corePkg}';
@@ -7169,44 +7820,76 @@ import {
   transactionStore as defaultTransactionStore,
   authCodeStore as defaultAuthCodeStore,
   authSessionStore as defaultAuthSessionStore,${bindingStoreImport}
-} from '../store.js';
-import { defaultViews, renderView } from '../views.js';${jarmConsentImports}${customScopeImports}
+} from '../store.js';${jarmConsentImports}${customScopeImports}
+
+/** What the consent form needs, prepared for GET /consent. */
+export interface ConsentScreen {
+  kind: 'screen';
+  transactionId: string;
+  /** Must be posted back as the csrf_token field. */
+  csrfToken: string;
+  /** Scopes this End-User is asked to grant (already narrowed by the scope policy). */
+  scopes: string[];
+  /** Client requesting the authorization. */
+  clientId: string;
+}
+
+/** A failure the OP shows on its own error page (never redirected to the client). */
+export interface ConsentError {
+  kind: 'error';
+  error: string;
+  errorDescription?: string;
+  statusCode: number;
+}
 
-export const consentApp = new Hono<{ Variables: Record<string, any> }>();
+/** What POST /consent decided; pages/consent.ts turns it into HTTP. */
+export type ConsentOutcome =
+  | ConsentError
+  /**
+   * OIDC Core 1.0 Section 3.1.2.4: no decision was obtained — action was
+   * missing, empty or unknown. Not access_denied (Section 3.1.2.6), so the
+   * browser stays on the OP (400).
+   */
+  | { kind: 'invalid_decision' }
+  /** No authenticated subject for this transaction: the login step was skipped or expired (400). */
+  | { kind: 'session_missing' }
+  /** Approved or denied: the authorization response for the client, ready in the URL. */
+  | { kind: 'authorization_response'; location: string; cookies: string[] };
+
+/** The fields of the consent form. */
+export interface ConsentSubmission {
+  transactionId: string;
+  csrfToken: string;
+  /** 'approve' or 'deny' — the submit button values of the consent view. */
+  action: string;
+}
 ${bindingGuard}${jarmConsentHelpers}
 /**
- * Consent Page - GET
- * Displays the consent form for scope authorization.
+ * GET /consent: load the transaction and describe the form, or the error to
+ * show instead when this browser may not see it.
  */
-consentApp.get('/', async (c) => {
-  const transactionId = c.req.query('transaction_id');
-  if (!transactionId) {
-    return c.text('Missing transaction_id', 400);
-  }
-
-  const views = c.get('views') ?? defaultViews;
+export async function prepareConsent(
+  c: any,
+  transactionId: string,
+): Promise<ConsentScreen | ConsentError> {
   const transactionStore = c.get('transactionStore') ?? defaultTransactionStore;
   const transaction = await getAuthTransaction(transactionId, transactionStore);
 ${bindingCheckBeforeConsentForm}
-${consentGetScopeResolution}  return renderView(views.consentPage({
+${consentGetScopeResolution}  return {
+    kind: 'screen',
     transactionId,
     csrfToken: transaction.csrfToken,
     scopes: ${consentDisplayScopes},
     clientId: transaction.clientId,
-  }));
-});
+  };
+}
 
 /**
- * Consent Handler - POST
- * Processes the consent decision.
+ * POST /consent: record the decision and build the authorization response.
  */
-consentApp.post('/', async (c) => {
-  const body = await c.req.parseBody();
-  const transactionId = String(body['transaction_id'] ?? '');
-  const csrfToken = String(body['csrf_token'] ?? '');
-  const action = String(body['action'] ?? '');
+export async function submitConsent(c: any, input: ConsentSubmission): Promise<ConsentOutcome> {
+  const { transactionId, csrfToken, action } = input;
 
-  const views = c.get('views') ?? defaultViews;
   const transactionStore = c.get('transactionStore') ?? defaultTransactionStore;
   const authCodeStore = c.get('authCodeStore') ?? defaultAuthCodeStore;
   const authSessionStore = c.get('authSessionStore') ?? defaultAuthSessionStore;
@@ -7219,7 +7902,7 @@ ${bindingCheckBeforeConsentCsrf}  validateCsrfToken(transaction, csrfToken);
   const config = c.get('config');
   const issuer = config.issuer;
 
-${consentDenyRedirect}
+${consentDenyResponse}
 
   // OIDC Core 1.0 Section 3.1.2.4: "the Authorization Server MUST obtain an
   // authorization decision before releasing information to the Relying Party."
@@ -7230,24 +7913,18 @@ ${consentDenyRedirect}
   // 'approve' is the decision value this provider accepts, and it MUST stay in
   // sync with the Approve button in views.ts consentPage(). Changing it here
   // without changing the button (or the other way round) makes every approval
-  // fail with the 400 below.
+  // fail with the 400 pages/consent.ts shows for this outcome.
   //
   // Section 3.1.2.6: access_denied means the End-User denied the request, which
   // is not the same as no decision at all — an unrecognized value stops here on
   // the OP's own error page instead of being redirected back to the client.
   if (action !== 'approve') {
-    return renderView(views.errorPage({
-      error: 'Invalid consent decision. Please use the Approve or Deny button.',
-      statusCode: 400,
-    }), { status: 400 });
+    return { kind: 'invalid_decision' };
   }
 
   const session = await authSessionStore.get(transactionId);
   if (!session) {
-    return renderView(views.errorPage({
-      error: 'Authentication session not found. Please restart login.',
-      statusCode: 400,
-    }), { status: 400 });
+    return { kind: 'session_missing' };
   }
 
   const responseParams = await completeAuthTransaction(
@@ -7268,7 +7945,7 @@ ${consentGrantedScope}
     authorizationResponse: { ...responseParams, scope: grantedScope },
     subject: session.subject,
     authTime: session.authTime,
-    // online refresh token をこのログインセッションへ束縛する（login route が
+    // online refresh token をこのログインセッションへ束縛する（login step が
     // authSessionStore へ載せた値）。ログアウトすれば RT も使えなくなる。
     sessionId: session.sessionId,
     ttlSeconds: config.authorizationCodeTtl,
@@ -7290,8 +7967,8 @@ ${consentGrantedScope}
 
   await authSessionStore.delete(transactionId);
 
-${consentSuccessRedirect}
-});
+${consentSuccessResponse}
+}
 `;
 }
 export function applyTemplate(_corePkg, features = DEFAULT_FEATURES) {
@@ -7330,14 +8007,14 @@ export function applyTemplate(_corePkg, features = DEFAULT_FEATURES) {
         : '';
     const deviceImport = features.deviceAuthorizationGrant
         ? `import { deviceAuthorizationApp } from './routes/device-authorization.js';
-import { deviceApp } from './routes/device.js';\n`
+import { devicePage } from './pages/device.js';\n`
         : '';
     const deviceCors = features.deviceAuthorizationGrant
         ? `  app.use('/device_authorization', protectedCors);\n`
         : '';
     const deviceMount = features.deviceAuthorizationGrant
         ? `  app.route('/device_authorization', deviceAuthorizationApp);
-  app.route('/device', deviceApp);\n`
+  app.route('/device', devicePage);\n`
         : '';
     const deviceStorageContext = features.deviceAuthorizationGrant
         ? `    c.set('deviceAuthorizationStore', deviceAuthorizationStore);\n`
@@ -7347,14 +8024,14 @@ import { deviceApp } from './routes/device.js';\n`
         : '';
     const cibaImport = features.ciba
         ? `import { backchannelAuthenticationApp } from './routes/backchannel-authentication.js';
-import { cibaApp } from './routes/ciba-verification.js';\n`
+import { cibaPage } from './pages/ciba.js';\n`
         : '';
     const cibaCors = features.ciba
         ? `  app.use('/backchannel_authentication', protectedCors);\n`
         : '';
     const cibaMount = features.ciba
         ? `  app.route('/backchannel_authentication', backchannelAuthenticationApp);
-  app.route('/ciba', cibaApp);\n`
+  app.route('/ciba', cibaPage);\n`
         : '';
     const cibaStorageContext = features.ciba
         ? `    c.set('cibaAuthenticationRequestStore', cibaAuthenticationRequestStore);
@@ -7377,6 +8054,44 @@ import { cibaApp } from './routes/ciba-verification.js';\n`
   cibaUserResolver?: (
     loginHint: string,
   ) => Promise<{ subject: string } | null> | { subject: string } | null;
+`
+        : '';
+    const logoutImport = features.rpInitiatedLogout
+        ? `import { logoutPage } from './pages/logout.js';\n`
+        : '';
+    const logoutMount = features.rpInitiatedLogout
+        ? `  app.route('/logout', logoutPage);\n`
+        : '';
+    const googleLoginImport = features.googleLogin
+        ? `import {
+  getDefaultGoogleIdTokenVerifier,
+  type GoogleAccountResolver,
+  type GoogleIdTokenPayload,
+  type GoogleIdTokenVerifier,
+} from '${GOOGLE_LOGIN_PACKAGE}';\n`
+        : '';
+    const googleLoginStorageContext = features.googleLogin
+        ? `    c.set('googleLoginNonceStore', stores.googleLoginNonceStore);
+    c.set('googleIdTokenVerifier', options.googleIdTokenVerifier ?? getDefaultGoogleIdTokenVerifier());
+    c.set('googleAccountResolver', options.googleAccountResolver ?? {
+      resolveSubject: async (account: GoogleIdTokenPayload) =>
+        (await stores.userStore.linkGoogleAccount(account)).sub,
+    });\n`
+        : '';
+    const googleLoginOptionsFields = features.googleLogin
+        ? `  /**
+   * EXTENSION (google-login): verifier for the ID token Google posts to
+   * /login/google. Defaults to google-auth-library (OAuth2Client.verifyIdToken)
+   * with a process-wide certificate cache; inject a custom one for tests or a
+   * proxied environment.
+   */
+  googleIdTokenVerifier?: GoogleIdTokenVerifier;
+  /**
+   * EXTENSION (google-login): map a verified Google account to the OP subject.
+   * Defaults to just-in-time provisioning through the user store
+   * (userStore.linkGoogleAccount), keyed by the Google \`sub\`.
+   */
+  googleAccountResolver?: GoogleAccountResolver;
 `
         : '';
     const refreshStorageContext = features.refreshToken
@@ -7393,13 +8108,13 @@ import { cibaApp } from './routes/ciba-verification.js';\n`
     const methodGuard = oidcMethodGuardTemplate(features);
     return `import type { Hono } from 'hono';
 import { cors } from 'hono/cors';
-import { authorizeApp } from './routes/authorize.js';
+import { authorizePage } from './pages/authorize.js';
 import { tokenApp } from './routes/token.js';
 import { userinfoApp } from './routes/userinfo.js';
-${introspectionImport}${revocationImport}${parImport}${deviceImport}${cibaImport}import { jwksApp } from './routes/jwks.js';
+${introspectionImport}${revocationImport}${parImport}${deviceImport}${cibaImport}${logoutImport}import { jwksApp } from './routes/jwks.js';
 import { discoveryApp } from './routes/discovery.js';
-import { loginApp } from './routes/login.js';
-import { consentApp } from './routes/consent.js';
+import { loginPage } from './pages/login.js';
+import { consentPage } from './pages/consent.js';
 import {
   createInMemoryClientResolver,
   createProviderConfig,
@@ -7414,7 +8129,7 @@ ${parStoreImport}${deviceStoreImport}${cibaStoreImport}  type ProviderStores,
   type ProviderStoresFactory,
 } from './store.js';
 import { createViews, type Views } from './views.js';
-import {
+${googleLoginImport}import {
   assertHasRs256Key,
   assertKeyStrength,
   assertKidStrategyConsistent,
@@ -7501,7 +8216,7 @@ export interface ApplyOidcOptions {
    * Token / UserInfo / Introspection / Revocation エンドポイントに適用される。
    * Discovery / JWKS は仕様上常に '*' 固定 (OIDC Discovery / RFC 8414 で公開資産扱い)。
    */
-${cibaOptionsField}  corsOrigins?: CorsOrigins;
+${cibaOptionsField}${googleLoginOptionsFields}  corsOrigins?: CorsOrigins;
   /**
    * Custom UI for the login / consent / error pages.
    * Provide any subset; omitted pages fall back to the default views.
@@ -7624,7 +8339,7 @@ ${introspectionCors}${revocationCors}${parCors}${deviceCors}${cibaCors}  app.use
     c.set('authCodeResolver', storeResolvers.authorizationCodeResolver);
     c.set('accessTokenResolver', storeResolvers.accessTokenResolver);
     c.set('userClaimsResolver', storeResolvers.userClaimsResolver);
-${refreshStorageContext}${introspectionStorageContext}${revocationStorageContext}${parStorageContext}${deviceStorageContext}${cibaStorageContext}
+${refreshStorageContext}${introspectionStorageContext}${revocationStorageContext}${parStorageContext}${deviceStorageContext}${cibaStorageContext}${googleLoginStorageContext}
     // T-015: acr / amr resolver (optional; undefined preserves T-009 hold behavior).
     if (options.acrResolver) {
       c.set('acrResolver', options.acrResolver);
@@ -7642,13 +8357,15 @@ ${refreshStorageContext}${introspectionStorageContext}${revocationStorageContext
     await next();
   });
 
-  app.route('/authorize', authorizeApp);
+  // Browser-facing surfaces are mounted from pages/: every GET and POST of a
+  // screen lives there, and the logic they call is in routes/.
+  app.route('/authorize', authorizePage);
   app.route('/token', tokenApp);
   app.route('/userinfo', userinfoApp);
-${introspectionMount}${revocationMount}${parMount}${deviceMount}${cibaMount}  app.route('/.well-known/jwks.json', jwksApp);
+${introspectionMount}${revocationMount}${parMount}${deviceMount}${cibaMount}${logoutMount}  app.route('/.well-known/jwks.json', jwksApp);
   app.route('/.well-known/openid-configuration', discoveryApp);
-  app.route('/login', loginApp);
-  app.route('/consent', consentApp);
+  app.route('/login', loginPage);
+  app.route('/consent', consentPage);
 }
 
 async function resolveProviderStores(
@@ -7735,6 +8452,7 @@ import {
   verifyClientSecret,
   requireIntrospectionToken,
   requireIntrospectionClient,
+  requireConfidentialIntrospectionCaller,
   resolveIntrospectionToken,
   isIntrospectionTokenActive,
   buildIntrospectionResponse,
@@ -7759,8 +8477,10 @@ function isFormUrlEncoded(contentType: string): boolean {
  * Token Introspection Endpoint
  * RFC 7662 Section 2
  *
- * Confidential client only — public clients are out of scope for this template.
- * Response is always cache-busting per RFC 7662 Section 2.2.
+ * Confidential client only — a caller registered with
+ * token_endpoint_auth_method 'none' is rejected with invalid_client
+ * (RFC 7662 §2.1 / RFC 9701 §5), because a public client_id alone is not
+ * authentication. Response is always cache-busting per RFC 7662 Section 2.2.
  */
 introspectionApp.post('/', async (c) => {
   c.header('Cache-Control', 'no-store');
@@ -7802,6 +8522,13 @@ introspectionApp.post('/', async (c) => {
     );
     validateClientAuthMethod(introspectingClient, presentedCredentials);
     await verifyClientSecret(introspectingClient, presentedCredentials.clientSecret);
+    // RFC 7662 §2.1 / RFC 9701 §5: the caller must be an authenticated
+    // confidential client. A client registered with token_endpoint_auth_method
+    // 'none' passes the pipeline above by presenting its client_id alone —
+    // public information — so treating it as authenticated would let anyone
+    // scan tokens. Revocation deliberately has no such step: RFC 7009 §2.1
+    // lets a public client revoke its own tokens.
+    requireConfidentialIntrospectionCaller(introspectingClient);
     const authenticatedClientId = presentedCredentials.clientId;
 
     // --- Introspection pipeline ---------------------------------------------
@@ -8335,11 +9062,114 @@ function defaultCibaCompletedPage(params: CibaCompletedPageParams): string {
   cibaCompletedPage: defaultCibaCompletedPage,
 `
         : '';
+    const rpInitiatedLogoutParamTypes = features.rpInitiatedLogout
+        ? `
+export interface LogoutConfirmationPageParams {
+  /** CSRF token (must be included as hidden form field of the approve POST) */
+  csrfToken: string;
+}
+
+/**
+ * Parameters of the logged-out page. Deliberately empty: the completed screen
+ * shows no End-User or client identifier (whoever sees the screen learns
+ * nothing), and its wording never depends on whether anything was actually
+ * deleted — varying it would make the page a session-existence oracle.
+ */
+export interface LogoutCompletedPageParams {}
+`
+        : '';
+    const rpInitiatedLogoutViewsMembers = features.rpInitiatedLogout
+        ? `  /** EXPERIMENTAL (RP-Initiated Logout 1.0 §2): render the logout confirmation screen */
+  logoutConfirmationPage(params: LogoutConfirmationPageParams): ViewResult;
+  /** EXPERIMENTAL (RP-Initiated Logout 1.0): render the logged-out screen */
+  logoutCompletedPage(params: LogoutCompletedPageParams): ViewResult;
+`
+        : '';
+    const rpInitiatedLogoutDefaultViews = features.rpInitiatedLogout
+        ? `// RP-Initiated Logout 1.0 §2: the wording is fixed for every path into this
+// screen (no hint, an invalid or expired hint, another user's session, no
+// session at all), so the page cannot be used as an oracle for session state
+// or for why the hint failed.
+function defaultLogoutConfirmationPage(params: LogoutConfirmationPageParams): string {
+  return \`<!DOCTYPE html>
+<html>
+<head><title>Log out</title></head>
+<body>
+  <h1>Log out</h1>
+  <p>Do you want to log out of the OpenID Provider?</p>
+  <p>If you did not request this, close this page.</p>
+  <form method="POST" action="/logout/approve">
+    <input type="hidden" name="csrf_token" value="\${escapeHtml(params.csrfToken)}" />
+    <button type="submit">Log out</button>
+  </form>
+</body>
+</html>\`;
+}
+
+function defaultLogoutCompletedPage(_params: LogoutCompletedPageParams): string {
+  return \`<!DOCTYPE html>
+<html>
+<head><title>Logged out</title></head>
+<body>
+  <h1>Logged out</h1>
+  <p>You have been logged out.</p>
+  <p>You can close this page.</p>
+</body>
+</html>\`;
+}
+
+`
+        : '';
+    const rpInitiatedLogoutDefaultViewsEntries = features.rpInitiatedLogout
+        ? `  logoutConfirmationPage: defaultLogoutConfirmationPage,
+  logoutCompletedPage: defaultLogoutCompletedPage,
+`
+        : '';
+    const googleViewsImport = features.googleLogin
+        ? `// EXTENSION (google-login): the GIS configuration type and the helper that
+// serializes it into this string template. The package generates no UI; the
+// three elements GIS needs are written out in defaultLoginPage below.
+import {
+  googleSignInAttributesToHtml,
+  GOOGLE_GSI_CLIENT_SCRIPT_URL,
+  type GoogleSignInAttributes,
+} from '${GOOGLE_LOGIN_PACKAGE}/sign-in';
+
+`
+        : '';
+    const googleLoginPageParam = features.googleLogin
+        ? `  /**
+   * EXTENSION (google-login): GIS configuration for "Sign in with Google"
+   * (redirect mode) — the g_id_onload attributes built by
+   * buildGoogleSignInAttributes(): client ID, data-ux_mode="redirect", the
+   * login_uri Google posts the ID token to, and the nonce bound to this
+   * transaction. The view owns the markup (see defaultLoginPage). Undefined
+   * when Google login is not configured; only the password form is shown then.
+   */
+  googleSignIn?: GoogleSignInAttributes;
+`
+        : '';
+    const googleSignInSnippet = features.googleLogin
+        ? `
+  // EXTENSION (google-login): the three elements GIS needs for redirect mode —
+  // its client script, #g_id_onload carrying the configuration (attribute
+  // values escaped by googleSignInAttributesToHtml), and .g_id_signin, which
+  // GIS replaces with the button. Style the button through the GIS button
+  // attributes (data-theme, data-size, data-text, ...) on .g_id_signin.
+  const googleSignInHtml = params.googleSignIn
+    ? \`  <hr />\\n  <section aria-label="Sign in with Google">\\n    <script src="\${GOOGLE_GSI_CLIENT_SCRIPT_URL}" async></script>\\n    <div \${googleSignInAttributesToHtml(params.googleSignIn)}></div>\\n    <div class="g_id_signin" data-type="standard"></div>\\n  </section>\\n\`
+    : '';
+`
+        : '';
+    const googleSignInPlaceholder = features.googleLogin ? '${googleSignInHtml}' : '';
     return `/**
  * UI Views for OpenID Connect Provider.
  *
- * This file contains all user-facing HTML rendering.
- * Customize these functions to match your application's design.
+ * This file contains the default HTML of every user-facing screen. The screen
+ * routes in pages/ deliver these views (pages/login.ts renders loginPage, and so
+ * on); the logic in routes/ never renders anything — it returns outcomes the
+ * pages turn into HTTP. Customize these functions to match your application's
+ * design, or change how a screen is delivered in its pages/ module.
  *
  * Each function receives typed parameters and returns a ViewResult: either an
  * HTML string (wrapped into a text/html Response by renderView) or a
@@ -8348,7 +9178,7 @@ function defaultCibaCompletedPage(params: CibaCompletedPageParams): string {
  * rendering, or UI framework of your choice.
  */
 
-// ============================================================
+${googleViewsImport}// ============================================================
 // View Parameter Types
 // ============================================================
 
@@ -8367,7 +9197,7 @@ export interface LoginPageParams {
    * HTML-attribute escaped before rendering since it is unauthenticated input.
    */
   loginHint?: string;
-}
+${googleLoginPageParam}}
 
 export interface ConsentPageParams {
   /** Transaction ID for the auth flow */
@@ -8388,7 +9218,7 @@ export interface ErrorPageParams {
   /** HTTP status code */
   statusCode: number;
 }
-${deviceParamTypes}${cibaParamTypes}
+${deviceParamTypes}${cibaParamTypes}${rpInitiatedLogoutParamTypes}
 // ============================================================
 // Views Interface
 // ============================================================
@@ -8407,7 +9237,7 @@ export interface Views {
   consentPage(params: ConsentPageParams): ViewResult;
   /** Render a generic error page */
   errorPage(params: ErrorPageParams): ViewResult;
-${deviceViewsMembers}${cibaViewsMembers}}
+${deviceViewsMembers}${cibaViewsMembers}${rpInitiatedLogoutViewsMembers}}
 
 /** Options applied when renderView wraps an HTML string into a Response. */
 export interface RenderViewInit {
@@ -8462,7 +9292,7 @@ function defaultLoginPage(params: LoginPageParams): string {
           : ''
       }</p>\`
     : '';
-
+${googleSignInSnippet}
   return \`<!DOCTYPE html>
 <html>
 <head><title>Login</title></head>
@@ -8482,7 +9312,7 @@ function defaultLoginPage(params: LoginPageParams): string {
     </div>
     <button type="submit">Login</button>
   </form>
-</body>
+${googleSignInPlaceholder}</body>
 </html>\`;
 }
 
@@ -8537,7 +9367,7 @@ function defaultErrorPage(params: ErrorPageParams): string {
 </html>\`;
 }
 
-${deviceDefaultViews}${cibaDefaultViews}/**
+${deviceDefaultViews}${cibaDefaultViews}${rpInitiatedLogoutDefaultViews}/**
  * Default Views used when no custom views are injected.
  * These render minimal, unstyled HTML so the flow works out of the box.
  */
@@ -8545,7 +9375,7 @@ export const defaultViews: Views = {
   loginPage: defaultLoginPage,
   consentPage: defaultConsentPage,
   errorPage: defaultErrorPage,
-${deviceDefaultViewsEntries}${cibaDefaultViewsEntries}};
+${deviceDefaultViewsEntries}${cibaDefaultViewsEntries}${rpInitiatedLogoutDefaultViewsEntries}};
 
 /**
  * Build a Views instance, overriding any subset of the default views with your
@@ -8634,9 +9464,9 @@ export function requestObjectConformanceBeforeAll(features = DEFAULT_FEATURES) {
   );
 `;
 }
-export function reuseFlowConformanceTestBlock(features = DEFAULT_FEATURES) {
+export function reuseFlowConformanceTestBlock(features = DEFAULT_FEATURES, errorPageMode = 'html') {
     return (reuseCascadeConformanceBlock(features) +
-        requestObjectValueConformanceBlock(features));
+        requestObjectValueConformanceBlock(features, errorPageMode));
 }
 function reuseCascadeConformanceBlock(features) {
     if (!features.refreshToken) {
@@ -9109,7 +9939,39 @@ function reuseCascadeConformanceBlock(features) {
   });
 `;
 }
-function requestObjectValueConformanceBlock(features) {
+function requestObjectValueConformanceBlock(features, errorPageMode = 'html') {
+    const brokenRequestObjectExpectation = errorPageMode === 'redirect'
+        ? `      // OIDC Core 1.0 §6.3: invalid_request_object (not the generic
+      // invalid_request). This provider sets authorizationErrorRedirectPath, so
+      // the browser is 303-redirected to the OP's OWN error page — never to the
+      // redirect_uri of the broken Request Object.
+      expect(res.status).toBe(303);
+      expect(res.headers.get('Location')).toBe(
+        '/oidc-error?error=invalid_request_object&error_description=request+object+is+not+a+JWS+compact+serialization',
+      );`
+        : `      // OIDC Core 1.0 §6.3: the request parameter contains an invalid Request
+      // Object, so the OP reports invalid_request_object (not the generic
+      // invalid_request). A redirect_uri carried inside a broken Request Object
+      // cannot be trusted, so the error stays on the OP: HTTP 400, no redirect,
+      // no state echo. Pinned to the default error page so a change in either
+      // the error code or the non-redirect behavior is caught exactly.
+      expect(res.status).toBe(400);
+      expect(res.headers.get('Location')).toBe(null);
+      expect(res.headers.get('Content-Type')).toBe('text/html; charset=UTF-8');
+      const body = await res.text();
+      expect(body).toBe(
+        [
+          '<!DOCTYPE html>',
+          '<html>',
+          '<head><title>Error</title></head>',
+          '<body>',
+          '  <h1>Error</h1>',
+          '  <p>invalid_request_object</p>',
+          '  <p>request object is not a JWS compact serialization</p>',
+          '</body>',
+          '</html>',
+        ].join('\\n'),
+      );`;
     if (!features.requestObject) {
         return `
   // OIDC Core 1.0 §6.3: the request parameter (Request Object by value) is disabled
@@ -9213,29 +10075,7 @@ function requestObjectValueConformanceBlock(features) {
         '&code_challenge=' + PKCE_CHALLENGE_S256 + '&code_challenge_method=S256';
       const res = await app.request(url);
 
-      // OIDC Core 1.0 §6.3: the request parameter contains an invalid Request
-      // Object, so the OP reports invalid_request_object (not the generic
-      // invalid_request). A redirect_uri carried inside a broken Request Object
-      // cannot be trusted, so the error stays on the OP: HTTP 400, no redirect,
-      // no state echo. Pinned to the default error page so a change in either
-      // the error code or the non-redirect behavior is caught exactly.
-      expect(res.status).toBe(400);
-      expect(res.headers.get('Location')).toBe(null);
-      expect(res.headers.get('Content-Type')).toBe('text/html; charset=UTF-8');
-      const body = await res.text();
-      expect(body).toBe(
-        [
-          '<!DOCTYPE html>',
-          '<html>',
-          '<head><title>Error</title></head>',
-          '<body>',
-          '  <h1>Error</h1>',
-          '  <p>invalid_request_object</p>',
-          '  <p>request object is not a JWS compact serialization</p>',
-          '</body>',
-          '</html>',
-        ].join('\\n'),
-      );
+${brokenRequestObjectExpectation}
     });
 
     it('should reject the request_uri parameter with a request_uri_not_supported redirect', async () => {
@@ -9641,8 +10481,9 @@ export function customViewConformanceTestBlock() {
       expect(await res.text()).toBe('<h1>custom-view-response</h1>');
     });
 
-    // End-to-end: the login route returns its view via renderView, so the login
-    // page is delivered as a text/html Response through the framework at runtime.
+    // End-to-end: the login page (pages/login.ts) returns its view via
+    // renderView, so the login page is delivered as a text/html Response through
+    // the framework at runtime.
     it('should deliver the login page through renderView as a text/html Response', async () => {
       // RFC 7636 Appendix B example challenge so authorize is accepted and mints a
       // transaction (302 -> /login); the verifier is never needed here.
@@ -10147,11 +10988,29 @@ export function jwtIntrospectionResponseConformanceBlock(features) {
         expect(res.headers.get('Content-Type')).toBe('application/json');
         expect(await res.json()).toMatchObject({ error: 'invalid_client' });
       });
-    });
-
-    describe('Provider metadata (RFC 9701 §7)', () => {
-      it('should advertise introspection_signing_alg_values_supported as exactly RS256', async () => {
-        const metadata = await (await app.request('/.well-known/openid-configuration')).json();
+
+      // RFC 9701 §5: an unauthenticated request must be refused, and a public
+      // client_id alone is not authentication. Without this rejection the
+      // signed assertion would vouch for a caller identity that was never
+      // verified.
+      it('should reject a public client introspection request even when it asks for the JWT response', async () => {
+        const res = await introspectWith(
+          { client_id: 'c-public', token: 'rfc9701-active' },
+          INTROSPECTION_JWT_MEDIA_TYPE,
+        );
+
+        expect(res.status).toBe(401);
+        expect(res.headers.get('Content-Type')).toBe('application/json');
+        expect(await res.json()).toEqual({
+          error: 'invalid_client',
+          error_description: 'Introspection requires an authenticated confidential client',
+        });
+      });
+    });
+
+    describe('Provider metadata (RFC 9701 §7)', () => {
+      it('should advertise introspection_signing_alg_values_supported as exactly RS256', async () => {
+        const metadata = await (await app.request('/.well-known/openid-configuration')).json();
 
         expect(metadata.introspection_signing_alg_values_supported).toEqual(['RS256']);
       });
@@ -10580,6 +11439,35 @@ export function introspectionConformanceBlock(features) {
       expect(body.active).toBe(true);
       expect(body.jti).toBe(accessTokenJti);
     });
+
+    // RFC 7662 §2.1: the introspection caller must be authorized, and a public
+    // client's client_id is public information, so presenting it alone is not
+    // client authentication. The route rejects the caller before any token
+    // lookup, while revocation keeps accepting the same client (RFC 7009 §2.1).
+    it('should reject an introspection request that presents only a public client_id', async () => {
+      const now = Math.floor(Date.now() / 1000);
+      accessTokenStore.set('public-introspect-token', {
+        sub: 'testuser',
+        clientId: 'c-public',
+        scope: ['openid'],
+        expiresAt: now + 3600,
+      });
+      const res = await app.request('/introspect', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          client_id: 'c-public',
+          token: 'public-introspect-token',
+        }).toString(),
+      });
+
+      expect(res.status).toBe(401);
+      expect(res.headers.get('WWW-Authenticate')).toBe('Basic realm="Client Authentication"');
+      expect(await res.json()).toEqual({
+        error: 'invalid_client',
+        error_description: 'Introspection requires an authenticated confidential client',
+      });
+    });
   });
 `;
 }
@@ -11187,6 +12075,11 @@ export function endpointBehaviorConformanceBlock(features, includeHonoApplyParit
       { path: '/device/login', method: 'GET', allow: 'POST' },
       { path: '/device/approve', method: 'GET', allow: 'POST' },`
         : '';
+    const logoutMethodTests = features.rpInitiatedLogout
+        ? `
+      { path: '/logout', method: 'PUT', allow: 'GET, POST' },
+      { path: '/logout/approve', method: 'GET', allow: 'POST' },`
+        : '';
     const corsPreflightTest = includeHonoApplyParity
         ? `    it('should give createApp and applyOidc the same CORS preflight behavior', async () => {
       const responses = await Promise.all(
@@ -11237,7 +12130,10 @@ export function endpointBehaviorConformanceBlock(features, includeHonoApplyParit
     it('should return 405 and an exact Allow header for unsupported endpoint methods', async () => {
       const cases = [
         { path: '/token', method: 'GET', allow: 'POST' },
-        { path: '/userinfo', method: 'PUT', allow: 'GET, POST' },${introspectionMethodTest}${revocationMethodTest}${deviceMethodTests}
+        { path: '/userinfo', method: 'PUT', allow: 'GET, POST' },
+        // The browser-facing screens (pages/) enforce their method lists too.
+        { path: '/login', method: 'PUT', allow: 'GET, POST' },
+        { path: '/consent', method: 'PUT', allow: 'GET, POST' },${introspectionMethodTest}${revocationMethodTest}${deviceMethodTests}${logoutMethodTests}
         { path: '/.well-known/openid-configuration', method: 'POST', allow: 'GET' },
         { path: '/.well-known/jwks.json', method: 'POST', allow: 'GET' },
       ];
@@ -16488,6 +17384,699 @@ export function consentDecisionConformanceBlock() {
   });
 `;
 }
+export function googleLoginConformanceImportsBlock(features) {
+    if (!features.googleLogin)
+        return '';
+    return `
+import {
+  GoogleLoginError,
+  GoogleLoginErrorCode,
+  type GoogleIdTokenPayload,
+  type GoogleIdTokenVerifier,
+} from '${GOOGLE_LOGIN_PACKAGE}';`;
+}
+export function googleLoginConformanceBlock(features) {
+    if (!features.googleLogin)
+        return '';
+    return `
+  // EXTENSION — Sign in with Google (Google Identity Services, redirect mode).
+  // Generated because this provider was created with --enable google-login.
+  // google-auth-library is replaced by a stand-in verifier, so these tests never
+  // reach Google: they pin the OP-side contract around the callback.
+  describe('Google login (Sign in with Google, redirect mode)', () => {
+    // RFC 7636 Appendix B example PKCE pair (verifier -> its S256 challenge).
+    const GOOGLE_PKCE_VERIFIER = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+    const GOOGLE_PKCE_CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+    const GOOGLE_CLIENT_ID = 'conformance-google-client.apps.googleusercontent.com';
+    const GOOGLE_CSRF = 'conformance-g-csrf-token';
+    const GOOGLE_SUB = '10769150350006150715113082367';
+
+    // Stand-in for google-auth-library: a credential is the JSON payload wrapped
+    // as 'fake:<base64>'; anything else is refused like a bad signature would be.
+    const verifiedClientIds: Array<string | readonly string[]> = [];
+    const fakeGoogleVerifier: GoogleIdTokenVerifier = {
+      async verify(idToken, clientId) {
+        verifiedClientIds.push(clientId);
+        if (!idToken.startsWith('fake:')) {
+          throw new GoogleLoginError(GoogleLoginErrorCode.InvalidIdToken, 'Invalid token signature');
+        }
+        return JSON.parse(atob(idToken.slice('fake:'.length))) as GoogleIdTokenPayload;
+      },
+    };
+
+    function googleCredential(payload: Record<string, unknown>): string {
+      return 'fake:' + btoa(JSON.stringify(payload));
+    }
+
+    function googleAccount(nonce: string, overrides: Record<string, unknown> = {}): Record<string, unknown> {
+      const now = Math.floor(Date.now() / 1000);
+      return {
+        iss: 'https://accounts.google.com',
+        aud: GOOGLE_CLIENT_ID,
+        sub: GOOGLE_SUB,
+        email: 'jsmith@example.com',
+        email_verified: true,
+        name: 'John Smith',
+        given_name: 'John',
+        family_name: 'Smith',
+        picture: 'https://lh3.googleusercontent.com/a/photo',
+        iat: now,
+        exp: now + 3600,
+        nonce,
+        ...overrides,
+      };
+    }
+
+    // Pure fetch + parse helpers: no assertions and no branching, so the
+    // contract stays visible in the it() blocks.
+    function googleRelativeFrom(location: string | null): string {
+      const url = new URL(location ?? '', 'http://localhost');
+      return url.pathname + url.search;
+    }
+
+    function googleCsrfFrom(html: string): string {
+      return html.match(/name="csrf_token" value="([^"]+)"/)?.[1] ?? '';
+    }
+
+    function googleNonceFrom(html: string): string {
+      return html.match(/data-nonce="([^"]+)"/)?.[1] ?? '';
+    }
+
+    function createGoogleApp(
+      googleLogin: GoogleLoginConfig = { clientId: GOOGLE_CLIENT_ID },
+    ): ReturnType<typeof createApp> {
+      return createApp({
+        signingKeyProvider,
+        clientResolver: createInMemoryClientResolver(testClients),
+        config: { googleLogin },
+        googleIdTokenVerifier: fakeGoogleVerifier,
+      });
+    }
+
+    // Start an authorization request on the given app and fetch its login page.
+    async function startGoogleFlow(
+      targetApp: ReturnType<typeof createApp>,
+      state: string,
+      scope = 'openid',
+    ): Promise<{ transactionId: string; loginHtml: string; nonce: string }> {
+      const authorizeRes = await targetApp.request(
+        '/authorize?response_type=code&client_id=c-conf' +
+        '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+        '&scope=' + encodeURIComponent(scope) + '&state=' + state + '&prompt=consent' +
+        '&code_challenge=' + GOOGLE_PKCE_CHALLENGE + '&code_challenge_method=S256',
+      );
+      const loginPath = googleRelativeFrom(authorizeRes.headers.get('Location'));
+      const loginRes = await targetApp.request(loginPath);
+      const loginHtml = await loginRes.text();
+      return {
+        transactionId:
+          new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '',
+        loginHtml,
+        nonce: googleNonceFrom(loginHtml),
+      };
+    }
+
+    // POST the redirect-mode callback exactly as the browser would after Google's
+    // account chooser: credential + g_csrf_token in the body, g_csrf_token cookie.
+    function googleCallback(
+      targetApp: ReturnType<typeof createApp>,
+      credential: string,
+      init: { bodyCsrf?: string; cookie?: string | null } = {},
+    ): Promise<Response> {
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+      };
+      if (init.cookie !== null) {
+        headers.Cookie = init.cookie ?? 'g_csrf_token=' + GOOGLE_CSRF;
+      }
+      return targetApp.request('/login/google', {
+        method: 'POST',
+        headers,
+        body: new URLSearchParams({
+          credential,
+          g_csrf_token: init.bodyCsrf ?? GOOGLE_CSRF,
+          select_by: 'btn',
+        }).toString(),
+      });
+    }
+
+    let googleApp: ReturnType<typeof createApp>;
+
+    beforeAll(() => {
+      googleApp = createGoogleApp();
+    });
+
+    // GIS HTML API, redirect mode: the g_id_onload element carries the client
+    // ID, data-ux_mode="redirect", the login_uri Google posts to, and the nonce
+    // that ties the click to this authorization transaction.
+    it('should render the Sign in with Google button in redirect mode on the login page', async () => {
+      const flow = await startGoogleFlow(googleApp, 'google-button');
+
+      expect(flow.loginHtml.includes('<script src="https://accounts.google.com/gsi/client" async></script>')).toBe(true);
+      expect(flow.loginHtml.includes(
+        '<div id="g_id_onload" data-client_id="' + GOOGLE_CLIENT_ID + '" data-ux_mode="redirect"' +
+        ' data-login_uri="http://localhost:3000/login/google" data-nonce="' + flow.nonce + '"></div>',
+      )).toBe(true);
+      expect(flow.nonce.length).toBe(43);
+      // The password form stays available next to the button.
+      expect(flow.loginHtml.includes('name="password"')).toBe(true);
+    });
+
+    it('should issue a fresh nonce for every login page render', async () => {
+      const first = await startGoogleFlow(googleApp, 'google-nonce-1');
+      const second = await startGoogleFlow(googleApp, 'google-nonce-2');
+
+      expect(first.nonce === second.nonce).toBe(false);
+    });
+
+    it('should not render the button when Google login is not configured', async () => {
+      const flow = await startGoogleFlow(app, 'google-unconfigured');
+
+      expect(flow.loginHtml.includes('g_id_onload')).toBe(false);
+      expect(flow.nonce).toBe('');
+    });
+
+    it('should answer 404 on the Google callback when Google login is not configured', async () => {
+      const res = await googleCallback(app, googleCredential(googleAccount('unused')));
+
+      expect(res.status).toBe(404);
+      expect(res.headers.get('Location')).toBe(null);
+    });
+
+    // Google's server-side guide: the double-submit cookie is checked before the
+    // credential is even looked at, in the order cookie -> body -> mismatch.
+    it('should reject the callback without the g_csrf_token cookie', async () => {
+      const flow = await startGoogleFlow(googleApp, 'google-no-cookie');
+
+      const res = await googleCallback(googleApp, googleCredential(googleAccount(flow.nonce)), { cookie: null });
+
+      expect(res.status).toBe(400);
+      expect(res.headers.get('Location')).toBe(null);
+      expect((await res.text()).includes('csrf_token_missing_in_cookie')).toBe(true);
+    });
+
+    it('should reject the callback whose g_csrf_token cookie and body differ', async () => {
+      const flow = await startGoogleFlow(googleApp, 'google-csrf-mismatch');
+
+      const res = await googleCallback(googleApp, googleCredential(googleAccount(flow.nonce)), { bodyCsrf: 'other' });
+
+      expect(res.status).toBe(400);
+      expect((await res.text()).includes('csrf_token_mismatch')).toBe(true);
+    });
+
+    it('should reject a credential the verifier does not accept', async () => {
+      await startGoogleFlow(googleApp, 'google-bad-credential');
+
+      const res = await googleCallback(googleApp, 'not-a-google-id-token');
+
+      expect(res.status).toBe(401);
+      expect(res.headers.get('Location')).toBe(null);
+      expect((await res.text()).includes('invalid_id_token')).toBe(true);
+    });
+
+    it('should hand the configured client ID to the verifier as the expected audience', async () => {
+      const flow = await startGoogleFlow(googleApp, 'google-audience');
+      verifiedClientIds.length = 0;
+
+      await googleCallback(googleApp, googleCredential(googleAccount(flow.nonce)));
+
+      expect(verifiedClientIds).toEqual([GOOGLE_CLIENT_ID]);
+    });
+
+    it('should reject a credential whose nonce was not issued for a login page', async () => {
+      await startGoogleFlow(googleApp, 'google-forged-nonce');
+
+      const res = await googleCallback(googleApp, googleCredential(googleAccount('forged-nonce')));
+
+      expect(res.status).toBe(400);
+      expect((await res.text()).includes('login_nonce_not_found')).toBe(true);
+    });
+
+    it('should reject a credential without a nonce', async () => {
+      await startGoogleFlow(googleApp, 'google-missing-nonce');
+
+      const res = await googleCallback(googleApp, googleCredential(googleAccount('', { nonce: undefined })));
+
+      expect(res.status).toBe(400);
+      expect((await res.text()).includes('invalid_nonce')).toBe(true);
+    });
+
+    it('should establish the OP session and continue to consent for a valid credential', async () => {
+      const flow = await startGoogleFlow(googleApp, 'google-happy');
+
+      const res = await googleCallback(googleApp, googleCredential(googleAccount(flow.nonce)));
+      const setCookie = res.headers.get('Set-Cookie') ?? '';
+
+      expect(res.status).toBe(302);
+      expect(res.headers.get('Location')).toBe(
+        'http://localhost:3000/consent?transaction_id=' + flow.transactionId,
+      );
+      expect(setCookie.startsWith('session_id=')).toBe(true);
+      expect(setCookie.endsWith('; HttpOnly; Secure; SameSite=Lax; Path=/')).toBe(true);
+    });
+
+    // The nonce is single use: the same credential cannot start a second session.
+    it('should reject a replay of an already used credential', async () => {
+      const flow = await startGoogleFlow(googleApp, 'google-replay');
+      const credential = googleCredential(googleAccount(flow.nonce));
+      await googleCallback(googleApp, credential);
+
+      const res = await googleCallback(googleApp, credential);
+
+      expect(res.status).toBe(400);
+      expect((await res.text()).includes('login_nonce_not_found')).toBe(true);
+    });
+
+    // A callback that fails before the credential is verified must not burn the
+    // nonce, or a forged POST could lock the user out of their own login page.
+    it('should keep the nonce usable after a callback that failed before verification', async () => {
+      const flow = await startGoogleFlow(googleApp, 'google-nonce-kept');
+      const credential = googleCredential(googleAccount(flow.nonce));
+      await googleCallback(googleApp, credential, { cookie: null });
+
+      const res = await googleCallback(googleApp, credential);
+
+      expect(res.status).toBe(302);
+    });
+
+    it('should issue tokens for the Google user and return the Google profile from UserInfo', async () => {
+      const flow = await startGoogleFlow(googleApp, 'google-tokens', 'openid profile email');
+      const callbackRes = await googleCallback(googleApp, googleCredential(googleAccount(flow.nonce)));
+      const consentPath = googleRelativeFrom(callbackRes.headers.get('Location'));
+      const consentGet = await googleApp.request(consentPath);
+      const consentRes = await googleApp.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          transaction_id: flow.transactionId,
+          csrf_token: googleCsrfFrom(await consentGet.text()),
+          action: 'approve',
+        }).toString(),
+      });
+      const code =
+        new URL(consentRes.headers.get('Location') ?? '', 'http://localhost').searchParams.get('code') ?? '';
+      const tokenRes = await googleApp.request('/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code,
+          redirect_uri: REDIRECT_URI,
+          client_id: 'c-conf',
+          client_secret: 's',
+          code_verifier: GOOGLE_PKCE_VERIFIER,
+        }).toString(),
+      });
+      const tokens = await tokenRes.json();
+      const userinfoRes = await googleApp.request('/userinfo', {
+        headers: { Authorization: 'Bearer ' + tokens.access_token },
+      });
+
+      expect(tokenRes.status).toBe(200);
+      // Users provisioned from Google are keyed by the Google sub, never the email.
+      expect(idTokenPayload(tokens.id_token as string).sub).toBe('google:' + GOOGLE_SUB);
+      expect(userinfoRes.status).toBe(200);
+      expect(await userinfoRes.json()).toEqual({
+        sub: 'google:' + GOOGLE_SUB,
+        name: 'John Smith',
+        given_name: 'John',
+        family_name: 'Smith',
+        picture: 'https://lh3.googleusercontent.com/a/photo',
+        email: 'jsmith@example.com',
+        email_verified: true,
+      });
+    });
+
+    it('should keep the password login working next to the Google button', async () => {
+      const flow = await startGoogleFlow(googleApp, 'google-password');
+
+      const res = await googleApp.request('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          transaction_id: flow.transactionId,
+          csrf_token: googleCsrfFrom(flow.loginHtml),
+          username: 'testuser',
+          password: 'password',
+        }).toString(),
+      });
+
+      expect(res.status).toBe(302);
+      expect(res.headers.get('Location')).toBe(
+        'http://localhost:3000/consent?transaction_id=' + flow.transactionId,
+      );
+    });
+
+    it('should reject a Google account outside the allowed hosted domain', async () => {
+      const workspaceApp = createGoogleApp({ clientId: GOOGLE_CLIENT_ID, hostedDomain: 'example.com' });
+      const flow = await startGoogleFlow(workspaceApp, 'google-hd');
+
+      const res = await googleCallback(
+        workspaceApp,
+        googleCredential(googleAccount(flow.nonce, { hd: 'other.example' })),
+      );
+
+      expect(res.status).toBe(403);
+      expect((await res.text()).includes('invalid_hosted_domain')).toBe(true);
+    });
+
+    it('should accept a Google account of the allowed hosted domain', async () => {
+      const workspaceApp = createGoogleApp({ clientId: GOOGLE_CLIENT_ID, hostedDomain: 'example.com' });
+      const flow = await startGoogleFlow(workspaceApp, 'google-hd-ok');
+
+      const res = await googleCallback(
+        workspaceApp,
+        googleCredential(googleAccount(flow.nonce, { hd: 'example.com' })),
+      );
+
+      expect(res.status).toBe(302);
+    });
+
+    it('should reject an unverified email when requireVerifiedEmail is set', async () => {
+      const strictApp = createGoogleApp({ clientId: GOOGLE_CLIENT_ID, requireVerifiedEmail: true });
+      const flow = await startGoogleFlow(strictApp, 'google-unverified');
+
+      const res = await googleCallback(
+        strictApp,
+        googleCredential(googleAccount(flow.nonce, { email_verified: false })),
+      );
+
+      expect(res.status).toBe(403);
+      expect((await res.text()).includes('email_not_verified')).toBe(true);
+    });
+
+    // The persistent (JsonStoreBackend) stores carry the same contract as the
+    // in-memory ones: the nonce is stored and consumed there, and the Google
+    // user is provisioned under its own key prefix.
+    it('should provision the Google user through the JSON store backend as well', async () => {
+      const values = new Map<string, unknown>();
+      const backend: JsonStoreBackend = {
+        async get<T>(key: string): Promise<T | null> {
+          return (values.get(key) as T | undefined) ?? null;
+        },
+        async put<T>(key: string, value: T): Promise<void> {
+          values.set(key, value);
+        },
+        async delete(key: string): Promise<void> {
+          values.delete(key);
+        },
+        async list<T>(prefix: string): Promise<Array<{ key: string; value: T }>> {
+          return [...values.entries()]
+            .filter(([key]) => key.startsWith(prefix))
+            .map(([key, value]) => ({ key, value: value as T }));
+        },
+      };
+      const jsonApp = createApp({
+        signingKeyProvider,
+        clientResolver: createInMemoryClientResolver(testClients),
+        config: { googleLogin: { clientId: GOOGLE_CLIENT_ID } },
+        googleIdTokenVerifier: fakeGoogleVerifier,
+        storage: createJsonProviderStores(backend),
+      });
+      const flow = await startGoogleFlow(jsonApp, 'google-json-store');
+
+      const res = await googleCallback(jsonApp, googleCredential(googleAccount(flow.nonce)));
+      const readerStores = createJsonProviderStores(backend);
+
+      expect(res.status).toBe(302);
+      expect(await readerStores.userStore.getClaims('google:' + GOOGLE_SUB)).toEqual({
+        sub: 'google:' + GOOGLE_SUB,
+        name: 'John Smith',
+        given_name: 'John',
+        family_name: 'Smith',
+        picture: 'https://lh3.googleusercontent.com/a/photo',
+        email: 'jsmith@example.com',
+        email_verified: true,
+      });
+      // The nonce record was consumed on first use.
+      expect([...values.keys()].filter((key) => key.startsWith('google-login-nonce:'))).toEqual([]);
+    });
+  });
+`;
+}
+export function rpInitiatedLogoutConformanceBlock(features) {
+    if (!features.rpInitiatedLogout)
+        return '';
+    return `
+  // EXPERIMENTAL — OpenID Connect RP-Initiated Logout 1.0. Generated because
+  // this provider was created with --enable rp-initiated-logout. These tests
+  // pin the contract the repository guarantees for the generated
+  // end_session_endpoint: change the behavior and they fail, which is how a
+  // customized OP learns it drifted.
+  describe('RP-Initiated Logout (RP-Initiated Logout 1.0)', () => {
+    // RFC 7636 Appendix B example PKCE pair (verifier -> its S256 challenge).
+    const LOGOUT_PKCE_VERIFIER = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+    const LOGOUT_PKCE_CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+    // A logout-specific registered return URI — deliberately NOT the authorize
+    // REDIRECT_URI, because §3 defines post_logout_redirect_uris as its own
+    // registry.
+    const POST_LOGOUT_URI = 'http://localhost:3000/logged-out';
+    const CLEARED_SESSION_COOKIE =
+      'session_id=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0';
+
+    // The generated settings object is the §3 registry; register the test
+    // client's return URI once for every test in this block.
+    rpInitiatedLogoutConfig.postLogoutRedirectUris = { 'c-conf': [POST_LOGOUT_URI] };
+
+    // Pure helpers: they fetch and parse only. Every assertion lives in an it().
+    function relativeFrom(location: string | null): string {
+      const url = new URL(location ?? '', 'http://localhost');
+      return url.pathname + url.search;
+    }
+
+    function csrfFrom(html: string): string {
+      return html.match(/name="csrf_token" value="([^"]+)"/)?.[1] ?? '';
+    }
+
+    // Drive authorize -> login -> consent -> token and hand back the browser
+    // session cookie plus the ID Token (the id_token_hint of the logout tests).
+    async function loginSession(): Promise<{ idToken: string; sessionCookie: string }> {
+      const authorizeRes = await app.request(
+        '/authorize?response_type=code&client_id=c-conf' +
+          '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+          '&scope=openid&state=logout-flow&nonce=logout-nonce&prompt=consent' +
+          '&code_challenge=' + LOGOUT_PKCE_CHALLENGE + '&code_challenge_method=S256',
+      );
+      const loginPath = relativeFrom(authorizeRes.headers.get('Location'));
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
+      const transactionId =
+        new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
+
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
+      const loginRes = await app.request('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: csrfFrom(await loginGet.text()),
+          username: 'testuser',
+          password: 'password',
+        }).toString(),
+      });
+      const sessionCookie =
+        (loginRes.headers.get('Set-Cookie') ?? '').match(/session_id=[^;,]+/)?.[0] ?? '';
+      const cookies = bindingCookie ? bindingCookie + '; ' + sessionCookie : sessionCookie;
+
+      const consentPath = relativeFrom(loginRes.headers.get('Location'));
+      const consentGet = await app.request(consentPath, { headers: { Cookie: cookies } });
+      const consentRes = await app.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: cookies },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: csrfFrom(await consentGet.text()),
+          action: 'approve',
+        }).toString(),
+      });
+      const code =
+        new URL(consentRes.headers.get('Location') ?? '', 'http://localhost')
+          .searchParams.get('code') ?? '';
+
+      const tokenRes = await app.request('/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code,
+          redirect_uri: REDIRECT_URI,
+          client_id: 'c-conf',
+          client_secret: 's',
+          code_verifier: LOGOUT_PKCE_VERIFIER,
+        }).toString(),
+      });
+      const idToken = ((await tokenRes.json()) as { id_token?: string }).id_token ?? '';
+      return { idToken, sessionCookie };
+    }
+
+    // prompt=none is the observable session probe (OIDC Core 1.0 §3.1.2.1): a
+    // live session answers with a code, a dead one with error=login_required.
+    async function promptNoneProbe(
+      sessionCookie: string,
+    ): Promise<{ error: string | null; hasCode: boolean }> {
+      const res = await app.request(
+        '/authorize?response_type=code&client_id=c-conf' +
+          '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+          '&scope=openid&state=logout-probe&prompt=none' +
+          '&code_challenge=' + LOGOUT_PKCE_CHALLENGE + '&code_challenge_method=S256',
+        { headers: { Cookie: sessionCookie } },
+      );
+      const callback = new URL(res.headers.get('Location') ?? '', 'http://localhost');
+      return {
+        error: callback.searchParams.get('error'),
+        hasCode: callback.searchParams.get('code') !== null,
+      };
+    }
+
+    it('should advertise end_session_endpoint in discovery metadata', async () => {
+      const res = await app.request('/.well-known/openid-configuration');
+
+      expect(res.status).toBe(200);
+      const metadata = await res.json();
+      expect(metadata.end_session_endpoint).toBe('http://localhost:3000/logout');
+    });
+
+    // §2 + §3: a valid hint for the current session logs out at once, the
+    // session cookie and store entry are destroyed together, and the browser
+    // returns to the registered URI with state appended.
+    it('should log out immediately and redirect with state for a valid hint and registered URI', async () => {
+      const { idToken, sessionCookie } = await loginSession();
+
+      const res = await app.request(
+        '/logout?id_token_hint=' + encodeURIComponent(idToken) +
+          '&post_logout_redirect_uri=' + encodeURIComponent(POST_LOGOUT_URI) +
+          '&state=af0ifjsldkj',
+        { headers: { Cookie: sessionCookie } },
+      );
+
+      expect(res.status).toBe(302);
+      expect(res.headers.get('Location')).toBe(POST_LOGOUT_URI + '?state=af0ifjsldkj');
+      expect(res.headers.get('Set-Cookie')).toBe(CLEARED_SESSION_COOKIE);
+      expect(await promptNoneProbe(sessionCookie)).toEqual({
+        error: 'login_required',
+        hasCode: false,
+      });
+    });
+
+    // §2 MUST: the end_session_endpoint accepts POST with a form body exactly
+    // like GET with a query.
+    it('should accept the logout request as a form POST', async () => {
+      const { idToken, sessionCookie } = await loginSession();
+
+      const res = await app.request('/logout', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: sessionCookie },
+        body: new URLSearchParams({
+          id_token_hint: idToken,
+          post_logout_redirect_uri: POST_LOGOUT_URI,
+          state: 'post-body-state',
+        }).toString(),
+      });
+
+      expect(res.status).toBe(302);
+      expect(res.headers.get('Location')).toBe(POST_LOGOUT_URI + '?state=post-body-state');
+    });
+
+    // §2 MUST + §7: without a valid hint nothing is deleted — the screen asks
+    // first, so a planted <img src="/logout"> cannot end the victim's session.
+    it('should show the confirmation screen and keep the session when the hint is absent', async () => {
+      const { sessionCookie } = await loginSession();
+
+      const res = await app.request('/logout', { headers: { Cookie: sessionCookie } });
+
+      expect(res.status).toBe(200);
+      expect(res.headers.get('Content-Type')).toBe('text/html; charset=UTF-8');
+      const html = await res.text();
+      expect(html.includes('action="/logout/approve"')).toBe(true);
+      expect((res.headers.get('Set-Cookie') ?? '').startsWith('oidc_logout_confirm=')).toBe(true);
+      expect(await promptNoneProbe(sessionCookie)).toEqual({ error: null, hasCode: true });
+    });
+
+    it('should delete the session when the confirmation is approved with the paired cookie and token', async () => {
+      const { sessionCookie } = await loginSession();
+      const confirmRes = await app.request('/logout', { headers: { Cookie: sessionCookie } });
+      const confirmCookie =
+        (confirmRes.headers.get('Set-Cookie') ?? '').match(/oidc_logout_confirm=[^;,]+/)?.[0] ?? '';
+      const csrfToken = csrfFrom(await confirmRes.text());
+
+      const res = await app.request('/logout/approve', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          Cookie: sessionCookie + '; ' + confirmCookie,
+        },
+        body: new URLSearchParams({ csrf_token: csrfToken }).toString(),
+      });
+
+      expect(res.status).toBe(200);
+      expect((res.headers.get('Set-Cookie') ?? '').includes(CLEARED_SESSION_COOKIE)).toBe(true);
+      expect(await promptNoneProbe(sessionCookie)).toEqual({
+        error: 'login_required',
+        hasCode: false,
+      });
+    });
+
+    // The hidden token alone is not a defense: without the HttpOnly cookie the
+    // approve POST must refuse to delete anything (forged cross-site POST).
+    it('should reject an approve POST without the confirmation cookie and keep the session', async () => {
+      const { sessionCookie } = await loginSession();
+      const confirmRes = await app.request('/logout', { headers: { Cookie: sessionCookie } });
+      const csrfToken = csrfFrom(await confirmRes.text());
+
+      const res = await app.request('/logout/approve', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          Cookie: sessionCookie,
+        },
+        body: new URLSearchParams({ csrf_token: csrfToken }).toString(),
+      });
+
+      expect(res.status).toBe(400);
+      expect(await promptNoneProbe(sessionCookie)).toEqual({ error: null, hasCode: true });
+    });
+
+    // §3 MUST NOT: an unregistered URI is never redirected to. The logout
+    // itself still happens (the hint was valid) — the browser just stays on
+    // the completed page and state is not echoed anywhere.
+    it('should show the completed page instead of redirecting to an unregistered URI', async () => {
+      const { idToken, sessionCookie } = await loginSession();
+
+      const res = await app.request(
+        '/logout?id_token_hint=' + encodeURIComponent(idToken) +
+          '&post_logout_redirect_uri=' + encodeURIComponent('https://attacker.example/out') +
+          '&state=leak-probe',
+        { headers: { Cookie: sessionCookie } },
+      );
+
+      expect(res.status).toBe(200);
+      expect(res.headers.get('Location')).toBe(null);
+      expect((await res.text()).includes('leak-probe')).toBe(false);
+      expect(await promptNoneProbe(sessionCookie)).toEqual({
+        error: 'login_required',
+        hasCode: false,
+      });
+    });
+
+    // §2 MUST: a client_id parameter that mismatches the hint audience voids
+    // the hint — confirmation screen, session intact, no redirect.
+    it('should fall back to the confirmation screen when client_id mismatches the hint audience', async () => {
+      const { idToken, sessionCookie } = await loginSession();
+
+      const res = await app.request(
+        '/logout?id_token_hint=' + encodeURIComponent(idToken) +
+          '&client_id=c-public' +
+          '&post_logout_redirect_uri=' + encodeURIComponent(POST_LOGOUT_URI),
+        { headers: { Cookie: sessionCookie } },
+      );
+
+      expect(res.status).toBe(200);
+      expect(res.headers.get('Location')).toBe(null);
+      expect((await res.text()).includes('action="/logout/approve"')).toBe(true);
+      expect(await promptNoneProbe(sessionCookie)).toEqual({ error: null, hasCode: true });
+    });
+  });
+`;
+}
 export function conformanceTestTemplate(corePkg, features = DEFAULT_FEATURES, scopes = []) {
     const customScopeConformanceImport = scopes.length > 0
         ? `
@@ -16523,19 +18112,25 @@ import { idJagConfig } from './routes/token.js';`
         ? `
 import { cibaAuthenticationRequestStore } from './store.js';`
         : '';
+    const rpInitiatedLogoutConformanceImports = features.rpInitiatedLogout
+        ? `
+import { rpInitiatedLogoutConfig } from './routes/logout.js';`
+        : '';
     const vitestNames = features.ciba
         ? 'describe, it, expect, beforeAll, afterEach'
         : 'describe, it, expect, beforeAll';
+    const googleLoginConformanceImports = googleLoginConformanceImportsBlock(features);
+    const googleLoginConfigTypeImport = features.googleLogin ? ', type GoogleLoginConfig' : '';
     return `import { ${vitestNames} } from 'vitest';
 import type { SigningKeyProvider, SigningKey } from '${corePkg}';
 import { Hono } from 'hono';
 ${exportPublicJwkImport}import { createApp, validateSigningKeySet } from './app.js';
 import { applyOidc } from './apply.js';
-import { createInMemoryClientResolver, type RegisteredClient } from './config.js';
+import { createInMemoryClientResolver, type RegisteredClient${googleLoginConfigTypeImport} } from './config.js';
 import { accessTokenStore, authSessionStore, consentStore, createJsonProviderStores,${onlineRefreshTokenConformanceStoreImport(features)} refreshTokenStore, transactionStore, type JsonStoreBackend } from './store.js';
 import { consentResolver } from './resolvers.js';
 import { defaultViews } from './views.js';
-import { renderView } from './views.js';${parConformanceImports}${tokenExchangeConformanceImports}${idJagConformanceImports}${cibaConformanceImports}${customScopeConformanceImport}
+import { renderView } from './views.js';${parConformanceImports}${tokenExchangeConformanceImports}${idJagConformanceImports}${cibaConformanceImports}${rpInitiatedLogoutConformanceImports}${googleLoginConformanceImports}${customScopeConformanceImport}
 
 /**
  * HTTP conformance smoke tests for the generated OpenID Connect Provider.
@@ -17014,7 +18609,7 @@ ${introspectionConformanceBlock(features)}
       });
     });
   });
-${transactionBindingConformanceBlock(features)}${customViewConformanceTestBlock()}${internalRedirectOriginConformanceBlock()}${endpointBehaviorConformanceBlock(features, true)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features)}${onlineRefreshTokenConformanceBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}${idJagConformanceBlock(features)}${deviceAuthorizationConformanceBlock(features)}${cibaConformanceBlock(features)}${jarmConformanceBlock(features)}${jwtIntrospectionResponseConformanceBlock(features)}${consentDecisionConformanceBlock()}${customScopeConformanceBlock(scopes)}});
+${transactionBindingConformanceBlock(features)}${customViewConformanceTestBlock()}${internalRedirectOriginConformanceBlock()}${endpointBehaviorConformanceBlock(features, true)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features)}${onlineRefreshTokenConformanceBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}${idJagConformanceBlock(features)}${deviceAuthorizationConformanceBlock(features)}${cibaConformanceBlock(features)}${jarmConformanceBlock(features)}${jwtIntrospectionResponseConformanceBlock(features)}${rpInitiatedLogoutConformanceBlock(features)}${googleLoginConformanceBlock(features)}${consentDecisionConformanceBlock()}${customScopeConformanceBlock(scopes)}});
 `;
 }
 //# sourceMappingURL=templates.js.map