@maronn-openid-connect/cli 0.7.0 → 0.8.0

package/dist/frameworks/web-standard/templates.js

@@ -828,1164 +828,12 @@ async function toFastifyReply(reply: FastifyReply, response: Response): Promise<
 }
 `;
 }
-export function nextJsRouteHandlerTemplate() {
-    return `import { createApp, type OidcProviderOptions } from './app';
-
-export type NextOidcProviderOptions = OidcProviderOptions;
-export type NextOidcRouteHandler = (request: Request) => Promise<Response>;
-
-export interface NextOidcRouteHandlers {
-  GET: NextOidcRouteHandler;
-  POST: NextOidcRouteHandler;
-  OPTIONS: NextOidcRouteHandler;
-}
-
-export function createOidcRouteHandlers(options: NextOidcProviderOptions): NextOidcRouteHandlers {
-  const oidc = createApp(options);
-  const handle = (request: Request): Promise<Response> =>
-    oidc.request(rebaseRequestOrigin(request, options.config?.issuer));
-
-  return {
-    GET: handle,
-    POST: handle,
-    OPTIONS: handle,
-  };
-}
-
-// The advertised issuer is the source of truth for the OP's own origin
-// (OIDC Discovery 1.0 §3): rebasing here keeps every URL the OP derives from
-// the request — including the /login and /consent redirect Locations —
-// independent of the Host header the runtime saw (RFC 9700 §2.1).
-function rebaseRequestOrigin(request: Request, issuer: string | undefined): Request {
-  if (!issuer) return request;
-
-  const issuerUrl = new URL(issuer);
-  const requestUrl = new URL(request.url);
-  if (requestUrl.origin === issuerUrl.origin) return request;
-
-  requestUrl.protocol = issuerUrl.protocol;
-  requestUrl.host = issuerUrl.host;
-  const init: RequestInit & { duplex?: 'half' } = {
-    method: request.method,
-    headers: request.headers,
-    body: request.body,
-    redirect: request.redirect,
-    signal: request.signal,
-  };
-  if (request.body) {
-    init.duplex = 'half';
-  }
-  return new Request(requestUrl, init);
-}
-`;
-}
-export function nextJsStorageBackendTemplate() {
-    return `import { mkdirSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { DatabaseSync } from 'node:sqlite';
-import {
-  createJsonProviderStores,
-  type JsonStoreBackend,
-  type JsonStoreEntry,
-  type ProviderStores,
-} from './store';
-
-declare const process: { env: Record<string, string | undefined> };
-
-interface StoredRow {
-  key: string;
-  value: string;
-  expires_at: number | null;
-}
-
-class SqliteJsonStoreBackend implements JsonStoreBackend {
-  private readonly database: DatabaseSync;
-
-  constructor(path: string) {
-    const databasePath = path === ':memory:' ? path : resolve(path);
-    if (databasePath !== ':memory:') {
-      mkdirSync(dirname(databasePath), { recursive: true });
-    }
-    this.database = new DatabaseSync(databasePath);
-    // Concurrent processes opening the same file (e.g. Next.js build workers
-    // collecting page data) race on the initial schema write; without a busy
-    // timeout SQLite fails fast with "database is locked" instead of waiting.
-    this.database.exec('PRAGMA busy_timeout = 5000');
-    this.database.exec('PRAGMA journal_mode = WAL');
-    this.database.exec(
-      'CREATE TABLE IF NOT EXISTS oidc_store (' +
-      'key TEXT PRIMARY KEY, value TEXT NOT NULL, expires_at INTEGER)',
-    );
-  }
-
-  async get<T>(key: string): Promise<T | null> {
-    const row = this.database
-      .prepare('SELECT key, value, expires_at FROM oidc_store WHERE key = ?')
-      .get(key) as unknown as StoredRow | undefined;
-    if (!row) return null;
-    if (row.expires_at !== null && row.expires_at <= Date.now()) {
-      await this.delete(key);
-      return null;
-    }
-    return JSON.parse(row.value) as T;
-  }
-
-  async put<T>(key: string, value: T, ttlSeconds?: number): Promise<void> {
-    const expiresAt = ttlSeconds === undefined ? null : Date.now() + ttlSeconds * 1000;
-    this.database.prepare(
-      'INSERT INTO oidc_store (key, value, expires_at) VALUES (?, ?, ?) ' +
-      'ON CONFLICT(key) DO UPDATE SET value = excluded.value, expires_at = excluded.expires_at',
-    ).run(key, JSON.stringify(value), expiresAt);
-  }
-
-  async delete(key: string): Promise<void> {
-    this.database.prepare('DELETE FROM oidc_store WHERE key = ?').run(key);
-  }
-
-  async list<T>(prefix: string): Promise<Array<JsonStoreEntry<T>>> {
-    const rows = this.database
-      .prepare(
-        'SELECT key, value, expires_at FROM oidc_store ' +
-        'WHERE key >= ? AND key < ? ORDER BY key',
-      )
-      .all(prefix, prefix + '\\uffff') as unknown as StoredRow[];
-    const entries: Array<JsonStoreEntry<T>> = [];
-    for (const row of rows) {
-      if (row.expires_at !== null && row.expires_at <= Date.now()) {
-        await this.delete(row.key);
-      } else {
-        entries.push({ key: row.key, value: JSON.parse(row.value) as T });
-      }
-    }
-    return entries;
-  }
-}
-
-interface UpstashResponse<T> {
-  result?: T;
-  error?: string;
-}
-
-class UpstashRedisJsonStoreBackend implements JsonStoreBackend {
-  constructor(
-    private readonly url: string,
-    private readonly token: string,
-    private readonly namespace = 'maronn-openid-connect:',
-  ) {}
-
-  async get<T>(key: string): Promise<T | null> {
-    const value = await this.command<string | null>(['GET', this.fullKey(key)]);
-    return value === null ? null : JSON.parse(value) as T;
-  }
-
-  async put<T>(key: string, value: T, ttlSeconds?: number): Promise<void> {
-    const command: Array<string | number> = ['SET', this.fullKey(key), JSON.stringify(value)];
-    if (ttlSeconds !== undefined) command.push('EX', ttlSeconds);
-    await this.command<string>(command);
-  }
-
-  async delete(key: string): Promise<void> {
-    await this.command<number>(['DEL', this.fullKey(key)]);
-  }
-
-  async list<T>(prefix: string): Promise<Array<JsonStoreEntry<T>>> {
-    const keys: string[] = [];
-    let cursor = '0';
-    do {
-      const result = await this.command<[string, string[]]>([
-        'SCAN',
-        cursor,
-        'MATCH',
-        this.fullKey(prefix) + '*',
-        'COUNT',
-        100,
-      ]);
-      cursor = String(result[0]);
-      keys.push(...result[1]);
-    } while (cursor !== '0');
-
-    const entries: Array<JsonStoreEntry<T>> = [];
-    for (const fullKey of keys) {
-      const value = await this.command<string | null>(['GET', fullKey]);
-      if (value !== null) {
-        entries.push({
-          key: fullKey.slice(this.namespace.length),
-          value: JSON.parse(value) as T,
-        });
-      }
-    }
-    return entries;
-  }
-
-  private fullKey(key: string): string {
-    return this.namespace + key;
-  }
-
-  private async command<T>(command: Array<string | number>): Promise<T> {
-    const response = await fetch(this.url, {
-      method: 'POST',
-      headers: {
-        Authorization: 'Bearer ' + this.token,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify(command),
-      cache: 'no-store',
-    });
-    const body = await response.json() as UpstashResponse<T>;
-    if (!response.ok || body.error || !('result' in body)) {
-      throw new Error(body.error ?? 'Upstash Redis request failed with HTTP ' + response.status);
-    }
-    return body.result as T;
-  }
-}
-
-const storageRegistry = globalThis as typeof globalThis & {
-  __oidcNextJsProviderStores?: ProviderStores;
-};
-
-export function createNextJsProviderStores(): ProviderStores {
-  return (storageRegistry.__oidcNextJsProviderStores ??= createStores());
-}
-
-function createStores(): ProviderStores {
-  const redisUrl = readEnv('UPSTASH_REDIS_REST_URL');
-  const redisToken = readEnv('UPSTASH_REDIS_REST_TOKEN');
-  if (redisUrl && redisToken) {
-    return createJsonProviderStores(new UpstashRedisJsonStoreBackend(redisUrl, redisToken));
-  }
-  if (readEnv('VERCEL')) {
-    throw new Error(
-      'UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN are required on Vercel',
-    );
-  }
-  const sqlitePath = readEnv('OIDC_SQLITE_PATH') ?? '.data/oidc.sqlite';
-  return createJsonProviderStores(new SqliteJsonStoreBackend(sqlitePath));
-}
-
-function readEnv(name: string): string | undefined {
-  return process.env[name];
-}
-`;
-}
-export function nextJsRuntimeTemplate(corePkg, features = DEFAULT_FEATURES) {
-    const googleLoginConfigTypeImport = features.googleLogin ? 'type GoogleLoginConfig, ' : '';
-    const googleLoginRuntimeConfig = features.googleLogin
-        ? `
-      // EXTENSION (google-login): set GOOGLE_CLIENT_ID (the OAuth client ID from
-      // the Google Cloud console) to render the "Sign in with Google" button.
-      // Register <issuer>/login/google as an authorized redirect URI there.
-      // GOOGLE_HOSTED_DOMAIN optionally restricts sign-in to one Workspace domain.
-      googleLogin: readGoogleLoginConfig(),`
-        : '';
-    const googleLoginRuntimeReader = features.googleLogin
-        ? `
-function readGoogleLoginConfig(): GoogleLoginConfig | undefined {
-  const clientId = readEnv('GOOGLE_CLIENT_ID');
-  if (!clientId) return undefined;
-  const hostedDomain = readEnv('GOOGLE_HOSTED_DOMAIN');
-  return hostedDomain ? { clientId, hostedDomain } : { clientId };
-}
-`
-        : '';
-    return `import {
-  createCachedSigningKeyProvider,
-  type AcrResolver,
-  type SigningKey,
-  type SigningKeyProvider,
-} from '${corePkg}';
-import { createInMemoryClientResolver, ${googleLoginConfigTypeImport}type RegisteredClient } from './config';
-import { createOidcRouteHandlers } from './next';
-import { createNextJsProviderStores } from './storage-backend';
-import type { OidcProviderOptions } from './app';
-
-declare const process: { env: Record<string, string | undefined> } | undefined;
-
-const signingKeyProvider = createCachedSigningKeyProvider(
-  createEphemeralRs256KeyProvider(),
-  60_000,
-);
-const providerStores = createNextJsProviderStores();
-
-// OIDC Core 1.0 §2 / §3.1.2.1: when a client requests an acr via \`acr_values\`
-// (or \`claims.id_token.acr.values\`), echo the most-preferred requested value back
-// as the ID Token \`acr\` claim. The OIDF oidcc-ensure-request-with-acr-values-succeeds
-// module only requires that the returned acr is one of the requested values; without
-// any resolver the OP omits acr and the module reports a SHOULD warning. This sample
-// treats every requested acr as satisfiable — a real deployment must map this to its
-// actual authentication context instead of echoing the request.
-const sampleAcrResolver: AcrResolver = async ({ requestedAcrValues }) => {
-  if (!requestedAcrValues) return undefined;
-  const preferred = requestedAcrValues.split(' ').find((value) => value.length > 0);
-  if (!preferred) return undefined;
-  return { acr: preferred, amr: ['pwd'] };
-};
-
-export function createOidcProviderOptions(): OidcProviderOptions {
-  const issuer = readEnv('OIDC_ISSUER') ?? readEnv('ISSUER') ?? 'http://localhost:3000';
-  const clients = readRegisteredClients();
-  const clientResolver = createInMemoryClientResolver(clients);
-
-  return {
-    config: {
-      issuer,
-      accessTokenExpiresIn: 3600,
-      idTokenExpiresIn: 3600,
-      refreshTokenAbsoluteLifetime: 7776000,
-      accessTokenFormat: 'jwt',
-      authorizationCodeTtl: 300,
-      allowNonPkceAuthorizationCodeFlow:
-        readEnv('OIDC_ALLOW_NON_PKCE_AUTHORIZATION_CODE_FLOW') === '1',
-      // OIDC Core 1.0 §6.1 / RFC 9101: accepting unsigned (alg:none) Request Objects
-      // is a security relaxation used only for OIDF Basic OP conformance, where the
-      // request object modules are skipped unless the OP advertises 'none' in
-      // request_object_signing_alg_values_supported. Default off (signed-only).
-      allowUnsignedRequestObject:
-        readEnv('OIDC_ALLOW_UNSIGNED_REQUEST_OBJECT') === '1',
-      // Non-redirect authorization errors (unknown client_id, unregistered
-      // redirect_uri, fragment) are handed to a Next.js-native error page at
-      // /oidc-error, which renders them via the App Router error boundary
-      // (app/oidc-error/error.tsx) — consistent with login/consent being real
-      // pages rather than HTML strings from the route handler.
-      authorizationErrorRedirectPath: '/oidc-error',${googleLoginRuntimeConfig}
-    },
-    signingKeyProvider,
-    clientResolver,
-    tokenClientResolver: clientResolver,
-    storage: providerStores,
-    acrResolver: sampleAcrResolver,
-    corsOrigins: readEnv('OIDC_CORS_ORIGINS') ?? issuer,
-  };
-}
-
-/**
- * Built provider options. Exported so the login / consent Server Actions can
- * reuse the same issuer and client resolver as the route handlers.
- */
-export const oidcProviderOptions = createOidcProviderOptions();
-
-export const oidcHandlers = createOidcRouteHandlers(oidcProviderOptions);
-
-function readRegisteredClients(): ReadonlyMap<string, RegisteredClient> {
-  const encoded = readEnv('OIDC_CLIENTS_JSON');
-  if (encoded) {
-    return parseRegisteredClients(encoded);
-  }
-
-  const clientId = readEnv('OIDC_CLIENT_ID') ?? readEnv('CLIENT_ID') ?? 'example-client';
-  const clientSecret =
-    readEnv('OIDC_CLIENT_SECRET') ?? readEnv('CLIENT_SECRET') ?? 'example-secret';
-  const clientRedirectUri =
-    readEnv('OIDC_CLIENT_REDIRECT_URI') ??
-    readEnv('CLIENT_REDIRECT_URI') ??
-    'http://localhost:3000/callback';
-
-  const clients = new Map<string, RegisteredClient>([
-    [
-      clientId,
-      {
-        clientId,
-        clientSecret,
-        redirectUris: [clientRedirectUri],
-        clientType: 'confidential',
-        grantTypes: ['authorization_code'],
-        tokenEndpointAuthMethod: 'client_secret_post',
-        responseTypes: ['code'],
-      },
-    ],
-  ]);
-
-  const resourceServerClientId =
-    readEnv('OIDC_RESOURCE_SERVER_CLIENT_ID') ?? readEnv('RESOURCE_SERVER_CLIENT_ID');
-  const resourceServerClientSecret =
-    readEnv('OIDC_RESOURCE_SERVER_CLIENT_SECRET') ?? readEnv('RESOURCE_SERVER_CLIENT_SECRET');
-  const resourceServerRedirectUri =
-    readEnv('OIDC_RESOURCE_SERVER_REDIRECT_URI') ??
-    readEnv('RESOURCE_SERVER_REDIRECT_URI') ??
-    'http://localhost:3030/unused-callback';
-
-  if (resourceServerClientId && resourceServerClientSecret) {
-    clients.set(resourceServerClientId, {
-      clientId: resourceServerClientId,
-      clientSecret: resourceServerClientSecret,
-      redirectUris: [resourceServerRedirectUri],
-      clientType: 'confidential',
-      grantTypes: ['authorization_code'],
-      tokenEndpointAuthMethod: 'client_secret_basic',
-      responseTypes: ['code'],
-    });
-  }
-
-  return clients;
-}
-
-function parseRegisteredClients(encoded: string): ReadonlyMap<string, RegisteredClient> {
-  const clients = JSON.parse(encoded) as RegisteredClient[];
-  return new Map(clients.map((client) => [client.clientId, client]));
-}
-
-function readEnv(name: string): string | undefined {
-  if (typeof process === 'undefined') return undefined;
-  return process.env[name];
-}
-${googleLoginRuntimeReader}
-function createEphemeralRs256KeyProvider(): SigningKeyProvider {
-  const keyPromise = generateSigningKey();
-  return {
-    async getSigningKey(): Promise<SigningKey> {
-      return keyPromise;
-    },
-    async getSigningKeys(): Promise<SigningKey[]> {
-      return [await keyPromise];
-    },
-  };
-}
-
-async function generateSigningKey(): Promise<SigningKey> {
-  const keyPair = await crypto.subtle.generateKey(
-    {
-      name: 'RSASSA-PKCS1-v1_5',
-      modulusLength: 2048,
-      publicExponent: new Uint8Array([1, 0, 1]),
-      hash: 'SHA-256',
-    },
-    true,
-    ['sign', 'verify'],
-  );
-  const publicJwk = await crypto.subtle.exportKey('jwk', keyPair.publicKey) as JsonWebKey & {
-    alg?: string;
-    use?: string;
-    kid?: string;
-  };
-  publicJwk.alg = 'RS256';
-  publicJwk.use = 'sig';
-  publicJwk.kid = readEnv('OIDC_SIGNING_KEY_ID') ?? 'nextjs-rs256-key';
-
-  return {
-    privateKey: keyPair.privateKey,
-    publicJwk,
-    keyId: publicJwk.kid,
-  };
-}
-`;
-}
-export function nextJsEndpointRouteTemplate(importPath, methods) {
-    const exports = methods
-        .map((method) => `export const ${method} = oidcHandlers.${method};`)
-        .join('\n');
-    return `import { oidcHandlers } from '${importPath}';
-
-export const dynamic = 'force-dynamic';
-export const runtime = 'nodejs';
-
-${exports}
-`;
-}
-export function nextJsLoginPageTemplate(corePkg, features = DEFAULT_FEATURES) {
-    const bindingImports = features.transactionBinding
-        ? `import { cookies } from 'next/headers';
-import { getAuthTransaction, validateTransactionBinding } from '${corePkg}';`
-        : `import { getAuthTransaction } from '${corePkg}';`;
-    const bindingStoreImport = features.transactionBinding
-        ? `import {
-  defaultProviderStores,
-  TRANSACTION_BINDING_COOKIE_PREFIX,
-} from '../_oidc-provider/store';`
-        : `import { defaultProviderStores } from '../_oidc-provider/store';`;
-    const bindingHelper = features.transactionBinding
-        ? `
-/**
- * Is this request coming from the User-Agent that started the transaction?
- * The authorization endpoint handed that browser a secret in an HttpOnly cookie
- * named per transaction; only its hash is stored (OIDC Core 1.0 Section 3.1.2.3
- * / 3.1.2.4). See buildTransactionBindingCookie() in _oidc-provider/store.ts.
- */
-async function isBoundToThisBrowser(
-  transaction: Awaited<ReturnType<typeof getAuthTransaction>>,
-  transactionId: string,
-): Promise<boolean> {
-  const cookieStore = await cookies();
-  const bindingSecret = cookieStore.get(TRANSACTION_BINDING_COOKIE_PREFIX + transactionId)?.value;
-  try {
-    await validateTransactionBinding(transaction, bindingSecret);
-    return true;
-  } catch {
-    return false;
-  }
-}
-`
-        : '';
-    const bindingCheck = features.transactionBinding
-        ? `
-  // OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4: this form embeds csrf_token, so only
-  // the User-Agent that started the transaction may render it. transaction_id
-  // alone is not proof — it rides in the URL and can leak. See store.ts.
-  if (!(await isBoundToThisBrowser(transaction, transactionId))) {
-    return (
-      <main>
-        <h1>Login</h1>
-        <p role="alert">This authorization transaction was not started by this browser.</p>
-      </main>
-    );
-  }
-`
-        : '';
-    const googleLoginImports = features.googleLogin
-        ? `
-import Script from 'next/script';
-import { issueGoogleLoginNonce } from '${GOOGLE_LOGIN_PACKAGE}';
-import {
-  buildGoogleSignInAttributes,
-  GOOGLE_GSI_CLIENT_SCRIPT_URL,
-} from '${GOOGLE_LOGIN_PACKAGE}/sign-in';`
-        : '';
-    const loginPageStores = features.googleLogin
-        ? `const { transactionStore, googleLoginNonceStore } =
-  oidcProviderOptions.storage ?? defaultProviderStores;`
-        : `const transactionStore =
-  (oidcProviderOptions.storage ?? defaultProviderStores).transactionStore;`;
-    const googleSignInRender = features.googleLogin
-        ? `
-  // EXTENSION (google-login): the GIS configuration (g_id_onload attributes),
-  // built only when config.googleLogin is set. Each render issues a fresh nonce
-  // bound to this transaction; Google echoes it in the ID token, which is how
-  // login/google/route.ts finds the transaction. The JSX below owns the markup.
-  const googleLogin = oidcProviderOptions.config?.googleLogin;
-  const googleSignIn = googleLogin
-    ? buildGoogleSignInAttributes({
-        clientId: googleLogin.clientId,
-        // Must equal an authorized redirect URI of the Google OAuth client.
-        loginUri: new URL(
-          '/login/google',
-          oidcProviderOptions.config?.issuer ?? 'http://localhost:3000',
-        ).toString(),
-        nonce: await issueGoogleLoginNonce({
-          transactionId,
-          expiresAt: transaction.expiresAt,
-          store: googleLoginNonceStore,
-        }),
-        loginHint: transaction.loginHint,
-        hostedDomain:
-          typeof googleLogin.hostedDomain === 'string' ? googleLogin.hostedDomain : undefined,
-      })
-    : undefined;
-`
-        : '';
-    const googleSignInJsx = features.googleLogin
-        ? `
-      {/*
-        EXTENSION (google-login): the three elements GIS needs for redirect mode.
-        googleSignIn holds the g_id_onload attributes (data-ux_mode="redirect",
-        data-login_uri, data-nonce, ...) and spreads straight onto the element;
-        GIS replaces .g_id_signin with the button — style it through the GIS
-        button attributes (data-theme, data-size, data-text, ...).
-      */}
-      {googleSignIn ? (
-        <section aria-label="Sign in with Google">
-          <Script src={GOOGLE_GSI_CLIENT_SCRIPT_URL} strategy="afterInteractive" />
-          <div {...googleSignIn} />
-          <div className="g_id_signin" data-type="standard" />
-        </section>
-      ) : null}`
-        : '';
-    return `${bindingImports}
-import { oidcProviderOptions } from '../_oidc-provider/runtime';
-${bindingStoreImport}${googleLoginImports}
-import { loginAction } from './actions';
-
-${loginPageStores}
-
-// Authorization redirects here with a per-request transaction_id, so the page
-// must always render dynamically (never statically cached).
-export const dynamic = 'force-dynamic';
-
-interface LoginPageProps {
-  searchParams: Promise<{
-    transaction_id?: string;
-    error?: string;
-    remaining?: string;
-  }>;
-}
-${bindingHelper}
-/**
- * Login page (React Server Component).
- *
- * This is intentionally a real Next.js \`page.tsx\` so you can customize the UI
- * with JSX, components, CSS modules, and the rest of the React/Next.js
- * ecosystem. The form posts to a Server Action (./actions.ts) that runs the
- * OpenID Connect login logic on the server.
- */
-export default async function LoginPage({ searchParams }: LoginPageProps) {
-  const { transaction_id: transactionId, error, remaining } = await searchParams;
-
-  if (!transactionId) {
-    return (
-      <main>
-        <h1>Login</h1>
-        <p>Missing transaction_id</p>
-      </main>
-    );
-  }
-
-  // Rate limit reached: handleLoginFailure() locked further attempts.
-  if (error === 'too_many_attempts') {
-    return (
-      <main>
-        <h1>Login</h1>
-        <p role="alert">Too many login attempts</p>
-      </main>
-    );
-  }
-
-  const transaction = await getAuthTransaction(transactionId, transactionStore);
-${bindingCheck}${googleSignInRender}
-  const errorMessage =
-    error === 'invalid_credentials'
-      ? \`Invalid credentials\${remaining ? \`. Attempts remaining: \${remaining}\` : ''}\`
-      : null;
-
-  return (
-    <main>
-      <h1>Login</h1>
-      {errorMessage ? (
-        <p role="alert" style={{ color: 'red' }}>
-          {errorMessage}
-        </p>
-      ) : null}
-      <form action={loginAction}>
-        <input type="hidden" name="transaction_id" value={transactionId} />
-        <input type="hidden" name="csrf_token" value={transaction.csrfToken} />
-        <div>
-          <label htmlFor="username">Username:</label>
-          <input type="text" id="username" name="username" required />
-        </div>
-        <div>
-          <label htmlFor="password">Password:</label>
-          <input type="password" id="password" name="password" required />
-        </div>
-        <button type="submit">Login</button>
-      </form>${googleSignInJsx}
-    </main>
-  );
-}
-`;
-}
-export function nextJsAuthorizationErrorPageTemplate() {
-    return `// The Authorization Endpoint 303-redirects non-redirect errors here (see
-// runtime.ts authorizationErrorRedirectPath), so this page must always render
-// dynamically and never be statically cached.
-export const dynamic = 'force-dynamic';
-
-interface OidcErrorPageProps {
-  searchParams: Promise<{ error?: string; error_description?: string }>;
-}
-
-/**
- * Authorization error page (OIDC Core 1.0 §3.1.2.2).
- *
- * The Authorization Endpoint cannot redirect certain errors (unknown client_id,
- * unregistered redirect_uri, redirect_uri with a fragment) back to the client,
- * so it sends the browser here instead. This Server Component intentionally
- * throws so the sibling App Router error boundary (\`error.tsx\`) renders the UI —
- * the idiomatic Next.js way to surface errors, consistent with login / consent
- * being real pages rather than HTML strings from a route handler. \`error.tsx\`
- * reads error / error_description from the URL, so the thrown Error only needs to
- * activate the boundary.
- */
-export default async function OidcErrorPage({ searchParams }: OidcErrorPageProps) {
-  const { error } = await searchParams;
-  throw new Error(\`Authorization error: \${error ?? 'invalid_request'}\`);
-}
-`;
-}
-export function nextJsAuthorizationErrorBoundaryTemplate() {
-    return `'use client';
-
-import { useSearchParams } from 'next/navigation';
-
-/**
- * App Router error boundary for the authorization error page.
- *
- * OIDC Core 1.0 §3.1.2.2: the Authorization Endpoint 303-redirects non-redirect
- * errors to /oidc-error, whose \`page.tsx\` throws to trigger this boundary. We read
- * the OAuth error / error_description from the URL — not from the thrown Error,
- * whose message is stripped in production builds — and render them as React text
- * so the values are safely escaped. Customize this UI with JSX as needed.
- */
-export default function OidcAuthorizationError() {
-  const searchParams = useSearchParams();
-  const error = searchParams.get('error') ?? 'invalid_request';
-  const errorDescription = searchParams.get('error_description');
-
-  return (
-    <main>
-      <h1>Error</h1>
-      <p>{error}</p>
-      {errorDescription ? <p>{errorDescription}</p> : null}
-    </main>
-  );
-}
-`;
-}
-export function nextJsLoginActionTemplate(corePkg, features = DEFAULT_FEATURES) {
-    const bindingCoreImport = features.transactionBinding
-        ? `
-  validateTransactionBinding,`
-        : '';
-    const bindingStoreImport = features.transactionBinding
-        ? `import {
-  defaultProviderStores,
-  SESSION_COOKIE_NAME,
-  TRANSACTION_BINDING_COOKIE_PREFIX,
-} from '../_oidc-provider/store';`
-        : `import { defaultProviderStores, SESSION_COOKIE_NAME } from '../_oidc-provider/store';`;
-    const bindingCheck = features.transactionBinding
-        ? `  // OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4: checked before validateCsrfToken —
-  // the CSRF token only proves the value came from the form, and that form is
-  // reachable by anyone holding transaction_id. This proves it is the same
-  // browser. Throws AuthTransactionError, surfaced by the App Router error
-  // boundary rather than redirected to the client. See _oidc-provider/store.ts.
-  const bindingCookieStore = await cookies();
-  await validateTransactionBinding(
-    transaction,
-    bindingCookieStore.get(TRANSACTION_BINDING_COOKIE_PREFIX + transactionId)?.value,
-  );
-`
-        : '';
-    return `'use server';
-
-import { redirect } from 'next/navigation';
-import { cookies } from 'next/headers';
-import {
-  getAuthTransaction,
-  validateCsrfToken,${bindingCoreImport}
-  handleLoginFailure,
-  generateRandomString,
-} from '${corePkg}';
-import { oidcProviderOptions } from '../_oidc-provider/runtime';
-${bindingStoreImport}
-
-const {
-  transactionStore,
-  authSessionStore,
-  browserSessionStore,
-  userStore,
-} = oidcProviderOptions.storage ?? defaultProviderStores;
-
-/**
- * Login Server Action.
- *
- * Mirrors the framework-neutral login route, but runs as a Next.js Server
- * Action so the UI can stay a plain React \`page.tsx\`. On failure it redirects
- * back to the login page with an error so the page can re-render the message.
- */
-export async function loginAction(formData: FormData): Promise<void> {
-  const transactionId = String(formData.get('transaction_id') ?? '');
-  const csrfToken = String(formData.get('csrf_token') ?? '');
-  const username = String(formData.get('username') ?? '');
-  const password = String(formData.get('password') ?? '');
-
-  const transaction = await getAuthTransaction(transactionId, transactionStore);
-${bindingCheck}  validateCsrfToken(transaction, csrfToken);
-
-  const user = await userStore.authenticate(username, password);
-  if (!user) {
-    const failureResult = await handleLoginFailure(
-      transactionId,
-      transaction,
-      transactionStore,
-    );
-    if (!failureResult.canRetry) {
-      redirect(
-        \`/login?transaction_id=\${encodeURIComponent(transactionId)}&error=too_many_attempts\`,
-      );
-    }
-    const remaining = failureResult.maxAttempts - failureResult.failedAttempts;
-    redirect(
-      \`/login?transaction_id=\${encodeURIComponent(transactionId)}&error=invalid_credentials&remaining=\${remaining}\`,
-    );
-  }
-
-  const cookieStore = await cookies();
-
-  // prompt=login / select_account requires fresh authentication: discard any
-  // existing transaction handoff AND browser session.
-  // OIDC Core 1.0 Section 3.1.2.1 — prompt is a space-delimited list.
-  const loginPromptValues = transaction.prompt?.trim().split(/\\s+/).filter(Boolean) ?? [];
-  if (loginPromptValues.includes('login') || loginPromptValues.includes('select_account')) {
-    await authSessionStore.delete(transactionId);
-    const existingSessionId = cookieStore.get(SESSION_COOKIE_NAME)?.value;
-    if (existingSessionId) await browserSessionStore.delete(existingSessionId);
-  }
-
-  const authTime = Math.floor(Date.now() / 1000);
-
-  // Establish a persistent browser (OP) session so SSO / prompt=none / max_age
-  // work on subsequent authorization requests (OIDC Core 1.0 Section 3.1.2.3).
-  // Cookie attributes match buildSessionCookie() in store.ts so the
-  // sessionResolver can read it back.
-  const sessionId = await generateRandomString(32);
-  await browserSessionStore.set(sessionId, { subject: user.sub, authTime });
-
-  // Store authenticated subject for the consent step (per-transaction handoff).
-  // sessionId も渡すのは online refresh token のため。consent 経由で発行する認可
-  // コードにこのセッションを引き継ぎ、ログアウトで使えなくなる RT を作る。
-  await authSessionStore.set(transactionId, {
-    subject: user.sub,
-    authTime,
-    sessionId,
-  });
-  cookieStore.set(SESSION_COOKIE_NAME, sessionId, {
-    httpOnly: true,
-    secure: true,
-    sameSite: 'lax',
-    path: '/',
-  });
-
-  redirect(\`/consent?transaction_id=\${encodeURIComponent(transactionId)}\`);
-}
-`;
-}
-export function nextJsConsentPageTemplate(corePkg, features = DEFAULT_FEATURES, scopes = []) {
-    const customScopesDeclared = scopes.length > 0;
-    const customScopeImport = customScopesDeclared
-        ? `
-import { resolveGrantableScopes } from '../_oidc-provider/scopes';`
-        : '';
-    const consentPageScopes = customScopesDeclared
-        ? `  // The subject comes from the auth session that the login step stored for this
-  // transaction; without one there is nothing to apply the scope policy to, so
-  // the request is shown as-is and the Server Action stops on the same missing
-  // session.
-  const consentSession = await authSessionStore.get(transactionId);
-  const requestedScopes = transaction.scope.split(' ').filter(Boolean);
-  const scopes = consentSession
-    ? await resolveGrantableScopes(requestedScopes, consentSession.subject)
-    : requestedScopes;`
-        : `  const scopes = transaction.scope.split(' ').filter(Boolean);`;
-    const consentPageStores = customScopesDeclared
-        ? `
-const authSessionStore =
-  (oidcProviderOptions.storage ?? defaultProviderStores).authSessionStore;`
-        : '';
-    const bindingImports = features.transactionBinding
-        ? `import { cookies } from 'next/headers';
-import { getAuthTransaction, validateTransactionBinding } from '${corePkg}';`
-        : `import { getAuthTransaction } from '${corePkg}';`;
-    const bindingStoreImport = features.transactionBinding
-        ? `import {
-  defaultProviderStores,
-  TRANSACTION_BINDING_COOKIE_PREFIX,
-} from '../_oidc-provider/store';`
-        : `import { defaultProviderStores } from '../_oidc-provider/store';`;
-    const bindingHelper = features.transactionBinding
-        ? `
-/**
- * Is this request coming from the User-Agent that started the transaction?
- * The authorization endpoint handed that browser a secret in an HttpOnly cookie
- * named per transaction; only its hash is stored (OIDC Core 1.0 Section 3.1.2.3
- * / 3.1.2.4). See buildTransactionBindingCookie() in _oidc-provider/store.ts.
- */
-async function isBoundToThisBrowser(
-  transaction: Awaited<ReturnType<typeof getAuthTransaction>>,
-  transactionId: string,
-): Promise<boolean> {
-  const cookieStore = await cookies();
-  const bindingSecret = cookieStore.get(TRANSACTION_BINDING_COOKIE_PREFIX + transactionId)?.value;
-  try {
-    await validateTransactionBinding(transaction, bindingSecret);
-    return true;
-  } catch {
-    return false;
-  }
-}
-`
-        : '';
-    const bindingCheck = features.transactionBinding
-        ? `
-  // OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4: this form embeds csrf_token and its
-  // submission mints the authorization code, so only the User-Agent that started
-  // the transaction may render it. See _oidc-provider/store.ts.
-  if (!(await isBoundToThisBrowser(transaction, transactionId))) {
-    return (
-      <main>
-        <h1>Authorize Application</h1>
-        <p role="alert">This authorization transaction was not started by this browser.</p>
-      </main>
-    );
-  }
-
-`
-        : '';
-    return `${bindingImports}
-import { oidcProviderOptions } from '../_oidc-provider/runtime';
-${bindingStoreImport}
-import { consentAction } from './actions';${customScopeImport}
-
-const transactionStore =
-  (oidcProviderOptions.storage ?? defaultProviderStores).transactionStore;${consentPageStores}
-
-export const dynamic = 'force-dynamic';
-
-interface ConsentPageProps {
-  searchParams: Promise<{ transaction_id?: string }>;
-}
-${bindingHelper}
-/**
- * Consent page (React Server Component).
- *
- * A real Next.js \`page.tsx\` so the consent UI can be customized with JSX and
- * React components. The form posts to a Server Action (./actions.ts).
- */
-export default async function ConsentPage({ searchParams }: ConsentPageProps) {
-  const { transaction_id: transactionId } = await searchParams;
-
-  if (!transactionId) {
-    return (
-      <main>
-        <h1>Authorize Application</h1>
-        <p>Missing transaction_id</p>
-      </main>
-    );
-  }
-
-  const transaction = await getAuthTransaction(transactionId, transactionStore);
-${bindingCheck}${consentPageScopes}
-
-  return (
-    <main>
-      <h1>Authorize Application</h1>
-      <p>
-        Client <strong>{transaction.clientId}</strong> is requesting access to the
-        following scopes:
-      </p>
-      <ul>
-        {scopes.map((scope) => (
-          <li key={scope}>{scope}</li>
-        ))}
-      </ul>
-      {/*
-        The submit buttons carry the authorization decision (OIDC Core 1.0
-        Section 3.1.2.4). consentAction accepts exactly two values — 'approve'
-        and 'deny' — and rejects everything else, so customizing this markup must
-        keep both button values as they are: renaming 'approve' makes every
-        approval fail with an error page. See ./actions.ts.
-      */}
-      <form action={consentAction}>
-        <input type="hidden" name="transaction_id" value={transactionId} />
-        <input type="hidden" name="csrf_token" value={transaction.csrfToken} />
-        <button type="submit" name="action" value="approve">
-          Approve
-        </button>
-        <button type="submit" name="action" value="deny">
-          Deny
-        </button>
-      </form>
-    </main>
-  );
-}
-`;
-}
-export function nextJsConsentActionTemplate(corePkg, features = DEFAULT_FEATURES, scopes = []) {
-    const customScopesDeclared = scopes.length > 0;
-    const customScopeImport = customScopesDeclared
-        ? `
-import { resolveGrantableScopes } from '../_oidc-provider/scopes';`
-        : '';
-    const consentGrantedScope = customScopesDeclared
-        ? `
-  // Apply the scope policy (resolveGrantableScopes in _oidc-provider/scopes.ts —
-  // the place to write per-user filtering). A dropped scope narrows the grant
-  // rather than failing the request: RFC 6749 §3.3 lets the authorization server
-  // issue a narrower scope, and the token response reports what was granted.
-  const grantedScope = await resolveGrantableScopes(
-    transaction.scope.split(' ').filter(Boolean),
-    session.subject,
-  );`
-        : `  const grantedScope = transaction.scope.split(' ').filter(Boolean);`;
-    const bindingCookiesImport = features.transactionBinding
-        ? `
-import { cookies } from 'next/headers';`
-        : '';
-    const bindingCoreImport = features.transactionBinding
-        ? `
-  validateTransactionBinding,`
-        : '';
-    const bindingStoreImport = features.transactionBinding
-        ? `import {
-  defaultProviderStores,
-  TRANSACTION_BINDING_COOKIE_PREFIX,
-} from '../_oidc-provider/store';`
-        : `import { defaultProviderStores } from '../_oidc-provider/store';`;
-    const bindingCheck = features.transactionBinding
-        ? `  // OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4: checked before validateCsrfToken and
-  // before any decision is acted on — this step mints the authorization code, so
-  // an unbound caller must reach it neither to approve nor to deny. Throws
-  // AuthTransactionError, surfaced by the App Router error boundary rather than
-  // redirected to the client. See _oidc-provider/store.ts.
-  const cookieStore = await cookies();
-  const bindingCookieName = TRANSACTION_BINDING_COOKIE_PREFIX + transactionId;
-  await validateTransactionBinding(
-    transaction,
-    cookieStore.get(bindingCookieName)?.value,
-  );
-`
-        : '';
-    const clearBindingCookie = features.transactionBinding
-        ? `    // The transaction is over; drop its binding cookie so the browser does not
-    // keep one cookie per finished flow.
-    cookieStore.delete(bindingCookieName);
-`
-        : '';
-    const clearBindingCookieOnSuccess = features.transactionBinding
-        ? `  // The transaction is over; drop its binding cookie so the browser does not
-  // keep one cookie per finished flow.
-  cookieStore.delete(bindingCookieName);
-
-`
-        : '';
-    return `'use server';
-
-import { redirect } from 'next/navigation';${bindingCookiesImport}
-import {
-  getAuthTransaction,
-  validateCsrfToken,${bindingCoreImport}
-  completeAuthTransaction,
-  createAuthorizationCode,
-} from '${corePkg}';
-import { oidcProviderOptions } from '../_oidc-provider/runtime';
-import { createStoreResolvers } from '../_oidc-provider/resolvers';
-${bindingStoreImport}${customScopeImport}
-
-const providerStores = oidcProviderOptions.storage ?? defaultProviderStores;
-const { transactionStore, authCodeStore, authSessionStore } = providerStores;
-const { consentResolver } = createStoreResolvers(providerStores);
-
-/**
- * Consent Server Action.
- *
- * Mirrors the framework-neutral consent route. Reuses the same issuer / client
- * resolver as the route handlers via oidcProviderOptions so the issued code and
- * recorded consent stay consistent with the rest of the provider.
- */
-export async function consentAction(formData: FormData): Promise<void> {
-  const transactionId = String(formData.get('transaction_id') ?? '');
-  const csrfToken = String(formData.get('csrf_token') ?? '');
-  const action = String(formData.get('action') ?? '');
-
-  const transaction = await getAuthTransaction(transactionId, transactionStore);
-${bindingCheck}  validateCsrfToken(transaction, csrfToken);
-
-  // RFC 9207 §2: include the issuer identifier on every authorization response.
-  const issuer = oidcProviderOptions.config?.issuer ?? '';
-
-  if (action === 'deny') {
-    const denyUrl = new URL(transaction.redirectUri);
-    denyUrl.searchParams.set('error', 'access_denied');
-    if (transaction.state) {
-      denyUrl.searchParams.set('state', transaction.state);
-    }
-    denyUrl.searchParams.set('iss', issuer);
-    await transactionStore.delete('auth_txn:' + transactionId);
-    await authSessionStore.delete(transactionId);
-${clearBindingCookie}    redirect(denyUrl.toString());
-  }
-
-  // OIDC Core 1.0 Section 3.1.2.4: "the Authorization Server MUST obtain an
-  // authorization decision before releasing information to the Relying Party."
-  // This action mints the authorization code, so it detects the affirmative
-  // decision on an allowlist just like the route handlers: a missing, empty or
-  // unknown 'action' means no decision was obtained and must not approve.
-  //
-  // 'approve' is the decision value this provider accepts, and it MUST stay in
-  // sync with the Approve button in consent/page.tsx.
-  //
-  // Section 3.1.2.6: access_denied means the End-User denied the request, which
-  // is not the same as no decision at all — an unrecognized value therefore goes
-  // to the OP's own error page instead of back to the client.
-  if (action !== 'approve') {
-    redirect(
-      '/oidc-error?error=invalid_request&error_description=' +
-        encodeURIComponent('Invalid consent decision. Please use the Approve or Deny button.'),
-    );
-  }
-
-  const session = await authSessionStore.get(transactionId);
-  if (!session) {
-    redirect(\`/login?transaction_id=\${encodeURIComponent(transactionId)}\`);
-  }
-
-  const responseParams = await completeAuthTransaction(
-    transactionId,
-    transaction,
-    transactionStore,
-  );
-
-  // transaction.scope は認可リクエスト検証時に applyOfflineAccessPolicy を通した後の値。
-  // offline_access の可否（OIDC Core 1.0 §11 の prompt=consent と、クライアント登録
-  // grant_types に refresh_token があるか）はそこで確定しているので再フィルタしない。
-${consentGrantedScope}
-
-  // OIDC Core 1.0 Section 3.1.3.1: TTL is configurable via ProviderConfig.
-  const authCodeData = await createAuthorizationCode({
-    authorizationResponse: { ...responseParams, scope: grantedScope },
-    subject: session.subject,
-    authTime: session.authTime,
-    // online refresh token をこのログインセッションへ束縛する（login フローが
-    // authSessionStore へ載せた値）。ログアウトすれば RT も使えなくなる。
-    sessionId: session.sessionId,
-    ttlSeconds: oidcProviderOptions.config?.authorizationCodeTtl,
-  });
-  await authCodeStore.set(authCodeData.code, authCodeData);
-
-  // Record consent so a later prompt=none request can confirm it without UI
-  // (OIDC Core 1.0 Section 3.1.2.4).
-  await consentResolver.recordConsent?.(
-    session.subject,
-    transaction.clientId,
-    grantedScope,
-  );
-
-  await authSessionStore.delete(transactionId);
-
-${clearBindingCookieOnSuccess}  const successUrl = new URL(responseParams.redirectUri);
-  successUrl.searchParams.set('code', authCodeData.code);
-  if (responseParams.state) {
-    successUrl.searchParams.set('state', responseParams.state);
-  }
-  successUrl.searchParams.set('iss', issuer);
-  redirect(successUrl.toString());
-}
-`;
-}
-export function webConformanceTestTemplate(corePkg, errorPageMode = 'html', features = DEFAULT_FEATURES, includeNodeAdapterContract = false, jarmConsentResponseMode = 'jwt', scopes = []) {
-    const usesRedirect = errorPageMode === 'redirect';
+export function webConformanceTestTemplate(corePkg, features = DEFAULT_FEATURES, scopes = []) {
     const customScopeConformanceImport = scopes.length > 0
         ? `
 import { RESTRICTED_SCOPE_SUBJECTS } from './scopes.js';`
         : '';
-    const createAppConfig = usesRedirect
-        ? `
-    config: { authorizationErrorRedirectPath: '/oidc-error' },`
-        : '';
-    const nonRedirectErrorTest = usesRedirect
-        ? `    // OIDC Core 1.0 §3.1.2.2: an unregistered redirect_uri MUST NOT be redirected
-    // to. This Next.js provider sets config.authorizationErrorRedirectPath, so the
-    // OP hands the error to a framework-native error page (app/oidc-error, rendered
-    // via Next.js error.tsx) instead of returning HTML from the route handler. The
-    // browser is 303-redirected to the OP's OWN error page (never the attacker's
-    // unregistered redirect_uri). That error page responds 200, so the 400 status
-    // is intentionally traded for an idiomatic Next.js error UI.
-    it('should 303-redirect browser callers to the OP error page for an unregistered redirect_uri', async () => {
-      const res = await app.request(unregisteredAuthorizeUrl);
-
-      expect(res.status).toBe(303);
-      // Pinned exactly so the redirect target stays the OP's own error page and
-      // never leaks to the unregistered (attacker-controlled) redirect_uri.
-      expect(res.headers.get('Location')).toBe(
-        '/oidc-error?error=invalid_request&error_description=redirect_uri+not+registered',
-      );
-    });`
-        : `    // OIDC Core 1.0 §3.1.2.2: an unregistered redirect_uri MUST NOT be redirected
+    const nonRedirectErrorTest = `    // OIDC Core 1.0 §3.1.2.2: an unregistered redirect_uri MUST NOT be redirected
     // to. Browser callers receive an HTML error page (HTTP 400) so the OIDF
     // Conformance Suite (oidcc-ensure-registered-redirect-uri) can screenshot it.
     it('should render an HTML error page (not redirect) for an unregistered redirect_uri', async () => {
@@ -2014,11 +862,8 @@ import { RESTRICTED_SCOPE_SUBJECTS } from './scopes.js';`
     const exportPublicJwkImport = features.requestObject || features.idJag
         ? `import { exportPublicJwk } from '${corePkg}';\n`
         : '';
-    const nodeAdapterImport = includeNodeAdapterContract
-        ? `import { writeWebResponse } from './node-adapter.js';\n`
-        : '';
-    const nodeAdapterContract = includeNodeAdapterContract
-        ? `
+    const nodeAdapterImport = `import { writeWebResponse } from './node-adapter.js';\n`;
+    const nodeAdapterContract = `
   describe('Node response adapter', () => {
     it('should preserve each Set-Cookie value as a separate outgoing header', async () => {
       const headers = new Map<string, string | string[]>();
@@ -2065,8 +910,7 @@ import { RESTRICTED_SCOPE_SUBJECTS } from './scopes.js';`
       expect(endedBody).toBe('ok');
     });
   });
-`
-        : '';
+`;
     const responseModesSupportedExpectation = features.jarm
         ? `        // OAuth 2.0 Multiple Response Type Encoding Practices §2 + JARM §4: the
         // code flow returns the authorization response via query, and this OP was
@@ -2140,7 +984,7 @@ ${requestObjectConformanceBeforeAll(features)}
   app = createApp({
     signingKeyProvider,
     clientResolver: createInMemoryClientResolver(testClients),
-    acrResolver: async () => ({ acr: 'urn:example:loa:2', amr: ['pwd', 'otp'] }),${createAppConfig}
+    acrResolver: async () => ({ acr: 'urn:example:loa:2', amr: ['pwd', 'otp'] }),
   });
 });
 
@@ -2521,11 +1365,10 @@ ${nonRedirectErrorTest}
       });
     });
   });
-${transactionBindingConformanceBlock(features)}${customViewConformanceTestBlock()}${internalRedirectOriginConformanceBlock()}${endpointBehaviorConformanceBlock(features)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features, errorPageMode)}${onlineRefreshTokenConformanceBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}${idJagConformanceBlock(features)}${deviceAuthorizationConformanceBlock(features)}${cibaConformanceBlock(features)}${jarmConformanceBlock(features, jarmConsentResponseMode)}${jwtIntrospectionResponseConformanceBlock(features)}${rpInitiatedLogoutConformanceBlock(features)}${googleLoginConformanceBlock(features)}${consentDecisionConformanceBlock()}${customScopeConformanceBlock(scopes)}});
+${transactionBindingConformanceBlock(features)}${customViewConformanceTestBlock()}${internalRedirectOriginConformanceBlock()}${endpointBehaviorConformanceBlock(features)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features)}${onlineRefreshTokenConformanceBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}${idJagConformanceBlock(features)}${deviceAuthorizationConformanceBlock(features)}${cibaConformanceBlock(features)}${jarmConformanceBlock(features)}${jwtIntrospectionResponseConformanceBlock(features)}${rpInitiatedLogoutConformanceBlock(features)}${googleLoginConformanceBlock(features)}${consentDecisionConformanceBlock()}${customScopeConformanceBlock(scopes)}});
 `;
 }
-function webCoreGeneratedFiles(corePkg, errorPageMode = 'html', features = DEFAULT_FEATURES, includeNodeAdapterContract = false, jarmConsentResponseMode = 'jwt', scopes = []) {
-    const consentFeatures = jarmConsentResponseMode === 'plain' ? { ...features, jarm: false } : features;
+function webCoreGeneratedFiles(corePkg, features = DEFAULT_FEATURES, scopes = []) {
     return [
         { path: 'app.ts', content: webAppTemplate(corePkg, features) },
         { path: 'web-router.ts', content: webRouterTemplate() },
@@ -2539,7 +1382,7 @@ function webCoreGeneratedFiles(corePkg, errorPageMode = 'html', features = DEFAU
         },
         {
             path: 'resolvers.ts',
-            content: resolversTemplate(corePkg, features).replace('through Hono context', 'through the generated request context'),
+            content: resolversTemplate(corePkg, features, 'Project integrations should inject a D1/KV/env-backed resolver through the generated request context.'),
         },
         { path: 'views.ts', content: viewsTemplate(features) },
         { path: 'pages/respond.ts', content: respondTemplate() },
@@ -2599,145 +1442,18 @@ function webCoreGeneratedFiles(corePkg, errorPageMode = 'html', features = DEFAU
         { path: 'routes/jwks.ts', content: toWebRouteTemplate(jwksRouteTemplate(corePkg)) },
         { path: 'routes/discovery.ts', content: toWebRouteTemplate(discoveryRouteTemplate(corePkg, features, scopes)) },
         { path: 'routes/login.ts', content: toWebRouteTemplate(loginRouteTemplate(corePkg, features)) },
-        { path: 'routes/consent.ts', content: toWebRouteTemplate(consentRouteTemplate(corePkg, consentFeatures, scopes)) },
+        { path: 'routes/consent.ts', content: toWebRouteTemplate(consentRouteTemplate(corePkg, features, scopes)) },
         {
             path: 'conformance.test.ts',
-            content: webConformanceTestTemplate(corePkg, errorPageMode, features, includeNodeAdapterContract, jarmConsentResponseMode, scopes),
+            content: webConformanceTestTemplate(corePkg, features, scopes),
         },
     ];
 }
-function toNextJsModuleImports(content) {
-    return content.replaceAll(/(from\s+['"](?:\.{1,2}\/[^'"]+))\.js(['"])/g, '$1$2');
-}
 export function webGeneratedFiles(corePkg, applyTemplate, features = DEFAULT_FEATURES, scopes = []) {
     return [
-        ...webCoreGeneratedFiles(corePkg, 'html', features, true, 'jwt', scopes),
+        ...webCoreGeneratedFiles(corePkg, features, scopes),
         { path: 'apply.ts', content: applyTemplate },
         { path: 'node-adapter.ts', content: nodeAdapterTemplate() },
     ];
 }
-export function nextJsGeneratedFiles(corePkg, features = DEFAULT_FEATURES, scopes = []) {
-    const internalFiles = webCoreGeneratedFiles(corePkg, 'redirect', features, false, 'plain', scopes).map((file) => ({
-        path: `_oidc-provider/${file.path}`,
-        content: toNextJsModuleImports(file.content),
-    }));
-    return [
-        ...internalFiles,
-        { path: '_oidc-provider/next.ts', content: nextJsRouteHandlerTemplate() },
-        { path: '_oidc-provider/storage-backend.ts', content: nextJsStorageBackendTemplate() },
-        { path: '_oidc-provider/runtime.ts', content: nextJsRuntimeTemplate(corePkg, features) },
-        {
-            path: 'authorize/route.ts',
-            content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', [
-                'GET',
-                'POST',
-                'OPTIONS',
-            ]),
-        },
-        {
-            path: 'token/route.ts',
-            content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', ['POST', 'OPTIONS']),
-        },
-        {
-            path: 'userinfo/route.ts',
-            content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', [
-                'GET',
-                'POST',
-                'OPTIONS',
-            ]),
-        },
-        ...(features.introspection
-            ? [
-                {
-                    path: 'introspect/route.ts',
-                    content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', ['POST', 'OPTIONS']),
-                },
-            ]
-            : []),
-        ...(features.revocation
-            ? [
-                {
-                    path: 'revoke/route.ts',
-                    content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', ['POST', 'OPTIONS']),
-                },
-            ]
-            : []),
-        ...(features.par
-            ? [
-                {
-                    path: 'par/route.ts',
-                    content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', ['POST', 'OPTIONS']),
-                },
-            ]
-            : []),
-        ...(features.deviceAuthorizationGrant
-            ? [
-                {
-                    path: 'device_authorization/route.ts',
-                    content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', ['POST', 'OPTIONS']),
-                },
-                {
-                    path: 'device/route.ts',
-                    content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', ['GET', 'POST']),
-                },
-                {
-                    path: 'device/login/route.ts',
-                    content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', ['POST']),
-                },
-                {
-                    path: 'device/approve/route.ts',
-                    content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', ['POST']),
-                },
-            ]
-            : []),
-        ...(features.ciba
-            ? [
-                {
-                    path: 'backchannel_authentication/route.ts',
-                    content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', ['POST', 'OPTIONS']),
-                },
-                {
-                    path: 'ciba/route.ts',
-                    content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', ['GET']),
-                },
-                {
-                    path: 'ciba/login/route.ts',
-                    content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', ['POST']),
-                },
-                {
-                    path: 'ciba/approve/route.ts',
-                    content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', ['POST']),
-                },
-            ]
-            : []),
-        {
-            path: '.well-known/jwks.json/route.ts',
-            content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', [
-                'GET',
-                'OPTIONS',
-            ]),
-        },
-        {
-            path: '.well-known/openid-configuration/route.ts',
-            content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', [
-                'GET',
-                'OPTIONS',
-            ]),
-        },
-        { path: 'login/page.tsx', content: nextJsLoginPageTemplate(corePkg, features) },
-        { path: 'login/actions.ts', content: nextJsLoginActionTemplate(corePkg, features) },
-        ...(features.googleLogin
-            ? [
-                {
-                    path: 'login/google/route.ts',
-                    content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', ['POST']),
-                },
-            ]
-            : []),
-        { path: 'consent/page.tsx', content: nextJsConsentPageTemplate(corePkg, features, scopes) },
-        { path: 'consent/actions.ts', content: nextJsConsentActionTemplate(corePkg, features, scopes) },
-        { path: 'oidc-error/page.tsx', content: nextJsAuthorizationErrorPageTemplate() },
-        { path: 'oidc-error/error.tsx', content: nextJsAuthorizationErrorBoundaryTemplate() },
-    ];
-}
 //# sourceMappingURL=templates.js.map