@maronn-openid-connect/cli 0.7.0 → 0.8.0

package/dist/frameworks/hono/templates.js

@@ -414,7 +414,13 @@ async function resolveProviderStores(
 }
 `;
 }
-export function customScopesTemplate(scopes, features = DEFAULT_FEATURES) {
+const DEFAULT_SCOPE_POLICY_FILE_REFS = {
+    userinfo: 'routes/userinfo.ts',
+    consent: 'routes/consent.ts',
+    authorize: 'routes/authorize.ts',
+    approvals: 'routes/device.ts / routes/ciba-verification.ts',
+};
+export function customScopesTemplate(scopes, features = DEFAULT_FEATURES, fileRefs = DEFAULT_SCOPE_POLICY_FILE_REFS) {
     const toListLiteral = (values) => values.length === 0 ? '[]' : `[${values.map((value) => `'${singleQuoted(value)}'`).join(', ')}]`;
     const standardScopes = [
         'openid',
@@ -444,7 +450,7 @@ export function customScopesTemplate(scopes, features = DEFAULT_FEATURES) {
  * Custom scopes carry no UserInfo claims of their own: OIDC Core 1.0 §5.4 defines
  * claims for profile / email / address / phone only, so \`filterClaimsByScope()\`
  * ignores them. Return your own claims for a custom scope by editing
- * routes/userinfo.ts.
+ * ${fileRefs.userinfo}.
  */
 
 /**
@@ -482,12 +488,12 @@ export const RESTRICTED_SCOPE_SUBJECTS: Record<string, readonly string[]> = {
  * **This is the per-user scope filtering seam.** It runs once the End-User is
  * known, and every step that decides a grant already awaits it:
  *
- * - routes/consent.ts — the consent screen (what is displayed) and the approval
+ * - ${fileRefs.consent} — the consent screen (what is displayed) and the approval
  *   (what is granted)
- * - routes/authorize.ts — the SSO fast path and prompt=none, which grant without
+ * - ${fileRefs.authorize} — the SSO fast path and prompt=none, which grant without
  *   showing consent. Both narrow BEFORE looking up stored consent, because a
  *   consent lookup for a scope the subject can never hold would never match.
- * - routes/device.ts / routes/ciba-verification.ts — the device and CIBA approval
+ * - ${fileRefs.approvals} — the device and CIBA approval
  *   steps, when those features are generated
  *
  * It is async so a database / KV lookup can be dropped in without touching any
@@ -518,7 +524,21 @@ export function findUnsupportedScopes(requested: readonly string[]): string[] {
 }
 `;
 }
-export function configTemplate(corePkg, features = DEFAULT_FEATURES) {
+export function configTemplate(corePkg, features = DEFAULT_FEATURES, options = {}) {
+    const authorizationErrorRedirectPathField = options.authorizationErrorRedirectPath === false
+        ? ''
+        : `  /**
+   * 任意。client redirect が禁止される非リダイレクト型の authorization error
+   * （未知 client_id / 未登録 redirect_uri / fragment 付き redirect_uri など、
+   * OIDC Core 1.0 §3.1.2.2）の HTML フォールバックを、views.errorPage() で直接
+   * 返す代わりに OP 内部のエラーページパスへ 303 リダイレクトしたいときに設定する。
+   * Next.js の error.tsx のような framework-native なエラー画面へ委ねるためのフック。
+   * 未設定なら従来どおり views.errorPage() を c.html で返す（express/fastify/hono の
+   * デフォルト）。なお Accept: application/json の programmatic caller には、この設定の
+   * 有無に関わらず常に 400 の OAuth error JSON を返す。
+   */
+  authorizationErrorRedirectPath?: string;
+`;
     const refreshTokenLifetimeField = features.refreshToken
         ? `  /**
    * Refresh token の absolute lifetime（秒）。初回発行時刻からの絶対的な有効期限。
@@ -700,18 +720,7 @@ ${refreshTokenLifetimeField}  /**
    * 不正なPKCE値やpublic clientの非PKCE requestは拒否する。
    */
   allowNonPkceAuthorizationCodeFlow: boolean;
-${allowUnsignedField}  /**
-   * 任意。client redirect が禁止される非リダイレクト型の authorization error
-   * （未知 client_id / 未登録 redirect_uri / fragment 付き redirect_uri など、
-   * OIDC Core 1.0 §3.1.2.2）の HTML フォールバックを、views.errorPage() で直接
-   * 返す代わりに OP 内部のエラーページパスへ 303 リダイレクトしたいときに設定する。
-   * Next.js の error.tsx のような framework-native なエラー画面へ委ねるためのフック。
-   * 未設定なら従来どおり views.errorPage() を c.html で返す（express/fastify/hono の
-   * デフォルト）。なお Accept: application/json の programmatic caller には、この設定の
-   * 有無に関わらず常に 400 の OAuth error JSON を返す。
-   */
-  authorizationErrorRedirectPath?: string;
-${googleLoginConfigField}}
+${allowUnsignedField}${authorizationErrorRedirectPathField}${googleLoginConfigField}}
 
 /**
  * Optional defaults for quick local testing.
@@ -2283,7 +2292,7 @@ export const consentStore = defaultProviderStores.consentStore;
 export const userStore = defaultProviderStores.userStore;${googleLoginStoreExport}
 ${parStoreImplementation}${deviceStoreImplementation}${cibaStoreImplementation}`;
 }
-export function resolversTemplate(corePkg, features = DEFAULT_FEATURES) {
+export function resolversTemplate(corePkg, features = DEFAULT_FEATURES, clientResolverInjectionNote = 'Project integrations should inject a D1/KV/env-backed resolver through Hono context.') {
     const refreshTypeImports = features.refreshToken
         ? `  RefreshTokenResolver,
   RefreshTokenInfo,
@@ -2419,7 +2428,7 @@ import {
 
 /**
  * Default in-memory client resolver for quick local testing.
- * Project integrations should inject a D1/KV/env-backed resolver through Hono context.
+ * ${clientResolverInjectionNote}
  */
 export const clientResolver: ClientResolver & TokenClientResolver =
   createInMemoryClientResolver();
@@ -8725,7 +8734,7 @@ revocationApp.post('/', async (c) => {
 });
 `;
 }
-export function viewsTemplate(features = DEFAULT_FEATURES) {
+export function viewParamTypesTemplate(features = DEFAULT_FEATURES) {
     const deviceParamTypes = features.deviceAuthorizationGrant
         ? `
 export interface DeviceVerificationPageParams {
@@ -8778,6 +8787,120 @@ export interface DeviceCompletedPageParams {
 }
 `
         : '';
+    const cibaParamTypes = features.ciba
+        ? `
+export interface CibaLoginPageParams {
+  /** Login transaction id; carried through as a hidden field. */
+  loginTransactionId: string;
+  /** CSRF token (must be included as hidden form field) */
+  csrfToken: string;
+  /** Error message from a previous failed attempt */
+  error?: string;
+  /** Number of remaining login attempts for this login transaction */
+  remainingAttempts?: number;
+}
+
+export interface CibaPendingRequestParams {
+  /** auth_req_id; carried through as a hidden field of the decision form. */
+  authReqId: string;
+  /** Client that asked for the backchannel authentication */
+  clientId: string;
+  /** Scopes the client asked for */
+  scopes: string[];
+  /**
+   * CIBA Core 1.0 §7.1 binding_message: shown so the user can compare it with
+   * the message on the consumption device — the visual check that they are
+   * approving THEIR transaction and not someone else's. Client-supplied text:
+   * it MUST be escaped before rendering.
+   */
+  bindingMessage?: string;
+  /** Seconds until this request expires */
+  expiresInSeconds: number;
+  /** Per-record CSRF token (must be included as hidden form field) */
+  csrfToken: string;
+}
+
+export interface CibaPendingRequestsPageParams {
+  /** Pending backchannel authentication requests addressed to the signed-in user */
+  requests: CibaPendingRequestParams[];
+}
+
+export interface CibaCompletedPageParams {
+  /** true when the user approved, false when they denied */
+  approved: boolean;
+  /** Client the decision applied to */
+  clientId: string;
+}
+`
+        : '';
+    const rpInitiatedLogoutParamTypes = features.rpInitiatedLogout
+        ? `
+export interface LogoutConfirmationPageParams {
+  /** CSRF token (must be included as hidden form field of the approve POST) */
+  csrfToken: string;
+}
+
+/**
+ * Parameters of the logged-out page. Deliberately empty: the completed screen
+ * shows no End-User or client identifier (whoever sees the screen learns
+ * nothing), and its wording never depends on whether anything was actually
+ * deleted — varying it would make the page a session-existence oracle.
+ */
+export interface LogoutCompletedPageParams {}
+`
+        : '';
+    const googleLoginPageParam = features.googleLogin
+        ? `  /**
+   * EXTENSION (google-login): GIS configuration for "Sign in with Google"
+   * (redirect mode) — the g_id_onload attributes built by
+   * buildGoogleSignInAttributes(): client ID, data-ux_mode="redirect", the
+   * login_uri Google posts the ID token to, and the nonce bound to this
+   * transaction. The view owns the markup (see defaultLoginPage). Undefined
+   * when Google login is not configured; only the password form is shown then.
+   */
+  googleSignIn?: GoogleSignInAttributes;
+`
+        : '';
+    return `export interface LoginPageParams {
+  /** Transaction ID for the auth flow */
+  transactionId: string;
+  /** CSRF token (must be included as hidden form field) */
+  csrfToken: string;
+  /** Error message from a previous failed attempt */
+  error?: string;
+  /** Number of remaining login attempts */
+  remainingAttempts?: number;
+  /**
+   * OIDC Core 1.0 §3.1.2.1 login_hint: untrusted external value the OP MAY use to
+   * pre-fill the login form. Treated as a hint only (initial display); it MUST be
+   * HTML-attribute escaped before rendering since it is unauthenticated input.
+   */
+  loginHint?: string;
+${googleLoginPageParam}}
+
+export interface ConsentPageParams {
+  /** Transaction ID for the auth flow */
+  transactionId: string;
+  /** CSRF token (must be included as hidden form field) */
+  csrfToken: string;
+  /** Scopes requested by the client */
+  scopes: string[];
+  /** Client ID requesting authorization */
+  clientId: string;
+}
+
+export interface ErrorPageParams {
+  /** Error message to display (OAuth error code for authorization errors) */
+  error: string;
+  /** Optional human-readable detail (OAuth error_description) */
+  errorDescription?: string;
+  /** HTTP status code */
+  statusCode: number;
+}
+${deviceParamTypes}${cibaParamTypes}${rpInitiatedLogoutParamTypes}
+`;
+}
+export function viewsInterfaceTemplate(features = DEFAULT_FEATURES) {
     const deviceViewsMembers = features.deviceAuthorizationGrant
         ? `  /** EXPERIMENTAL (RFC 8628 §3.3): render the user_code entry form */
   deviceVerificationPage(params: DeviceVerificationPageParams): ViewResult;
@@ -8789,6 +8912,33 @@ export interface DeviceCompletedPageParams {
   deviceCompletedPage(params: DeviceCompletedPageParams): ViewResult;
 `
         : '';
+    const cibaViewsMembers = features.ciba
+        ? `  /** EXPERIMENTAL (CIBA Core 1.0): render the sign-in form of the authentication device UI */
+  cibaLoginPage(params: CibaLoginPageParams): ViewResult;
+  /** EXPERIMENTAL (CIBA Core 1.0): render the pending-requests approval screen */
+  cibaPendingRequestsPage(params: CibaPendingRequestsPageParams): ViewResult;
+  /** EXPERIMENTAL (CIBA Core 1.0): render the decision-recorded screen */
+  cibaCompletedPage(params: CibaCompletedPageParams): ViewResult;
+`
+        : '';
+    const rpInitiatedLogoutViewsMembers = features.rpInitiatedLogout
+        ? `  /** EXPERIMENTAL (RP-Initiated Logout 1.0 §2): render the logout confirmation screen */
+  logoutConfirmationPage(params: LogoutConfirmationPageParams): ViewResult;
+  /** EXPERIMENTAL (RP-Initiated Logout 1.0): render the logged-out screen */
+  logoutCompletedPage(params: LogoutCompletedPageParams): ViewResult;
+`
+        : '';
+    return `export interface Views {
+  /** Render the login page (and login error page when error is set) */
+  loginPage(params: LoginPageParams): ViewResult;
+  /** Render the consent/authorization page */
+  consentPage(params: ConsentPageParams): ViewResult;
+  /** Render a generic error page */
+  errorPage(params: ErrorPageParams): ViewResult;
+${deviceViewsMembers}${cibaViewsMembers}${rpInitiatedLogoutViewsMembers}}
+`;
+}
+export function viewsTemplate(features = DEFAULT_FEATURES) {
     const deviceDefaultViews = features.deviceAuthorizationGrant
         ? `function defaultDeviceVerificationPage(params: DeviceVerificationPageParams): string {
   const errorHtml = params.error
@@ -8897,61 +9047,6 @@ function defaultDeviceCompletedPage(params: DeviceCompletedPageParams): string {
   deviceLoginPage: defaultDeviceLoginPage,
   deviceApprovalPage: defaultDeviceApprovalPage,
   deviceCompletedPage: defaultDeviceCompletedPage,
-`
-        : '';
-    const cibaParamTypes = features.ciba
-        ? `
-export interface CibaLoginPageParams {
-  /** Login transaction id; carried through as a hidden field. */
-  loginTransactionId: string;
-  /** CSRF token (must be included as hidden form field) */
-  csrfToken: string;
-  /** Error message from a previous failed attempt */
-  error?: string;
-  /** Number of remaining login attempts for this login transaction */
-  remainingAttempts?: number;
-}
-
-export interface CibaPendingRequestParams {
-  /** auth_req_id; carried through as a hidden field of the decision form. */
-  authReqId: string;
-  /** Client that asked for the backchannel authentication */
-  clientId: string;
-  /** Scopes the client asked for */
-  scopes: string[];
-  /**
-   * CIBA Core 1.0 §7.1 binding_message: shown so the user can compare it with
-   * the message on the consumption device — the visual check that they are
-   * approving THEIR transaction and not someone else's. Client-supplied text:
-   * it MUST be escaped before rendering.
-   */
-  bindingMessage?: string;
-  /** Seconds until this request expires */
-  expiresInSeconds: number;
-  /** Per-record CSRF token (must be included as hidden form field) */
-  csrfToken: string;
-}
-
-export interface CibaPendingRequestsPageParams {
-  /** Pending backchannel authentication requests addressed to the signed-in user */
-  requests: CibaPendingRequestParams[];
-}
-
-export interface CibaCompletedPageParams {
-  /** true when the user approved, false when they denied */
-  approved: boolean;
-  /** Client the decision applied to */
-  clientId: string;
-}
-`
-        : '';
-    const cibaViewsMembers = features.ciba
-        ? `  /** EXPERIMENTAL (CIBA Core 1.0): render the sign-in form of the authentication device UI */
-  cibaLoginPage(params: CibaLoginPageParams): ViewResult;
-  /** EXPERIMENTAL (CIBA Core 1.0): render the pending-requests approval screen */
-  cibaPendingRequestsPage(params: CibaPendingRequestsPageParams): ViewResult;
-  /** EXPERIMENTAL (CIBA Core 1.0): render the decision-recorded screen */
-  cibaCompletedPage(params: CibaCompletedPageParams): ViewResult;
 `
         : '';
     const cibaDefaultViews = features.ciba
@@ -9060,29 +9155,6 @@ function defaultCibaCompletedPage(params: CibaCompletedPageParams): string {
         ? `  cibaLoginPage: defaultCibaLoginPage,
   cibaPendingRequestsPage: defaultCibaPendingRequestsPage,
   cibaCompletedPage: defaultCibaCompletedPage,
-`
-        : '';
-    const rpInitiatedLogoutParamTypes = features.rpInitiatedLogout
-        ? `
-export interface LogoutConfirmationPageParams {
-  /** CSRF token (must be included as hidden form field of the approve POST) */
-  csrfToken: string;
-}
-
-/**
- * Parameters of the logged-out page. Deliberately empty: the completed screen
- * shows no End-User or client identifier (whoever sees the screen learns
- * nothing), and its wording never depends on whether anything was actually
- * deleted — varying it would make the page a session-existence oracle.
- */
-export interface LogoutCompletedPageParams {}
-`
-        : '';
-    const rpInitiatedLogoutViewsMembers = features.rpInitiatedLogout
-        ? `  /** EXPERIMENTAL (RP-Initiated Logout 1.0 §2): render the logout confirmation screen */
-  logoutConfirmationPage(params: LogoutConfirmationPageParams): ViewResult;
-  /** EXPERIMENTAL (RP-Initiated Logout 1.0): render the logged-out screen */
-  logoutCompletedPage(params: LogoutCompletedPageParams): ViewResult;
 `
         : '';
     const rpInitiatedLogoutDefaultViews = features.rpInitiatedLogout
@@ -9135,18 +9207,6 @@ import {
   type GoogleSignInAttributes,
 } from '${GOOGLE_LOGIN_PACKAGE}/sign-in';
 
-`
-        : '';
-    const googleLoginPageParam = features.googleLogin
-        ? `  /**
-   * EXTENSION (google-login): GIS configuration for "Sign in with Google"
-   * (redirect mode) — the g_id_onload attributes built by
-   * buildGoogleSignInAttributes(): client ID, data-ux_mode="redirect", the
-   * login_uri Google posts the ID token to, and the nonce bound to this
-   * transaction. The view owns the markup (see defaultLoginPage). Undefined
-   * when Google login is not configured; only the password form is shown then.
-   */
-  googleSignIn?: GoogleSignInAttributes;
 `
         : '';
     const googleSignInSnippet = features.googleLogin
@@ -9182,44 +9242,7 @@ ${googleViewsImport}// =========================================================
 // View Parameter Types
 // ============================================================
 
-export interface LoginPageParams {
-  /** Transaction ID for the auth flow */
-  transactionId: string;
-  /** CSRF token (must be included as hidden form field) */
-  csrfToken: string;
-  /** Error message from a previous failed attempt */
-  error?: string;
-  /** Number of remaining login attempts */
-  remainingAttempts?: number;
-  /**
-   * OIDC Core 1.0 §3.1.2.1 login_hint: untrusted external value the OP MAY use to
-   * pre-fill the login form. Treated as a hint only (initial display); it MUST be
-   * HTML-attribute escaped before rendering since it is unauthenticated input.
-   */
-  loginHint?: string;
-${googleLoginPageParam}}
-
-export interface ConsentPageParams {
-  /** Transaction ID for the auth flow */
-  transactionId: string;
-  /** CSRF token (must be included as hidden form field) */
-  csrfToken: string;
-  /** Scopes requested by the client */
-  scopes: string[];
-  /** Client ID requesting authorization */
-  clientId: string;
-}
-
-export interface ErrorPageParams {
-  /** Error message to display (OAuth error code for authorization errors) */
-  error: string;
-  /** Optional human-readable detail (OAuth error_description) */
-  errorDescription?: string;
-  /** HTTP status code */
-  statusCode: number;
-}
-${deviceParamTypes}${cibaParamTypes}${rpInitiatedLogoutParamTypes}
-// ============================================================
+${viewParamTypesTemplate(features)}// ============================================================
 // Views Interface
 // ============================================================
 
@@ -9230,15 +9253,7 @@ ${deviceParamTypes}${cibaParamTypes}${rpInitiatedLogoutParamTypes}
  */
 export type ViewResult = string | Response;
 
-export interface Views {
-  /** Render the login page (and login error page when error is set) */
-  loginPage(params: LoginPageParams): ViewResult;
-  /** Render the consent/authorization page */
-  consentPage(params: ConsentPageParams): ViewResult;
-  /** Render a generic error page */
-  errorPage(params: ErrorPageParams): ViewResult;
-${deviceViewsMembers}${cibaViewsMembers}${rpInitiatedLogoutViewsMembers}}
-
+${viewsInterfaceTemplate(features)}
 /** Options applied when renderView wraps an HTML string into a Response. */
 export interface RenderViewInit {
   /** HTTP status code for the generated Response (defaults to 200). */
@@ -9464,9 +9479,26 @@ export function requestObjectConformanceBeforeAll(features = DEFAULT_FEATURES) {
   );
 `;
 }
-export function reuseFlowConformanceTestBlock(features = DEFAULT_FEATURES, errorPageMode = 'html') {
+export function reuseFlowConformanceTestBlock(features = DEFAULT_FEATURES, viewMarkup = 'string') {
     return (reuseCascadeConformanceBlock(features) +
-        requestObjectValueConformanceBlock(features, errorPageMode));
+        requestObjectValueConformanceBlock(features, viewMarkup));
+}
+export function defaultErrorPageBodyExpectation(error, description, viewMarkup) {
+    if (viewMarkup === 'jsx') {
+        return `        '<!DOCTYPE html><html><head><title>Error</title></head><body>' +
+          '<h1>Error</h1><p>${error}</p><p>${description}</p></body></html>'`;
+    }
+    return `        [
+          '<!DOCTYPE html>',
+          '<html>',
+          '<head><title>Error</title></head>',
+          '<body>',
+          '  <h1>Error</h1>',
+          '  <p>${error}</p>',
+          '  <p>${description}</p>',
+          '</body>',
+          '</html>',
+        ].join('\\n')`;
 }
 function reuseCascadeConformanceBlock(features) {
     if (!features.refreshToken) {
@@ -9939,17 +9971,8 @@ function reuseCascadeConformanceBlock(features) {
   });
 `;
 }
-function requestObjectValueConformanceBlock(features, errorPageMode = 'html') {
-    const brokenRequestObjectExpectation = errorPageMode === 'redirect'
-        ? `      // OIDC Core 1.0 §6.3: invalid_request_object (not the generic
-      // invalid_request). This provider sets authorizationErrorRedirectPath, so
-      // the browser is 303-redirected to the OP's OWN error page — never to the
-      // redirect_uri of the broken Request Object.
-      expect(res.status).toBe(303);
-      expect(res.headers.get('Location')).toBe(
-        '/oidc-error?error=invalid_request_object&error_description=request+object+is+not+a+JWS+compact+serialization',
-      );`
-        : `      // OIDC Core 1.0 §6.3: the request parameter contains an invalid Request
+function requestObjectValueConformanceBlock(features, viewMarkup = 'string') {
+    const brokenRequestObjectExpectation = `      // OIDC Core 1.0 §6.3: the request parameter contains an invalid Request
       // Object, so the OP reports invalid_request_object (not the generic
       // invalid_request). A redirect_uri carried inside a broken Request Object
       // cannot be trusted, so the error stays on the OP: HTTP 400, no redirect,
@@ -9960,17 +9983,7 @@ function requestObjectValueConformanceBlock(features, errorPageMode = 'html') {
       expect(res.headers.get('Content-Type')).toBe('text/html; charset=UTF-8');
       const body = await res.text();
       expect(body).toBe(
-        [
-          '<!DOCTYPE html>',
-          '<html>',
-          '<head><title>Error</title></head>',
-          '<body>',
-          '  <h1>Error</h1>',
-          '  <p>invalid_request_object</p>',
-          '  <p>request object is not a JWS compact serialization</p>',
-          '</body>',
-          '</html>',
-        ].join('\\n'),
+${defaultErrorPageBodyExpectation('invalid_request_object', 'request object is not a JWS compact serialization', viewMarkup)},
       );`;
     if (!features.requestObject) {
         return `
@@ -10445,6 +10458,79 @@ function transactionBindingDisabledConformanceBlock() {
   });
 `;
 }
+function loginPageDeliveryConformanceTest() {
+    return `    // End-to-end: the login page (pages/login.ts) returns its view via
+    // renderView, so the login page is delivered as a text/html Response through
+    // the framework at runtime.
+    it('should deliver the login page through renderView as a text/html Response', async () => {
+      // RFC 7636 Appendix B example challenge so authorize is accepted and mints a
+      // transaction (302 -> /login); the verifier is never needed here.
+      const PKCE_CHALLENGE_S256 = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+      const authorizeUrl =
+        '/authorize?response_type=code&client_id=c-conf' +
+        '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+        '&scope=' + encodeURIComponent('openid') +
+        '&state=view-xyz' +
+        '&code_challenge=' + PKCE_CHALLENGE_S256 + '&code_challenge_method=S256';
+      const authorizeRes = await app.request(authorizeUrl);
+      const loginUrl = new URL(authorizeRes.headers.get('Location') ?? '', 'http://localhost');
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
+
+      const res = await app.request(loginUrl.pathname + loginUrl.search, { headers: { Cookie: bindingCookie } });
+
+      // The login body carries a dynamic transaction_id / csrf_token, so the
+      // status + content type pin that renderView delivered a text/html Response
+      // at runtime; the exact-body wrapping is pinned by the renderView unit tests.
+      expect(res.status).toBe(200);
+      expect(res.headers.get('Content-Type')).toBe('text/html; charset=UTF-8');
+    });
+`;
+}
+export function jsxViewConformanceTestBlock() {
+    return `
+  describe('JSX view rendering (ViewResult / renderView)', () => {
+    // A view returns a hono/jsx element; renderView serializes it into a
+    // text/html Response.
+    it('should serialize a JSX view into a text/html Response', async () => {
+      const res = renderView(defaultViews.errorPage({ error: 'jsx-view', statusCode: 400 }));
+
+      expect(res.status).toBe(200);
+      expect(res.headers.get('Content-Type')).toBe('text/html; charset=UTF-8');
+      expect(await res.text()).toBe(
+        '<!DOCTYPE html><html><head><title>Error</title></head><body>' +
+          '<h1>Error</h1><p>jsx-view</p></body></html>',
+      );
+    });
+
+    // The caller-provided status is applied (e.g. the 429 rate-limit error page).
+    it('should apply the provided status to a JSX view', async () => {
+      const res = renderView(
+        defaultViews.errorPage({ error: 'too many', statusCode: 429 }),
+        { status: 429 },
+      );
+
+      expect(res.status).toBe(429);
+      expect(res.headers.get('Content-Type')).toBe('text/html; charset=UTF-8');
+    });
+
+    // A view that renders asynchronously (an async component, or hono/html
+    // with a Promise inside) is streamed once its HTML resolves; the Response
+    // itself is built synchronously so a page can still attach cookies to it.
+    it('should stream a view that renders asynchronously', async () => {
+      const res = renderView(html\`<p>\${Promise.resolve('async-view')}</p>\`);
+
+      expect(res.status).toBe(200);
+      expect(res.headers.get('Content-Type')).toBe('text/html; charset=UTF-8');
+      expect(await res.text()).toBe('<p>async-view</p>');
+    });
+
+${loginPageDeliveryConformanceTest()}  });
+`;
+}
 export function customViewConformanceTestBlock() {
     return `
   describe('custom view rendering (ViewResult / renderView)', () => {
@@ -10481,36 +10567,7 @@ export function customViewConformanceTestBlock() {
       expect(await res.text()).toBe('<h1>custom-view-response</h1>');
     });
 
-    // End-to-end: the login page (pages/login.ts) returns its view via
-    // renderView, so the login page is delivered as a text/html Response through
-    // the framework at runtime.
-    it('should deliver the login page through renderView as a text/html Response', async () => {
-      // RFC 7636 Appendix B example challenge so authorize is accepted and mints a
-      // transaction (302 -> /login); the verifier is never needed here.
-      const PKCE_CHALLENGE_S256 = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
-      const authorizeUrl =
-        '/authorize?response_type=code&client_id=c-conf' +
-        '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
-        '&scope=' + encodeURIComponent('openid') +
-        '&state=view-xyz' +
-        '&code_challenge=' + PKCE_CHALLENGE_S256 + '&code_challenge_method=S256';
-      const authorizeRes = await app.request(authorizeUrl);
-      const loginUrl = new URL(authorizeRes.headers.get('Location') ?? '', 'http://localhost');
-      // Carry forward whatever cookie /authorize set, exactly as a browser would.
-      // With --enable transaction-binding this is the per-transaction binding
-      // secret the later steps require; without it this is '' and the OP ignores
-      // it, so the same flow works in both builds.
-      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
-
-      const res = await app.request(loginUrl.pathname + loginUrl.search, { headers: { Cookie: bindingCookie } });
-
-      // The login body carries a dynamic transaction_id / csrf_token, so the
-      // status + content type pin that renderView delivered a text/html Response
-      // at runtime; the exact-body wrapping is pinned by the renderView unit tests.
-      expect(res.status).toBe(200);
-      expect(res.headers.get('Content-Type')).toBe('text/html; charset=UTF-8');
-    });
-  });
+${loginPageDeliveryConformanceTest()}  });
 `;
 }
 function deviceAuthorizationConformanceClients(features) {
@@ -11913,6 +11970,161 @@ export function tokenEndpointAuthMethodsConformanceBlock() {
       const tokenBody = await tokenRes.json();
       expect(tokenBody.error).toBe('invalid_request');
     });
+
+    // RFC 6749 §3.2: "Parameters sent without a value MUST be treated as if they
+    // were omitted from the request." A public client whose HTTP stack serializes
+    // an unset secret as client_secret= must still authenticate as method 'none'.
+    it('should treat an empty client_secret field as absent for a public client', async () => {
+      const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+      const authorizeRes = await app.request(
+        '/authorize?response_type=code&client_id=c-public' +
+        '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+        '&scope=openid&state=public-empty-secret' +
+        '&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256',
+      );
+      const loginPath = relativeLocation(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
+      const transactionId =
+        new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
+      const loginRes = await app.request('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: csrfTokenFrom(await loginGet.text()),
+          username: 'testuser',
+          password: 'password',
+        }).toString(),
+      });
+      const consentPath = relativeLocation(loginRes.headers.get('Location'));
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
+      const consentRes = await app.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: csrfTokenFrom(await consentGet.text()),
+          action: 'approve',
+        }).toString(),
+      });
+      const callback = new URL(consentRes.headers.get('Location') ?? '', 'http://localhost');
+      const tokenRes = await app.request('/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: callback.searchParams.get('code') ?? '',
+          redirect_uri: REDIRECT_URI,
+          code_verifier: verifier,
+          client_id: 'c-public',
+          // A valueless form field (client_secret=) carries no credential.
+          client_secret: '',
+        }).toString(),
+      });
+
+      expect(consentRes.status).toBe(302);
+      expect(tokenRes.status).toBe(200);
+      const tokenBody = await tokenRes.json();
+      expect(tokenBody.token_type).toBe('Bearer');
+      expect(tokenBody.scope).toBe('openid');
+      expect((tokenBody.access_token as string).split('.')).toHaveLength(3);
+      expect((tokenBody.id_token as string).split('.')).toHaveLength(3);
+    });
+
+    // RFC 6749 §2.3 / §3.2: an empty client_secret field carries no credential,
+    // so it is not a second authentication method next to Authorization: Basic.
+    it('should authenticate a client_secret_basic request that also sends an empty client_secret field', async () => {
+      const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+      const authorizeRes = await app.request(
+        '/authorize?response_type=code&client_id=c-conf-basic' +
+        '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+        '&scope=openid&state=basic-empty-secret' +
+        '&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256',
+      );
+      const loginPath = relativeLocation(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
+      const transactionId =
+        new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
+      const loginRes = await app.request('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: csrfTokenFrom(await loginGet.text()),
+          username: 'testuser',
+          password: 'password',
+        }).toString(),
+      });
+      const consentPath = relativeLocation(loginRes.headers.get('Location'));
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
+      const consentRes = await app.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: csrfTokenFrom(await consentGet.text()),
+          action: 'approve',
+        }).toString(),
+      });
+      const callback = new URL(consentRes.headers.get('Location') ?? '', 'http://localhost');
+      const tokenRes = await app.request('/token', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          Authorization: 'Basic ' + btoa('c-conf-basic:s'),
+        },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: callback.searchParams.get('code') ?? '',
+          redirect_uri: REDIRECT_URI,
+          code_verifier: verifier,
+          client_id: 'c-conf-basic',
+          // A valueless form field left behind by the client's HTTP stack.
+          client_secret: '',
+        }).toString(),
+      });
+
+      expect(consentRes.status).toBe(302);
+      expect(tokenRes.status).toBe(200);
+      const tokenBody = await tokenRes.json();
+      expect(tokenBody.token_type).toBe('Bearer');
+      expect(tokenBody.scope).toBe('openid');
+      expect((tokenBody.access_token as string).split('.')).toHaveLength(3);
+      expect((tokenBody.id_token as string).split('.')).toHaveLength(3);
+    });
+
+    // A confidential client sending only an empty client_secret presents no
+    // credential at all, so the rejection reason is 'authentication required',
+    // not a method mismatch. Client authentication runs before code validation,
+    // so no authorization code flow is needed here.
+    it('should still require authentication when a confidential client sends an empty client_secret', async () => {
+      const tokenRes = await app.request('/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: 'irrelevant-code',
+          redirect_uri: REDIRECT_URI,
+          client_id: 'c-conf-basic',
+          client_secret: '',
+        }).toString(),
+      });
+
+      expect(tokenRes.status).toBe(401);
+      const tokenBody = await tokenRes.json();
+      expect(tokenBody.error).toBe('invalid_client');
+      expect(tokenBody.error_description).toBe('Client authentication required');
+    });
   });
 
 `;
@@ -15139,59 +15351,6 @@ function jarmInteractiveConsentJwtBlock() {
 ${jarmPromptNoneErrorTest()}    });
 `;
 }
-function jarmInteractiveConsentPlainBlock() {
-    return `    describe('Interactive flow response (Next.js Server Action limitation)', () => {
-      // On this target the consent step runs as a Next.js Server Action, which is
-      // bundled apart from the Route Handlers and holds its own signing key
-      // provider instance. A response JWT signed there would carry the same kid as
-      // /.well-known/jwks.json but different key material, so every client would
-      // fail signature verification. The Server Action therefore keeps the plain
-      // query response, and these tests pin that so the limitation stays visible.
-      it('should return the plain query response after login and consent', async () => {
-        const { location } = await interactiveFlow(authorizeUrl({ response_mode: 'query.jwt' }));
-
-        // RFC 9207 Section 2: the plain response carries iss, because no JWT iss
-        // claim is available to identify the issuer here.
-        expect([...queryOf(location).keys()].sort()).toEqual(['code', 'iss', 'state']);
-        expect(queryOf(location).get('state')).toBe('jarm-state');
-        expect(queryOf(location).get('iss')).toBe('http://localhost:3000');
-      });
-
-      it('should return the plain query error when the End-User denies consent', async () => {
-        const { location } = await interactiveFlow(
-          authorizeUrl({ response_mode: 'query.jwt' }),
-          'deny',
-        );
-
-        expect([...queryOf(location).keys()].sort()).toEqual(['error', 'iss', 'state']);
-        expect(queryOf(location).get('error')).toBe('access_denied');
-        expect(queryOf(location).get('state')).toBe('jarm-state');
-      });
-
-      it('should exchange the plainly delivered code for tokens', async () => {
-        const { location } = await interactiveFlow(authorizeUrl({ response_mode: 'query.jwt' }));
-        const res = await app.request('/token', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-          body: new URLSearchParams({
-            grant_type: 'authorization_code',
-            code: queryOf(location).get('code') ?? '',
-            redirect_uri: REDIRECT_URI,
-            client_id: 'c-conf',
-            client_secret: 's',
-            code_verifier: PKCE_VERIFIER,
-          }).toString(),
-        });
-
-        expect(res.status).toBe(200);
-        expect((await res.json()).token_type).toBe('Bearer');
-      });
-    });
-
-    describe('Error response (JARM Section 2.1)', () => {
-${jarmPromptNoneErrorTest()}    });
-`;
-}
 function jarmPromptNoneErrorTest() {
     return `      it('should return a signed error JWT for a prompt=none request with no session', async () => {
         // OIDC Core 1.0 Section 3.1.2.1: prompt=none without a session is
@@ -16895,19 +17054,11 @@ ${refreshTokenExpectation}    });
   });
 `;
 }
-export function jarmConformanceBlock(features, consentResponseMode = 'jwt') {
+export function jarmConformanceBlock(features) {
     if (!features.jarm)
         return '';
-    const interactiveResponseTests = consentResponseMode === 'plain'
-        ? jarmInteractiveConsentPlainBlock()
-        : jarmInteractiveConsentJwtBlock();
-    const jarmAuthorizeRouteResponsesComment = consentResponseMode === 'plain'
-        ? `      // These paths answer inside the authorize route — a Route Handler, which
-      // shares the signing key provider with /.well-known/jwks.json — so they do
-      // produce a verifiable JARM response even though the consent step above
-      // cannot.
-`
-        : `      // The authorize route records the mode on the transaction and the consent
+    const interactiveResponseTests = jarmInteractiveConsentJwtBlock();
+    const jarmAuthorizeRouteResponsesComment = `      // The authorize route records the mode on the transaction and the consent
       // route reads it back, so a store that drops unknown fields would answer in
       // plain query. These paths, by contrast, answer inside the authorize route
       // itself and never touch the store round trip.
@@ -18124,6 +18275,7 @@ import { rpInitiatedLogoutConfig } from './routes/logout.js';`
     return `import { ${vitestNames} } from 'vitest';
 import type { SigningKeyProvider, SigningKey } from '${corePkg}';
 import { Hono } from 'hono';
+import { html } from 'hono/html';
 ${exportPublicJwkImport}import { createApp, validateSigningKeySet } from './app.js';
 import { applyOidc } from './apply.js';
 import { createInMemoryClientResolver, type RegisteredClient${googleLoginConfigTypeImport} } from './config.js';
@@ -18213,24 +18365,15 @@ ${persistentStorageConformanceBlock()}
       expect(consentHtml.includes('&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt;')).toBe(true);
     });
 
-    it('should preserve a custom Response returned by a view', () => {
-      const customResponse = new Response('custom view', {
-        status: 202,
-        headers: { 'X-View-Renderer': 'custom' },
-      });
-      const rendered = renderView(customResponse, { status: 400 });
-
-      expect(rendered).toBe(customResponse);
-      expect(rendered.status).toBe(202);
-      expect(rendered.headers.get('X-View-Renderer')).toBe('custom');
-    });
-
-    it('should render a custom HTML string returned by the error view', async () => {
-      const customHtml = '<!DOCTYPE html><p>custom authorization error</p>';
+    // A custom view injected through createApp({ views }) replaces the default
+    // one; hono/html escapes what it interpolates, like JSX does.
+    it('should render a custom error view injected through createApp', async () => {
       const customApp = createApp({
         signingKeyProvider,
         clientResolver: createInMemoryClientResolver(testClients),
-        views: { errorPage: () => customHtml },
+        views: {
+          errorPage: (params) => html\`<!DOCTYPE html><p>custom \${params.error}: \${params.errorDescription}</p>\`,
+        },
       });
       const res = await customApp.request(
         '/authorize?response_type=code&client_id=c-conf' +
@@ -18241,7 +18384,9 @@ ${persistentStorageConformanceBlock()}
 
       expect(res.status).toBe(400);
       expect(res.headers.get('Content-Type')).toBe('text/html; charset=UTF-8');
-      expect(await res.text()).toBe(customHtml);
+      expect(await res.text()).toBe(
+        '<!DOCTYPE html><p>custom invalid_request: redirect_uri not registered</p>',
+      );
     });
   });
 
@@ -18580,17 +18725,7 @@ ${introspectionConformanceBlock(features)}
       // Pinned to the default error page so a regression in the rendered markup
       // (or a missing error_description) is caught exactly.
       expect(body).toBe(
-        [
-          '<!DOCTYPE html>',
-          '<html>',
-          '<head><title>Error</title></head>',
-          '<body>',
-          '  <h1>Error</h1>',
-          '  <p>invalid_request</p>',
-          '  <p>redirect_uri not registered</p>',
-          '</body>',
-          '</html>',
-        ].join('\\n'),
+${defaultErrorPageBodyExpectation('invalid_request', 'redirect_uri not registered', 'jsx')},
       );
     });
 
@@ -18609,7 +18744,7 @@ ${introspectionConformanceBlock(features)}
       });
     });
   });
-${transactionBindingConformanceBlock(features)}${customViewConformanceTestBlock()}${internalRedirectOriginConformanceBlock()}${endpointBehaviorConformanceBlock(features, true)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features)}${onlineRefreshTokenConformanceBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}${idJagConformanceBlock(features)}${deviceAuthorizationConformanceBlock(features)}${cibaConformanceBlock(features)}${jarmConformanceBlock(features)}${jwtIntrospectionResponseConformanceBlock(features)}${rpInitiatedLogoutConformanceBlock(features)}${googleLoginConformanceBlock(features)}${consentDecisionConformanceBlock()}${customScopeConformanceBlock(scopes)}});
+${transactionBindingConformanceBlock(features)}${jsxViewConformanceTestBlock()}${internalRedirectOriginConformanceBlock()}${endpointBehaviorConformanceBlock(features, true)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features, 'jsx')}${onlineRefreshTokenConformanceBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}${idJagConformanceBlock(features)}${deviceAuthorizationConformanceBlock(features)}${cibaConformanceBlock(features)}${jarmConformanceBlock(features)}${jwtIntrospectionResponseConformanceBlock(features)}${rpInitiatedLogoutConformanceBlock(features)}${googleLoginConformanceBlock(features)}${consentDecisionConformanceBlock()}${customScopeConformanceBlock(scopes)}});
 `;
 }
 //# sourceMappingURL=templates.js.map