@owlmeans/oidc 0.1.15 → 0.1.16

package/README.md

@@ -87,10 +87,9 @@ Array of dispatcher module declarations: `POST /authenticate/oidc/init` and `POS
 <!-- owlmeans:agent-guidance:start -->
 ## Agent guidance
 
-This package ships embedded Claude Code skills and GitHub Copilot instructions under
-`agent-meta/`. After installing your `@owlmeans/*` packages, run the OwlMeans
-agent-skills installer to place them into your project's native locations
-(`.claude/skills/` and `.github/instructions/`):
+This package ships embedded agent skills under `agent-meta/`. After installing your
+`@owlmeans/*` packages, run the OwlMeans agent-skills installer to place them into
+your project's skill store (`.agents/skills/`):
 
 ```sh
 npx @owlmeans/agent-skills

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "package": "@owlmeans/oidc",
-  "version": "0.1.15",
-  "generatedAt": "2026-08-07T17:06:32.903Z",
+  "version": "0.1.16",
+  "generatedAt": "2026-08-14T10:14:48.853Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {
@@ -10,21 +10,14 @@
       "name": "oidc-versions",
       "category": "multi-package",
       "file": "skills/oidc-versions/SKILL.md",
-      "canonicalPath": ".claude/skills/oidc-versions/SKILL.md"
+      "canonicalPath": ".agents/skills/oidc-versions/SKILL.md"
     },
     {
       "kind": "skill",
       "name": "oidc",
       "category": "package-specific",
       "file": "skills/oidc/SKILL.md",
-      "canonicalPath": ".claude/skills/oidc/SKILL.md"
-    },
-    {
-      "kind": "instruction",
-      "name": "oidc",
-      "category": "package-specific",
-      "file": "instructions/oidc.instructions.md",
-      "canonicalPath": ".github/instructions/oidc.instructions.md"
+      "canonicalPath": ".agents/skills/oidc/SKILL.md"
     }
   ]
 }

package/agent-meta/skills/oidc/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/oidc
 
 **Layer:** Core
-**Install:** `"@owlmeans/oidc": "^0.1.15"` in `dependencies`
+**Install:** `"@owlmeans/oidc": "^0.1.16"` in `dependencies`
 
 ## Key Exports
 
@@ -17,6 +17,10 @@ user-invocable: false
 | `OIDC_GATE` | Gate alias to pass to `gate(...)` inside `guard(...)` |
 | `GOOGLE_CLIENT_AUTH` | Client auth plugin type for Google OAuth |
 | `GOOGLE_SERVICE` | Provider service key for Google (`'google'`) |
+| `OIDC_RP_BASE_SCOPES` / `OIDC_RP_BASE_SCOPE` | The scopes every OwlMeans RP requests, as array / space-delimited string |
+| `EMAIL_SCOPE`, `PERMISSIONS_SCOPE`, `PERMISSIONS_CLAIM` | Standard email scope; the integrated-IAM grant scope and its claim |
+| `OIDC_ERROR_QUERY`, `OIDC_ERROR_DESCRIPTION_QUERY` | Redirect-URI params an authorization server sets on failure |
+| `INTERACTION`, `INTERACTION_PATH`, `INTERACTION_UID` | Interaction screen entrypoint alias, path, and its uid path param |
 | `OidcProviderDescriptor` | Shared provider config shape, including service, endpoints, redirect URI, and optional default flag |
 | `OidcGuard` types | Guard payload shapes |
 | Modules | Shared OIDC module declarations |
@@ -38,6 +42,19 @@ entrypoint(
 
 The actual OIDC verification happens in `@owlmeans/server-oidc-rp` (server) and `@owlmeans/web-oidc-rp` (browser). The `oidc` package gives both sides a shared name to refer to.
 
+## Scope names are a cross-package contract
+
+`OIDC_RP_BASE_SCOPES` is the one definition of what an OwlMeans relying party asks an authorization
+server for. Two sides must agree on it and both read it from here:
+
+- the **RP** builds its request from it (`requestedScope()` in `@owlmeans/server-oidc-rp`);
+- whoever **registers the client** must allow at least these scopes — an authorization server
+  rejects the entire request with `invalid_scope` when a requested scope is one it supports but
+  the client is not allowed to use (see `@owlmeans/iam-integrated`'s `INTEGRATED_CLIENT_SCOPES`).
+
+Never hardcode a scope string on either side; adding one to `OIDC_RP_BASE_SCOPES` must widen every
+client allowlist derived from it in the same change.
+
 ## Product-Viable Usage Notes
 
 - Provider config is stored in `cfg.oidc.providers`; viable config registers both an internal admin provider and a Google provider with `service: GOOGLE_SERVICE`.

package/agent-meta/skills/oidc-versions/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: oidc-versions
 description: How to manage and upgrade the four OIDC/OAuth third-party dependencies used by OwlMeans OIDC packages. Covers exact-pin policy, official doc anchors, breaking-change checklists for each lib, the OwlMeans isolation principle, and the verification flow across common and downstream repos. Auto-invoked when touching oidc-provider, openid-client, jose, or oidc-client-ts version strings in package.json files.
-allowed-tools: Bash(npm view *), Bash(grep *), Bash(bun *)
+allowed-tools: Bash(npm view *) Bash(grep *) Bash(bun *)
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
 

package/build/consts.d.ts

@@ -1,5 +1,7 @@
 export declare const DEFAULT_PATH = "oidc";
 export declare const DEFAULT_FRONT = "oidc-client";
+/** The path param carrying the interaction uid — every INTERACTION route must declare it. */
+export declare const INTERACTION_UID = "uid";
 export declare const INTERACTION_PATH = "/interaction/:uid";
 export declare const INTERACTION = "oidc:interaction";
 export declare const OIDC_FLOW = "oidc";
@@ -13,11 +15,31 @@ export declare const OIDC_GUARD_CACHE = "resource:oidc-guard:cache";
 export declare const DISPATCHER_OIDC_INIT = "dispatcher:oidc:init";
 export declare const DISPATCHER_OIDC = "dispatcher:oidc:authenticate";
 export declare const OIDC_CODE_QUERY = "code";
+/**
+ * Query params an authorization server sets on the redirect URI when the request failed
+ * (RFC 6749 §4.1.2.1). Their presence means the flow is over — a relying party that re-enters
+ * authorization on seeing them loops between itself and the provider forever.
+ */
+export declare const OIDC_ERROR_QUERY = "error";
+export declare const OIDC_ERROR_DESCRIPTION_QUERY = "error_description";
 export declare const OIDC_WRAPPED_TOKEN = "oidc-wrapped-token";
 export declare const WRAPPED_OIDC = "wrapped-oidc-authz";
 export declare const OIDC_GATE = "oidc-gate";
+/** Standard OIDC scope that requests the `email` / `email_verified` claims. */
+export declare const EMAIL_SCOPE = "email";
 /** OIDC scope that requests the permissions claim from the integrated provider. */
 export declare const PERMISSIONS_SCOPE = "permissions";
+/**
+ * The scopes an OwlMeans relying party asks for on every authorization request, before the
+ * provider-specific `extraScopes` are appended.
+ *
+ * Any provider we register a client with must allow all of them: `oidc-provider` rejects the whole
+ * request with `invalid_scope` when a requested scope is one it supports but the client is not
+ * allowed to use (`email` is such a scope — it exists as soon as `claims.email` is configured).
+ */
+export declare const OIDC_RP_BASE_SCOPES: string[];
+/** `OIDC_RP_BASE_SCOPES` as the space-delimited string an authorization request carries. */
+export declare const OIDC_RP_BASE_SCOPE: string;
 /** Token/userinfo claim carrying the subject's PermissionSet[] for the requesting client. */
 export declare const PERMISSIONS_CLAIM = "permissions";
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,gBAAgB,sBAAsB,CAAA;AAEnD,eAAO,MAAM,WAAW,qBAAqB,CAAA;AAE7C,eAAO,MAAM,SAAS,SAAS,CAAA;AAE/B,eAAO,MAAM,kBAAkB,oBAAoB,CAAA;AAEnD,eAAO,MAAM,oBAAoB,4BAA4B,CAAA;AAE7D,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAE7C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAGhD,eAAO,MAAM,cAAc,WAAW,CAAA;AAEtC,eAAO,MAAM,UAAU,eAAe,CAAA;AAEtC,eAAO,MAAM,gBAAgB,8BAA8B,CAAA;AAE3D,eAAO,MAAM,oBAAoB,yBAAyB,CAAA;AAE1D,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAE7D,eAAO,MAAM,eAAe,SAAS,CAAA;AAErC,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,SAAS,cAAc,CAAA;AAEpC,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,gBAAgB,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,6FAA6F;AAC7F,eAAO,MAAM,eAAe,QAAQ,CAAA;AAEpC,eAAO,MAAM,gBAAgB,sBAA4C,CAAA;AAEzE,eAAO,MAAM,WAAW,qBAAqB,CAAA;AAE7C,eAAO,MAAM,SAAS,SAAS,CAAA;AAE/B,eAAO,MAAM,kBAAkB,oBAAoB,CAAA;AAEnD,eAAO,MAAM,oBAAoB,4BAA4B,CAAA;AAE7D,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAE7C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAGhD,eAAO,MAAM,cAAc,WAAW,CAAA;AAEtC,eAAO,MAAM,UAAU,eAAe,CAAA;AAEtC,eAAO,MAAM,gBAAgB,8BAA8B,CAAA;AAE3D,eAAO,MAAM,oBAAoB,yBAAyB,CAAA;AAE1D,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAE7D,eAAO,MAAM,eAAe,SAAS,CAAA;AAErC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,eAAO,MAAM,4BAA4B,sBAAsB,CAAA;AAE/D,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,SAAS,cAAc,CAAA;AAEpC,+EAA+E;AAC/E,eAAO,MAAM,WAAW,UAAU,CAAA;AAElC,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,UAAqC,CAAA;AAErE,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,QAAgC,CAAA;AAE/D,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,gBAAgB,CAAA"}

package/build/consts.js

@@ -1,6 +1,9 @@
+import { PARAM } from '@owlmeans/route';
 export const DEFAULT_PATH = 'oidc';
 export const DEFAULT_FRONT = 'oidc-client';
-export const INTERACTION_PATH = '/interaction/:uid';
+/** The path param carrying the interaction uid — every INTERACTION route must declare it. */
+export const INTERACTION_UID = 'uid';
+export const INTERACTION_PATH = `/interaction/${PARAM}${INTERACTION_UID}`;
 export const INTERACTION = 'oidc:interaction';
 export const OIDC_FLOW = 'oidc';
 export const OIDC_AUTHEN_MODULE = 'iam-oidc-authen';
@@ -14,11 +17,31 @@ export const OIDC_GUARD_CACHE = 'resource:oidc-guard:cache';
 export const DISPATCHER_OIDC_INIT = 'dispatcher:oidc:init';
 export const DISPATCHER_OIDC = 'dispatcher:oidc:authenticate';
 export const OIDC_CODE_QUERY = 'code';
+/**
+ * Query params an authorization server sets on the redirect URI when the request failed
+ * (RFC 6749 §4.1.2.1). Their presence means the flow is over — a relying party that re-enters
+ * authorization on seeing them loops between itself and the provider forever.
+ */
+export const OIDC_ERROR_QUERY = 'error';
+export const OIDC_ERROR_DESCRIPTION_QUERY = 'error_description';
 export const OIDC_WRAPPED_TOKEN = 'oidc-wrapped-token';
 export const WRAPPED_OIDC = 'wrapped-oidc-authz';
 export const OIDC_GATE = 'oidc-gate';
+/** Standard OIDC scope that requests the `email` / `email_verified` claims. */
+export const EMAIL_SCOPE = 'email';
 /** OIDC scope that requests the permissions claim from the integrated provider. */
 export const PERMISSIONS_SCOPE = 'permissions';
+/**
+ * The scopes an OwlMeans relying party asks for on every authorization request, before the
+ * provider-specific `extraScopes` are appended.
+ *
+ * Any provider we register a client with must allow all of them: `oidc-provider` rejects the whole
+ * request with `invalid_scope` when a requested scope is one it supports but the client is not
+ * allowed to use (`email` is such a scope — it exists as soon as `claims.email` is configured).
+ */
+export const OIDC_RP_BASE_SCOPES = ['openid', 'profile', EMAIL_SCOPE];
+/** `OIDC_RP_BASE_SCOPES` as the space-delimited string an authorization request carries. */
+export const OIDC_RP_BASE_SCOPE = OIDC_RP_BASE_SCOPES.join(' ');
 /** Token/userinfo claim carrying the subject's PermissionSet[] for the requesting client. */
 export const PERMISSIONS_CLAIM = 'permissions';
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAA;AAEnD,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAA;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAA;AAE/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAA;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAA;AAE7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEhD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAA;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAA;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAA;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAA;AAE7D,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAA;AAErC,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAEtD,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAA;AAEpC,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAEvC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAA;AAEpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,KAAK,GAAG,eAAe,EAAE,CAAA;AAEzE,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAA;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAA;AAE/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAA;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAA;AAE7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEhD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAA;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAA;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAA;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAA;AAE7D,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAA;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAAmB,CAAA;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAEtD,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAA;AAEpC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAElC,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE/D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/oidc",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,14 +21,14 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.15",
-    "@owlmeans/auth-common": "^0.1.15",
-    "@owlmeans/basic-envelope": "^0.1.15",
-    "@owlmeans/config": "^0.1.15",
-    "@owlmeans/context": "^0.1.15",
-    "@owlmeans/entrypoint": "^0.1.15",
-    "@owlmeans/resource": "^0.1.15",
-    "@owlmeans/route": "^0.1.15"
+    "@owlmeans/auth": "^0.1.16",
+    "@owlmeans/auth-common": "^0.1.16",
+    "@owlmeans/basic-envelope": "^0.1.16",
+    "@owlmeans/config": "^0.1.16",
+    "@owlmeans/context": "^0.1.16",
+    "@owlmeans/entrypoint": "^0.1.16",
+    "@owlmeans/resource": "^0.1.16",
+    "@owlmeans/route": "^0.1.16"
   },
   "peerDependencies": {
     "ajv": "*"

package/src/consts.ts

@@ -1,9 +1,14 @@
 
+import { PARAM } from '@owlmeans/route'
+
 export const DEFAULT_PATH = 'oidc'
 
 export const DEFAULT_FRONT = 'oidc-client'
 
-export const INTERACTION_PATH = '/interaction/:uid'
+/** The path param carrying the interaction uid — every INTERACTION route must declare it. */
+export const INTERACTION_UID = 'uid'
+
+export const INTERACTION_PATH = `/interaction/${PARAM}${INTERACTION_UID}`
 
 export const INTERACTION = 'oidc:interaction'
 
@@ -30,14 +35,39 @@ export const DISPATCHER_OIDC = 'dispatcher:oidc:authenticate'
 
 export const OIDC_CODE_QUERY = 'code'
 
+/**
+ * Query params an authorization server sets on the redirect URI when the request failed
+ * (RFC 6749 §4.1.2.1). Their presence means the flow is over — a relying party that re-enters
+ * authorization on seeing them loops between itself and the provider forever.
+ */
+export const OIDC_ERROR_QUERY = 'error'
+
+export const OIDC_ERROR_DESCRIPTION_QUERY = 'error_description'
+
 export const OIDC_WRAPPED_TOKEN = 'oidc-wrapped-token'
 
 export const WRAPPED_OIDC = 'wrapped-oidc-authz'
 
 export const OIDC_GATE = 'oidc-gate'
 
+/** Standard OIDC scope that requests the `email` / `email_verified` claims. */
+export const EMAIL_SCOPE = 'email'
+
 /** OIDC scope that requests the permissions claim from the integrated provider. */
 export const PERMISSIONS_SCOPE = 'permissions'
 
+/**
+ * The scopes an OwlMeans relying party asks for on every authorization request, before the
+ * provider-specific `extraScopes` are appended.
+ *
+ * Any provider we register a client with must allow all of them: `oidc-provider` rejects the whole
+ * request with `invalid_scope` when a requested scope is one it supports but the client is not
+ * allowed to use (`email` is such a scope — it exists as soon as `claims.email` is configured).
+ */
+export const OIDC_RP_BASE_SCOPES = ['openid', 'profile', EMAIL_SCOPE]
+
+/** `OIDC_RP_BASE_SCOPES` as the space-delimited string an authorization request carries. */
+export const OIDC_RP_BASE_SCOPE = OIDC_RP_BASE_SCOPES.join(' ')
+
 /** Token/userinfo claim carrying the subject's PermissionSet[] for the requesting client. */
 export const PERMISSIONS_CLAIM = 'permissions'

package/agent-meta/instructions/oidc.instructions.md

@@ -1,47 +0,0 @@
----
-description: "How to use @owlmeans/oidc — shared OIDC protocol abstractions including OIDC_GATE constant used in module gate() declarations."
-applyTo: "**/*.ts, **/*.tsx"
----
-<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
-
-# @owlmeans/oidc
-
-**Layer:** Core
-**Install:** `"@owlmeans/oidc": "^0.1.15"` in `dependencies`
-
-## Key Exports
-
-| Export | Description |
-|--------|-------------|
-| `OIDC_GATE` | Gate alias to pass to `gate(...)` inside `guard(...)` |
-| `GOOGLE_CLIENT_AUTH` | Client auth plugin type for Google OAuth |
-| `GOOGLE_SERVICE` | Provider service key for Google (`'google'`) |
-| `OidcProviderDescriptor` | Shared provider config shape, including service, endpoints, redirect URI, and optional default flag |
-| `OidcGuard` types | Guard payload shapes |
-| Modules | Shared OIDC module declarations |
-| Models | Token/profile shapes |
-
-## Usage
-
-```typescript
-import { OIDC_GATE } from '@owlmeans/oidc'
-import { guard, gate } from '@owlmeans/entrypoint'
-import { DEFAULT_GUARD } from '@owlmeans/auth-common'
-
-guard(DEFAULT_GUARD, gate(OIDC_GATE, [`my-service-account-{entity}`]))
-```
-
-## Product-Viable Usage Notes
-
-- Provider config is stored in `cfg.oidc.providers`; viable config registers both an internal admin provider and a Google provider with `service: GOOGLE_SERVICE`.
-- `GOOGLE_SERVICE` is the provider service value `'google'`. Keep it stable so browser plugins, backend provider lookup, and identity credentials derive the same login-service key.
-- `GOOGLE_CLIENT_AUTH` names the browser authentication plugin registered by `@owlmeans/web-oidc-rp/auth/plugins`.
-- `OIDC_GATE` is for OIDC/UMA-style authorization gates. Do not use it for downstream products that authenticate with OIDC/Google but authorize against local identity resources; those products should declare their own gate alias.
-
-- `PERMISSIONS_SCOPE` / `PERMISSIONS_CLAIM` (`'permissions'`) — the OIDC scope requesting, and the
-  token claim carrying, the subject's `PermissionSet[]` from the integrated IAM provider. Shared by
-  `server-oidc-provider` (emission), `server-oidc-rp` (extraction), and target provider config (`extraScopes`).
-
-## Depends On
-
-- `@owlmeans/entrypoint`, `@owlmeans/route`, `@owlmeans/auth`