@owlmeans/oidc 0.1.18-rc.5 → 0.1.18-rc.50

package/README.md

@@ -1,33 +1,34 @@
 # @owlmeans/oidc
 
-Shared OIDC protocol abstractions — guard/gate aliases, models, and module declarations used by both server and browser OIDC packages.
+Shared OIDC protocol abstractions — guard/gate aliases, models, and immutable protocol declarations used by both server and browser OIDC packages.
 
 ## Overview
 
-- `OIDC_GATE` — gate alias to compose with `gate(...)` inside `guard(...)` declarations
+- `OIDC_GATE` — gate alias to put in a protocol's `gate` option
 - `OIDC_GUARD`, `WRAPPED_OIDC`, `OIDC_FLOW`, `OIDC_AUTHEN_MODULE`, `OIDC_WRAPPED_TOKEN` — shared aliases
 - `OidcGuard`, `WithSharedConfig`, `OidcProviderConfig` — shared types
-- Module declarations for the OIDC dispatcher (`/authenticate/oidc/init`, `/authenticate/oidc/process`)
+- Entrypoint declarations for the OIDC dispatcher (`/authenticate/oidc/init`, `/authenticate/oidc/process`)
 
 ## Installation
 
 ```bash
-bun add @owlmeans/oidc
+bun add @owlmeans/oidc@^0.1.18-rc.50
 ```
 
 ## Usage
 
-Compose `OIDC_GATE` into a guard on a module:
+Compose `OIDC_GATE` into a protocol declaration:
 
 ```typescript
-import { module, guard, gate } from '@owlmeans/module'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
 import { route } from '@owlmeans/route'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 import { OIDC_GATE } from '@owlmeans/oidc'
 
-module(
+protocol(
   route(manager.back.account.base, '/account'),
-  guard(DEFAULT_GUARD, gate(OIDC_GATE, [`my-service-account-{entity}`]))
+  contract(typed<Account>()),
+  { guards: DEFAULT_GUARD, gate: { alias: OIDC_GATE, params: [`my-service-account-{entity}`] } },
 )
 ```
 
@@ -56,7 +57,7 @@ import { OIDC_GUARD } from '@owlmeans/oidc'
 - `WRAPPED_OIDC` — `'wrapped-oidc-authz'`
 - `OIDC_AUTHEN_MODULE` — `'iam-oidc-authen'`
 - `OIDC_WRAPPED_TOKEN` — `'oidc-wrapped-token'`
-- `DISPATCHER_OIDC`, `DISPATCHER_OIDC_INIT` — auth dispatcher module aliases
+- `DISPATCHER_OIDC`, `DISPATCHER_OIDC_INIT` — auth dispatcher entrypoint aliases
 - `INTERACTION`, `INTERACTION_PATH` — interaction route aliases
 - `OIDC_GUARD_CACHE` — guard cache resource alias
 
@@ -73,9 +74,11 @@ import { OIDC_GUARD } from '@owlmeans/oidc'
 - `GOOGLE_CLIENT_AUTH` identifies the browser Google auth plugin registered by `@owlmeans/web-oidc-rp/auth/plugins`.
 - `OIDC_GATE` is for OIDC-backed authorization. Apps that only use Google/OIDC for login and authorize against local identity records should define their own product gate alias.
 
-### `modules`
+### `oidcProtocols`
 
-Array of dispatcher module declarations: `POST /authenticate/oidc/init` and `POST /authenticate/oidc/process`.
+Immutable dispatcher declaration tree: `POST /authenticate/oidc/init` and
+`POST /authenticate/oidc/process`. The relying-party packages bind these exact protocol objects
+locally; do not recreate them or consume an alias-addressed compatibility list.
 
 ## Related Packages
 
@@ -92,7 +95,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.44
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/oidc",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.507Z",
+  "version": "0.1.18-rc.50",
+  "generatedAt": "2026-09-30T09:41:02.827Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/oidc/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oidc
-description: How to use @owlmeans/oidc — shared OIDC protocol abstractions including OIDC_GATE constant used in module gate() declarations. Auto-invoked when importing OIDC types/constants or wiring OIDC into a guard().
+description: How to use @owlmeans/oidc — the OIDC names both sides share — the OIDC_GATE alias, the guard, the requested-scope contract, provider descriptors, the dispatcher entrypoints and the error query params. Auto-invoked when importing OIDC types or constants, wiring OIDC into a protocol gate, or declaring an identity provider in configuration.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,60 +8,105 @@ user-invocable: false
 # @owlmeans/oidc
 
 **Layer:** Core
-**Install:** `"@owlmeans/oidc": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/oidc": "^0.1.18-rc.50"` in `dependencies`
+
+The shared half of the OIDC stack: no transport, no library. It owns the names, the shapes and the
+guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser relying party
+(`@owlmeans/web-oidc-rp`) and the embedded provider (`@owlmeans/server-oidc-provider`) must agree on.
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `OIDC_GATE` | Gate alias to pass to `gate(...)` inside `guard(...)` |
-| `GOOGLE_CLIENT_AUTH` | Client auth plugin type for Google OAuth |
-| `GOOGLE_SERVICE` | Provider service key for Google (`'google'`) |
+| `OIDC_GATE` | Gate alias to pass in a protocol's `gate` option |
+| `OIDC_GUARD` | The guard's alias |
+| `OIDC_GUARD_CACHE` | A resource-alias constant nothing reads — the guard has no cache lookup, so registering a resource under it changes no behaviour |
+| `makeOidcGuard(opts?)` / `appendOidcGuard(context, opts?)` | The wrapped-token guard, and its registration. The target-specific packages wrap these |
+| `withOidcGuard(protocolTree, coguards?)` | Returns a decorated immutable protocol tree, prepending `OIDC_GUARD` to selected guarded declarations (default `DEFAULT_GUARD`) |
+| `oidcProtocols` | Shared dispatcher declarations: `DISPATCHER_OIDC_INIT` (`POST /authenticate/oidc/init`) and `DISPATCHER_OIDC` (`POST /authenticate/oidc/process`) |
+| `DISPATCHER_OIDC_INIT`, `DISPATCHER_OIDC` | Their aliases |
+| `OIDC_WRAPPED_TOKEN`, `WRAPPED_OIDC` | The authorization-header scheme for an OIDC-wrapped token, and the service alias that refreshes one |
+| `OIDC_CLIENT_AUTH`, `GOOGLE_CLIENT_AUTH` | Authentication plugin types — the generic OIDC one and the Google one |
+| `GOOGLE_SERVICE` | Provider service value for Google (`'google'`) |
 | `OIDC_RP_BASE_SCOPES` / `OIDC_RP_BASE_SCOPE` | The scopes every OwlMeans RP requests, as array / space-delimited string |
-| `EMAIL_SCOPE`, `PERMISSIONS_SCOPE`, `PERMISSIONS_CLAIM` | Standard email scope; the integrated-IAM grant scope and its claim |
-| `OIDC_ERROR_QUERY`, `OIDC_ERROR_DESCRIPTION_QUERY` | Redirect-URI params an authorization server sets on failure |
-| `INTERACTION`, `INTERACTION_PATH`, `INTERACTION_UID` | Interaction screen entrypoint alias, path, and its uid path param |
-| `OidcProviderDescriptor` | Shared provider config shape, including service, endpoints, redirect URI, and optional default flag |
-| `OidcGuard` types | Guard payload shapes |
-| Modules | Shared OIDC module declarations |
-| Models | Token/profile shapes |
+| `EMAIL_SCOPE`, `PERMISSIONS_SCOPE`, `PERMISSIONS_CLAIM` | The standard email scope; the integrated-IAM grant scope and the claim it produces |
+| `OIDC_CODE_QUERY`, `OIDC_ERROR_QUERY`, `OIDC_ERROR_DESCRIPTION_QUERY` | Redirect-URI params an authorization server sets on success and on failure |
+| `INTERACTION`, `INTERACTION_PATH`, `INTERACTION_UID` | Interaction screen alias, path, and the uid path param the path must declare |
+| `PROVIDER_INTERACTION`, `OIDC_AUTHEN_MODULE`, `OIDC_FLOW` | The provider-side interaction alias, the IAM authentication entrypoint alias, and the flow name |
+| `DEFAULT_PATH`, `DEFAULT_FRONT` | `'oidc'` and `'oidc-client'` — the provider's default base path and the default front service alias |
+| `OidcProviderDescriptor` | One identity provider as configuration: `clientId`, `secret?`, `discoveryUrl?`, `service?`/`basePath?`, `redirectUri?`, `extraScopes?`, `entityId?`, `idOverride?`, the three endpoint overrides `authEndpoint?`/`tokenEndpoint?`/`userinfoEndpoint?`, plus the presentation fields below |
+| `OidcProviderConfig` | A descriptor plus `internal?` (machine use only) and `apiClientId?` (the admin client) |
+| `OidcSharedConfig` / `WithSharedConfig` | `cfg.oidc`: `providers`, `restrictedProviders`, `clientCookie.interaction` |
+| `OidcIamConfig` | `{ iamMode?: 'keycloak' \| 'integrated' }` — the IAM-mode seam, kept here to avoid a cycle with `@owlmeans/iam` |
+| `OidcGuard`, `OidcGuardOptions` | The guard service type, and `{ coguards, cache?, tokenService? }` — only `coguards` (its **first** entry, default `DEFAULT_GUARD`) and `tokenService` are read; `cache` is declared and never used |
+| `OIDCAuthInitParams`, `OIDCClientAuthPayload`, `OIDCTokenUpdate`, `CommonTokenSetParams` | The dispatcher wire shapes |
+| `OIDCAuthInitParamsSchema`, `OIDCClientAuthPayloadSchema`, `OIDCTokenUpdateSchema`, `ProviderProfileDetailsSchema` | Their AJV schemas |
+| `ProviderProfileDetails`, `OidcUserDetails`, `OidcProviderSettings` | What an identity provider reports about a subject |
+| `WrappedOIDCService` | The `AuthorizationService` that keeps a wrapped token fresh |
 
 ## Usage
 
 ```typescript
-import { entrypoint, guard, gate } from '@owlmeans/entrypoint'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
 import { route } from '@owlmeans/route'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 import { OIDC_GATE } from '@owlmeans/oidc'
 
-entrypoint(
-  route(manager.back.account.base, '/account'),
-  guard(DEFAULT_GUARD, gate(OIDC_GATE, [`my-service-account-{entity}`]))
+protocol(
+  route(accountAlias, '/account'),
+  contract(typed<Account>()),
+  { guards: DEFAULT_GUARD, gate: { alias: OIDC_GATE, params: ['my-service-account--read'] } },
 )
 ```
 
-The actual OIDC verification happens in `@owlmeans/server-oidc-rp` (server) and `@owlmeans/web-oidc-rp` (browser). The `oidc` package gives both sides a shared name to refer to.
+The verification itself happens in `@owlmeans/server-oidc-rp` (server) and `@owlmeans/web-oidc-rp`
+(browser); this package gives both sides one name to refer to. `OIDC_GATE` is for OIDC/UMA-style
+authorization. A product that authenticates over OIDC but authorizes against its own identity
+resources declares its own gate alias instead.
 
 ## Scope names are a cross-package contract
 
 `OIDC_RP_BASE_SCOPES` is the one definition of what an OwlMeans relying party asks an authorization
-server for. Two sides must agree on it and both read it from here:
+server for, and two sides read it from here:
 
 - the **RP** builds its request from it (`requestedScope()` in `@owlmeans/server-oidc-rp`);
 - whoever **registers the client** must allow at least these scopes — an authorization server
-  rejects the entire request with `invalid_scope` when a requested scope is one it supports but
-  the client is not allowed to use (see `@owlmeans/iam-integrated`'s `INTEGRATED_CLIENT_SCOPES`).
+  rejects the entire request with `invalid_scope` when a requested scope is one it supports but the
+  client is not allowed to use.
 
-Never hardcode a scope string on either side; adding one to `OIDC_RP_BASE_SCOPES` must widen every
+Never hardcode a scope string on either side. Adding one to `OIDC_RP_BASE_SCOPES` must widen every
 client allowlist derived from it in the same change.
 
-## Product-Viable Usage Notes
+## Provider descriptors
+
+`cfg.oidc.providers` is the list. `discoveryUrl` is the canonical form — the fully-qualified issuer,
+used verbatim; `service` + `basePath` is the legacy fallback that reassembles the issuer from a
+registered service host, and it forces the relying party to know the provider's URL layout.
+
+Presentation lives on the descriptor too, because a browser never talks to the issuer directly and
+has no discovery document to read a name out of: `label` (the human-readable name), `icon` (an icon
+registry **name**, never markup), `order` (ascending; absent sorts after the default) and `hidden`
+(registered but never offered). `internal: true` means machine use and is never offered either.
+
+`def` marks the default provider, and **both sides read it**. On the server, `getDefault()` in
+`@owlmeans/server-oidc-rp` returns the `clientId` of the first provider carrying the flag, and the
+init handler resolves the OIDC client from that value before it looks at `entityId` at all — so `def`
+in a server config decides which provider the browser-starts-server-finishes flow runs against. In
+the browser it drives presentation as well: `@owlmeans/web-oidc-rp` gives the flagged provider a
+login method of `order` 20 (unless the descriptor sets its own) and renders it with primary emphasis.
+
+`restrictedProviders` narrows what an application may use: `false` forbids identity-provider sign-in
+outright, `true` allows only the default one, and an array is an allowlist matched against a
+provider's `entityId ?? service ?? clientId`.
 
-- Provider config is stored in `cfg.oidc.providers`; viable config registers both an internal admin provider and a Google provider with `service: GOOGLE_SERVICE`.
-- `GOOGLE_SERVICE` is the provider service value `'google'`. Keep it stable so browser plugins, backend provider lookup, and identity credentials derive the same login-service key.
-- `GOOGLE_CLIENT_AUTH` names the browser authentication plugin registered by `@owlmeans/web-oidc-rp/auth/plugins`.
-- `OIDC_GATE` is for OIDC/UMA-style authorization gates. Do not use it for downstream products that authenticate with OIDC/Google but authorize against local identity resources; those products should declare their own gate alias.
+`authEndpoint`, `tokenEndpoint` and `userinfoEndpoint` name a provider's endpoints outright, for a
+provider reached without discovery. The shipped reader of all three is the Google sign-in plugin in
+`@owlmeans/server-oidc-rp`, which falls back to Google's own endpoints when they are absent; a
+descriptor that carries a `discoveryUrl` gets its endpoints from the discovery document instead and
+these fields do nothing.
 
 ## Depends On
 
-- `@owlmeans/entrypoint`, `@owlmeans/route`, `@owlmeans/auth`
+- `@owlmeans/entrypoint`, `@owlmeans/route`, `@owlmeans/auth`, `@owlmeans/auth-common`,
+  `@owlmeans/basic-envelope`, `@owlmeans/config`, `@owlmeans/context`, `@owlmeans/resource`
+- `ajv` (peer) — the schemas above are `JSONSchemaType` declarations

package/agent-meta/skills/oidc-versions/SKILL.md

@@ -1,13 +1,15 @@
 ---
 name: oidc-versions
 description: How to manage and upgrade the four OIDC/OAuth third-party dependencies used by OwlMeans OIDC packages. Covers exact-pin policy, official doc anchors, breaking-change checklists for each lib, the OwlMeans isolation principle, and the verification flow across common and downstream repos. Auto-invoked when touching oidc-provider, openid-client, jose, or oidc-client-ts version strings in package.json files.
-allowed-tools: Bash(npm view *) Bash(grep *) Bash(bun *)
+allowed-tools: Bash(npm view *), Bash(grep *), Bash(bun *)
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
 
 # OIDC / OAuth dependency version management — OwlMeans Common
 
-This skill is the sibling of [[versions]] (internal `@owlmeans/*` version sync) and [[shadcn-versions]] (UI lib bumps). Use it whenever upgrading the upstream OIDC/OAuth libraries, and cross-read it before touching any OIDC package implementation.
+The sibling of [[versions]] (internal `@owlmeans/*` version sync) and [[shadcn-versions]] (UI lib
+bumps). Use it whenever upgrading the upstream OIDC/OAuth libraries, and cross-read it before
+touching any OIDC package implementation.
 
 ## The four libraries and their owning packages
 
@@ -18,9 +20,12 @@ This skill is the sibling of [[versions]] (internal `@owlmeans/*` version sync)
 | `openid-client` | `@owlmeans/server-oidc-rp` | **exact** | `6.8.4` |
 | `oidc-client-ts` | `@owlmeans/web-oidc-rp`, `@owlmeans/mui-oidc-rp` | **exact** | `3.5.0` |
 
-`@types/oidc-provider` is a dev dep of `server-oidc-provider` and must track the oidc-provider major: `9.5.0` (v9 ships no bundled types).
+`@types/oidc-provider` is a dev dependency of `@owlmeans/server-oidc-provider` and must track the
+oidc-provider major: `9.5.0` (v9 ships no bundled types).
 
-All four are authored by panva or authts and follow semantic versioning. **Exact pins** are the project policy — every bump is deliberate and reviewed.
+All four are authored by panva or authts and follow semantic versioning. **Exact pins** are the
+policy — no caret, no range — so that every bump is a deliberate, reviewed change. The pinned value
+lives in each owning package's `dependencies`; nothing else may declare one of these libraries.
 
 ## Checking installed vs latest
 
@@ -43,91 +48,114 @@ Consult these before every bump — especially for same-major minors that might
 
 ## Breaking-change checklist per library
 
-### oidc-provider (v9.x — current)
-
-Migrated from v8 in this project. Key differences to keep in mind:
-
-- **Provider is a Koa app instance.** `oidc.use()` middleware registered after `api.server.use(base, oidc.callback())` is *downstream* of the Koa router — `await next()` inside such middleware does **not** run after a matched route completes. Move any post-response header manipulation (e.g. CSP rewrites) to a **Fastify `onSend` hook** scoped to the OIDC base path instead.
-- **`enableHttpPostMethods`** defaults to `false` (authorization/logout endpoints no longer accept POST by default). Set `enableHttpPostMethods: true` in the Provider config if the interaction flow POSTs.
-- **DPoP is on by default.** `features.dPoP.enabled` is `true` without explicit config. Disable if the OIDC clients don't send DPoP proofs.
-- **Cookie `sameSite` defaults to `lax`** (was `none`). Review if the interaction UI lives on a different subdomain.
-- **JWK `kid` must be unique.** No two keys in `jwks.keys` can share the same `kid`. Generate or assign a deterministic unique `kid` when building the JWKS.
-- **`provider.Account` getter removed.** Use `findAccount` callback; do not read `oidc.Account`.
-- **Node 22+ required.**
-- **ESM-only** (was already ESM in v8).
-- HTTP requests now use the **global `fetch()`** (not `got`). `httpOptions` is replaced with a `fetch` config option that mirrors the fetch API.
-- **`@types/oidc-provider`** must be `9.x` (`^9.5.0` or exact); the v8 types are incompatible.
-
-### jose (v6.x — current)
-
-Migrated from v5 in this project:
-
-- **WebCrypto is the only crypto backend.** `importPKCS8`, `importSPKI`, `importJWK`, `generateKeyPair` now return `CryptoKey` (not `KeyObject`).
-- **`extractable` must be set when you need to call `exportJWK` on an imported key.** In v5 Node `KeyObject` was always extractable. In v6 the `CryptoKey` default is `extractable: false`. The fix:
+### oidc-provider v9
+
+- **The provider is a Koa app instance**, and `Provider#use(fn)` splices `fn` **ahead of** the
+  provider's own router in the Koa chain, so such a middleware runs before routing and resumes
+  normally after `await next()`. Header corrections for an OwlMeans server nonetheless belong in a
+  middleware registered on the API server **before** `oidc.callback()`, writing to the raw response
+  where `@fastify/helmet` has already put its defaults. They must never be a Fastify `onSend` hook:
+  `oidc.callback()` ends the response outside Fastify's reply lifecycle, so `onSend` never fires for
+  a route the provider answers.
+- **`enableHttpPostMethods` is `false`.** Turning it on requires `cookies.long.sameSite: 'none'` in
+  the same configuration; otherwise the constructor throws `TypeError: HTTP POST Method support
+  requires that cookies.long.sameSite is set to none`.
+- **DPoP is on.** `features.dPoP.enabled` is `true` with no configuration. Disable it when the
+  clients send no DPoP proofs.
+- **Cookie `sameSite` is `lax`** for both `cookies.long` and `cookies.short`. Review it when the
+  interaction UI lives on a different subdomain.
+- **JWK `kid` must be unique.** No two keys in `jwks.keys` may share one.
+- **There is no `provider.Account` getter.** Accounts come from the `findAccount` callback.
+- **ESM-only**, and outbound HTTP goes through the `fetch` configuration option — a function
+  mirroring the fetch API, defaulting to `globalThis.fetch`. There is no `httpOptions`.
+- **`@types/oidc-provider` must track the major** (`9.5.0`); v9 ships no bundled types.
+
+### jose v6
+
+- **WebCrypto is the only crypto backend.** `importPKCS8`, `importSPKI` and `importX509` resolve to a
+  `CryptoKey`; `importJWK` resolves to a `CryptoKey` for every key type except `oct`, which yields a
+  `Uint8Array`. `KeyObject` survives only as an exported type.
+- **`extractable` defaults to `false` for a private key** and `true` for everything else, so an
+  imported private key cannot be exported unless the import asked for it:
   ```typescript
-  // ✅ v6 — must pass { extractable: true }
   const key = await jose.importPKCS8(pkcs8String, 'RS256', { extractable: true })
   const jwk = await jose.exportJWK(key)   // works
   ```
-- **`decodeJwt` unchanged** — still `decodeJwt(jwt): JWTPayload`.
-- **Subpath exports removed.** All exports are from the root `'jose'` entry; e.g. `'jose/jwt/verify'` no longer works.
-- **CJS `require()` requires Node's `require(esm)` support** (Node 22+, or use dynamic `import()`).
-
-### openid-client (v6.x — no migration needed from v6.1)
+- `decodeJwt(jwt): JWTPayload`.
+- Both the root entry and the subpath entries (`jose/jwt/verify`, `jose/key/import`, `jose/errors`, …)
+  are exported. Prefer the root entry — an `import * as jose from 'jose'` is what the OwlMeans
+  packages use, and a subpath import buys nothing under a bundler.
+- **CJS `require()` needs Node's `require(esm)` support**; use dynamic `import()` otherwise.
 
-v6 introduced a **functional API** (replacing the class-based v5 API). OwlMeans already targets v6 (migrated earlier). Key API surface used:
+### openid-client v6
 
-- `client.discovery(issuerUrl, clientId, secret, authMethod, options)` — returns a `Configuration` object.
-- `client.buildAuthorizationUrl(config, params)` — returns a `URL`.
-- `client.authorizationCodeGrant(config, url, checks)` — returns `TokenEndpointResponse`.
-- `client.clientCredentialsGrant(config)` / `client.refreshTokenGrant(config, refreshToken)`.
-- `client.tokenIntrospection(config, token)`.
-- `client.allowInsecureRequests` — passed in the `execute` array option of `discovery` when behind HTTP (dev/internal).
+A functional API — there is no client class. The surface OwlMeans uses:
 
-Breaking changes within v6.x are documented in the CHANGELOG; check before bumping patch/minor versions.
+- `discovery(issuerUrl, clientId, metadata?, clientAuthentication?, options?)` → `Configuration`.
+  `metadata` accepts the client secret as a bare string. `clientAuthentication` is a `ClientAuth`
+  function (`ClientSecretPost(secret)`, `ClientSecretBasic(secret)`, …) and defaults to
+  `ClientSecretPost` when a secret is present — passing `undefined` takes that default.
+- `buildAuthorizationUrl(config, params)` → `URL`.
+- `authorizationCodeGrant(config, url, checks)` → `TokenEndpointResponse`.
+- `clientCredentialsGrant(config)` / `refreshTokenGrant(config, refreshToken)`.
+- `tokenIntrospection(config, token)`.
+- `allowInsecureRequests` — passed inside the `execute` array of `discovery`'s options to permit
+  plain HTTP for an internal or development issuer.
 
-### oidc-client-ts (v3.x — no migration from v3.1)
+### oidc-client-ts v3
 
-Current pin is `3.5.0`. OwlMeans only uses `UserManager` (browser-side, currently a stub). Check the CHANGELOG for breaking changes to `UserManager` constructor or `signinRedirect` between minor versions.
+Only `UserManager` is referenced, in the incomplete fully-browser-side path; the production flow is a
+server-side token exchange. Check the CHANGELOG for changes to the `UserManager` constructor or
+`signinRedirect` before bumping a minor.
 
 ## OwlMeans isolation principle
 
-**No upstream OIDC library type may appear in a package's public `index.ts` exports.** Define OwlMeans-owned interfaces and map at the service boundary.
-
-Canonical example — `@owlmeans/server-oidc-rp` public types:
-- `OidcTokenSet` — OwlMeans-owned shape for `access_token`, `refresh_token`, `id_token`, etc.
-- `OidcGrantChecks` — owned shape for PKCE checks.
-- `OidcServerMetadata` — owned shape for issuer/endpoint metadata.
-- `OidcIntrospectionResponse` — owned shape for token introspection.
-- `OidcClientDescriptor` — **opaque branded type** (consumers receive and pass it back; never read its internal structure).
-
-The implementation in `src/service.ts` imports and uses the upstream types internally, mapping to/from the owned types at method boundaries. This means a future library swap is confined to a single file.
+**No upstream OIDC library NAME may appear in a package's public `index.ts` exports.** Declare
+OwlMeans-owned types and map at the service boundary, so a consumer never imports from
+`openid-client` or `oidc-provider` to type a variable this stack handed it.
+
+The public types of `@owlmeans/server-oidc-rp` are the canonical example:
+
+- `OidcTokenSet` / `OidcTokenSetParameters` — declared shapes for `access_token`, `refresh_token`,
+  `id_token`, `token_type`, `expires_in`, `scope`, with and without the `claims()` helper.
+- `OidcGrantChecks` — the declared shape for PKCE checks.
+- `OidcIntrospectionResponse` — the declared shape for token introspection.
+- `OidcServerMetadata` and `OidcClientDescriptor` — deliberate aliases onto the upstream metadata and
+  configuration objects, exported under owned names. `OidcClientDescriptor` is **opaque**: consumers
+  receive it and pass it back, and never read its internals.
+
+What the principle guarantees is the **exported name**: a consumer types every value this stack hands
+it without importing `openid-client` or `oidc-provider`. It does not confine upstream imports to one
+file, and reading it that way misleads. In `@owlmeans/server-oidc-rp` the type module imports
+`Configuration`, `ServerMetadata`, `TokenEndpointResponse` and `TokenEndpointResponseHelpers` from
+`openid-client` in order to alias them under the owned names; the service module imports the
+functional API; and `jose`'s `decodeJwt` is imported directly by the token wrapper, the `oidc-client`
+auth plugin and the exchange handler. A library swap touches each of those — the owned names are what
+keep it from reaching any consumer.
 
 See [[server-oidc-rp]] for the full public surface.
 
 ## Performing a bump
 
-1. **Read the CHANGELOG** for the target version (link above). Enumerate every breaking change against the checklist above.
+1. **Read the CHANGELOG** for the target version (link above). Enumerate every breaking change
+   against the checklist above.
 2. Update the version string in **each owning package's `package.json`** — exact pins only, no caret.
-3. Update `@types/oidc-provider` if bumping `oidc-provider` across a major.
-4. **Run `bun install`** in the monorepo root to update the lockfile.
-5. **Fix any code changes** using the checklist (particularly the `extractable` gotcha for jose and the CSP/debug middleware placement for oidc-provider).
-6. Build affected packages: `bun run build` (or `tsc -b`) per package.
-7. Run unit tests: `bun test ./tests` per package.
+3. Update `@types/oidc-provider` when bumping `oidc-provider` across a major.
+4. Reinstall so the lockfile is regenerated.
+5. **Fix the code** using the checklist — particularly the jose `extractable` argument and the
+   placement of the header-correcting middleware for oidc-provider.
+6. Build every affected package, then run its unit tests.
 
 ## Downstream verification
 
-Downstream repos that link `@owlmeans/*` packages as local workspace entries (bun hoisted linker) pick up the rebuilt outputs automatically. After rebuilding the affected packages, verify each downstream:
-
-```bash
-# per repo: viable, viable-agent, internal
-cd <your-project-root>
-bun install           # refresh transitive third-party versions
-bun run build         # or per-workspace build command
-bun test              # or per-workspace test command
-```
+A project that links these packages as local workspace entries picks up the rebuilt outputs
+automatically, but its own transitive copies of the four libraries do not move on their own. After
+rebuilding, in every consuming project: reinstall, build, and run the tests.
 
-Check `overrides` in each repo's root `package.json` — remove stale pins of oidc-provider/jose/openid-client/oidc-client-ts if present.
+Then check `overrides` (or the equivalent resolution field) in each consuming project's root
+manifest and remove any stale pin of `oidc-provider`, `jose`, `openid-client` or `oidc-client-ts` —
+an override outranks the exact pin the owning package declares, so a forgotten one silently keeps the
+old version installed.
 
 ## Cross-references
 

package/build/entrypoints.d.ts

@@ -0,0 +1,10 @@
+/** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
+export declare const oidcProtocols: {
+    init: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: import("./types.js").OIDCAuthInitParams;
+    }, any>;
+    authenticate: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: import("./types.js").OIDCClientAuthPayload;
+    }, any>;
+};
+//# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAKA,oFAAoF;AACpF,eAAO,MAAM,aAAa;IACxB,IAAI;;;IAIJ,YAAY;;;CAIb,CAAA"}

package/build/entrypoints.js

@@ -0,0 +1,10 @@
+import { contract, protocol, typed } from '@owlmeans/entrypoint';
+import { route, RouteMethod, backend } from '@owlmeans/route';
+import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from './consts.js';
+import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema } from './models.js';
+/** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
+export const oidcProtocols = {
+    init: protocol(route(DISPATCHER_OIDC_INIT, '/authenticate/oidc/init', backend(null, RouteMethod.POST)), contract.request({ body: typed(OIDCAuthInitParamsSchema) }, typed())),
+    authenticate: protocol(route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)), contract.request({ body: typed(OIDCClientAuthPayloadSchema) }, typed())),
+};
+//# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAEnF,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,QAAQ,CACZ,KAAK,CAAC,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,CAC1E;IACD,YAAY,EAAE,QAAQ,CACpB,KAAK,CAAC,eAAe,EAAE,4BAA4B,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,CAC7E;CACF,CAAA"}

package/build/guard.d.ts

@@ -1,6 +1,13 @@
 import type { Config, Context, OidcGuard, OidcGuardOptions } from './types.js';
-import type { CommonEntrypoint } from '@owlmeans/entrypoint';
+import type { EntrypointTree } from '@owlmeans/entrypoint';
 export declare const makeOidcGuard: (opts?: OidcGuardOptions) => OidcGuard;
 export declare const appendOidcGuard: <C extends Config, T extends Context<C>>(context: T, opts?: OidcGuardOptions) => T;
-export declare const setupOidcGuard: (modules: CommonEntrypoint[], coguards?: string | string[]) => void;
+/**
+ * Decorate an immutable protocol tree so the OIDC guard runs before each selected auth guard.
+ *
+ * The tree's shape and protocol types are preserved; only declarations that explicitly carry a
+ * selected guard are cloned. Parent inheritance then carries OIDC to their children exactly as
+ * the route model does for every other guard.
+ */
+export declare const withOidcGuard: <Tree extends EntrypointTree>(tree: Tree, coguards?: string | readonly string[]) => Tree;
 //# sourceMappingURL=guard.d.ts.map

package/build/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAA;AAElG,OAAO,KAAK,EAAqC,gBAAgB,EAAgB,MAAM,sBAAsB,CAAA;AAS7G,eAAO,MAAM,aAAa,UAAW,gBAAgB,KAAG,SA4FvD,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED,eAAO,MAAM,cAAc,YAAa,gBAAgB,EAAE,aAAa,MAAM,GAAG,MAAM,EAAE,SAUvF,CAAA"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAA;AAGlG,OAAO,KAAK,EAAqC,cAAc,EAAgB,MAAM,sBAAsB,CAAA;AAQ3G,eAAO,MAAM,aAAa,UAAW,gBAAgB,KAAG,SAqGvD,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,SAAS,cAAc,QACjD,IAAI,aAAa,MAAM,GAAG,SAAS,MAAM,EAAE,KAChD,IAcF,CAAA"}

package/build/guard.js

@@ -1,12 +1,12 @@
 import { createService } from '@owlmeans/context';
 import { OIDC_GUARD, OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from './consts.js';
+import { decorateEntrypoint, isEntrypointProtocol } from '@owlmeans/entrypoint';
 import { DEFAULT_GUARD, TOKEN_UPDATE } from '@owlmeans/auth-common';
 import { AUTH_HEADER, AuthorizationError } from '@owlmeans/auth';
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
 import { trust } from '@owlmeans/auth-common/utils';
 import { TRUSTED } from '@owlmeans/config';
 import { extractAuthToken } from '@owlmeans/auth-common/utils';
-import { modules as oidcModules } from './modules.js';
 export const makeOidcGuard = (opts) => {
     // const cache = (context: Context) => context.hasResource(opts?.cache ?? OIDC_GUARD_CACHE)
     //   ? context.resource<Resource<ResourceRecord>>(opts?.cache ?? OIDC_GUARD_CACHE)
@@ -47,9 +47,19 @@ export const makeOidcGuard = (opts) => {
                 return false;
             }
             const ctx = guard.assertCtx();
-            const envelope = makeEnvelopeModel(authorization, EnvelopeKind.Token);
             const trusted = await trust(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service);
-            if (!await envelope.verify(trusted.key)) {
+            // A token that cannot even be decoded is a credential this server does not accept — the
+            // same answer as one whose signature does not verify (401), never a server failure (500).
+            let envelope;
+            let verified = false;
+            try {
+                envelope = makeEnvelopeModel(authorization, EnvelopeKind.Token);
+                verified = await envelope.verify(trusted.key);
+            }
+            catch {
+                verified = false;
+            }
+            if (!verified) {
                 return false;
             }
             const token = extractAuthToken(req, OIDC_WRAPPED_TOKEN, false);
@@ -86,15 +96,24 @@ export const appendOidcGuard = (context, opts) => {
     context.registerService(makeOidcGuard(opts));
     return context;
 };
-export const setupOidcGuard = (modules, coguards) => {
-    modules.push(...oidcModules);
-    coguards = Array.isArray(coguards) ? coguards : [coguards ?? DEFAULT_GUARD];
-    modules.forEach(module => {
-        if (module.guards != null && !module.guards.includes(OIDC_GUARD)
-            && module.guards.some(guard => coguards.includes(guard))) {
-            module.guards.unshift(OIDC_GUARD);
+/**
+ * Decorate an immutable protocol tree so the OIDC guard runs before each selected auth guard.
+ *
+ * The tree's shape and protocol types are preserved; only declarations that explicitly carry a
+ * selected guard are cloned. Parent inheritance then carries OIDC to their children exactly as
+ * the route model does for every other guard.
+ */
+export const withOidcGuard = (tree, coguards) => {
+    const selected = new Set(Array.isArray(coguards) ? coguards : [coguards ?? DEFAULT_GUARD]);
+    const decorate = (node) => Object.fromEntries(Object.entries(node).map(([key, value]) => {
+        if (!isEntrypointProtocol(value))
+            return [key, decorate(value)];
+        if (value.guards.includes(OIDC_GUARD) || !value.guards.some(guard => selected.has(guard))) {
+            return [key, value];
         }
-    });
+        return [key, decorateEntrypoint(value, { guards: [OIDC_GUARD, ...value.guards] })];
+    }));
+    return decorate(tree);
 };
 const wrapper = (context) => context.hasService(WRAPPED_OIDC)
     ? context.service(WRAPPED_OIDC)

package/build/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAwB,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAA;AAErD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAa,EAAE;IAClE,2FAA2F;IAC3F,kFAAkF;IAClF,WAAW;IAEX,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,aAAa,CAAC,CAAA;IAEnG,MAAM,KAAK,GAAc,aAAa,CAAY,UAAU,EAAE;QAC5D,cAAc;QAEd,gBAAgB;QAChB,mDAAmD;QACnD,oCAAoC;QACpC,uBAAuB;QACvB,MAAM;QAEN,0DAA0D;QAC1D,6DAA6D;QAC7D,6BAA6B;QAC7B,oDAAoD;QACpD,sBAAsB;QACtB,KAAK;QAEL,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,qDAAqD;YACrD,yEAAyE;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAe,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,IAAI,KAAK,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,cAAc;QACd,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAI;QAErE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/D,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAE5F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAE,CAAA;YAE/D,IAAI,OAAO,GAAqB,IAAI,CAAA;YAEpC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;oBACpC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;oBAC7C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;gBACrD,CAAC;gBAED,MAAM,CAAC,CAAA;YACT,CAAC;YAED,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAErE,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;gBACxD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;gBAE9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAA2B,EAAE,QAA4B,EAAE,EAAE;IAC1F,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;IAC5B,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAA;IAE3E,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACvB,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;eAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACnC,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAsB,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,KAAK,EAAwB,CAAA"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE/E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAwB,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAa,EAAE;IAClE,2FAA2F;IAC3F,kFAAkF;IAClF,WAAW;IAEX,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,aAAa,CAAC,CAAA;IAEnG,MAAM,KAAK,GAAc,aAAa,CAAY,UAAU,EAAE;QAC5D,cAAc;QAEd,gBAAgB;QAChB,mDAAmD;QACnD,oCAAoC;QACpC,uBAAuB;QACvB,MAAM;QAEN,0DAA0D;QAC1D,6DAA6D;QAC7D,6BAA6B;QAC7B,oDAAoD;QACpD,sBAAsB;QACtB,KAAK;QAEL,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,qDAAqD;YACrD,yEAAyE;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAe,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,IAAI,KAAK,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,cAAc;QACd,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAI;QAErE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/D,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAE5F,wFAAwF;YACxF,0FAA0F;YAC1F,IAAI,QAAoD,CAAA;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,IAAI,CAAC;gBACH,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBACrE,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,KAAK,CAAA;YAClB,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAE,CAAA;YAE/D,IAAI,OAAO,GAAqB,IAAI,CAAA;YAEpC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;oBACpC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;oBAC7C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;gBACrD,CAAC;gBAED,MAAM,CAAC,CAAA;YACT,CAAC;YAED,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAErE,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;gBACxD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;gBAE9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,QAAS,CAAC,OAAO,EAAE,CAAC,CAAA;YAClC,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAU,EAAE,QAAqC,EAC3C,EAAE;IACR,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAA;IAC1F,MAAM,QAAQ,GAAG,CAAC,IAAoB,EAAkB,EAAE,CAAC,MAAM,CAAC,WAAW,CAC3E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/D,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC,CAAC,CACH,CAAA;IAED,OAAO,QAAQ,CAAC,IAAI,CAAS,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAsB,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,KAAK,EAAwB,CAAA"}

package/build/index.d.ts

@@ -1,7 +1,7 @@
 export type * from './types.js';
 export * from './consts.js';
 export * from './guard.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './models.js';
 export type * from './iam.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,mBAAmB,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,mBAAmB,UAAU,CAAA"}

package/build/index.js

@@ -1,5 +1,5 @@
 export * from './consts.js';
 export * from './guard.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './models.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA"}

package/build/types.d.ts

@@ -39,6 +39,26 @@ export interface OidcProviderDescriptor {
     userinfoEndpoint?: string;
     idOverride?: string;
     def?: boolean;
+    /**
+     * Require a live authorization-server decision before accepting a wrapped
+     * session. `required` is for applications whose provider is their authority
+     * for account disablement and permission changes.
+     */
+    sessionValidation?: 'required' | 'optional';
+    /**
+     * How this provider presents itself on the sign-in screen.
+     *
+     * A provider list is configuration, so the only place its human-readable name can come from is
+     * the configuration itself — the client never talks to the issuer directly and has no discovery
+     * document to read a name out of.
+     */
+    label?: string;
+    /** Icon registry NAME, never markup — this package must stay free of an icon library. */
+    icon?: string;
+    /** Ascending. Absent means "after the default one". */
+    order?: number;
+    /** Registered, but never offered as a choice. */
+    hidden?: boolean;
 }
 export interface WithSharedConfig {
     oidc: OidcSharedConfig;

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,MAAM,WAAW,MAAO,SAAQ,WAAW;CAAI;AAC/C,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,YAAY,CAAC,CAAC,CAAC;CAAI;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE;YACZ,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAC;IACF,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAChC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAEhE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED,MAAM,WAAW,SAAU,SAAQ,YAAY;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAGD,MAAM,WAAW,qBAAsB,SAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;CAC/D;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,EAAE,oBAAoB,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAqB,SAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACvF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAGD,MAAM,WAAW,sBAAuB,SAAQ,OAAO,CAAC,eAAe,CAAC;IACtE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IASZ,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,OAAO,CAAA;CAC7B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,MAAM,WAAW,MAAO,SAAQ,WAAW;CAAI;AAC/C,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,YAAY,CAAC,CAAC,CAAC;CAAI;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE;YACZ,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAC;IACF,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAChC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAEhE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,GAAG,CAAC,EAAE,OAAO,CAAA;IACb;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,UAAU,GAAG,UAAU,CAAA;IAC3C;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iDAAiD;IACjD,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED,MAAM,WAAW,SAAU,SAAQ,YAAY;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAGD,MAAM,WAAW,qBAAsB,SAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;CAC/D;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,EAAE,oBAAoB,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAqB,SAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACvF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAGD,MAAM,WAAW,sBAAuB,SAAQ,OAAO,CAAC,eAAe,CAAC;IACtE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IASZ,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,OAAO,CAAA;CAC7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/oidc",
-  "version": "0.1.18-rc.5",
+  "version": "0.1.18-rc.50",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,14 +21,14 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.5",
-    "@owlmeans/auth-common": "^0.1.18-rc.5",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.5",
-    "@owlmeans/config": "^0.1.18-rc.5",
-    "@owlmeans/context": "^0.1.18-rc.5",
-    "@owlmeans/entrypoint": "^0.1.18-rc.5",
-    "@owlmeans/resource": "^0.1.18-rc.5",
-    "@owlmeans/route": "^0.1.18-rc.5"
+    "@owlmeans/auth": "^0.1.18-rc.36",
+    "@owlmeans/auth-common": "^0.1.18-rc.42",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.41",
+    "@owlmeans/config": "^0.1.18-rc.39",
+    "@owlmeans/context": "^0.1.18-rc.32",
+    "@owlmeans/entrypoint": "^0.1.18-rc.37",
+    "@owlmeans/resource": "^0.1.18-rc.37",
+    "@owlmeans/route": "^0.1.18-rc.33"
   },
   "peerDependencies": {
     "ajv": "*"

package/src/{modules.ts → entrypoints.ts}

@@ -1,16 +1,16 @@
-import { body, filter, entrypoint } from '@owlmeans/entrypoint'
+import { contract, protocol, typed } from '@owlmeans/entrypoint'
 import { route, RouteMethod, backend } from '@owlmeans/route'
 import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from './consts.js'
 import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema } from './models.js'
 
-export const modules = [
-  entrypoint(
+/** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
+export const oidcProtocols = {
+  init: protocol(
     route(DISPATCHER_OIDC_INIT, '/authenticate/oidc/init', backend(null, RouteMethod.POST)),
-    filter(body(OIDCAuthInitParamsSchema))
-
+    contract.request({ body: typed(OIDCAuthInitParamsSchema) }, typed<any>()),
   ),
-  entrypoint(
+  authenticate: protocol(
     route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)),
-    filter(body(OIDCClientAuthPayloadSchema))
-  )
-]
+    contract.request({ body: typed(OIDCClientAuthPayloadSchema) }, typed<any>()),
+  ),
+}

package/src/guard.ts

@@ -1,14 +1,14 @@
 import { createService } from '@owlmeans/context'
 import type { Config, Context, OidcGuard, OidcGuardOptions, WrappedOIDCService } from './types.js'
 import { OIDC_GUARD, OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from './consts.js'
-import type { AbstractRequest, AbstractResponse, CommonEntrypoint, GuardService } from '@owlmeans/entrypoint'
+import { decorateEntrypoint, isEntrypointProtocol } from '@owlmeans/entrypoint'
+import type { AbstractRequest, AbstractResponse, EntrypointTree, GuardService } from '@owlmeans/entrypoint'
 import { DEFAULT_GUARD, TOKEN_UPDATE } from '@owlmeans/auth-common'
 import { AUTH_HEADER, type Auth, AuthToken, AuthorizationError } from '@owlmeans/auth'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
 import { trust } from '@owlmeans/auth-common/utils'
 import { TRUSTED } from '@owlmeans/config'
 import { extractAuthToken } from '@owlmeans/auth-common/utils'
-import { modules as oidcModules } from './modules.js'
 
 export const makeOidcGuard = (opts?: OidcGuardOptions): OidcGuard => {
   // const cache = (context: Context) => context.hasResource(opts?.cache ?? OIDC_GUARD_CACHE)
@@ -59,10 +59,19 @@ export const makeOidcGuard = (opts?: OidcGuardOptions): OidcGuard => {
       }
 
       const ctx = guard.assertCtx()
-      const envelope = makeEnvelopeModel<Auth>(authorization, EnvelopeKind.Token)
       const trusted = await trust<Config, Context>(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service)
 
-      if (!await envelope.verify(trusted.key)) {
+      // A token that cannot even be decoded is a credential this server does not accept — the
+      // same answer as one whose signature does not verify (401), never a server failure (500).
+      let envelope: ReturnType<typeof makeEnvelopeModel<Auth>>
+      let verified = false
+      try {
+        envelope = makeEnvelopeModel<Auth>(authorization, EnvelopeKind.Token)
+        verified = await envelope.verify(trusted.key)
+      } catch {
+        verified = false
+      }
+      if (!verified) {
         return false as T
       }
 
@@ -94,7 +103,7 @@ export const makeOidcGuard = (opts?: OidcGuardOptions): OidcGuard => {
 
         res.resolve(envelope.message())
       } else {
-        res.resolve(envelope.message())
+        res.resolve(envelope!.message())
       }
 
       return true as T
@@ -112,16 +121,29 @@ export const appendOidcGuard = <C extends Config, T extends Context<C>>(
   return context
 }
 
-export const setupOidcGuard = (modules: CommonEntrypoint[], coguards?: string | string[]) => {
-  modules.push(...oidcModules)
-  coguards = Array.isArray(coguards) ? coguards : [coguards ?? DEFAULT_GUARD]
+/**
+ * Decorate an immutable protocol tree so the OIDC guard runs before each selected auth guard.
+ *
+ * The tree's shape and protocol types are preserved; only declarations that explicitly carry a
+ * selected guard are cloned. Parent inheritance then carries OIDC to their children exactly as
+ * the route model does for every other guard.
+ */
+export const withOidcGuard = <Tree extends EntrypointTree>(
+  tree: Tree, coguards?: string | readonly string[],
+): Tree => {
+  const selected = new Set(Array.isArray(coguards) ? coguards : [coguards ?? DEFAULT_GUARD])
+  const decorate = (node: EntrypointTree): EntrypointTree => Object.fromEntries(
+    Object.entries(node).map(([key, value]) => {
+      if (!isEntrypointProtocol(value)) return [key, decorate(value)]
+      if (value.guards.includes(OIDC_GUARD) || !value.guards.some(guard => selected.has(guard))) {
+        return [key, value]
+      }
 
-  modules.forEach(module => {
-    if (module.guards != null && !module.guards.includes(OIDC_GUARD)
-      && module.guards.some(guard => coguards.includes(guard))) {
-      module.guards.unshift(OIDC_GUARD)
-    }
-  })
+      return [key, decorateEntrypoint(value, { guards: [OIDC_GUARD, ...value.guards] })]
+    }),
+  )
+
+  return decorate(tree) as Tree
 }
 
 const wrapper = (context: Context): WrappedOIDCService =>

package/src/index.ts

@@ -1,6 +1,6 @@
 export type * from './types.js'
 export * from './consts.js'
 export * from './guard.js'
-export * from './modules.js'
+export * from './entrypoints.js'
 export * from './models.js'
 export type * from './iam.js'

package/src/types.ts

@@ -45,6 +45,26 @@ export interface OidcProviderDescriptor {
   idOverride?: string
   // This flag works only on client side. It specifies a default relying party
   def?: boolean
+  /**
+   * Require a live authorization-server decision before accepting a wrapped
+   * session. `required` is for applications whose provider is their authority
+   * for account disablement and permission changes.
+   */
+  sessionValidation?: 'required' | 'optional'
+  /**
+   * How this provider presents itself on the sign-in screen.
+   *
+   * A provider list is configuration, so the only place its human-readable name can come from is
+   * the configuration itself — the client never talks to the issuer directly and has no discovery
+   * document to read a name out of.
+   */
+  label?: string
+  /** Icon registry NAME, never markup — this package must stay free of an icon library. */
+  icon?: string
+  /** Ascending. Absent means "after the default one". */
+  order?: number
+  /** Registered, but never offered as a choice. */
+  hidden?: boolean
 }
 
 

package/tests/guard.spec.ts

@@ -0,0 +1,35 @@
+import { describe, expect, mock, test } from 'bun:test'
+
+/**
+ * A bearer that cannot be decoded is a credential the server does not accept — the guard answers
+ * "not authenticated" (the API layer's 401), exactly as for a signature that does not verify, and
+ * never throws the decoder's own error (which the API layer answers with 500).
+ */
+mock.module('@owlmeans/auth-common/utils', () => ({
+  trust: async () => ({ key: { verify: async () => false } }),
+  extractAuthToken: (req: { headers: Record<string, string> }, type: string, strip = true) => {
+    const header = req.headers.authorization
+    if (header == null || !header.toUpperCase().startsWith(type.toUpperCase())) return null
+    return strip ? header.split(' ')[1] : header
+  },
+}))
+
+const { makeOidcGuard } = await import('../src/guard.js')
+
+const call = async (authorization: string) => {
+  const guard = makeOidcGuard() as any
+  guard.assertCtx = () => ({ cfg: { alias: 'app' } })
+  const res = { responseProvider: { header: () => undefined } }
+  return await guard.handle({ headers: { authorization } }, res)
+}
+
+describe('oidc guard', () => {
+  test('an undecodable wrapped token is unauthenticated, not a server error', async () => {
+    expect(await call('OIDC-WRAPPED-TOKEN bogus.token')).toBe(false)
+  })
+
+  test('garbage of every shape stays unauthenticated', async () => {
+    expect(await call('OIDC-WRAPPED-TOKEN %%%')).toBe(false)
+    expect(await call('OIDC-WRAPPED-TOKEN ')).toBe(false)
+  })
+})

package/tsconfig.json

@@ -10,6 +10,7 @@
   "exclude": [
     "./dist/**/*",
     "./build/**/*",
+    "./tests/**/*",
     "./*.ts"
   ]
 }

package/build/modules.d.ts

@@ -1,2 +0,0 @@
-export declare const modules: import("@owlmeans/entrypoint").CommonEntrypoint[];
-//# sourceMappingURL=modules.d.ts.map

package/build/modules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,OAAO,mDAUnB,CAAA"}

package/build/modules.js

@@ -1,9 +0,0 @@
-import { body, filter, entrypoint } from '@owlmeans/entrypoint';
-import { route, RouteMethod, backend } from '@owlmeans/route';
-import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from './consts.js';
-import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema } from './models.js';
-export const modules = [
-    entrypoint(route(DISPATCHER_OIDC_INIT, '/authenticate/oidc/init', backend(null, RouteMethod.POST)), filter(body(OIDCAuthInitParamsSchema))),
-    entrypoint(route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)), filter(body(OIDCClientAuthPayloadSchema)))
-];
-//# sourceMappingURL=modules.js.map

package/build/modules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAEnF,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,UAAU,CACR,KAAK,CAAC,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACvF,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAEvC;IACD,UAAU,CACR,KAAK,CAAC,eAAe,EAAE,4BAA4B,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACrF,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAC1C;CACF,CAAA"}