@owlmeans/server-oidc-provider 0.1.18-rc.48 → 0.1.18-rc.49

package/README.md

@@ -14,7 +14,7 @@ Embedded OIDC identity provider — wraps the `oidc-provider` library as an OwlM
 ## Installation
 
 ```bash
-bun add @owlmeans/server-oidc-provider@^0.1.18-rc.48
+bun add @owlmeans/server-oidc-provider@^0.1.18-rc.49
 ```
 
 ## Usage
@@ -72,7 +72,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.47
+npx @owlmeans/agent-skills@^0.1.18-rc.48
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.48",
-  "generatedAt": "2026-10-03T20:05:07.604Z",
+  "version": "0.1.18-rc.49",
+  "generatedAt": "2026-10-05T08:32:19.130Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-oidc-provider/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-oidc-provider
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.48"` in `dependencies`
+**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.49"` in `dependencies`
 **Runtime deps:** `oidc-provider@9.11.1` (exact), `jose@6.2.5` (exact), `@types/oidc-provider@9.5.0`
 
 Use this only when your service **is** the identity provider. For consuming someone else's issuer,

package/build/iam.d.ts

@@ -1,31 +1,4 @@
-import type { ClientMetadata } from 'oidc-provider';
-/** A registered OIDC client stored in the provider's Client adapter. */
-export interface OidcRegisteredClient {
-    clientId: string;
-    secret: string;
-    /** The entity (realm) this client belongs to — used for identity scoping. */
-    entityId?: string;
-    /** Application display name */
-    name?: string;
-    redirectUris?: string[];
-    grantTypes?: string[];
-    responseTypes?: string[];
-    scope?: string;
-}
-/** Full oidc-provider ClientMetadata with our entity extension. */
-export type OidcClientMetadata = ClientMetadata & {
-    entityId?: string;
-    owlEntityId?: string;
-};
+import type { OidcClientMetadata, OidcRegisteredClient } from './types.js';
 /** Convert an OidcRegisteredClient to the oidc-provider ClientMetadata shape. */
 export declare const toClientMetadata: (client: OidcRegisteredClient) => OidcClientMetadata;
-/** Extension seam for IAM integration into the OIDC provider — Phase 2 fills this */
-export interface OidcProviderIamExtension {
-    /** Convert a stored client record to oidc-provider ClientMetadata */
-    toClientMetadata: typeof toClientMetadata;
-    /** Type of a stored client record */
-    OidcRegisteredClient: OidcRegisteredClient;
-    /** Extended metadata type */
-    OidcClientMetadata: OidcClientMetadata;
-}
 //# sourceMappingURL=iam.d.ts.map

package/build/iam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,eAAe,CAAA;AAEjE,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7F,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,WAAY,oBAAoB,KAAG,kBAS9D,CAAA;AAEF,qFAAqF;AACrF,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,gBAAgB,EAAE,OAAO,gBAAgB,CAAA;IACzC,qCAAqC;IACrC,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,6BAA6B;IAC7B,kBAAkB,EAAE,kBAAkB,CAAA;CACvC"}
+{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE1E,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,WAAY,oBAAoB,KAAG,kBAS9D,CAAA"}

package/build/iam.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam.js","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAmBA,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAA4B,EAAsB,EAAE,CAAC,CAAC;IACrF,SAAS,EAAE,MAAM,CAAC,QAAQ;IAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;IAC5B,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACzE,cAAc,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,CAAmB;IACpE,0BAA0B,EAAE,qBAAqB;IACjD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,+BAA+B;IACtD,WAAW,EAAE,MAAM,CAAC,QAAQ;CAC7B,CAAC,CAAA"}
+{"version":3,"file":"iam.js","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAGA,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAA4B,EAAsB,EAAE,CAAC,CAAC;IACrF,SAAS,EAAE,MAAM,CAAC,QAAQ;IAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;IAC5B,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACzE,cAAc,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,CAAmB;IACpE,0BAA0B,EAAE,qBAAqB;IACjD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,+BAA+B;IACtD,WAAW,EAAE,MAAM,CAAC,QAAQ;CAC7B,CAAC,CAAA"}

package/build/types.d.ts

@@ -3,6 +3,7 @@ import type { OidcSharedConfig } from '@owlmeans/oidc';
 import type { ApiServer, ApiServerAppend } from '@owlmeans/server-api';
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context';
 import type { Account, Adapter, ClientMetadata, Configuration, Interaction, Provider } from 'oidc-provider';
+import { toClientMetadata } from './iam.js';
 export interface OidcProviderService extends InitializedService {
     oidc: Provider;
     update: (api: ApiServer) => Promise<void>;
@@ -64,4 +65,31 @@ export interface Config extends ServerConfig, OidcConfigAppend {
 }
 export interface Context<C extends Config = Config> extends ServerContext<C>, ApiServerAppend {
 }
+/** A registered OIDC client stored in the provider's Client adapter. */
+export interface OidcRegisteredClient {
+    clientId: string;
+    secret: string;
+    /** The entity (realm) this client belongs to — used for identity scoping. */
+    entityId?: string;
+    /** Application display name */
+    name?: string;
+    redirectUris?: string[];
+    grantTypes?: string[];
+    responseTypes?: string[];
+    scope?: string;
+}
+/** Full oidc-provider ClientMetadata with our entity extension. */
+export type OidcClientMetadata = ClientMetadata & {
+    entityId?: string;
+    owlEntityId?: string;
+};
+/** Extension seam for IAM integration into the OIDC provider — Phase 2 fills this */
+export interface OidcProviderIamExtension {
+    /** Convert a stored client record to oidc-provider ClientMetadata */
+    toClientMetadata: typeof toClientMetadata;
+    /** Type of a stored client record */
+    OidcRegisteredClient: OidcRegisteredClient;
+    /** Extended metadata type */
+    OidcClientMetadata: OidcClientMetadata;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE3G,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,IAAI,EAAE,QAAQ,CAAA;IAEd,MAAM,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC,QAAQ,EAAE,MAAM,QAAQ,CAAA;IAExB,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,IAAI,EAAE,UAAU,GAAG,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,mBAAmB,CAAC,EAAE,uBAAuB,CAAA;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE;QACX,KAAK,EAAE;YACL,EAAE,EAAE,MAAM,CAAA;YACV,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAA;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,2BAA2B,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAA;CACpF;AAED,MAAM,WAAW,iBAAiB;IAChC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;CACnI;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,MAAO,SAAQ,YAAY,EAAE,gBAAgB;IAC5D,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;QAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,UAAU,CAAC,EAAE,OAAO,CAAA;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACxE,eAAe;CAAI"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,IAAI,EAAE,QAAQ,CAAA;IAEd,MAAM,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC,QAAQ,EAAE,MAAM,QAAQ,CAAA;IAExB,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,IAAI,EAAE,UAAU,GAAG,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,mBAAmB,CAAC,EAAE,uBAAuB,CAAA;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE;QACX,KAAK,EAAE;YACL,EAAE,EAAE,MAAM,CAAA;YACV,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAA;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,2BAA2B,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAA;CACpF;AAED,MAAM,WAAW,iBAAiB;IAChC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;CACnI;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,MAAO,SAAQ,YAAY,EAAE,gBAAgB;IAC5D,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;QAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,UAAU,CAAC,EAAE,OAAO,CAAA;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACxE,eAAe;CAAI;AAEvB,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7F,qFAAqF;AACrF,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,gBAAgB,EAAE,OAAO,gBAAgB,CAAA;IACzC,qCAAqC;IACrC,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,6BAA6B;IAC7B,kBAAkB,EAAE,kBAAkB,CAAA;CACvC"}

package/build/utils/client.js

@@ -1,4 +1,4 @@
-import { randomBytes } from '@noble/hashes/utils';
+import { randomBytes } from '@noble/hashes/utils.js';
 import { hex } from '@scure/base';
 import { makeSecurityHelper } from '@owlmeans/config';
 import { SEP } from '@owlmeans/route';

package/build/utils/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAkB,EAAE;IACvF,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAClD,+CAA+C;QAC/C,GAAG,CAAC,IAAI,CAAC,uFAAuF,EAAE;YAChG,QAAQ,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACjE,MAAM,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAEzF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAE,EAAE,CAAC,CAAC,GAAW,EAAU,EAAE;IAClG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAkB,EAAE;IACvF,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAClD,+CAA+C;QAC/C,GAAG,CAAC,IAAI,CAAC,uFAAuF,EAAE;YAChG,QAAQ,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACjE,MAAM,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAEzF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAE,EAAE,CAAC,CAAC,GAAW,EAAU,EAAE;IAClG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}

package/build/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAMnE,eAAO,MAAM,aAAa,YAAmB,OAAO,aAAa,OAAO,KAAG,OAAO,CAAC,uBAAuB,CAiDzG,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAUnE,eAAO,MAAM,aAAa,YAAmB,OAAO,aAAa,OAAO,KAAG,OAAO,CAAC,uBAAuB,CAiDzG,CAAA"}

package/build/utils/config.js

@@ -2,6 +2,8 @@ import { makeUriUpdater, updateClient } from './client.js';
 import { ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSIONS_SCOPE } from '@owlmeans/oidc';
 import { makeSecurityHelper } from '@owlmeans/config';
 import * as jose from 'jose';
+/** A claim list is an array, or (as the provider's types also allow) a record keyed by claim name. */
+const claimNamesOf = (claims) => claims == null ? [] : Array.isArray(claims) ? claims : Object.keys(claims);
 export const combineConfig = async (context, _unsecure) => {
     const cfg = context.cfg.oidc;
     const updateUri = makeUriUpdater(context, makeSecurityHelper(context));
@@ -12,10 +14,10 @@ export const combineConfig = async (context, _unsecure) => {
             ...(cfg.customConfiguration?.clients ?? [])
         ].map(client => updateClient(context, client)),
         claims: {
-            email: ['email', 'email_verified', ...cfg.customConfiguration?.claims?.email ?? []],
+            email: ['email', 'email_verified', ...claimNamesOf(cfg.customConfiguration?.claims?.email)],
             profile: [
                 'username', 'family_name', 'given_name', 'locale', 'name', 'nickname', 'preferred_username',
-                ...cfg.customConfiguration?.claims?.profile ?? []
+                ...claimNamesOf(cfg.customConfiguration?.claims?.profile)
             ],
             // Inert unless the account service actually emits the claim (integrated IAM mode)
             [PERMISSIONS_SCOPE]: [PERMISSIONS_CLAIM],

package/build/utils/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAE,SAAkB,EAAoC,EAAE;IAC5G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAC5B,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;IAEtE,MAAM,aAAa,GAA4B;QAC7C,GAAG,GAAG,CAAC,mBAAmB;QAC1B,OAAO,EAAE;YACP,GAAG,GAAG,CAAC,OAAO;YACd,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,IAAI,EAAE,CAAC;SAC5C,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;YACnF,OAAO,EAAE;gBACP,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB;gBAC3F,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE;aAClD;YACD,kFAAkF;YAClF,CAAC,iBAAiB,CAAC,EAAE,CAAC,iBAAiB,CAAC;YACxC,yFAAyF;YACzF,CAAC,mBAAmB,CAAC,EAAE,CAAC,mBAAmB,CAAC;YAC5C,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM;SACnC;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB;YAC7E,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE;SACzC;QACD,SAAS,EAAE;YACT,GAAG,GAAG,CAAC,mBAAmB,EAAE,SAAS;YACrC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9G;QACD,QAAQ,EAAE;YACR,GAAG,GAAG,CAAC,mBAAmB,EAAE,QAAQ;YACpC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,qBAAqB;YACrB,eAAe;YACf,kEAAkE;YAClE,gCAAgC;YAChC,mBAAmB;YACnB,2DAA2D;YAC3D,KAAK;SACN;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;aACvG;SACF;KACF,CAAA;IAED,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,sGAAsG;AACtG,MAAM,YAAY,GAAG,CAAC,MAA6E,EAAqB,EAAE,CACxH,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAE5E,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAE,SAAkB,EAAoC,EAAE;IAC5G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAC5B,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;IAEtE,MAAM,aAAa,GAA4B;QAC7C,GAAG,GAAG,CAAC,mBAAmB;QAC1B,OAAO,EAAE;YACP,GAAG,GAAG,CAAC,OAAO;YACd,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,IAAI,EAAE,CAAC;SAC5C,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3F,OAAO,EAAE;gBACP,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB;gBAC3F,GAAG,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC;aAC1D;YACD,kFAAkF;YAClF,CAAC,iBAAiB,CAAC,EAAE,CAAC,iBAAiB,CAAC;YACxC,yFAAyF;YACzF,CAAC,mBAAmB,CAAC,EAAE,CAAC,mBAAmB,CAAC;YAC5C,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM;SACnC;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB;YAC7E,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE;SACzC;QACD,SAAS,EAAE;YACT,GAAG,GAAG,CAAC,mBAAmB,EAAE,SAAS;YACrC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9G;QACD,QAAQ,EAAE;YACR,GAAG,GAAG,CAAC,mBAAmB,EAAE,QAAQ;YACpC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,qBAAqB;YACrB,eAAe;YACf,kEAAkE;YAClE,gCAAgC;YAChC,mBAAmB;YACnB,2DAA2D;YAC3D,KAAK;SACN;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;aACvG;SACF;KACF,CAAA;IAED,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}

package/build/utils/consts.d.ts

@@ -0,0 +1,3 @@
+/** The `reason` of the login check this module adds to the provider's default policy. */
+export declare const ACCOUNT_REFUSED_REASON = "account_refused";
+//# sourceMappingURL=consts.d.ts.map

package/build/utils/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/utils/consts.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAAoB,CAAA"}

package/build/utils/consts.js

@@ -0,0 +1,3 @@
+/** The `reason` of the login check this module adds to the provider's default policy. */
+export const ACCOUNT_REFUSED_REASON = 'account_refused';
+//# sourceMappingURL=consts.js.map

package/build/utils/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/utils/consts.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAA"}

package/build/utils/policy.d.ts

@@ -1,6 +1,4 @@
 import { interactionPolicy } from 'oidc-provider';
-/** The `reason` of the login check this module adds to the provider's default policy. */
-export declare const ACCOUNT_REFUSED_REASON = "account_refused";
 /**
  * The provider's default interaction policy plus one login check: a session whose account the
  * application REFUSED to load is a session that identifies nobody, so the person logs in again.

package/build/utils/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/utils/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEzD,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAAoB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qBAAqB,QAAO,iBAAiB,CAAC,aAqB1D,CAAA"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/utils/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAGzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qBAAqB,QAAO,iBAAiB,CAAC,aAqB1D,CAAA"}

package/build/utils/policy.js

@@ -1,6 +1,5 @@
 import { errors, interactionPolicy } from 'oidc-provider';
-/** The `reason` of the login check this module adds to the provider's default policy. */
-export const ACCOUNT_REFUSED_REASON = 'account_refused';
+import { ACCOUNT_REFUSED_REASON } from './consts.js';
 /**
  * The provider's default interaction policy plus one login check: a session whose account the
  * application REFUSED to load is a session that identifies nobody, so the person logs in again.

package/build/utils/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/utils/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEzD,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAoC,EAAE;IACzE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAA;IAEvC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CACzD,sBAAsB,EACtB,8DAA8D,EAC9D,gBAAgB,EAChB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACX,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5D,OAAO,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAClD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAA;QACxF,CAAC;QAED,OAAO,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAA;IAC/C,CAAC,CACF,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/utils/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAEpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAoC,EAAE;IACzE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAA;IAEvC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CACzD,sBAAsB,EACtB,8DAA8D,EAC9D,gBAAgB,EAChB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACX,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5D,OAAO,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAClD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAA;QACxF,CAAC;QAED,OAAO,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAA;IAC/C,CAAC,CACF,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.48",
+  "version": "0.1.18-rc.49",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -23,10 +23,10 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/context": "^0.1.18-rc.32",
-    "@types/bun": "^1.4.0",
-    "@types/node": "^26.1.0",
-    "@types/oidc-provider": "9.5.0",
+    "@owlmeans/context": "^0.1.18-rc.33",
+    "@types/bun": "^1.4.2",
+    "@types/node": "^26.6.4",
+    "@types/oidc-provider": "9.12.1",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },
@@ -34,18 +34,18 @@
     "fastify": "*"
   },
   "dependencies": {
-    "@noble/hashes": "^1.5.0",
-    "@owlmeans/config": "^0.1.18-rc.42",
-    "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/entrypoint": "^0.1.18-rc.39",
-    "@owlmeans/log": "^0.1.18-rc.0",
-    "@owlmeans/oidc": "^0.1.18-rc.53",
-    "@owlmeans/route": "^0.1.18-rc.33",
-    "@owlmeans/server-api": "^0.1.18-rc.49",
-    "@owlmeans/server-context": "^0.1.18-rc.41",
-    "@scure/base": "^2.3.0",
-    "jose": "6.2.5",
-    "oidc-provider": "9.11.1"
+    "@noble/hashes": "^2.4.0",
+    "@owlmeans/config": "^0.1.18-rc.43",
+    "@owlmeans/context": "^0.1.18-rc.33",
+    "@owlmeans/entrypoint": "^0.1.18-rc.40",
+    "@owlmeans/log": "^0.1.18-rc.1",
+    "@owlmeans/oidc": "^0.1.18-rc.54",
+    "@owlmeans/route": "^0.1.18-rc.34",
+    "@owlmeans/server-api": "^0.1.18-rc.50",
+    "@owlmeans/server-context": "^0.1.18-rc.42",
+    "@scure/base": "^2.4.0",
+    "jose": "6.2.12",
+    "oidc-provider": "9.12.2"
   },
   "publishConfig": {
     "access": "public"

package/src/iam.ts

@@ -1,21 +1,5 @@
-import type { ClientMetadata, ResponseType } from 'oidc-provider'
-
-/** A registered OIDC client stored in the provider's Client adapter. */
-export interface OidcRegisteredClient {
-  clientId: string
-  secret: string
-  /** The entity (realm) this client belongs to — used for identity scoping. */
-  entityId?: string
-  /** Application display name */
-  name?: string
-  redirectUris?: string[]
-  grantTypes?: string[]
-  responseTypes?: string[]
-  scope?: string
-}
-
-/** Full oidc-provider ClientMetadata with our entity extension. */
-export type OidcClientMetadata = ClientMetadata & { entityId?: string; owlEntityId?: string }
+import type { ResponseType } from 'oidc-provider'
+import type { OidcClientMetadata, OidcRegisteredClient } from './types.js'
 
 /** Convert an OidcRegisteredClient to the oidc-provider ClientMetadata shape. */
 export const toClientMetadata = (client: OidcRegisteredClient): OidcClientMetadata => ({
@@ -29,12 +13,3 @@ export const toClientMetadata = (client: OidcRegisteredClient): OidcClientMetada
   owlEntityId: client.entityId,
 })
 
-/** Extension seam for IAM integration into the OIDC provider — Phase 2 fills this */
-export interface OidcProviderIamExtension {
-  /** Convert a stored client record to oidc-provider ClientMetadata */
-  toClientMetadata: typeof toClientMetadata
-  /** Type of a stored client record */
-  OidcRegisteredClient: OidcRegisteredClient
-  /** Extended metadata type */
-  OidcClientMetadata: OidcClientMetadata
-}

package/src/types.ts

@@ -3,6 +3,7 @@ import type { OidcSharedConfig } from '@owlmeans/oidc'
 import type { ApiServer, ApiServerAppend } from '@owlmeans/server-api'
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import type { Account, Adapter, ClientMetadata, Configuration, Interaction, Provider } from 'oidc-provider'
+import { toClientMetadata } from './iam.js'
 
 export interface OidcProviderService extends InitializedService {
   oidc: Provider
@@ -76,3 +77,30 @@ export interface Config extends ServerConfig, OidcConfigAppend {
 
 export interface Context<C extends Config = Config> extends ServerContext<C>
   , ApiServerAppend { }
+
+/** A registered OIDC client stored in the provider's Client adapter. */
+export interface OidcRegisteredClient {
+  clientId: string
+  secret: string
+  /** The entity (realm) this client belongs to — used for identity scoping. */
+  entityId?: string
+  /** Application display name */
+  name?: string
+  redirectUris?: string[]
+  grantTypes?: string[]
+  responseTypes?: string[]
+  scope?: string
+}
+
+/** Full oidc-provider ClientMetadata with our entity extension. */
+export type OidcClientMetadata = ClientMetadata & { entityId?: string; owlEntityId?: string }
+
+/** Extension seam for IAM integration into the OIDC provider — Phase 2 fills this */
+export interface OidcProviderIamExtension {
+  /** Convert a stored client record to oidc-provider ClientMetadata */
+  toClientMetadata: typeof toClientMetadata
+  /** Type of a stored client record */
+  OidcRegisteredClient: OidcRegisteredClient
+  /** Extended metadata type */
+  OidcClientMetadata: OidcClientMetadata
+}

package/src/utils/client.ts

@@ -1,4 +1,4 @@
-import { randomBytes } from '@noble/hashes/utils'
+import { randomBytes } from '@noble/hashes/utils.js'
 import { hex } from '@scure/base'
 import type { ClientMetadata } from 'oidc-provider'
 import type { Config, Context } from '../types.js'

package/src/utils/config.ts

@@ -4,6 +4,10 @@ import { ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSION
 import { makeSecurityHelper } from '@owlmeans/config'
 import * as jose from 'jose'
 
+/** A claim list is an array, or (as the provider's types also allow) a record keyed by claim name. */
+const claimNamesOf = (claims: readonly string[] | Readonly<Record<string, null>> | null | undefined): readonly string[] =>
+  claims == null ? [] : Array.isArray(claims) ? claims : Object.keys(claims)
+
 export const combineConfig = async (context: Context, _unsecure: boolean): Promise<OidcCustomConfiguration> => {
   const cfg = context.cfg.oidc
   const updateUri = makeUriUpdater(context, makeSecurityHelper(context))
@@ -15,10 +19,10 @@ export const combineConfig = async (context: Context, _unsecure: boolean): Promi
       ...(cfg.customConfiguration?.clients ?? [])
     ].map(client => updateClient(context, client)),
     claims: {
-      email: ['email', 'email_verified', ...cfg.customConfiguration?.claims?.email ?? []],
+      email: ['email', 'email_verified', ...claimNamesOf(cfg.customConfiguration?.claims?.email)],
       profile: [
         'username', 'family_name', 'given_name', 'locale', 'name', 'nickname', 'preferred_username',
-        ...cfg.customConfiguration?.claims?.profile ?? []
+        ...claimNamesOf(cfg.customConfiguration?.claims?.profile)
       ],
       // Inert unless the account service actually emits the claim (integrated IAM mode)
       [PERMISSIONS_SCOPE]: [PERMISSIONS_CLAIM],

package/src/utils/consts.ts

@@ -0,0 +1,2 @@
+/** The `reason` of the login check this module adds to the provider's default policy. */
+export const ACCOUNT_REFUSED_REASON = 'account_refused'

package/src/utils/policy.ts

@@ -1,7 +1,5 @@
 import { errors, interactionPolicy } from 'oidc-provider'
-
-/** The `reason` of the login check this module adds to the provider's default policy. */
-export const ACCOUNT_REFUSED_REASON = 'account_refused'
+import { ACCOUNT_REFUSED_REASON } from './consts.js'
 
 /**
  * The provider's default interaction policy plus one login check: a session whose account the

package/tests/pairwise.spec.ts

@@ -5,7 +5,7 @@ import type { AddressInfo } from 'node:net'
 import { generateKeyPairSync } from 'node:crypto'
 import Provider from 'oidc-provider'
 import type { ClientMetadata, KoaContextWithOIDC } from 'oidc-provider'
-import { sha256 } from '@noble/hashes/sha2'
+import { sha256 } from '@noble/hashes/sha2.js'
 import { base58 } from '@scure/base'
 import { AppType, makeBasicContext } from '@owlmeans/context'
 import { ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSIONS_SCOPE } from '@owlmeans/oidc'

package/tests/policy.spec.ts

@@ -1,11 +1,11 @@
 import { describe, it, expect, afterEach } from 'bun:test'
-import { createServer } from 'node:http'
-import type { Server } from 'node:http'
+import { createServer, type Server } from 'node:http'
 import type { AddressInfo } from 'node:net'
 import { createHmac } from 'node:crypto'
 import Provider, { errors, interactionPolicy } from 'oidc-provider'
 import type { Configuration } from 'oidc-provider'
-import { ACCOUNT_REFUSED_REASON, makeInteractionPolicy } from '../src/utils/policy.js'
+import { makeInteractionPolicy } from '../src/utils/policy.js'
+import { ACCOUNT_REFUSED_REASON } from '../src/utils/consts.js'
 
 const KEYS = ['policy-spec-cookie-key']
 const CLIENT_ID = 'policy-spec-client'