@qauth-labs/plugin-sdk 0.0.0 → 0.2.0-rc.2

package/dist/lib/context.js

@@ -0,0 +1,390 @@
+import { AUTH_METHOD_ROUTE_PATH_PATTERN, authMethodRoutePrefix } from './contract.js';
+import { AuthMethodConfigError } from './errors.js';
+const EGRESS_METHODS = ['GET', 'POST'];
+const EGRESS_SOURCES = ['operator', 'admin', 'remote_document'];
+const EGRESS_REDIRECTS = [undefined, 'follow', 'error'];
+const ASSERTION_ALGORITHMS = ['RS256', 'ES256', 'EdDSA'];
+/**
+ * The longest a client assertion signed through the context stays valid, in
+ * seconds: its `exp` is lowered to at most this far past the moment it is
+ * signed. Five minutes covers a token request and clock skew; an assertion
+ * that outlives it is a replayable credential at the provider.
+ *
+ * @experimental
+ */
+export const MAX_AUTH_METHOD_CLIENT_ASSERTION_LIFETIME_SECONDS = 300;
+/**
+ * How far a client assertion's `iat` may lie in the future, in seconds, for
+ * the clock skew between the method's idea of now and the host's.
+ */
+const ASSERTION_IAT_SKEW_SECONDS = 60;
+/**
+ * The fields a method's log line may not carry, at any depth, matched without
+ * regard to case, `_` or `-` (`clientSecret` matches `client_secret`): the
+ * value is replaced with `[Redacted]`. Codes, verifiers, client secrets and
+ * assertions, tokens, nonces and passwords: what an upstream sign-in handles
+ * and a log must never hold. The last segment of each of the method's own
+ * secret paths joins them (`AuthMethodContextParts.secrets`), so does every
+ * occurrence of a secret's value.
+ *
+ * @experimental
+ */
+export const AUTH_METHOD_LOG_REDACTED_FIELDS = Object.freeze([
+    'code',
+    'code_verifier',
+    'client_secret',
+    'client_assertion',
+    'refresh_token',
+    'access_token',
+    'id_token',
+    'nonce',
+    'password',
+]);
+/**
+ * The key a method's log fields are nested under, so they never overwrite
+ * the host's own fields of the line (`reqId`, `realm`, …).
+ *
+ * @experimental
+ */
+export const AUTH_METHOD_LOG_FIELDS_KEY = 'authMethod';
+/** What a redacted log value is replaced with. */
+const LOG_CENSOR = '[Redacted]';
+/** How deep a method's log fields are copied; anything deeper is cut. */
+const MAX_LOG_DEPTH = 8;
+/**
+ * Build the context a method is handed for one realm (ADR-019 Decision 12).
+ *
+ * The context holds exactly five members: the config, parsed by the method's
+ * `configSchema`, copied and deep-frozen (it must be plain data: objects,
+ * arrays and primitives, so a Map, Set, Date or other class instance is
+ * refused, as none of them freezes); `egress`; `signer`; `log`; and
+ * `routeUrl`. Each is an adapter that calls the host's object with the members
+ * the contract names and nothing else:
+ *
+ * - `egress.request` passes `method` (`GET` or `POST`), `url`, `headers`,
+ *   `body`, `purpose` and `source`, and adds this realm's name. One cap only,
+ *   `maxRedirects: 0` when the method asks for `redirect: 'error'`; no other
+ *   cap, no other realm, no other method. `source` is `operator` or `admin` (the
+ *   labels the realm's egress allowlist applies to, for non-public
+ *   addresses) only when the URL's origin is the origin of a URL among the
+ *   plain members of the method's parsed config, never a secret one; any
+ *   other call goes as `remote_document`, so a method cannot reach an
+ *   allowlisted address its config does not name.
+ * - `signer.signClientAssertion` passes `audience`, `claims` and `algorithm`,
+ *   with this realm, this provider and the host's caller role. It sets `iat`
+ *   when the claims carry none, and lowers `exp` to at most
+ *   {@link MAX_AUTH_METHOD_CLIENT_ASSERTION_LIFETIME_SECONDS} from now.
+ *   `signer.getUpstreamJwks` takes no argument and asks for this realm and
+ *   provider.
+ * - `log` calls the logger's four levels with a message and the method's
+ *   fields nested under {@link AUTH_METHOD_LOG_FIELDS_KEY}, as a copy in which
+ *   every field {@link AUTH_METHOD_LOG_REDACTED_FIELDS} names, or a secret
+ *   path's last segment, is redacted at any depth, and every secret value is
+ *   cut out of the message and of every string.
+ * - `routeUrl` answers URLs only for the paths the method's own `routes`
+ *   declare.
+ *
+ * So the host can hand over its whole egress client, signer and logger, and a
+ * method still reaches no `validateDestination`, no `decrypt`, no `child`, no
+ * database or cache handle and no key material.
+ *
+ * @throws AuthMethodConfigError when the config does not pass `configSchema`,
+ *   or its parsed form is not plain data; the error names the failing
+ *   members, never their values
+ * @experimental
+ */
+export function createAuthMethodContext(method, parts) {
+    const type = method.type;
+    const config = parseAuthMethodConfig(method, parts.config);
+    const origin = new URL(parts.origin);
+    if (origin.origin !== parts.origin) {
+        throw new TypeError('origin must be a bare origin, such as https://auth.example.com');
+    }
+    const prefix = authMethodRoutePrefix(type);
+    const routePaths = declaredRoutePaths(method.routes);
+    const secrets = parts.secrets ?? new Map();
+    const secretValues = [...secrets.values()].filter((value) => value !== '');
+    const configOrigins = urlOrigins(config, new Set(secrets.keys()), new Set(secretValues));
+    const redaction = {
+        fields: new Set([
+            ...AUTH_METHOD_LOG_REDACTED_FIELDS.map(fieldKey),
+            ...[...secrets.keys()].map((path) => fieldKey(path.split('.').at(-1) ?? path)),
+        ]),
+        // The longest first, so no shorter value cuts a longer one apart.
+        values: [...secretValues].sort((a, b) => b.length - a.length),
+    };
+    const { egress, signer, log, realmName, realmId, providerId, signerCaller } = parts;
+    const logged = (fields) => ({
+        [AUTH_METHOD_LOG_FIELDS_KEY]: redactedCopy(fields, 0, new WeakSet(), redaction),
+    });
+    const message = (text) => withoutSecrets(String(text), redaction);
+    return Object.freeze({
+        config: deepFreeze(config),
+        egress: Object.freeze({
+            request(request) {
+                // Each member read once: what is checked is what is sent.
+                const { method: verb, url, headers, body, purpose, source, redirect } = request;
+                if (!EGRESS_METHODS.includes(verb)) {
+                    return Promise.reject(new TypeError('egress method must be GET or POST'));
+                }
+                if (!EGRESS_SOURCES.includes(source)) {
+                    return Promise.reject(new TypeError('egress source must be operator, admin or remote_document'));
+                }
+                if (!EGRESS_REDIRECTS.includes(redirect)) {
+                    return Promise.reject(new TypeError('egress redirect must be follow or error'));
+                }
+                return egress.request({
+                    method: verb,
+                    url,
+                    ...(headers === undefined ? {} : { headers: { ...headers } }),
+                    ...(body === undefined ? {} : { body }),
+                    purpose,
+                    source: source === 'remote_document' || configOrigins.has(originOf(url))
+                        ? source
+                        : 'remote_document',
+                    realm: realmName,
+                    // The one cap a method may set: zero redirects, the floor.
+                    ...(redirect === 'error' ? { limits: { maxRedirects: 0 } } : {}),
+                });
+            },
+        }),
+        signer: Object.freeze({
+            signClientAssertion(request) {
+                const { audience, claims, algorithm } = request;
+                if (algorithm !== undefined && !ASSERTION_ALGORITHMS.includes(algorithm)) {
+                    return Promise.reject(new TypeError('algorithm must be RS256, ES256 or EdDSA'));
+                }
+                if (typeof claims !== 'object' || claims === null || Array.isArray(claims)) {
+                    return Promise.reject(new TypeError('claims must be an object'));
+                }
+                const now = Math.floor(Date.now() / 1000);
+                const bounded = { ...claims };
+                const { iat, exp } = bounded;
+                if (iat === undefined) {
+                    bounded['iat'] = now;
+                }
+                else if (typeof iat !== 'number' ||
+                    !Number.isFinite(iat) ||
+                    iat > now + ASSERTION_IAT_SKEW_SECONDS) {
+                    return Promise.reject(new TypeError('iat must be a time, in seconds, not in the future'));
+                }
+                // A missing or non-numeric exp goes on as it is: the signer refuses it.
+                const latest = now + MAX_AUTH_METHOD_CLIENT_ASSERTION_LIFETIME_SECONDS;
+                if (typeof exp === 'number' && exp > latest)
+                    bounded['exp'] = latest;
+                return signer.signClientAssertion(signerCaller, {
+                    realmId,
+                    providerId,
+                    audience,
+                    claims: bounded,
+                    ...(algorithm === undefined ? {} : { algorithm }),
+                });
+            },
+            async getUpstreamJwks() {
+                const jwks = await signer.getUpstreamJwks(signerCaller, realmId, providerId);
+                return { keys: jwks.keys };
+            },
+        }),
+        log: Object.freeze({
+            debug: (fields, text) => log.debug(logged(fields), message(text)),
+            info: (fields, text) => log.info(logged(fields), message(text)),
+            warn: (fields, text) => log.warn(logged(fields), message(text)),
+            error: (fields, text) => log.error(logged(fields), message(text)),
+        }),
+        routeUrl(path) {
+            if (typeof path !== 'string' ||
+                !AUTH_METHOD_ROUTE_PATH_PATTERN.test(path) ||
+                !routePaths.has(path)) {
+                throw new TypeError("routeUrl takes the path of one of the method's own routes, such as /callback");
+            }
+            return `${origin.origin}${prefix}${path}`;
+        },
+    });
+}
+/** The paths of a method's routes, read once by index. */
+function declaredRoutePaths(routes) {
+    const paths = new Set();
+    if (!Array.isArray(routes))
+        return paths;
+    const length = routes.length;
+    if (typeof length !== 'number' || !Number.isSafeInteger(length))
+        return paths;
+    for (let index = 0; index < length; index += 1) {
+        const route = routes[index];
+        if (typeof route !== 'object' || route === null)
+            continue;
+        const path = route['path'];
+        if (typeof path === 'string')
+            paths.add(path);
+    }
+    return paths;
+}
+/**
+ * The origins of every absolute URL among the strings of a (plain) config's
+ * plain members: a member at one of `secretPaths`, and a string that is one
+ * of `secretValues`, is skipped, so a secret that parses as a URL opens no
+ * destination.
+ */
+function urlOrigins(config, secretPaths, secretValues) {
+    const origins = new Set();
+    const walk = (value, path, depth) => {
+        if (path !== '' && secretPaths.has(path))
+            return;
+        if (typeof value === 'string') {
+            if (secretValues.has(value))
+                return;
+            const found = originOf(value);
+            if (found !== '')
+                origins.add(found);
+            return;
+        }
+        if (typeof value !== 'object' || value === null || depth > 32)
+            return;
+        // A list's items have no member path; a secret is never inside one.
+        const inList = Array.isArray(value);
+        for (const [key, item] of Object.entries(value)) {
+            walk(item, inList ? `${path}[]` : path === '' ? key : `${path}.${key}`, depth + 1);
+        }
+    };
+    walk(config, '', 0);
+    return origins;
+}
+/** The origin of an absolute http(s) URL, or `''`. */
+function originOf(value) {
+    if (typeof value !== 'string')
+        return '';
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return '';
+    }
+    return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : '';
+}
+/**
+ * A method's config as a context holds it: parsed by its `configSchema`, and
+ * a copy of plain data (objects with the plain prototype or none, arrays,
+ * primitives). The admin API checks a plugin's config with it before it
+ * writes it (#600, #639), so a config the context would refuse is refused at
+ * the configure, never at every sign-in.
+ *
+ * @throws AuthMethodConfigError when the config does not pass the schema, or
+ *   its parsed form is not plain data; the error names the failing member's
+ *   path, never its value
+ * @experimental
+ */
+export function parseAuthMethodConfig(method, raw) {
+    const type = method.type;
+    const parsed = method.configSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new AuthMethodConfigError(type, parsed.error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.code}`));
+    }
+    const notPlain = notPlainDataPath(parsed.data, [], 0);
+    if (notPlain !== undefined) {
+        throw new AuthMethodConfigError(type, [
+            `${notPlain.join('.') || '(root)'}: not plain data (a Map, Set, Date or class instance does not freeze)`,
+        ]);
+    }
+    try {
+        // A copy, so freezing it leaves the caller's objects alone.
+        return structuredClone(parsed.data);
+    }
+    catch {
+        throw new AuthMethodConfigError(type, ['(root): the parsed config is not plain data']);
+    }
+}
+/**
+ * The path of the first member of `value` that is not plain data (an object
+ * with the plain prototype or none, an array, or a primitive), or
+ * `undefined` when there is none.
+ */
+function notPlainDataPath(value, path, depth) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    if (depth > 32)
+        return path;
+    if (!Array.isArray(value)) {
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null)
+            return path;
+    }
+    for (const [key, item] of Object.entries(value)) {
+        const found = notPlainDataPath(item, [...path, key], depth + 1);
+        if (found !== undefined)
+            return found;
+    }
+    return undefined;
+}
+/** A field name as redaction compares it: lower case, without `_` or `-`. */
+function fieldKey(name) {
+    return name.toLowerCase().replace(/[_-]/g, '');
+}
+/** `text` with every occurrence of a secret value replaced by the censor. */
+function withoutSecrets(text, redaction) {
+    let result = text;
+    for (const value of redaction.values) {
+        if (result.includes(value))
+            result = result.split(value).join(LOG_CENSOR);
+    }
+    return result;
+}
+/**
+ * A copy of a method's log fields with every field `redaction` names redacted,
+ * at any depth, and every secret value cut out of every string. An Error is
+ * copied as its name, message, stack, cause and own fields, as the host's
+ * error serializer would write it; binary data as its size.
+ */
+function redactedCopy(value, depth, seen, redaction) {
+    if (typeof value !== 'object' || value === null) {
+        if (typeof value === 'string')
+            return withoutSecrets(value, redaction);
+        return typeof value === 'function' || typeof value === 'symbol'
+            ? withoutSecrets(String(value), redaction)
+            : value;
+    }
+    if (depth >= MAX_LOG_DEPTH)
+        return '[Truncated]';
+    if (seen.has(value))
+        return '[Circular]';
+    seen.add(value);
+    if (ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {
+        return `[${value.byteLength} bytes]`;
+    }
+    if (value instanceof Date)
+        return value.toISOString();
+    if (Array.isArray(value)) {
+        const copy = [];
+        const length = value.length;
+        for (let index = 0; index < length; index += 1) {
+            copy[index] = redactedCopy(value[index], depth + 1, seen, redaction);
+        }
+        return copy;
+    }
+    // No prototype: a field named `__proto__` stays a field.
+    const copy = Object.create(null);
+    if (value instanceof Error) {
+        copy['type'] = redactedCopy(value.name, depth + 1, seen, redaction);
+        copy['message'] = redactedCopy(value.message, depth + 1, seen, redaction);
+        copy['stack'] = redactedCopy(value.stack, depth + 1, seen, redaction);
+        if (value.cause !== undefined) {
+            copy['cause'] = redactedCopy(value.cause, depth + 1, seen, redaction);
+        }
+    }
+    for (const [key, item] of Object.entries(value)) {
+        copy[key] = redaction.fields.has(fieldKey(key))
+            ? LOG_CENSOR
+            : redactedCopy(item, depth + 1, seen, redaction);
+    }
+    return copy;
+}
+/** Freeze `value` and everything it holds; `seen` stops at cycles. */
+function deepFreeze(value, seen = new WeakSet()) {
+    if (typeof value !== 'object' || value === null || seen.has(value))
+        return value;
+    seen.add(value);
+    for (const item of Object.values(value))
+        deepFreeze(item, seen);
+    Object.freeze(value);
+    return value;
+}

package/dist/lib/contract.d.ts

@@ -0,0 +1,274 @@
+/**
+ * The fixed values of the AuthMethod contract (#599, ADR-003 as amended,
+ * ADR-018 §4, ADR-019 Decision 12).
+ *
+ * EXPERIMENTAL. The AuthMethod contract is the plugin API of ADR-018 §4: it is
+ * public and documented, so others can write methods against it, but it stays
+ * outside the 1.0 stability promise and may change in a minor release. It
+ * becomes stable in 1.x. QAuth's experimental-feature registry lists it as
+ * `plugin-api`.
+ *
+ * This package imports no other QAuth package, so the few values it shares
+ * with the server's other contracts (the Interaction API's version label and
+ * display rule, the credential types QAuth writes itself) are written out
+ * here. The server checks at boot, and in its tests, that each still equals
+ * its source.
+ *
+ * @packageDocumentation
+ */
+/**
+ * The contract's name, as it appears in {@link AUTH_METHOD_CONTRACT}.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_CONTRACT_NAME = "qauth-auth-method";
+/**
+ * The contract's version: a release candidate until QAuth 1.0.0
+ * (ADR-018 §5). A breaking change raises the release-candidate number, so one
+ * identifier never names two contracts.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_CONTRACT_VERSION = "1-rc.0";
+/**
+ * The contract a method declares it is written against, as a format id:
+ * `qauth-auth-method/1-rc.0`. The registry refuses a method that declares
+ * another one, so a method built for another version fails the boot instead of
+ * running against a contract it does not know.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_CONTRACT: "qauth-auth-method/1-rc.0";
+/**
+ * The export a plugin package names its method by: `authMethod`, an
+ * AuthMethod object. A CommonJS package may put it under `default`.
+ *
+ * ```ts
+ * // index.ts of @example/qauth-plugin-corp-sso
+ * export const authMethod: AuthMethod<CorpSsoConfig, CorpSsoTransaction> = { … };
+ * ```
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_PLUGIN_EXPORT = "authMethod";
+/**
+ * The upstream step: the Interaction API step through which a person signs in
+ * at an upstream identity provider. The method starts an upstream transaction
+ * (`AuthMethod.start`), the browser goes to the provider, and the
+ * method's callback route hands the provider's answer back to the engine.
+ *
+ * Step names are QAuth identifiers that carry the Interaction API's version
+ * (ADR-018 §5): `urn:qauth:ia:upstream:v1-rc.0` until 1.0.0. The step's params
+ * and its place in ADR-017's step table come with the upstream sign-in flow
+ * (#639).
+ *
+ * @experimental
+ */
+export declare const UPSTREAM_STEP_URN: "urn:qauth:ia:upstream:v1-rc.0";
+/**
+ * Every step a method may contribute in this version of the contract, by URN.
+ * Only the upstream step today; a later version may add others (an LDAP form,
+ * for instance).
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_STEP_URNS: readonly ["urn:qauth:ia:upstream:v1-rc.0"];
+/**
+ * A step a method may contribute: one of {@link AUTH_METHOD_STEP_URNS}.
+ *
+ * @experimental
+ */
+export type AuthMethodStepUrn = (typeof AUTH_METHOD_STEP_URNS)[number];
+/**
+ * The root every method's routes are mounted under, on the realm host. A
+ * method's own prefix is `/upstream/<type>` ({@link authMethodRoutePrefix}),
+ * so each provider has its own callback URL, and a response meant for one
+ * provider cannot be replayed at another.
+ *
+ * No version in the path: the callback URL is registered at the upstream
+ * provider, and a path that changed at 1.0 would break every registration.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_ROUTE_ROOT = "/upstream";
+/**
+ * The prefix a method's routes are mounted under: `/upstream/<type>`.
+ *
+ * @experimental
+ */
+export declare function authMethodRoutePrefix(type: string): string;
+/**
+ * An AuthMethod's `type`: lower-case ASCII letters, digits and `_`, starting
+ * with a letter, at most 63 characters. It is the registry key, the value
+ * written to `user_credentials.provider_type`, the `source` of the attributes
+ * the method extracts and a segment of its route prefix, so it must be safe in
+ * all four. A type with `:` or `/` (an ID-JAG issuer type, `oidc_<issuer URL>`)
+ * can never match.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_TYPE_PATTERN: RegExp;
+/**
+ * An AuthMethod's `id`: the stable name of the method's implementation, such
+ * as `oidc` or `corp-sso`. Lower-case ASCII letters, digits, `_` and `-`,
+ * starting with a letter, at most 63 characters.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_ID_PATTERN: RegExp;
+/**
+ * Types an AuthMethod may not take: the credential types and the attribute
+ * source QAuth writes itself, built or planned. A method under one of them
+ * would read as that built-in credential, and `wallet` would outrank every
+ * other attribute source in claim resolution (`rankAttributeSource`).
+ *
+ * @experimental
+ */
+export declare const RESERVED_AUTH_METHOD_TYPES: readonly string[];
+/**
+ * A route path below a method's prefix: one to four segments of lower-case
+ * ASCII letters, digits, `_` and `-`, such as `/callback`. No dot segment, no
+ * encoded character, no route parameter and no wildcard can match, so a path
+ * cannot leave the prefix it is mounted under.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_ROUTE_PATH_PATTERN: RegExp;
+/**
+ * The display rule of the Interaction API (ADR-019 Decision 6), which a
+ * method's default name follows: no markup bracket, no control, format,
+ * private-use or unassigned character, no line separator and no space at
+ * either end.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_DISPLAY_NAME_PATTERN: RegExp;
+/**
+ * The longest default display name, in UTF-16 code units.
+ *
+ * @experimental
+ */
+export declare const MAX_AUTH_METHOD_DISPLAY_NAME_LENGTH = 64;
+/**
+ * The largest default icon, in bytes.
+ *
+ * @experimental
+ */
+export declare const MAX_AUTH_METHOD_ICON_BYTES: number;
+/**
+ * The media types a default icon may have: raster PNG only. An SVG can carry
+ * script, and the icon is served from the realm origin.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_ICON_MEDIA_TYPES: readonly ["image/png"];
+/**
+ * The largest upstream transaction a method may ask the engine to keep, in
+ * bytes of its JSON form. The engine stores it server-side, bound to the
+ * interaction and its flow cookie, for the lifetime of the interaction.
+ *
+ * @experimental
+ */
+export declare const MAX_UPSTREAM_TRANSACTION_BYTES = 4096;
+/**
+ * A binding (#599): the value `start()` answers beside its transaction, which
+ * the authorization request carries to the provider (as `state`, usually)
+ * and the provider's callback carries back. 22 to 512 base64url characters:
+ * 22 is the length of 128 random bits in base64url. The pattern checks the
+ * length and the alphabet only; the method makes the value random.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_BINDING_PATTERN: RegExp;
+/**
+ * The parameter a callback route carries the binding back in when the route
+ * names none: `state` (RFC 6749 §4.1.2).
+ *
+ * @experimental
+ */
+export declare const DEFAULT_AUTH_METHOD_BINDING_PARAMETER = "state";
+/**
+ * A parameter name a callback route may name as its binding parameter:
+ * ASCII letters, digits, `_`, `.` and `-`, at most 64 characters.
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_BINDING_PARAMETER_PATTERN: RegExp;
+/**
+ * The longest URL a method may send the browser to when it starts.
+ *
+ * @experimental
+ */
+export declare const MAX_UPSTREAM_REDIRECT_LENGTH = 8192;
+/**
+ * The longest `externalSub` a method may resolve: 255 characters, the limit
+ * OpenID Connect Core 1.0 §2 sets on `sub`.
+ *
+ * @experimental
+ */
+export declare const MAX_AUTH_METHOD_EXTERNAL_SUB_LENGTH = 255;
+/**
+ * The largest `rawClaims` a method's `verify()` may resolve, in bytes of its
+ * JSON form. The engine keeps a frozen copy.
+ *
+ * @experimental
+ */
+export declare const MAX_AUTH_METHOD_RAW_CLAIMS_BYTES: number;
+/**
+ * An attribute key a method may extract: lower-case ASCII letters, digits
+ * and `_`, starting with a letter, at most 64 characters (`email`,
+ * `given_name`).
+ *
+ * @experimental
+ */
+export declare const AUTH_METHOD_ATTRIBUTE_KEY_PATTERN: RegExp;
+/**
+ * The longest attribute value a method may extract, in UTF-16 code units.
+ *
+ * @experimental
+ */
+export declare const MAX_AUTH_METHOD_ATTRIBUTE_VALUE_LENGTH = 8192;
+/**
+ * The most parameters a method's route handler sees from one query or one
+ * form; the rest are dropped.
+ *
+ * @experimental
+ */
+export declare const MAX_AUTH_METHOD_PARAMETERS = 64;
+/**
+ * The longest parameter value a method's route handler sees, in UTF-16 code
+ * units; a parameter with a longer value is dropped.
+ *
+ * @experimental
+ */
+export declare const MAX_AUTH_METHOD_PARAMETER_LENGTH = 8192;
+/**
+ * The most values of one repeated parameter a method's route handler sees;
+ * a parameter repeated more often is dropped.
+ *
+ * @experimental
+ */
+export declare const MAX_AUTH_METHOD_PARAMETER_VALUES = 16;
+/**
+ * Why a method's callback did not produce a result, other than the person
+ * declining at the provider:
+ *
+ * - `transaction_mismatch`: no transaction is pending for this browser, or the
+ *   callback does not belong to it (its binding, `state` by default, is
+ *   missing, repeated or another's). A callback replayed in another browser,
+ *   or forged, ends here; the host answers it before the method runs.
+ * - `provider_error`: the provider answered with an error, other than the
+ *   person declining (`access_denied`).
+ * - `invalid_response`: the provider's answer failed a check, such as the ID
+ *   token's signature, `iss`, `aud` or `nonce`.
+ * - `upstream_unavailable`: the provider could not be reached in time.
+ *
+ * @experimental
+ */
+export declare const UPSTREAM_FAILURE_REASONS: readonly ["transaction_mismatch", "provider_error", "invalid_response", "upstream_unavailable"];
+/**
+ * One of {@link UPSTREAM_FAILURE_REASONS}.
+ *
+ * @experimental
+ */
+export type UpstreamFailureReason = (typeof UPSTREAM_FAILURE_REASONS)[number];