@sourceregistry/sveltekit-oidc 1.1.0 → 1.2.0

package/README.md

@@ -33,6 +33,7 @@ export const oidc = createOIDC({
 	loginPath: '/auth/login',
 	redirectPath: '/auth/callback',
 	scope: ['openid', 'profile', 'email', 'offline_access'],
+	clockSkewSeconds: 30,
 	fetchUserInfo: true,
 	backChannelLogoutStore: createInMemoryBackChannelLogoutStore(),
 	transformSession(session) {
@@ -159,6 +160,76 @@ export async function load(event) {
 - periodic `invalidateAll()` revalidation so revoked server sessions are detected
 - a client context for nested auth-aware components through `useOIDC()` / `getOIDCContext()`
 
+## Typed Custom Claims
+
+`createOIDC` infers a `TClaims` type from whatever `transformClaims` / `transformUser` / `transformSession` return, and threads it through the session, `event.locals.oidc`, `OIDCPublicSession`, and the client context — no casts needed.
+
+```ts
+// src/lib/server/auth.ts
+export const oidc = createOIDC({
+	issuer: 'https://your-idp.example.com',
+	clientId: process.env.OIDC_CLIENT_ID!,
+	cookieSecret: process.env.OIDC_COOKIE_SECRET!,
+	transformClaims: (claims) => ({
+		...claims,
+		roles: (claims.roles as string[]) ?? [],
+		tenant: claims.tenant as string | undefined
+	})
+});
+```
+
+Extract the inferred type with `OIDCInferClaims` and apply it to `App.Locals` so `event.locals.oidc` is typed everywhere:
+
+```ts
+// src/app.d.ts
+import type { OIDCHandleLocals, OIDCInferClaims } from 'sveltekit-oidc/server';
+import { oidc } from '$lib/server/auth';
+
+export type AppClaims = OIDCInferClaims<typeof oidc>;
+
+declare global {
+	namespace App {
+		interface Locals {
+			oidc?: OIDCHandleLocals<AppClaims>;
+		}
+	}
+}
+
+export {};
+```
+
+Now `event.locals.oidc?.claims?.roles` is `string[]` and `?.tenant` is `string | undefined` in every hook, load function, and action.
+
+`OIDCContext` is a generic component, but Svelte doesn't support passing explicit type arguments in markup — `TClaims` is inferred from the `session` prop instead. Since `data.session` comes from `oidc.getPublicSession(event)`, it's already typed `OIDCPublicSession<AppClaims> | null`, so the inference flows through automatically:
+
+```html
+<!-- src/routes/+layout.svelte -->
+<script lang="ts">
+	import { OIDCContext } from 'sveltekit-oidc';
+	let { data, children } = $props();
+</script>
+
+<OIDCContext session={data.session} config={data.sessionManagement}>
+	{@render children()}
+</OIDCContext>
+```
+
+```html
+<!-- src/lib/Account.svelte -->
+<script lang="ts">
+	import { useOIDC } from 'sveltekit-oidc';
+	import type { AppClaims } from '../../app.d.ts';
+
+	const oidc = useOIDC<AppClaims>();
+</script>
+
+{#if oidc.isAuthenticated}
+	<p>Roles: {oidc.claims?.roles.join(', ')}</p>
+{/if}
+```
+
+If `transformClaims` (and friends) are omitted, `TClaims` defaults to `OIDCUserClaims` — existing setups keep working unchanged.
+
 ## Example App
 
 This repository now includes a runnable example under [src/routes](C:/Users/alexa/WebstormProjects/github.com/SourceRegistry/sveltekit-oidc/src/routes) and [src/hooks.server.ts](C:/Users/alexa/WebstormProjects/github.com/SourceRegistry/sveltekit-oidc/src/hooks.server.ts).
@@ -175,10 +246,11 @@ Set these environment variables to enable it:
 ## Notes
 
 - `cookieSecret` should be a strong random secret and must stay stable across instances.
+- `clockSkewSeconds` defaults to `30` and tolerates small clock drift between your app and the identity provider.
 - `createInMemoryBackChannelLogoutStore()` is suitable for local development or single-instance deployments. Use Redis, SQL, or another shared store for production.
 - The library validates `id_token` and `logout_token` values through `@sourceregistry/node-jwt` and provider JWKS metadata.
 - `groups` are normalized onto the session from `groups` and `roles` claims when present.
 - Use `transformClaims`, `transformUser`, and `transformSession` to project provider-specific claims into your own session shape.
 - `check_session_iframe` monitoring only runs when the provider advertises that endpoint and the session includes `session_state`.
 - Refresh token handling is automatic when a valid refresh token is present.
-- `event.locals.oidc` is attached by the hook, but you should add your own `app.d.ts` augmentation in the consuming app for full typing.
+- `event.locals.oidc` is attached by the hook and typed via `OIDCHandleLocals<TClaims>`; see [Typed Custom Claims](#typed-custom-claims) for wiring your own claim shapes through `app.d.ts`.

package/dist/client/OIDCContext.svelte

@@ -1,9 +1,13 @@
-<script lang="ts">
+<script lang="ts" generics="TClaims extends OIDCUserClaims = OIDCUserClaims">
 	import { goto, invalidateAll } from '$app/navigation';
 	import type { Snippet } from 'svelte';
 
 	import { setOIDCContext } from './context.js';
-	import type { OIDCPublicSession, OIDCSessionManagementConfig } from '../server/index.js';
+	import type {
+		OIDCPublicSession,
+		OIDCSessionManagementConfig,
+		OIDCUserClaims
+	} from '../server/index.js';
 
 	type RedirectMode = 'login' | 'logout' | 'reload' | 'none';
 
@@ -19,7 +23,7 @@
 		redirectIfUnauthenticated = false,
 		children
 	}: {
-		session?: OIDCPublicSession | null;
+		session?: OIDCPublicSession<TClaims> | null;
 		config: OIDCSessionManagementConfig;
 		loginPath?: string;
 		logoutPath?: string;
@@ -44,7 +48,7 @@
 		Boolean(session?.isAuthenticated && session?.sessionState && iframeUrl)
 	);
 
-	const context = setOIDCContext({
+	const context = setOIDCContext<TClaims>({
 		get isAuthenticated() {
 			return Boolean(session?.isAuthenticated);
 		},

package/dist/client/OIDCContext.svelte.d.ts

@@ -1,18 +1,37 @@
 import type { Snippet } from 'svelte';
-import type { OIDCPublicSession, OIDCSessionManagementConfig } from '../server/index.js';
-type RedirectMode = 'login' | 'logout' | 'reload' | 'none';
-type $$ComponentProps = {
-    session?: OIDCPublicSession | null;
-    config: OIDCSessionManagementConfig;
-    loginPath?: string;
-    logoutPath?: string;
-    checkSessionIntervalMs?: number;
-    revalidateIntervalMs?: number;
-    redirectOnExpired?: RedirectMode;
-    redirectOnRevoked?: RedirectMode;
-    redirectIfUnauthenticated?: boolean;
-    children?: Snippet;
+import type { OIDCPublicSession, OIDCSessionManagementConfig, OIDCUserClaims } from '../server/index.js';
+declare function $$render<TClaims extends OIDCUserClaims = OIDCUserClaims>(): {
+    props: {
+        session?: OIDCPublicSession<TClaims> | null;
+        config: OIDCSessionManagementConfig;
+        loginPath?: string;
+        logoutPath?: string;
+        checkSessionIntervalMs?: number;
+        revalidateIntervalMs?: number;
+        redirectOnExpired?: "none" | "login" | "logout" | "reload";
+        redirectOnRevoked?: "none" | "login" | "logout" | "reload";
+        redirectIfUnauthenticated?: boolean;
+        children?: Snippet;
+    };
+    exports: {};
+    bindings: "";
+    slots: {};
+    events: {};
 };
-declare const OIDCContext: import("svelte").Component<$$ComponentProps, {}, "">;
-type OIDCContext = ReturnType<typeof OIDCContext>;
+declare class __sveltets_Render<TClaims extends OIDCUserClaims = OIDCUserClaims> {
+    props(): ReturnType<typeof $$render<TClaims>>['props'];
+    events(): ReturnType<typeof $$render<TClaims>>['events'];
+    slots(): ReturnType<typeof $$render<TClaims>>['slots'];
+    bindings(): "";
+    exports(): {};
+}
+interface $$IsomorphicComponent {
+    new <TClaims extends OIDCUserClaims = OIDCUserClaims>(options: import('svelte').ComponentConstructorOptions<ReturnType<__sveltets_Render<TClaims>['props']>>): import('svelte').SvelteComponent<ReturnType<__sveltets_Render<TClaims>['props']>, ReturnType<__sveltets_Render<TClaims>['events']>, ReturnType<__sveltets_Render<TClaims>['slots']>> & {
+        $$bindings?: ReturnType<__sveltets_Render<TClaims>['bindings']>;
+    } & ReturnType<__sveltets_Render<TClaims>['exports']>;
+    <TClaims extends OIDCUserClaims = OIDCUserClaims>(internal: unknown, props: ReturnType<__sveltets_Render<TClaims>['props']> & {}): ReturnType<__sveltets_Render<TClaims>['exports']>;
+    z_$$bindings?: ReturnType<__sveltets_Render<any>['bindings']>;
+}
+declare const OIDCContext: $$IsomorphicComponent;
+type OIDCContext<TClaims extends OIDCUserClaims = OIDCUserClaims> = InstanceType<typeof OIDCContext<TClaims>>;
 export default OIDCContext;

package/dist/client/context.d.ts

@@ -1,16 +1,16 @@
-import type { OIDCDiscoveryDocument, OIDCPublicSession } from '../server/index.js';
-export type OIDCClientContextValue = {
+import type { OIDCDiscoveryDocument, OIDCPublicSession, OIDCUserClaims } from '../server/index.js';
+export type OIDCClientContextValue<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     isAuthenticated: boolean;
-    session: OIDCPublicSession | null;
-    user: OIDCPublicSession['user'];
-    claims: OIDCPublicSession['claims'];
-    groups: OIDCPublicSession['groups'];
+    session: OIDCPublicSession<TClaims> | null;
+    user: OIDCPublicSession<TClaims>['user'];
+    claims: OIDCPublicSession<TClaims>['claims'];
+    groups: OIDCPublicSession<TClaims>['groups'];
     metadata?: Pick<OIDCDiscoveryDocument, 'issuer' | 'check_session_iframe' | 'end_session_endpoint' | 'backchannel_logout_supported' | 'backchannel_logout_session_supported'>;
     status: 'authenticated' | 'unauthenticated' | 'expired' | 'revoked';
     login: (returnTo?: string) => void;
     logout: (clearSessionOnly?: boolean) => Promise<void>;
     revalidate: () => Promise<void>;
 };
-export declare function setOIDCContext(value: OIDCClientContextValue): OIDCClientContextValue;
-export declare function getOIDCContext(): OIDCClientContextValue;
-export declare function useOIDC(): OIDCClientContextValue;
+export declare function setOIDCContext<TClaims extends OIDCUserClaims = OIDCUserClaims>(value: OIDCClientContextValue<TClaims>): OIDCClientContextValue<TClaims>;
+export declare function getOIDCContext<TClaims extends OIDCUserClaims = OIDCUserClaims>(): OIDCClientContextValue<TClaims>;
+export declare function useOIDC<TClaims extends OIDCUserClaims = OIDCUserClaims>(): OIDCClientContextValue<TClaims>;

package/dist/server/cookies.d.ts

@@ -1,2 +1,2 @@
-import type { CookieOptions, OIDCCookies } from './types.js';
-export declare function createOIDCCookieStore(cookieSecret: string, sessionCookieName: string, stateCookieName: string, cookieOptions: CookieOptions): OIDCCookies;
+import type { CookieOptions, OIDCCookies, OIDCUserClaims } from './types.js';
+export declare function createOIDCCookieStore<TClaims extends OIDCUserClaims = OIDCUserClaims>(cookieSecret: string, sessionCookieName: string, stateCookieName: string, cookieOptions: CookieOptions): OIDCCookies<TClaims>;

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import type { OIDCOptions, OIDCInstance } from './types.js';
+import type { OIDCOptions, OIDCInstance, OIDCUserClaims } from './types.js';
 export type * from './types.js';
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
-export declare function createOIDC(options: OIDCOptions): OIDCInstance;
+export declare function createOIDC<TClaims extends OIDCUserClaims = OIDCUserClaims>(options: OIDCOptions<TClaims>): OIDCInstance<TClaims>;
 export declare const OpenIDConnect: typeof createOIDC;

package/dist/server/index.js

@@ -8,6 +8,7 @@ import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, create
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 export function createOIDC(options) {
     const cookieOptions = buildCookieOptions(options.cookieOptions);
+    const clockSkewSeconds = options.clockSkewSeconds ?? 30;
     const refreshToleranceSeconds = options.refreshToleranceSeconds ?? 30;
     const sessionCookieName = options.sessionCookieName ?? 'oidc_session';
     const stateCookieName = options.stateCookieName ?? 'oidc_auth_state';
@@ -195,9 +196,12 @@ export function createOIDC(options) {
         const claims = await verifyJwtWithJwks(idToken, {
             issuer: metadata.issuer,
             audience: options.clientId,
-            algorithms: metadata.id_token_signing_alg_values_supported
+            algorithms: metadata.id_token_signing_alg_values_supported,
+            clockSkew: clockSkewSeconds
         });
-        const transformedClaims = options.transformClaims ? await options.transformClaims(claims) : claims;
+        const transformedClaims = options.transformClaims
+            ? await options.transformClaims(claims)
+            : claims;
         if (transformedClaims.nonce !== nonce) {
             throw error(401, { message: 'Invalid id_token nonce' });
         }
@@ -207,7 +211,8 @@ export function createOIDC(options) {
         const metadata = await getMetadata();
         const claims = await verifyJwtWithJwks(logoutToken, {
             issuer: metadata.issuer,
-            audience: options.clientId
+            audience: options.clientId,
+            clockSkew: clockSkewSeconds
         });
         if (!claims.events?.['http://schemas.openid.net/event/backchannel-logout']) {
             throw error(400, { message: 'Invalid logout_token events claim' });
@@ -255,7 +260,9 @@ export function createOIDC(options) {
                 ? await validateIdToken(tokenResponse.id_token, session.nonce)
                 : session.claims;
             const rawUser = options.fetchUserInfo !== false ? await fetchUserInfo(tokenResponse.access_token) : session.user;
-            const user = options.transformUser ? await options.transformUser(rawUser, { claims }) : rawUser;
+            const user = options.transformUser
+                ? await options.transformUser(rawUser, { claims })
+                : rawUser;
             const nextSession = {
                 ...session,
                 sub: claims?.sub ?? session.sub,
@@ -344,7 +351,9 @@ export function createOIDC(options) {
         const rawUser = options.fetchUserInfo === false
             ? undefined
             : await fetchUserInfo(tokenResponse.access_token).catch(() => undefined);
-        const user = options.transformUser ? await options.transformUser(rawUser, { claims }) : rawUser;
+        const user = options.transformUser
+            ? await options.transformUser(rawUser, { claims })
+            : rawUser;
         const metadata = await getMetadata();
         const now = Math.floor(Date.now() / 1000);
         const session = {

package/dist/server/session.d.ts

@@ -1,3 +1,3 @@
-import type { OIDCSession, OIDCSessionTokens, OIDCTokenResponse } from './types.js';
+import type { OIDCSession, OIDCSessionTokens, OIDCTokenResponse, OIDCUserClaims } from './types.js';
 export declare function normalizeTokens(tokenResponse: OIDCTokenResponse, defaultScope: string[], existing?: OIDCSessionTokens, now?: number): OIDCSessionTokens;
-export declare function shouldRefresh(session: OIDCSession, refreshToleranceSeconds: number, now?: number): boolean;
+export declare function shouldRefresh<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims>, refreshToleranceSeconds: number, now?: number): boolean;

package/dist/server/store.d.ts

@@ -1,3 +1,3 @@
-import type { OIDCBackChannelLogoutStore, OIDCSessionStore } from './types.js';
-export declare function createInMemoryBackChannelLogoutStore(): OIDCBackChannelLogoutStore;
-export declare function createInMemorySessionStore(): OIDCSessionStore;
+import type { OIDCBackChannelLogoutStore, OIDCSessionStore, OIDCUserClaims } from './types.js';
+export declare function createInMemoryBackChannelLogoutStore<TClaims extends OIDCUserClaims = OIDCUserClaims>(): OIDCBackChannelLogoutStore<TClaims>;
+export declare function createInMemorySessionStore<TClaims extends OIDCUserClaims = OIDCUserClaims>(): OIDCSessionStore<TClaims>;

package/dist/server/types.d.ts

@@ -56,7 +56,7 @@ export type OIDCUserClaims = Record<string, unknown> & {
     nbf?: number;
     nonce?: string;
 };
-export type OIDCSession = {
+export type OIDCSession<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     issuer: string;
     clientId: string;
     nonce?: string;
@@ -64,16 +64,16 @@ export type OIDCSession = {
     sid?: string;
     sessionState?: string;
     groups: string[];
-    user?: OIDCUserClaims;
-    claims?: OIDCUserClaims;
+    user?: TClaims;
+    claims?: TClaims;
     tokens: OIDCSessionTokens;
     createdAt: number;
     refreshedAt: number;
 };
-export type OIDCPublicSession = {
+export type OIDCPublicSession<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     isAuthenticated: boolean;
-    user?: OIDCUserClaims;
-    claims?: OIDCUserClaims;
+    user?: TClaims;
+    claims?: TClaims;
     groups: string[];
     scope: string[];
     expiresAt?: number;
@@ -114,13 +114,13 @@ export type OIDCBackChannelLogoutRecord = {
     jti: string;
     iat: number;
 };
-export type OIDCBackChannelLogoutStore = {
+export type OIDCBackChannelLogoutStore<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     revoke(record: OIDCBackChannelLogoutRecord): MaybePromise<void>;
-    isRevoked(session: OIDCSession): MaybePromise<boolean>;
+    isRevoked(session: OIDCSession<TClaims>): MaybePromise<boolean>;
 };
-export type OIDCSessionStore = {
-    get(sessionId: string): MaybePromise<OIDCSession | null>;
-    set(sessionId: string, session: OIDCSession): MaybePromise<void>;
+export type OIDCSessionStore<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
+    get(sessionId: string): MaybePromise<OIDCSession<TClaims> | null>;
+    set(sessionId: string, session: OIDCSession<TClaims>): MaybePromise<void>;
     delete(sessionId: string): MaybePromise<void>;
 };
 export type OIDCSessionManagementConfig = {
@@ -133,7 +133,7 @@ export type OIDCSessionManagementConfig = {
     backChannelLogoutSupported: boolean;
     backChannelLogoutSessionSupported: boolean;
 };
-export type OIDCOptions = {
+export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     issuer?: string;
     discoveryUrl?: string;
     clientId: string;
@@ -151,22 +151,23 @@ export type OIDCOptions = {
     stateCookieName?: string;
     cookieSecret: string;
     cookieOptions?: Partial<CookieOptions>;
+    clockSkewSeconds?: number;
     refreshToleranceSeconds?: number;
     defaultLoginRedirect?: string;
     defaultLogoutRedirect?: string;
-    sessionStore?: OIDCSessionStore;
-    backChannelLogoutStore?: OIDCBackChannelLogoutStore;
-    transformClaims?: (claims: OIDCUserClaims) => MaybePromise<OIDCUserClaims>;
+    sessionStore?: OIDCSessionStore<TClaims>;
+    backChannelLogoutStore?: OIDCBackChannelLogoutStore<TClaims>;
+    transformClaims?: (claims: OIDCUserClaims) => MaybePromise<TClaims>;
     transformUser?: (user: OIDCUserClaims | undefined, context: {
-        claims?: OIDCUserClaims;
-    }) => MaybePromise<OIDCUserClaims | undefined>;
-    transformSession?: (session: OIDCSession, context: {
+        claims?: TClaims;
+    }) => MaybePromise<TClaims | undefined>;
+    transformSession?: (session: OIDCSession<TClaims>, context: {
         event?: RequestEvent;
         tokenResponse?: OIDCTokenResponse;
-        claims?: OIDCUserClaims;
-        user?: OIDCUserClaims;
+        claims?: TClaims;
+        user?: TClaims;
         isRefresh: boolean;
-    }) => MaybePromise<OIDCSession>;
+    }) => MaybePromise<OIDCSession<TClaims>>;
     endpoints?: Partial<OIDCDiscoveryDocument>;
 };
 export type OIDCLoginOptions = {
@@ -180,16 +181,16 @@ export type OIDCLogoutOptions = {
     state?: string;
     clearSessionOnly?: boolean;
 };
-export type OIDCCallbackResult = {
-    session: OIDCSession;
+export type OIDCCallbackResult<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
+    session: OIDCSession<TClaims>;
     returnTo: string;
 };
-export type OIDCHandleLocals = {
+export type OIDCHandleLocals<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     isAuthenticated: boolean;
-    session: OIDCSession | null;
-    user?: OIDCUserClaims;
-    claims?: OIDCUserClaims;
-    requireAuth: () => Promise<OIDCSession>;
+    session: OIDCSession<TClaims> | null;
+    user?: TClaims;
+    claims?: TClaims;
+    requireAuth: () => Promise<OIDCSession<TClaims>>;
     clearSession: () => Promise<void>;
 };
 export type OIDCStateCookie = {
@@ -199,8 +200,8 @@ export type OIDCStateCookie = {
     returnTo: string;
     createdAt: number;
 };
-export type OIDCCallbackHandlerOptions = {
-    onsuccess?: (event: RequestEvent, result: OIDCCallbackResult) => MaybePromise<Response | void>;
+export type OIDCCallbackHandlerOptions<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
+    onsuccess?: (event: RequestEvent, result: OIDCCallbackResult<TClaims>) => MaybePromise<Response | void>;
     onfailure?: (event: RequestEvent, err: unknown) => MaybePromise<Response | void>;
     redirectTo?: string;
 };
@@ -213,9 +214,9 @@ export type OIDCClientAssertionOptions = {
     clientId: string;
     clientSecret?: string;
 };
-export type OIDCCookies = {
-    readSession(cookies: Cookies): OIDCSession | null;
-    writeSession(cookies: Cookies, session: OIDCSession): void;
+export type OIDCCookies<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
+    readSession(cookies: Cookies): OIDCSession<TClaims> | null;
+    writeSession(cookies: Cookies, session: OIDCSession<TClaims>): void;
     clearSession(cookies: Cookies): void;
     readSessionReference(cookies: Cookies): {
         id: string;
@@ -228,28 +229,29 @@ export type OIDCCookies = {
     writeState(cookies: Cookies, state: OIDCStateCookie): void;
     clearState(cookies: Cookies): void;
 };
-export type OIDCPersistedSession = {
+export type OIDCPersistedSession<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     id?: string;
-    session: OIDCSession;
+    session: OIDCSession<TClaims>;
 };
-export type OIDCInstance = {
+export type OIDCInstance<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     handle: Handle;
     getMetadata: () => Promise<OIDCDiscoveryDocument>;
-    getSession: (event: RequestEvent) => Promise<OIDCSession | null>;
-    getPublicSession: (event: RequestEvent) => Promise<OIDCPublicSession | null>;
+    getSession: (event: RequestEvent) => Promise<OIDCSession<TClaims> | null>;
+    getPublicSession: (event: RequestEvent) => Promise<OIDCPublicSession<TClaims> | null>;
     getSessionManagementConfig: () => Promise<OIDCSessionManagementConfig>;
     login: (event: RequestEvent, loginOptions?: OIDCLoginOptions) => Promise<never>;
     logout: (event: RequestEvent, logoutOptions?: OIDCLogoutOptions) => Promise<never>;
-    handleCallback: (event: RequestEvent) => Promise<OIDCCallbackResult>;
+    handleCallback: (event: RequestEvent) => Promise<OIDCCallbackResult<TClaims>>;
     handleBackChannelLogout: (event: RequestEvent) => Promise<Response>;
     loginHandler: (defaults?: OIDCLoginOptions) => RequestHandler;
-    callbackHandler: (handlerOptions?: OIDCCallbackHandlerOptions) => RequestHandler;
+    callbackHandler: (handlerOptions?: OIDCCallbackHandlerOptions<TClaims>) => RequestHandler;
     logoutHandler: (defaults?: OIDCLogoutOptions) => RequestHandler;
     backChannelLogoutHandler: () => RequestHandler;
     createActions: (actionOptions?: OIDCActionOptions) => Readonly<{
         login: Action;
         logout: Action;
     }>;
-    requireAuth: (event: RequestEvent, returnTo?: string) => Promise<OIDCSession>;
+    requireAuth: (event: RequestEvent, returnTo?: string) => Promise<OIDCSession<TClaims>>;
     clearSession: (cookies: Cookies) => Promise<void>;
 };
+export type OIDCInferClaims<T> = T extends OIDCInstance<infer TClaims> ? TClaims : OIDCUserClaims;

package/dist/server/utils.d.ts

@@ -8,7 +8,7 @@ export declare function createPKCEPair(length?: number): {
 export declare function normalizeIssuer(issuer: string): string;
 export declare function normalizeScope(scope?: string[]): string[];
 export declare function normalizeStringArray(value: unknown): string[];
-export declare function collectGroups(...sources: Array<OIDCUserClaims | undefined>): string[];
+export declare function collectGroups<TClaims extends OIDCUserClaims = OIDCUserClaims>(...sources: Array<TClaims | undefined>): string[];
 export declare function createSignedValue(value: string, secret: string): string;
 export declare function verifySignedValue(value: string, secret: string): string | null;
 export declare function serializeSignedCookie(payload: unknown, secret: string): string;
@@ -16,4 +16,4 @@ export declare function parseSignedCookie<T>(value: string | undefined, secret:
 export declare function buildCookieOptions(options?: Partial<CookieOptions>): CookieOptions;
 export declare function parseProviderError(event: RequestEvent): null;
 export declare function absoluteUrl(event: RequestEvent, pathOrUrl: string): string;
-export declare function toPublicSession(session: OIDCSession | null): OIDCPublicSession | null;
+export declare function toPublicSession<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims> | null): OIDCPublicSession<TClaims> | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "OIDC authentication helpers for SvelteKit applications.",
   "license": "Apache-2.0",
   "scripts": {
@@ -57,22 +57,22 @@
     "svelte": "^5.0.0"
   },
   "devDependencies": {
-    "@sveltejs/adapter-auto": "^7.0.0",
-    "@sveltejs/kit": "^2.50.2",
-    "@sveltejs/package": "^2.5.7",
-    "@sveltejs/vite-plugin-svelte": "^6.2.4",
-    "@types/node": "^25.5.2",
+    "@sveltejs/adapter-auto": "^7.0.1",
+    "@sveltejs/kit": "^2.63.1",
+    "@sveltejs/package": "^2.5.8",
+    "@sveltejs/vite-plugin-svelte": "^7.1.2",
+    "@types/node": "^25.9.2",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
-    "publint": "^0.3.17",
-    "svelte": "^5.54.0",
-    "svelte-check": "^4.4.2",
-    "typescript": "^5.9.3",
-    "vite": "^7.3.1",
-    "@vitest/coverage-v8": "^4.1.2",
-    "vitest": "^4.1.2",
-    "@sourceregistry/semantic-release-jsr": "^1.0.1",
-    "typedoc": "^0.28.18"
+    "publint": "^0.3.21",
+    "svelte": "^5.56.3",
+    "svelte-check": "^4.6.0",
+    "typescript": "^6.0.3",
+    "vite": "^8.0.16",
+    "@vitest/coverage-v8": "^4.1.8",
+    "vitest": "^4.1.8",
+    "@sourceregistry/semantic-release-jsr": "^1.1.1",
+    "typedoc": "^0.28.19"
   },
   "keywords": [
     "sveltekit",
@@ -83,7 +83,7 @@
     "oauth"
   ],
   "dependencies": {
-    "@sourceregistry/node-jwt": "^1.5.9"
+    "@sourceregistry/node-jwt": "^1.5.10"
   },
   "release": {
     "branches": [