@ultimat3/auth 25.2.0 → 26.1.0

package/CLAUDE.md

@@ -76,13 +76,15 @@ Tier 2. Produces the `Actor`; produces nothing else. Authorization is `@ultimat3
   `decodeJwtSegment` answers `null` for all three failures; each caller raises its own refusal.
 - Absolute and idle expiry are two separate computations in `sessionExpiry()`. Do not fold them.
 - PKCE is not provider-dependent: `OAuthProvider.usesPkce` is the literal `true`.
-- **Providers are a registry, `OAuthProviderId` is `string`.** The three built-ins seed it through
+- **Providers are a registry, `OAuthProviderId` is `string`.** The two built-ins seed it through
   `registerOAuthProvider()`, the call an app makes. `providerFor(id)` throws
   `X_OAUTH_PROVIDER_UNKNOWN`, never `undefined`; a second claim is `X_OAUTH_PROVIDER_DUPLICATE`.
 - **`oauthProviderUnknown(provider, supported)` scopes its list to its reader**: the route passes
   `BUILTIN_OAUTH_PROVIDER_IDS` (an anonymous caller), `providerFor()` passes `oauthProviderIds()`.
 - **`verifyIdToken({ keys })` is required, with no default.** `'token-endpoint-tls'` is the OIDC
-  Core 3.1.3.7 exemption and `exchangeOAuthCode` is its only entitled caller. `HS256` and
+  Core 3.1.3.7 exemption and `exchangeOAuthCode` is its only entitled caller — and since 26.0.0
+  it defaults to the provider's `providerJwks` whenever there is a `jwksUri`, using the exemption
+  only for a provider with none or when the caller names it (`idTokenKeys`). `HS256` and
   `alg: none` are refused in `decodeJwtHeader`. It checks `nbf` and `azp` too.
 - **`resolveGrants` is a seam, never a group-to-role table**, called on EVERY login. Absent leaves
   the row alone. A user created with no roles and no org logs a warning.
@@ -222,7 +224,7 @@ Tier 2. Produces the `Actor`; produces nothing else. Authorization is `@ultimat3
 | `rate-limit-postgres.ts` | the SHARED limiter: one table, one row per key, a one-statement take, over a structural `PgExecutor` |
 | `limiter-install.ts` | the host's one install point for that limiter — the factory, what it built, and the purge over it |
 | `oauth.ts` | `OAuthProvider`, PKCE, `beginOAuth`, the callback gate. No I/O, no env |
-| `oauth-builtins.ts` | the three shipped IdPs, as data. Imports only the type, so no cycle |
+| `oauth-builtins.ts` | the two shipped IdPs (`github`, `google`), as data. Imports only the type, so no cycle |
 | `oauth-registry.ts` | the registry: `registerOAuthProvider`, `providerFor`, `oauthProviderIds` |
 | `oauth-discovery.ts` | `/.well-known/openid-configuration` → an `OAuthProvider`. One `fetch` |
 | `jwks.ts` | `crypto.subtle` signature verification, cached by `kid`, one shared in-flight refresh. No dependency |

package/README.md

@@ -207,7 +207,7 @@ that sweep at boot.
 ## Providers are a registry, not a union
 
 `OAuthProviderId` is `string`, and `registerOAuthProvider()` is the one way a provider gets in —
-the three built-ins go through the same call. Before 1.3.0 the id was `keyof typeof
+the two built-ins go through the same call. Before 1.3.0 the id was `keyof typeof
 OAUTH_PROVIDERS` over `github | google | apple`, so an enterprise OP was **unrepresentable**: the
 constraint was a type, there was no runtime escape, and the only ways out were forking the package
 or bypassing OAuth entirely and losing PKCE, the sealed handshake, issuer pinning and account
@@ -241,7 +241,7 @@ registerOAuthProvider(await discoverOAuthProvider({ id: 'bigco-sso', issuer: 'ht
 | `registerOAuthProvider(provider)` | the frozen provider; `X_OAUTH_PROVIDER_DUPLICATE` on a second claim of one id |
 | `providerFor(id)` | the provider, or throws `X_OAUTH_PROVIDER_UNKNOWN` — never `undefined` |
 | `hasOAuthProvider(id)` | whether the id is registered |
-| `BUILTIN_OAUTH_PROVIDER_IDS` | the three shipped ids — the only list an **anonymous** refusal is built from, and it is named in the `auth.oauth.refused` log line, never in the response body |
+| `BUILTIN_OAUTH_PROVIDER_IDS` | the two shipped ids — the only list an **anonymous** refusal is built from, and it is named in the `auth.oauth.refused` log line, never in the response body |
 | `oauthProviderIds()` | every registered id, live. **NOT** what `defineAuth({ providers })` defaults to — that is `[]`, so an app names what it enabled |
 
 `discoverOAuthProvider` refuses a document with no `jwks_uri`: without a key set there is nothing
@@ -262,9 +262,35 @@ because a default is what silently makes a second door as trusting as the first.
 
 | `keys` | Means |
 |---|---|
-| `'token-endpoint-tls'` | this token came off a TLS response from the provider's own token endpoint — the one case OIDC Core 3.1.3.7 exempts. `exchangeOAuthCode` passes it, and that is the only shipped call site that may |
+| `'token-endpoint-tls'` | this token came off a TLS response from the provider's own token endpoint — the one case OIDC Core 3.1.3.7 exempts. Since 26.0.0 the login flow uses it only for a provider with no `jwksUri`, or when the app names it |
 | a `JwksKeySource` | the signature is checked. `providerJwks(providerFor(id))`, or `jwksClient({ provider, jwksUri })` |
 
+**The login flow verifies the signature by default** (26.0.0). `exchangeOAuthCode`, and with it
+`completeOAuthLogin` and `oauthLogin`'s callback, checks the id token against the provider's
+published key set (`providerJwks`, cached per provider, one fetch per TTL) whenever the provider has
+a `jwksUri` — Google and every discovered provider do; GitHub issues no id token. The token-endpoint
+exemption trusts every hop the response crossed (a TLS-inspecting proxy, a bad DNS answer); a
+signature trusts only the provider. A bad signature is `X_OAUTH_TOKEN_INVALID` (400) and no session.
+
+| Where | Option | Default |
+|---|---|---|
+| `exchangeOAuthCode(handshake, callback, { keys })` | `keys?: IdTokenKeys` | the provider's key set, else `'token-endpoint-tls'` |
+| `completeOAuthLogin(auth, { idTokenKeys })` | `idTokenKeys?: IdTokenKeys` | same |
+| `oauthLogin(auth, { idTokenKeys })` | `idTokenKeys?: (provider) => IdTokenKeys \| undefined` — asked per callback; `undefined` = the default | same |
+
+```ts
+import { type Auth, oauthLogin } from '@ultimat3/auth';
+
+declare const auth: Auth;
+
+// An egress that cannot reach one provider's jwks_uri: name the exemption for that provider only.
+// `undefined` keeps every other provider on the default — never `providerJwks(providerFor(id))`
+// here, which throws for GitHub: it publishes no jwks_uri.
+export const login = oauthLogin(auth, {
+  idTokenKeys: (provider) => (provider === 'bigco-sso' ? 'token-endpoint-tls' : undefined),
+});
+```
+
 ```ts
 const keys = providerJwks(providerFor('bigco-sso'));
 const claims = await verifyIdToken({ provider: 'bigco-sso', idToken, clientId, nonce, clock, keys });
@@ -743,14 +769,13 @@ override all three at once.
 |---|---|---|---|
 | `github` | S256 | — profile + verified-emails call | `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` |
 | `google` | S256 | required, nonce-bound | `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` |
-| `apple` | S256 | required, nonce-bound | `APPLE_CLIENT_ID` / `APPLE_CLIENT_SECRET` |
 
-Apple alone rejects a static secret: `APPLE_CLIENT_SECRET` must hold the ES256 client-secret
-JWT signed with the `.p8` key, which Apple expires every six months.
+Apple is not a built-in (removed in 26.0.0): it POSTs its callback (`response_mode=form_post`) and
+both callback routes are GET. An app that needs it registers its own with `registerOAuthProvider`.
 
 | Step | Does | Fails with |
 |---|---|---|
-| `oauthLogin(auth)` | the two routes: redirect out, session back | `X_OAUTH_PROVIDER_UNKNOWN`, `X_OAUTH_DENIED` |
+| `oauthLogin(auth)` | the two routes: redirect out, session back — the id token's signature verified against the provider's key set (`idTokenKeys` overrides) | `X_OAUTH_PROVIDER_UNKNOWN`, `X_OAUTH_DENIED`, `X_OAUTH_TOKEN_INVALID` |
 | `handshakeCookie` / `readHandshakeCookie` | seals the handshake onto the redirect, opens it on the callback | `X_OAUTH_STATE_INVALID`, `X_ENV_MISSING` |
 | `exchangeOAuthCode` | POSTs the code + PKCE verifier, verifies the id token | `X_OAUTH_EXCHANGE_FAILED`, `X_OAUTH_TOKEN_INVALID` |
 | `oauthProfile` | id-token claims, else userinfo → one normalised identity | `X_OAUTH_EXCHANGE_FAILED` |
@@ -856,7 +881,7 @@ later. In a test the store is `memoryAuthAdapter()` — every `AuthAdapter` is a
 | `X_OAUTH_STATE_INVALID` | state, nonce or PKCE verifier did not match |
 | `X_OAUTH_EXCHANGE_FAILED` | the provider refused the exchange, or returned no usable identity |
 | `X_OAUTH_TOKEN_INVALID` | the id token failed its signature, issuer, audience or expiry check, or no key in the published set matched its `kid` |
-| `X_OAUTH_PROVIDER_UNKNOWN` | the URL named a provider nothing registered, one `defineAuth({ providers })` did not enable, or one whose `*_CLIENT_ID`/`*_CLIENT_SECRET` are unset — all three answer 404 with the same body, because telling an anonymous caller which is which describes this deployment for free. The real reason is logged. The refusal lists only the three built-ins, never your registry |
+| `X_OAUTH_PROVIDER_UNKNOWN` | the URL named a provider nothing registered, one `defineAuth({ providers })` did not enable, or one whose `*_CLIENT_ID`/`*_CLIENT_SECRET` are unset — all three answer 404 with the same body, because telling an anonymous caller which is which describes this deployment for free. The real reason is logged. The refusal lists only the two built-ins, never your registry |
 | `X_OAUTH_PROVIDER_DUPLICATE` | two `registerOAuthProvider` calls claimed one id — at boot, never at a login |
 | `X_OAUTH_DENIED` | the user pressed Cancel, or the provider declined — `403`, never a `502` |
 | `X_PASSWORD_WEAK` | strength check rejected the password |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/auth",
-  "version": "25.2.0",
+  "version": "26.1.0",
   "description": "Sessions, passwords, OAuth, MFA and api keys — resolved to one Actor",
   "license": "MIT",
   "type": "module",
@@ -32,8 +32,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "25.2.0",
-    "@ultimat3/db": "25.2.0",
-    "@ultimat3/schema": "25.2.0"
+    "@ultimat3/core": "26.1.0",
+    "@ultimat3/db": "26.1.0",
+    "@ultimat3/schema": "26.1.0"
   }
 }

package/src/auth.ts

@@ -72,7 +72,7 @@ export const SessionSchema = t.object({
 export const AccountSchema = t.object({
   id: t.uuid,
   userId: t.uuid,
-  // Any registered provider id, not the three built-ins: an app that registers its own OP has
+  // Any registered provider id, not the two built-ins: an app that registers its own OP has
   // account rows carrying that id, and an enum of three would refuse to parse its own data.
   provider: t.string,
   providerAccountId: t.string,

package/src/index.ts

@@ -176,7 +176,6 @@ export type {
 } from './oauth';
 export { assertOAuthCallback, beginOAuth, pkcePair } from './oauth';
 export {
-  APPLE_PROVIDER,
   BUILTIN_OAUTH_PROVIDER_IDS,
   BUILTIN_OAUTH_PROVIDERS,
   GITHUB_PROVIDER,

package/src/oauth-builtins.ts

@@ -1,4 +1,5 @@
-// Single responsibility: the three consumer IdPs Ultimate ships with, as plain data. They live
+// Single responsibility: the two consumer IdPs Ultimate ships with, as plain data. Apple left in
+// 26.0.0: it POSTs its callback and both callback routes are GET, so it could never complete. They live
 // apart from `oauth-registry.ts` so the registry can be seeded from them while `oauth.ts` reads
 // the registry — the only edge back to `oauth.ts` is the type, and a type is erased, so there is
 // no runtime cycle between the three files.
@@ -39,44 +40,19 @@ export const GOOGLE_PROVIDER: OAuthProvider = {
   clientSecretEnv: 'GOOGLE_CLIENT_SECRET',
 };
 
-/**
- * UNPROVEN: this flow has never completed a sign-in against Apple, in a test or anywhere else.
- * Apple answers a request that asks for a scope with `response_mode=form_post` — a POST to the
- * callback — and both route descriptors in `oauth-route.ts` are GET and read the query string.
- * Whether this entry ships or is removed is an open owner decision; do not rely on it.
- */
-export const APPLE_PROVIDER: OAuthProvider = {
-  id: 'apple',
-  authorizeUrl: 'https://appleid.apple.com/auth/authorize',
-  tokenUrl: 'https://appleid.apple.com/auth/token',
-  // Apple returns claims in the id token only; there is no userinfo endpoint to call.
-  userInfoUrl: null,
-  userEmailsUrl: null,
-  issuers: ['https://appleid.apple.com'],
-  jwksUri: 'https://appleid.apple.com/auth/keys',
-  scopes: ['name', 'email'],
-  usesPkce: true,
-  usesNonce: true,
-  clientIdEnv: 'APPLE_CLIENT_ID',
-  // Apple alone does not accept a static secret: `APPLE_CLIENT_SECRET` must hold the ES256
-  // client-secret JWT signed with the .p8 key, which Apple expires every six months.
-  clientSecretEnv: 'APPLE_CLIENT_SECRET',
-};
-
 /** Seeded into the registry at import, through the same call an app registers its own IdP with. */
 export const BUILTIN_OAUTH_PROVIDERS: readonly OAuthProvider[] = Object.freeze([
   GITHUB_PROVIDER,
   GOOGLE_PROVIDER,
-  APPLE_PROVIDER,
 ]);
 
 /**
- * The three ids, and the only list an ANONYMOUS caller is ever shown. It is a framework constant
+ * The two ids, and the only list an ANONYMOUS caller is ever shown. It is a framework constant
  * already in the docs, so naming it discloses nothing; the live registry is not, because an app
  * that registered `acme-internal-sso` has put its own vocabulary in there. `oauth-route.ts` is the
  * one reader in this package — every other refusal reaches a developer and gets
  * `oauthProviderIds()` instead. Off `index.ts` too, because an app writing its own login route
- * owes an anonymous caller the same narrow list and must not have to restate the three ids.
+ * owes an anonymous caller the same narrow list and must not have to restate the two ids.
  */
 export const BUILTIN_OAUTH_PROVIDER_IDS: readonly string[] = Object.freeze(
   BUILTIN_OAUTH_PROVIDERS.map((provider) => provider.id),

package/src/oauth-cookie.ts

@@ -186,7 +186,7 @@ export function openHandshake(
  * session cookie's: the callback is a top-level cross-site GET from the provider, which `Lax`
  * still attaches the cookie to and `Strict` would strip — leaving every login to fail its state
  * check. A provider answering with `response_mode=form_post` POSTs instead, and this cookie
- * would not reach it; none of the three built-in providers is configured that way.
+ * would not reach it; neither built-in provider is configured that way.
  */
 export function handshakeCookie(
   handshake: OAuthHandshake,

package/src/oauth-discovery.ts

@@ -46,7 +46,7 @@ const stringOrNull = (body: Record<string, unknown>, key: string): string | null
   return typeof value === 'string' && value !== '' ? value : null;
 };
 
-/** `bigco-sso` → `BIGCO_SSO_CLIENT_ID`, the same shape the three built-ins use. */
+/** `bigco-sso` → `BIGCO_SSO_CLIENT_ID`, the same shape the two built-ins use. */
 const envPrefix = (id: string): string => id.toUpperCase().replace(/[^A-Z0-9]+/g, '_');
 
 /**

package/src/oauth-errors.ts

@@ -33,7 +33,7 @@ export const restartAt = (provider: string): string =>
  *
  * **`supported` is the CALLER's to scope, because the two callers have two audiences.**
  * `oauth-route.ts` passes `BUILTIN_OAUTH_PROVIDER_IDS` — its reader is an anonymous stranger who
- * typed a URL, and the three built-ins are a framework constant already in the public docs, while
+ * typed a URL, and the two built-ins are a framework constant already in the public docs, while
  * the live registry holds whatever internal OP this deployment registered. `providerFor()` passes
  * `oauthProviderIds()` — its reader is a developer holding a stack trace, and there the full list
  * is exactly what makes the fix runnable. Neither ever passes `defineAuth({ providers })`: naming

package/src/oauth-exchange.ts

@@ -14,11 +14,12 @@ import {
 } from '@ultimat3/core';
 import { type IdTokenClaims, verifyIdToken } from './id-token';
 import { isRecord } from './json';
-import type { IdTokenKeys } from './jwks';
+import { type IdTokenKeys, providerJwks } from './jwks';
 import {
   assertOAuthCallback,
   type OAuthCallback,
   type OAuthHandshake,
+  type OAuthProvider,
   type OAuthProviderId,
 } from './oauth';
 import { oauthExchangeFailed, restartAt } from './oauth-errors';
@@ -60,10 +61,12 @@ export interface OAuthExchangeOptions {
   readonly fetch?: OAuthFetch | undefined;
   readonly timeoutMs?: number | undefined;
   /**
-   * Defaults to `'token-endpoint-tls'`, and this is the one call site where that default is
-   * correct: the id token below was read off a TLS response from the provider's own token
-   * endpoint, which is the channel OIDC Core 3.1.3.7 exempts. An app that pins the key set anyway
-   * — a corporate egress proxy, a compliance requirement — passes `providerJwks(providerFor(id))`.
+   * Where the id token's signature is checked against. Default (26.0.0): the provider's own
+   * published key set (`providerJwks`, cached per provider) whenever it has a `jwksUri`, and
+   * token-endpoint TLS only for a provider that publishes none. OIDC Core 3.1.3.7 exempts the
+   * token endpoint, but that exemption trusts every hop the response crossed — a TLS-inspecting
+   * egress proxy, a misrouted DNS answer — and a verified signature trusts only the provider.
+   * `'token-endpoint-tls'` is the explicit opt-out; a `jwksClient({ jwksUri })` pins another set.
    */
   readonly keys?: IdTokenKeys | undefined;
 }
@@ -273,6 +276,23 @@ async function postForm(
   return parsed;
 }
 
+/**
+ * The provider's key set when it publishes one, else the token-endpoint exemption. An injected
+ * `fetch` (a test, an egress proxy) gets a client of its own, so the key set travels the same
+ * path as the token; the global one shares `providerJwks`'s memo, so a key set is fetched once
+ * per TTL per process, not once per login.
+ */
+function defaultIdTokenKeys(provider: OAuthProvider, options: OAuthExchangeOptions): IdTokenKeys {
+  if (provider.jwksUri === null) return 'token-endpoint-tls';
+  return options.fetch === undefined
+    ? providerJwks(provider)
+    : providerJwks(provider, {
+        fetch: options.fetch,
+        ...(options.clock === undefined ? {} : { clock: options.clock }),
+        ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
+      });
+}
+
 /**
  * Validates the callback, then trades the code for tokens. PKCE's verifier travels here and
  * nowhere else — it is what proves this exchange belongs to the browser that started the flow.
@@ -341,7 +361,7 @@ export async function exchangeOAuthCode(
             clientId: options.credentials.clientId,
             nonce: handshake.nonce,
             clock,
-            keys: options.keys ?? 'token-endpoint-tls',
+            keys: options.keys ?? defaultIdTokenKeys(provider, options),
           }),
   };
 }

package/src/oauth-login.ts

@@ -8,6 +8,7 @@ import type { AuthAccount, AuthUser } from './adapter';
 import type { Auth, LoginResult } from './auth';
 import { normaliseEmail } from './email';
 import { AuthError, authWriteFailed } from './errors';
+import type { IdTokenKeys } from './jwks';
 import { mfaChallengeRequired } from './mfa-challenge';
 import type { OAuthCallback, OAuthHandshake } from './oauth';
 import { oauthExchangeFailed, restartAt } from './oauth-errors';
@@ -326,6 +327,11 @@ export interface CompleteOAuthLoginInput {
   readonly userAgent?: string | null | undefined;
   /** The app's grant seam. Called once, after the profile is proven. */
   readonly resolveGrants?: ResolveOAuthGrants | undefined;
+  /**
+   * What the id token's signature is checked against — `exchangeOAuthCode`'s `keys`. Default:
+   * the provider's published key set when it has a `jwksUri`, token-endpoint TLS when it has none.
+   */
+  readonly idTokenKeys?: IdTokenKeys | undefined;
 }
 
 /** Callback → session, in one call: exchange, identify, sign in. */
@@ -339,6 +345,7 @@ export async function completeOAuthLogin(
     clock: auth.clock,
     fetch: input.fetch,
     timeoutMs: input.timeoutMs,
+    keys: input.idTokenKeys,
   });
   const options = { fetch: input.fetch, timeoutMs: input.timeoutMs };
   const { profile, userinfo } = await readOAuthProfile(provider, tokens, options);

package/src/oauth-registry.ts

@@ -2,7 +2,7 @@
 // consumer IdPs made an enterprise OP — Okta, Entra, Ping, an in-house OP — *unrepresentable*: the
 // constraint was a type, so there was no runtime escape and the only ways out were forking the
 // package or bypassing the whole subsystem, losing PKCE, the sealed handshake, issuer pinning and
-// account linking with it. The three built-ins register through the same call an app uses, so the
+// account linking with it. The two built-ins register through the same call an app uses, so the
 // opening does not create a second path.
 
 import { renderCauseValue, renderFixLiteral } from '@ultimat3/core';

package/src/oauth-route.ts

@@ -20,6 +20,7 @@ import {
 } from '@ultimat3/core';
 import type { Auth, LoginResult } from './auth';
 import { AuthError } from './errors';
+import type { IdTokenKeys } from './jwks';
 import { beginOAuth, type OAuthProviderId } from './oauth';
 import { BUILTIN_OAUTH_PROVIDER_IDS } from './oauth-builtins';
 import { clearHandshakeCookie, handshakeCookie, readHandshakeCookie } from './oauth-cookie';
@@ -113,6 +114,15 @@ export interface OAuthLoginOptions {
    * sign-in rather than never.
    */
   readonly resolveGrants?: ResolveOAuthGrants | undefined;
+  /**
+   * What each provider's id token signature is checked against, asked per callback. Omit it and
+   * the callback verifies against the provider's published key set (`providerJwks`) whenever it
+   * has a `jwksUri` — token-endpoint TLS only for one that publishes none. Return
+   * `'token-endpoint-tls'` to opt a provider out, a `jwksClient({ jwksUri })` to pin another set,
+   * or `undefined` to leave that provider on the default. `undefined` is the safe "everyone else"
+   * branch: `providerJwks(providerFor('github'))` throws, because GitHub publishes no `jwks_uri`.
+   */
+  readonly idTokenKeys?: ((provider: OAuthProviderId) => IdTokenKeys | undefined) | undefined;
   readonly env?: Readonly<Record<string, string | undefined>> | undefined;
 }
 
@@ -227,13 +237,22 @@ function providerSegment(request: Request, leg: 'start' | 'callback'): string {
   return segments[index] ?? '';
 }
 
+/** The app's answer for this provider, or nothing — so `undefined` falls through to the default. */
+function idTokenKeysFor(
+  options: OAuthLoginOptions,
+  provider: OAuthProviderId,
+): { readonly idTokenKeys?: IdTokenKeys } {
+  const keys = options.idTokenKeys?.(provider);
+  return keys === undefined ? {} : { idTokenKeys: keys };
+}
+
 /**
  * Both halves of "is this a provider", in one refusal. An unknown segment and a known provider
  * the app left out of `defineAuth({ providers })` are the same 404 on purpose — telling an
  * anonymous caller which of the two it hit describes the app's configuration for free.
  *
- * The list in the refusal is the THREE BUILT-INS, never the live registry and never
- * `defineAuth({ providers })`. Both of the latter are this deployment's own configuration, and
+ * The list in the refusal is the BUILT-INS (`BUILTIN_OAUTH_PROVIDER_IDS`), never the live
+ * registry and never `defineAuth({ providers })`. Both of the latter are this deployment's own configuration, and
  * this caller is an anonymous stranger who typed a URL: an app that registered an internal OP has
  * put its own vocabulary into the registry, and echoing it back names a system the stranger had no
  * way to know exists. The built-in list is a framework constant already in the public docs, so it
@@ -373,6 +392,7 @@ async function callbackHandler(
       ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
       ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
       ...(options.resolveGrants === undefined ? {} : { resolveGrants: options.resolveGrants }),
+      ...idTokenKeysFor(options, provider),
       ip: options.clientIp?.(request) ?? null,
       userAgent: request.headers.get('user-agent'),
     });