{
  "schemaVersion": 3,
  "package": "@owlmeans/server-oidc-rp",
  "version": "0.1.18",
  "generatedAt": "2026-10-28T00:31:34.743Z",
  "canonicalRepo": "https://github.com/owlmeans/common",
  "entries": [
    {
      "kind": "skill",
      "name": "server-oidc-rp",
      "category": "package-specific",
      "file": "skills/server-oidc-rp/SKILL.md",
      "canonicalPath": ".agents/skills/server-oidc-rp/SKILL.md",
      "parts": [
        {
          "name": "providers",
          "file": "skills/server-oidc-rp/parts/providers.md",
          "description": "Resolving a provider through OidcClientService, the client adapter surface, and the owned public types that keep openid-client out of the API.",
          "purposes": [
            "auth",
            "config"
          ],
          "mentions": [
            "OidcClientService",
            "findProvider",
            "hasProvider",
            "getConfig",
            "getDefault",
            "entityToClientId",
            "registerTemporaryProvider",
            "OidcClientAdapter",
            "OidcTokenSet",
            "OidcClientDescriptor",
            "openid-client"
          ]
        },
        {
          "name": "sessions",
          "file": "skills/server-oidc-rp/parts/sessions.md",
          "description": "Where the verifier, exchange and session records are cached, and the acting organization of a tenanted session and its switch.",
          "purposes": [
            "auth",
            "state"
          ],
          "mentions": [
            "OIDC_TOKEN_STORE",
            "AUTH_CACHE",
            "oidcCacheOf",
            "sessionRecord",
            "oidcOrganizationHelper",
            "ORGANIZATIONS_SCOPE",
            "pickOrganization",
            "switchOrganization",
            "listOrganizations",
            "ORGANIZATION_REFUSAL"
          ]
        },
        {
          "name": "sign-in",
          "file": "skills/server-oidc-rp/parts/sign-in.md",
          "description": "The authorization round trip — requested scope, id_token-only decoding, consume-once PKCE verifiers, entityId in the browser-starts-server-finishes flow, and absolute URLs from a server context.",
          "purposes": [
            "auth"
          ],
          "mentions": [
            "requestedScope",
            "OIDC_RP_BASE_SCOPES",
            "extraScopes",
            "GOOGLE_CLIENT_AUTH",
            "decodeJwt",
            "id_token",
            "DISPATCHER_OIDC",
            "makeSecurityHelper"
          ]
        }
      ]
    }
  ]
}