release: WRNexusJS 0.8.0

.publish/oauth/README.md

@@ -194,3 +194,24 @@ const gitlab = defineProvider({
   `verifier` between `startAuth` and `completeAuth` (session or signed cookie).
 - Pairs with [`@wrnexus/core`](../core) — feed the normalized `OAuthProfile` into
   `logIn` to establish a session.
+  OIDC integrations can combine strict discovery with the rotating JWKS verifier:
+
+```ts
+import { createRemoteJwks } from "@wrnexus/jwt";
+import { discoverOidc, verifyOidcIdToken } from "@wrnexus/oauth";
+
+const metadata = await discoverOidc("https://issuer.example");
+const jwks = createRemoteJwks(metadata.jwks_uri);
+const claims = await verifyOidcIdToken(idToken, {
+  issuer: metadata.issuer,
+  clientId: "client-id",
+  jwks,
+  nonce: expectedNonce,
+  accessToken,
+});
+```
+
+Discovery requires an exact normalized issuer and HTTPS endpoints without URL
+credentials/fragments. ID-token verification checks the RS256 signature,
+expiry/not-before, issuer, audience, required OIDC claims, nonce, multi-audience
+`azp`, optional token age, and optional `at_hash` binding.