Interface ClaimsTicket

What PHP is handed, exactly once.

Single use is the guarantee (the ticket sits in a redirect URL, so history and proxy logs see it); the TTL only narrows the window.

interface ClaimsTicket {
    email: string;
    expiresAt: number;
    issuer: string;
    name: string;
    sub: string;
    ticket: string;
}