@_mustachio/openauth 0.10.0 → 0.11.0

package/src/index.ts

@@ -57,8 +57,11 @@ export type {
 
 export type {
   AccessTokenClaims,
+  AddressClaim,
   CodePayload,
+  IdTokenClaims,
   RefreshTokenPayload,
+  ScopedProfileClaims,
   TokenResponse,
 } from "./types/token"
 
@@ -74,6 +77,9 @@ export type {
   IdP,
   IdPOptions,
   PersistUpstreamTokens,
+  RegisterClient,
+  RegisterClientRequest,
+  RegisterClientResponse,
   RenderPicker,
   SuccessEvent,
   SuccessMapInput,
@@ -90,7 +96,11 @@ export type {
   SigningKey,
 } from "./ports/key-store"
 export type { MethodStore } from "./ports/method-store"
-export type { SessionRecord, SessionStore } from "./ports/session-store"
+export type {
+  ParRecord,
+  SessionRecord,
+  SessionStore,
+} from "./ports/session-store"
 export type { TokenStore } from "./ports/token-store"
 
 /**
@@ -243,6 +253,7 @@ export function createIdP(opts: IdPOptions): IdP {
       ? { exchangeAudience: opts.exchangeAudience }
       : {}),
     ...(opts.renderPicker ? { renderPicker: opts.renderPicker } : {}),
+    ...(opts.registerClient ? { registerClient: opts.registerClient } : {}),
     ...(opts.buildCustomContext
       ? { buildCustomContext: opts.buildCustomContext }
       : {}),
@@ -254,6 +265,9 @@ export function createIdP(opts: IdPOptions): IdP {
         : {}),
       ...(opts.cookies?.path !== undefined ? { path: opts.cookies.path } : {}),
     },
+    ...(opts.customScopeClaims !== undefined
+      ? { customScopeClaims: opts.customScopeClaims }
+      : {}),
   }
 
   const app = buildRouter(deps)
@@ -268,5 +282,8 @@ export function createIdP(opts: IdPOptions): IdP {
     discovery: fetch,
     revoke: fetch,
     introspect: fetch,
+    endSession: fetch,
+    par: fetch,
+    register: fetch,
   }
 }

package/src/ports/CONSISTENCY.md

@@ -15,27 +15,30 @@ overspecifies adapters that don't need that on the read-eventual paths
 
 ## Per-method consistency contracts
 
-| Port           | Method                                                              | Required                                                                                                               | Why                                                                                                                                                                                                                                                                  |
-| -------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `TokenStore`   | `saveCode(code, payload, ttl)`                                      | **Strong, atomic.** Payload **encrypted at rest** with a key from `KeyStore`; `ttl ≤ 60 s` (framework refuses larger). | Code must be created exactly once and visible to the next `consumeCode` on any node. Payload may carry upstream tokens — see _Code payload confidentiality_ in plan.                                                                                                 |
-| `TokenStore`   | `consumeCode(code)`                                                 | **Strong, CAS.** Returns the **decrypted** payload on success.                                                         | Single-use; second consumption must fail deterministically. Race with itself must resolve to one winner.                                                                                                                                                             |
-| `TokenStore`   | `saveRefresh(refresh, payload)`                                     | **Strong, atomic.**                                                                                                    | New refresh tokens issued during rotation must be immediately retrievable on the next request.                                                                                                                                                                       |
-| `TokenStore`   | `consumeRefresh(refresh, options)`                                  | **Strong, CAS with reuse-detection window** (default 60 s).                                                            | Core of refresh-token rotation security. Concurrent presentations resolve to one winner; reuse within the window triggers the revoke chain.                                                                                                                          |
-| `TokenStore`   | `peekRefresh(refresh)`                                              | **Eventual acceptable.** Non-destructive read; must never mark the token consumed.                                     | Used by `/revoke` for token-to-client binding (RFC 7009 §2.2) and by the refresh-grant for client auth + audit fields. Race losers fall through to `consumeRefresh`, which is the strong gate, so a stale peek can only delay — not bypass — single-use enforcement. |
-| `TokenStore`   | `revokeFamily(family)`                                              | Strong preferred; eventual acceptable with documented SLA.                                                             | Reuse-detection must invalidate the whole chain. Brief lag is tolerable.                                                                                                                                                                                             |
-| `TokenStore`   | `revokeBySubject(tenant, subject)`                                  | Strong preferred; eventual acceptable with documented SLA.                                                             | Revocation must propagate quickly. A few seconds of lag is tolerable.                                                                                                                                                                                                |
-| `SessionStore` | `saveFlow(flowId, payload, ttl)`                                    | **Strong, atomic.** `ttl == expiresAt - createdAt`.                                                                    | Flow record must be visible on the callback request to `consumeFlow`.                                                                                                                                                                                                |
-| `SessionStore` | `updateFlowMethodState(flowId, state)`                              | **Strong, atomic.** Resolves **before** the user-agent redirect is sent.                                               | Upstream PKCE verifier / nonce must be durably persisted before the redirect, otherwise the callback cannot validate.                                                                                                                                                |
-| `SessionStore` | `consumeFlow(flowId)`                                               | **Strong, atomic delete-on-read** that **returns the full `FlowRecord`** (`CAS` or `DELETE … RETURNING`).              | Single-use; concurrent consumption resolves to one winner. The record is returned so the framework can snapshot fields into the auth-code payload before disposal.                                                                                                   |
-| `SessionStore` | `createSession / readSession / revokeSession` (optional long-lived) | **Strong.**                                                                                                            | Session creation must be immediately readable on the next request.                                                                                                                                                                                                   |
-| `KeyStore`     | `currentSigningKey()` / `currentEncryptionKey()`                    | Strong.                                                                                                                | Active key must be unambiguous.                                                                                                                                                                                                                                      |
-| `KeyStore`     | `signingKeys()` (JWKS)                                              | Eventual OK (with TTL).                                                                                                | Verifiers tolerate brief JWKS lag during rotation.                                                                                                                                                                                                                   |
-| `KeyStore`     | `getEncryptionKey(kid)`                                             | Strong.                                                                                                                | Required to decrypt code payloads encrypted under non-current keys during the overlap window.                                                                                                                                                                        |
-| `ConfigStore`  | `getTenantConfig(id)`                                               | **Eventual + bounded staleness (TTL ≤ 60 s).** Invalidation hook fires on update.                                      | Read-heavy, write-rare. Aggressive caching is desirable.                                                                                                                                                                                                             |
-| `ConfigStore`  | `putTenantConfig(config)`                                           | **Strong write + immediate invalidation** of cached entries for the affected `TenantId`.                               | Subsequent `getTenantConfig` must reflect the new value once the write resolves.                                                                                                                                                                                     |
-| `MethodStore`  | `getMethodConfig` / `listMethods`                                   | Same as `ConfigStore.getTenantConfig`.                                                                                 | Subset of tenant config.                                                                                                                                                                                                                                             |
-| `MethodStore`  | `putMethodConfig` / `deleteMethodConfig`                            | Strong write + immediate invalidation.                                                                                 | Console-driven mutations must take effect on the next request.                                                                                                                                                                                                       |
-| `AuditLog`     | `log(event)`                                                        | Append-only, durable. Cross-instance ordering **not** required (consumers sort by `timestamp` + `actor`).              | Loss = audit gap; ordering is a UI / SIEM concern.                                                                                                                                                                                                                   |
+| Port           | Method                                                              | Required                                                                                                               | Why                                                                                                                                                                                                                                                                    |
+| -------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `TokenStore`   | `saveCode(code, payload, ttl)`                                      | **Strong, atomic.** Payload **encrypted at rest** with a key from `KeyStore`; `ttl ≤ 60 s` (framework refuses larger). | Code must be created exactly once and visible to the next `consumeCode` on any node. Payload may carry upstream tokens — see _Code payload confidentiality_ in plan.                                                                                                   |
+| `TokenStore`   | `consumeCode(code)`                                                 | **Strong, CAS.** Returns the **decrypted** payload on success.                                                         | Single-use; second consumption must fail deterministically. Race with itself must resolve to one winner.                                                                                                                                                               |
+| `TokenStore`   | `saveRefresh(refresh, payload)`                                     | **Strong, atomic.**                                                                                                    | New refresh tokens issued during rotation must be immediately retrievable on the next request.                                                                                                                                                                         |
+| `TokenStore`   | `consumeRefresh(refresh, options)`                                  | **Strong, CAS with reuse-detection window** (default 60 s).                                                            | Core of refresh-token rotation security. Concurrent presentations resolve to one winner; reuse within the window triggers the revoke chain.                                                                                                                            |
+| `TokenStore`   | `peekRefresh(refresh)`                                              | **Eventual acceptable.** Non-destructive read; must never mark the token consumed.                                     | Used by `/revoke` for token-to-client binding (RFC 7009 §2.2) and by the refresh-grant for client auth + audit fields. Race losers fall through to `consumeRefresh`, which is the strong gate, so a stale peek can only delay — not bypass — single-use enforcement.   |
+| `TokenStore`   | `revokeFamily(family)`                                              | Strong preferred; eventual acceptable with documented SLA.                                                             | Reuse-detection must invalidate the whole chain. Brief lag is tolerable.                                                                                                                                                                                               |
+| `TokenStore`   | `revokeBySubject(tenant, subject)`                                  | Strong preferred; eventual acceptable with documented SLA.                                                             | Revocation must propagate quickly. A few seconds of lag is tolerable.                                                                                                                                                                                                  |
+| `SessionStore` | `saveFlow(flowId, payload, ttl)`                                    | **Strong, atomic.** `ttl == expiresAt - createdAt`.                                                                    | Flow record must be visible on the callback request to `consumeFlow`.                                                                                                                                                                                                  |
+| `SessionStore` | `updateFlowMethodState(flowId, state)`                              | **Strong, atomic.** Resolves **before** the user-agent redirect is sent.                                               | Upstream PKCE verifier / nonce must be durably persisted before the redirect, otherwise the callback cannot validate.                                                                                                                                                  |
+| `SessionStore` | `consumeFlow(flowId)`                                               | **Strong, atomic delete-on-read** that **returns the full `FlowRecord`** (`CAS` or `DELETE … RETURNING`).              | Single-use; concurrent consumption resolves to one winner. The record is returned so the framework can snapshot fields into the auth-code payload before disposal.                                                                                                     |
+| `SessionStore` | `savePar(uri, payload, ttl)` (optional)                             | **Strong, atomic.** `ttl` default 60 s.                                                                                | RFC 9126 §3 — the PAR record must be visible to the next `consumePar` on any node. One-shot read.                                                                                                                                                                      |
+| `SessionStore` | `consumePar(uri)` (optional)                                        | **Strong, atomic delete-on-read.**                                                                                     | RFC 9126 §4 — `request_uri` is single-use; concurrent presentations of the same uri resolve to one winner. Same semantics as `consumeFlow`.                                                                                                                            |
+| `SessionStore` | `createSession / readSession / revokeSession` (optional long-lived) | **Strong.**                                                                                                            | Session creation must be immediately readable on the next request.                                                                                                                                                                                                     |
+| `TokenStore`   | `recordDpopJti(jti, ttlMs)` (optional)                              | **Strong, atomic record-or-fail.**                                                                                     | RFC 9449 §11.1 — replay protection requires single-use enforcement on the jti within the TTL window. A re-presentation must return `invalid_grant` deterministically. Adapters without this method cannot satisfy DPoP and the verifier surfaces `invalid_dpop_proof`. |
+| `KeyStore`     | `currentSigningKey()` / `currentEncryptionKey()`                    | Strong.                                                                                                                | Active key must be unambiguous.                                                                                                                                                                                                                                        |
+| `KeyStore`     | `signingKeys()` (JWKS)                                              | Eventual OK (with TTL).                                                                                                | Verifiers tolerate brief JWKS lag during rotation.                                                                                                                                                                                                                     |
+| `KeyStore`     | `getEncryptionKey(kid)`                                             | Strong.                                                                                                                | Required to decrypt code payloads encrypted under non-current keys during the overlap window.                                                                                                                                                                          |
+| `ConfigStore`  | `getTenantConfig(id)`                                               | **Eventual + bounded staleness (TTL ≤ 60 s).** Invalidation hook fires on update.                                      | Read-heavy, write-rare. Aggressive caching is desirable.                                                                                                                                                                                                               |
+| `ConfigStore`  | `putTenantConfig(config)`                                           | **Strong write + immediate invalidation** of cached entries for the affected `TenantId`.                               | Subsequent `getTenantConfig` must reflect the new value once the write resolves.                                                                                                                                                                                       |
+| `MethodStore`  | `getMethodConfig` / `listMethods`                                   | Same as `ConfigStore.getTenantConfig`.                                                                                 | Subset of tenant config.                                                                                                                                                                                                                                               |
+| `MethodStore`  | `putMethodConfig` / `deleteMethodConfig`                            | Strong write + immediate invalidation.                                                                                 | Console-driven mutations must take effect on the next request.                                                                                                                                                                                                         |
+| `AuditLog`     | `log(event)`                                                        | Append-only, durable. Cross-instance ordering **not** required (consumers sort by `timestamp` + `actor`).              | Loss = audit gap; ordering is a UI / SIEM concern.                                                                                                                                                                                                                     |
 
 ## Implications for adapter choice
 
@@ -86,3 +89,31 @@ The fixture set covers, at minimum:
 - `ConfigStore` invalidation hook fires within bounded staleness.
 - JWKS overlap window — keys retired during the verification window remain
   in `signingKeys()` until removed.
+- **PAR (`supportsPar: true`)** — `savePar` / `consumePar` round-trip,
+  one-shot consume atomicity, expiry enforcement, ttl-0 rejection.
+- **DPoP jti (`recordDpopJti`)** — first record succeeds, replay within
+  TTL fails with `invalid_grant`, post-TTL the slot is freed for reuse.
+
+## Optional methods and graceful degradation
+
+Several recent ports are **optional** because not every adapter has
+caught up yet:
+
+- `SessionStore.savePar` / `consumePar` — required for RFC 9126 PAR.
+  Without them the framework's `/par` handler returns `invalid_request`
+  with a clear "session adapter does not support PAR" description, and
+  `/authorize?request_uri=...` returns the same. Memory adapter
+  implements; production adapters (Postgres, D1, DO, DynamoDB) follow
+  the same `consumeFlow` pattern and should add it.
+- `TokenStore.recordDpopJti` — required for RFC 9449 DPoP. Without it
+  the DPoP verifier returns `invalid_dpop_proof: "token-store adapter
+does not support DPoP replay protection"`. Memory adapter
+  implements; production adapters add it the same way `consumeRefresh`
+  uses an atomic write-once primitive.
+
+The framework never advertises a feature in discovery that the wired
+adapters cannot actually serve: `pushed_authorization_request_endpoint`
+and `dpop_signing_alg_values_supported` are advertised unconditionally,
+and clients receive the appropriate error if the adapter doesn't
+support them. Operators who do not run PAR / DPoP should communicate
+that to RPs out-of-band.

package/src/ports/audit-log.ts

@@ -54,6 +54,10 @@ export type AuditEvent =
       subjectId: string
       /** Hash of the issued refresh token id — never the token itself. */
       refreshTokenIdHash?: string
+      /** OIDC Core §2 — set when the response carried an `id_token`. */
+      idTokenIssued?: boolean
+      /** RFC 9449 — set when the access token is DPoP-bound. */
+      dpopBound?: boolean
     }
   | {
       kind: "token_refreshed"
@@ -87,6 +91,31 @@ export type AuditEvent =
       clientId: string
       family: string
     }
+  | {
+      /**
+       * Emitted by `/end_session` (OIDC RP-Initiated Logout 1.0 §2) after
+       * processing the logout request — regardless of whether a
+       * `post_logout_redirect_uri` was supplied. `subjectId` is present
+       * when the request carried an `id_token_hint` that successfully
+       * verified; absent otherwise.
+       */
+      kind: "session_logout"
+      tenantId: TenantId
+      clientId?: string
+      subjectId?: string
+    }
+  | {
+      /**
+       * Emitted when a DPoP proof's `jti` is presented within the replay
+       * window (RFC 9449 §11.1). The request was rejected with
+       * `invalid_dpop_proof`. Operators / SIEM use this to spot
+       * stolen-key replay attempts.
+       */
+      kind: "dpop_replay_detected"
+      tenantId: TenantId | null
+      /** First-half of the offending jti so logs can correlate without storing it. */
+      jtiPrefix: string
+    }
   | {
       kind: "flow_replay_attempt"
       tenantId: TenantId | null

package/src/ports/session-store.ts

@@ -83,6 +83,39 @@ export type SessionStore = {
   ): Promise<Result<void>>
   readSession?(sessionId: string): Promise<Result<SessionRecord>>
   revokeSession?(sessionId: string): Promise<Result<void>>
+
+  /**
+   * Optional: Pushed Authorization Request (RFC 9126) storage. Persists the
+   * pre-parsed `/authorize` parameters under an opaque `request_uri` for
+   * one-shot retrieval at `/authorize` time. Strong consistency + atomic
+   * delete-on-read — same semantics as `saveFlow` / `consumeFlow`.
+   *
+   * Adapters without these methods cannot satisfy `/par`; the framework's
+   * `/par` handler returns `invalid_request` when called against such a
+   * store. Implement both methods together (the framework only exposes
+   * the endpoint when both are present).
+   */
+  savePar?(
+    requestUri: string,
+    payload: ParRecord,
+    ttl: number,
+  ): Promise<Result<void>>
+  consumePar?(requestUri: string): Promise<Result<ParRecord>>
+}
+
+/**
+ * Stored PAR payload. The `params` blob is the raw form/query record from
+ * `POST /par`, kept verbatim so the `/authorize` rehydrate path can feed
+ * it through the same Zod parser the direct path uses.
+ */
+export type ParRecord = {
+  requestUri: string
+  /** Raw key/value record as posted to `/par` (excluding auth fields). */
+  params: Record<string, string>
+  clientId: string
+  /** Wall-clock issuance + absolute expiry (ms). */
+  issuedAt: number
+  expiresAt: number
 }
 
 /** Optional long-lived session payload (used by `createSession` family). */

package/src/ports/token-store.ts

@@ -100,4 +100,17 @@ export type TokenStore = {
    * preferred; documented eventual lag acceptable.
    */
   revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>
+
+  /**
+   * Optional: DPoP proof replay protection (RFC 9449 §11.1). Atomically
+   * record the proof's `jti` and reject if it's been seen within the TTL
+   * window. Returns `invalid_grant` (with `reuseSignal` omitted) when a
+   * `jti` is already present.
+   *
+   * Adapters without this method cannot satisfy DPoP at the token /
+   * userinfo endpoints; the framework's DPoP verifier returns
+   * `invalid_dpop_proof` when called against such a store. Memory adapter
+   * implements; production adapters follow in subsequent commits.
+   */
+  recordDpopJti?(jti: string, ttlMs: number): Promise<Result<void>>
 }

package/src/types/authorization.ts

@@ -37,6 +37,31 @@ export type AuthorizationRequest = {
   uiLocales?: string[]
   /** Standard OIDC. */
   nonce?: string
+  /**
+   * OIDC Core §5.5 — RP-requested claims, parsed from the `claims`
+   * parameter's JSON value. The library currently honors claim **names**
+   * (additive, bypasses scope gating) but does not enforce the
+   * `essential` / `value` / `values` qualifiers.
+   */
+  claimsRequest?: ClaimsRequest
+}
+
+/**
+ * OIDC Core §5.5 `claims` parameter. Each section maps claim name to an
+ * optional qualifier object (`{essential, value, values}`) or `null`
+ * meaning "just request the claim without qualifiers".
+ */
+export type ClaimsRequest = {
+  /** Claims to include in the `/userinfo` response. */
+  userinfo?: Record<string, ClaimRequestEntry | null>
+  /** Claims to include in the `id_token`. */
+  id_token?: Record<string, ClaimRequestEntry | null>
+}
+
+export type ClaimRequestEntry = {
+  essential?: boolean
+  value?: unknown
+  values?: unknown[]
 }
 
 /**

package/src/types/error.ts

@@ -50,6 +50,21 @@ export type AuthError =
   // endpoints. Use for control-flow signalling that should never escape to a
   // standards-compliant client.
   | { code: "internal_error"; description: string; cause?: unknown }
+  // RFC 9449 §5.2 — DPoP proof verification failed (bad signature, htm/htu
+  // mismatch, iat outside window, replayed jti, missing/mismatched cnf.jkt).
+  // Returned as a 400 with `error="invalid_dpop_proof"` on form-body
+  // endpoints; on resource-server endpoints it becomes a 401 with
+  // `WWW-Authenticate: DPoP error="invalid_dpop_proof"`.
+  //
+  // `replaySignal`, when present, indicates `recordDpopJti` reported a
+  // jti already seen within the replay window. The HTTP layer uses this
+  // to emit a `dpop_replay_detected` audit event distinct from other
+  // proof failures.
+  | {
+      code: "invalid_dpop_proof"
+      description: string
+      replaySignal?: { jti: string }
+    }
 
 export type AuthErrorCode = AuthError["code"]
 
@@ -120,4 +135,12 @@ export const authError = {
     description,
     ...(cause !== undefined ? { cause } : {}),
   }),
+  invalidDpopProof: (
+    description: string,
+    replaySignal?: { jti: string },
+  ): AuthError => ({
+    code: "invalid_dpop_proof",
+    description,
+    ...(replaySignal !== undefined ? { replaySignal } : {}),
+  }),
 }

package/src/types/flow.ts

@@ -19,6 +19,7 @@
  *      needed at `/token` into the auth-code payload; `methodState` is
  *      dropped.
  */
+import type { ClaimsRequest } from "./authorization"
 import type { TenantId } from "./tenant"
 
 export type FlowRecord = {
@@ -56,6 +57,15 @@ export type FlowRecord = {
    * `appState`. Compared at callback against the consumed record.
    */
   nonce: string
+  /**
+   * Relying party's OIDC `nonce` parameter (OIDC Core §3.1.2.1). Distinct
+   * from `nonce` (which is the framework's CSRF nonce for state-MAC
+   * binding). When present, must be echoed in the issued `id_token`
+   * (OIDC Core §2). Snapshotted into `CodePayload.appNonce` at success.
+   */
+  appNonce?: string
+  /** OIDC Core §5.5 — RP-requested claims, parsed at `/authorize`. */
+  claimsRequest?: ClaimsRequest
   /**
    * Relying-party → IdP PKCE. The RP generates the verifier and sends the
    * challenge to `/authorize`. Verified at `/token`.

package/src/types/idp.ts

@@ -15,6 +15,7 @@ import type { AnyAuthMethodFactory } from "./method"
 import type { Result } from "./result"
 import type { SubjectClaim, SubjectSchema } from "./subject"
 import type {
+  ClientConfig,
   StateKeyRing,
   TenantContext,
   TenantId,
@@ -119,6 +120,69 @@ export type ExchangeAudience = (
   },
 ) => Promise<SubjectClaim | AuthError>
 
+/**
+ * RFC 7591 Dynamic Client Registration request body, normalized to the
+ * library's type system. The framework's `/register` handler parses the
+ * raw JSON, validates structure, then calls the host's `registerClient`
+ * hook with this shape. The host owns persistence — writing through its
+ * own `ConfigStore` — and returns the final `ClientConfig`.
+ */
+export type RegisterClientRequest = {
+  client_name?: string
+  redirect_uris: string[]
+  /** RFC 7591 §2 — defaults to `["authorization_code"]`. */
+  grant_types?: string[]
+  /** RFC 7591 §2 — defaults to `["code"]`. */
+  response_types?: string[]
+  /** RFC 7591 §2 — `"none"` = public client, otherwise confidential. */
+  token_endpoint_auth_method?:
+    | "none"
+    | "client_secret_basic"
+    | "client_secret_post"
+  scope?: string
+  /** OIDC RP-Initiated Logout 1.0 §2. */
+  post_logout_redirect_uris?: string[]
+  /** OIDC Core §8.1. */
+  sector_identifier_uri?: string
+  /** Free-form metadata the host may interpret. */
+  contacts?: string[]
+}
+
+/**
+ * RFC 7591 §3.2.1 response body. Returned verbatim from `/register` when
+ * the host hook produces a `ClientConfig`. `client_secret` is included
+ * only for confidential clients; public clients omit it.
+ */
+export type RegisterClientResponse = {
+  client_id: string
+  client_secret?: string
+  client_id_issued_at: number
+  client_secret_expires_at?: number
+  redirect_uris: string[]
+  grant_types?: string[]
+  response_types?: string[]
+  token_endpoint_auth_method?: string
+  client_name?: string
+}
+
+/**
+ * Optional Dynamic Client Registration hook. Hosts that want to expose
+ * RFC 7591 client provisioning supply this; the framework validates the
+ * wire format, then defers persistence to the host. If absent, the
+ * `/register` endpoint returns `invalid_request` so RPs receive a clear
+ * "not enabled" signal rather than a 404.
+ *
+ * The hook receives the parsed request, the resolved tenant, and the
+ * plaintext client secret (if any) the framework minted — hosts hash it
+ * with `hashClientSecret` before storing on `ClientConfig.secretHash`,
+ * then return the final `ClientConfig` along with the secret in the
+ * `RegisterClientResponse` so the RP can record it.
+ */
+export type RegisterClient = (input: {
+  tenant: TenantContext
+  request: RegisterClientRequest
+}) => Promise<Result<{ client: ClientConfig; secret?: string }, AuthError>>
+
 /**
  * Optional override for the default provider picker shown when an
  * `/authorize` request has multiple enabled methods and no `method_id`.
@@ -213,6 +277,13 @@ export type IdPOptions = {
    */
   renderPicker?: RenderPicker
 
+  /**
+   * Optional RFC 7591 Dynamic Client Registration hook. See
+   * `RegisterClient` for the contract. When absent, `/register` rejects
+   * with `invalid_request: "dynamic client registration is not enabled"`.
+   */
+  registerClient?: RegisterClient
+
   /**
    * Optional hook that builds the `TenantContext.request.custom` blob for
    * each request the framework processes (the initial `/authorize`, the
@@ -234,6 +305,25 @@ export type IdPOptions = {
     req: Request,
   ) => Record<string, unknown> | Promise<Record<string, unknown>>
 
+  /**
+   * Optional vendor scope → claim-names map. Merged on top of OIDC Core
+   * §5.4 when building the id_token + `/userinfo` response. Lets a host
+   * expose its own identity vocabulary (`tenant_id`, `org_role`, etc.)
+   * via custom scope names. The standard §5.4 mapping always wins on
+   * collision, so an entry for `email` is silently ignored.
+   *
+   * Per-client scope allowlist still applies — a client must list a
+   * custom scope in `ClientConfig.scopes` to be allowed to request it.
+   *
+   * ```ts
+   * customScopeClaims: {
+   *   tenant: ["tenant_id", "tenant_role", "tenant_roles"],
+   *   org: ["organization_id", "org_role"],
+   * }
+   * ```
+   */
+  customScopeClaims?: Record<string, ReadonlyArray<string>>
+
   /**
    * Optional override for the framework's `Set-Cookie` defaults.
    *
@@ -266,4 +356,10 @@ export type IdP = {
   discovery: (req: Request) => Promise<Response>
   revoke: (req: Request) => Promise<Response>
   introspect: (req: Request) => Promise<Response>
+  /** OIDC RP-Initiated Logout 1.0. */
+  endSession: (req: Request) => Promise<Response>
+  /** RFC 9126 Pushed Authorization Requests. */
+  par: (req: Request) => Promise<Response>
+  /** RFC 7591 Dynamic Client Registration. */
+  register: (req: Request) => Promise<Response>
 }

package/src/types/tenant.ts

@@ -128,6 +128,26 @@ export type PublicClientConfig = {
   scopes: string[]
   /** Must be `true` for public clients per OAuth 2.1 §2.1.1. */
   pkceRequired: true
+  /**
+   * Registered URIs to which `/end_session` may redirect after RP-initiated
+   * logout (OIDC RP-Initiated Logout 1.0 §2). Exact-match. If absent, the
+   * `/end_session` endpoint refuses any `post_logout_redirect_uri`.
+   */
+  postLogoutRedirectUris?: string[]
+  /**
+   * RFC 9126 §2: when `true`, the client MUST use Pushed Authorization
+   * Requests; a direct `GET /authorize` call without `request_uri` is
+   * rejected with `invalid_request`.
+   */
+  requirePushedAuthorizationRequests?: boolean
+  /**
+   * OIDC Core §8.1 — when set, the subject identifier (`sub`) is derived
+   * as a pairwise pseudonym keyed by this string. Two clients sharing
+   * the same `sectorIdentifier` will see the same `sub`; different
+   * values yield different `sub`s for the same end user. Absent =
+   * public subject (sub is identical across all RPs).
+   */
+  sectorIdentifier?: string
   /** Phase 8. */
   dpopRequired?: boolean
 }
@@ -146,6 +166,23 @@ export type ConfidentialClientConfig = {
    * strongly discouraged; OAuth 2.1 §2.1.1 recommends PKCE for every client.
    */
   pkceRequired: boolean
+  /**
+   * Registered URIs to which `/end_session` may redirect after RP-initiated
+   * logout (OIDC RP-Initiated Logout 1.0 §2). Exact-match.
+   */
+  postLogoutRedirectUris?: string[]
+  /**
+   * RFC 9126 §2: when `true`, the client MUST use Pushed Authorization
+   * Requests; a direct `GET /authorize` call without `request_uri` is
+   * rejected with `invalid_request`.
+   */
+  requirePushedAuthorizationRequests?: boolean
+  /**
+   * OIDC Core §8.1 — see `PublicClientConfig.sectorIdentifier` for
+   * semantics. Same field; duplicated on each branch because the
+   * `ClientConfig` discriminated union doesn't share optional fields.
+   */
+  sectorIdentifier?: string
   /** Phase 8. */
   dpopRequired?: boolean
 }