@_mustachio/openauth 0.10.0 → 0.11.0

package/dist/types/http/handlers/par.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"par.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/par.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAIvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,OAC1B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA+DjD"}

package/dist/types/http/handlers/register.d.ts

@@ -0,0 +1,3 @@
+import type { HttpContext, HttpDeps } from "../context";
+export declare function makeRegisterHandler(deps: HttpDeps): (c: HttpContext) => Promise<Response>;
+//# sourceMappingURL=register.d.ts.map

package/dist/types/http/handlers/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/register.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAIvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAkDjD"}

package/dist/types/http/handlers/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/token.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,OAC5B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CA6KjD"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/token.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAKvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,OAC5B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAoOjD"}

package/dist/types/http/handlers/userinfo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/userinfo.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAEvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAiDjD"}
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../../src/http/handlers/userinfo.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAEvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,OAC/B,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC,CAgDjD"}

package/dist/types/http/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAW3B,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAmCzD"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/http/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAc3B,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAElD,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAmDzD"}

package/dist/types/http/schemas/authorize.d.ts

@@ -8,6 +8,12 @@
  * requirement, etc.).
  */
 import { z } from "zod";
+/**
+ * Standard `/authorize` query schema. Used both for direct calls and as
+ * the validation target after a PAR record is rehydrated — the PAR'd
+ * params are passed through this same parser so semantic checks stay in
+ * a single place.
+ */
 export declare const authorizeQuerySchema: z.ZodObject<{
     response_type: z.ZodString;
     client_id: z.ZodString;
@@ -21,6 +27,12 @@ export declare const authorizeQuerySchema: z.ZodObject<{
     prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     nonce: z.ZodOptional<z.ZodString>;
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.ZodOptional<z.ZodString>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     response_type: z.ZodString;
     client_id: z.ZodString;
@@ -34,6 +46,12 @@ export declare const authorizeQuerySchema: z.ZodObject<{
     prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     nonce: z.ZodOptional<z.ZodString>;
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.ZodOptional<z.ZodString>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     response_type: z.ZodString;
     client_id: z.ZodString;
@@ -47,6 +65,28 @@ export declare const authorizeQuerySchema: z.ZodObject<{
     prompt: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     ui_locales: z.ZodOptional<z.ZodEffects<z.ZodString, string[], string>>;
     nonce: z.ZodOptional<z.ZodString>;
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * RFC 9126 §4: when `request_uri` is presented, the user-agent's
+ * `/authorize` URL is allowed to carry only `client_id` and
+ * `request_uri`; the rest of the parameter set must come from the
+ * stored PAR record.
+ */
+export declare const authorizeRequestUriQuerySchema: z.ZodObject<{
+    client_id: z.ZodString;
+    request_uri: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    client_id: z.ZodString;
+    request_uri: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    client_id: z.ZodString;
+    request_uri: z.ZodString;
 }, z.ZodTypeAny, "passthrough">>;
 export type AuthorizeQuery = z.infer<typeof authorizeQuerySchema>;
 //# sourceMappingURL=authorize.d.ts.map

package/dist/types/http/schemas/authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAyBvB,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAqBjB,CAAA;AAEhB,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAyBvB;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;IAoB7B;;;;OAIG;;;;;;;;;;;;;;;IAJH;;;;OAIG;;;;;;;;;;;;;;;IAJH;;;;OAIG;;gCAGS,CAAA;AAEhB;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;gCAO3B,CAAA;AAEhB,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/types/http/schemas/end-session.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Zod schema for `/end_session` (OIDC RP-Initiated Logout 1.0 §2).
+ *
+ * Every parameter is optional per spec. The domain layer enforces the
+ * "needs identifying client to honor post_logout_redirect_uri" rule.
+ */
+import { z } from "zod";
+export declare const endSessionParamsSchema: z.ZodObject<{
+    id_token_hint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    logout_hint: z.ZodOptional<z.ZodString>;
+    ui_locales: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id_token_hint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    logout_hint: z.ZodOptional<z.ZodString>;
+    ui_locales: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id_token_hint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uri: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    logout_hint: z.ZodOptional<z.ZodString>;
+    ui_locales: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export type EndSessionParams = z.infer<typeof endSessionParamsSchema>;
+//# sourceMappingURL=end-session.d.ts.map

package/dist/types/http/schemas/end-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-session.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/end-session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;gCAYnB,CAAA;AAEhB,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA"}

package/dist/types/http/schemas/par.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Zod schema for the `POST /par` body (RFC 9126 §2).
+ *
+ * The shape is identical to `/authorize` query parameters; we just need
+ * `client_id` to identify the authenticating client. `client_secret` is
+ * accepted in-body for `client_secret_post` auth.
+ */
+import { z } from "zod";
+export declare const parBodySchema: z.ZodObject<{
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodString, z.objectOutputType<{
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.ZodString, "strip">, z.objectInputType<{
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.ZodString, "strip">>;
+export type ParBody = z.infer<typeof parBodySchema>;
+//# sourceMappingURL=par.d.ts.map

package/dist/types/http/schemas/par.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"par.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/par.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,aAAa;;;;;;;;;yBAWH,CAAA;AAEvB,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA"}

package/dist/types/http/schemas/register.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Zod schema for `POST /register` (RFC 7591 §2).
+ *
+ * The body is `application/json`. We surface invalid structure as
+ * `invalid_request` rather than the spec's `invalid_client_metadata` /
+ * `invalid_redirect_uri` codes — the library collapses all wire-format
+ * problems to the OAuth-2.0 `invalid_request` family for consistency.
+ */
+import { z } from "zod";
+export declare const registerBodySchema: z.ZodObject<{
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString, "many">;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<["none", "client_secret_basic", "client_secret_post"]>>;
+    scope: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sector_identifier_uri: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString, "many">;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<["none", "client_secret_basic", "client_secret_post"]>>;
+    scope: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sector_identifier_uri: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    client_name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString, "many">;
+    grant_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    response_types: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<["none", "client_secret_basic", "client_secret_post"]>>;
+    scope: z.ZodOptional<z.ZodString>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sector_identifier_uri: z.ZodOptional<z.ZodString>;
+    contacts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, z.ZodTypeAny, "passthrough">>;
+export type RegisterBody = z.infer<typeof registerBodySchema>;
+//# sourceMappingURL=register.d.ts.map

package/dist/types/http/schemas/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/http/schemas/register.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAgBf,CAAA;AAEhB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA"}

package/dist/types/index.d.ts

@@ -18,15 +18,15 @@ export { asTenantId } from "./types/tenant";
 export type { FlowRecord } from "./types/flow";
 export type { AuthMethod, AuthMethodFactory, CachePolicy, ClientFn, MethodContext, MethodDispatchData, MethodHandler, MethodResult, SetCookie, } from "./types/method";
 export type { AuthorizationRequest, AuthorizationState, } from "./types/authorization";
-export type { AccessTokenClaims, CodePayload, RefreshTokenPayload, TokenResponse, } from "./types/token";
+export type { AccessTokenClaims, AddressClaim, CodePayload, IdTokenClaims, RefreshTokenPayload, ScopedProfileClaims, TokenResponse, } from "./types/token";
 export type { SubjectClaim, SubjectPayload, SubjectSchema, } from "./types/subject";
-export type { ExchangeAudience, FailureEvent, IdP, IdPOptions, PersistUpstreamTokens, RenderPicker, SuccessEvent, SuccessMapInput, } from "./types/idp";
+export type { ExchangeAudience, FailureEvent, IdP, IdPOptions, PersistUpstreamTokens, RegisterClient, RegisterClientRequest, RegisterClientResponse, RenderPicker, SuccessEvent, SuccessMapInput, } from "./types/idp";
 export type { PickerContext, PickerMethod } from "./types/picker";
 export type { AuditEvent, AuditLog } from "./ports/audit-log";
 export type { ConfigStore } from "./ports/config-store";
 export type { EncryptionKey, KeyStore, KeyWrapper, SigningKey, } from "./ports/key-store";
 export type { MethodStore } from "./ports/method-store";
-export type { SessionRecord, SessionStore } from "./ports/session-store";
+export type { ParRecord, SessionRecord, SessionStore, } from "./ports/session-store";
 export type { TokenStore } from "./ports/token-store";
 /**
  * Host-callable primitive for "log me out of all devices" UX. Wraps

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACxE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CA8E/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,YAAY,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAErD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,YAAY,EACV,YAAY,EACZ,wBAAwB,EACxB,SAAS,EACT,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,GAAG,EACH,UAAU,EACV,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEjE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,UAAU,GACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,cAAc,EACd,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAM7D,OAAO,EACL,aAAa,EACb,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,GAAG,CAqF/C"}

package/dist/types/ports/audit-log.d.ts

@@ -49,6 +49,10 @@ export type AuditEvent = {
     subjectId: string;
     /** Hash of the issued refresh token id — never the token itself. */
     refreshTokenIdHash?: string;
+    /** OIDC Core §2 — set when the response carried an `id_token`. */
+    idTokenIssued?: boolean;
+    /** RFC 9449 — set when the access token is DPoP-bound. */
+    dpopBound?: boolean;
 } | {
     kind: "token_refreshed";
     tenantId: TenantId;
@@ -77,6 +81,29 @@ export type AuditEvent = {
     tenantId: TenantId;
     clientId: string;
     family: string;
+} | {
+    /**
+     * Emitted by `/end_session` (OIDC RP-Initiated Logout 1.0 §2) after
+     * processing the logout request — regardless of whether a
+     * `post_logout_redirect_uri` was supplied. `subjectId` is present
+     * when the request carried an `id_token_hint` that successfully
+     * verified; absent otherwise.
+     */
+    kind: "session_logout";
+    tenantId: TenantId;
+    clientId?: string;
+    subjectId?: string;
+} | {
+    /**
+     * Emitted when a DPoP proof's `jti` is presented within the replay
+     * window (RFC 9449 §11.1). The request was rejected with
+     * `invalid_dpop_proof`. Operators / SIEM use this to spot
+     * stolen-key replay attempts.
+     */
+    kind: "dpop_replay_detected";
+    tenantId: TenantId | null;
+    /** First-half of the offending jti so logs can correlate without storing it. */
+    jtiPrefix: string;
 } | {
     kind: "flow_replay_attempt";
     tenantId: TenantId | null;

package/dist/types/ports/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/ports/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,0DAA0D;IAC1D,YAAY,EAAE,QAAQ,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,QAAQ,CAAA;IACvB,YAAY,EAAE,QAAQ,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAEL,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,CAAA"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../src/ports/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,0DAA0D;IAC1D,YAAY,EAAE,QAAQ,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE;;;;;;OAMG;IACH,IAAI,EAAE,gBAAgB,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,sBAAsB,CAAA;IAC5B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,aAAa,EAAE,QAAQ,CAAA;IACvB,YAAY,EAAE,QAAQ,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACvC,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;CAClB,GACD;IACE,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,CAAA;AAEL,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,CAAA"}

package/dist/types/ports/session-store.d.ts

@@ -67,6 +67,33 @@ export type SessionStore = {
     createSession?(sessionId: string, payload: SessionRecord, ttl: number): Promise<Result<void>>;
     readSession?(sessionId: string): Promise<Result<SessionRecord>>;
     revokeSession?(sessionId: string): Promise<Result<void>>;
+    /**
+     * Optional: Pushed Authorization Request (RFC 9126) storage. Persists the
+     * pre-parsed `/authorize` parameters under an opaque `request_uri` for
+     * one-shot retrieval at `/authorize` time. Strong consistency + atomic
+     * delete-on-read — same semantics as `saveFlow` / `consumeFlow`.
+     *
+     * Adapters without these methods cannot satisfy `/par`; the framework's
+     * `/par` handler returns `invalid_request` when called against such a
+     * store. Implement both methods together (the framework only exposes
+     * the endpoint when both are present).
+     */
+    savePar?(requestUri: string, payload: ParRecord, ttl: number): Promise<Result<void>>;
+    consumePar?(requestUri: string): Promise<Result<ParRecord>>;
+};
+/**
+ * Stored PAR payload. The `params` blob is the raw form/query record from
+ * `POST /par`, kept verbatim so the `/authorize` rehydrate path can feed
+ * it through the same Zod parser the direct path uses.
+ */
+export type ParRecord = {
+    requestUri: string;
+    /** Raw key/value record as posted to `/par` (excluding auth fields). */
+    params: Record<string, string>;
+    clientId: string;
+    /** Wall-clock issuance + absolute expiry (ms). */
+    issuedAt: number;
+    expiresAt: number;
 };
 /** Optional long-lived session payload (used by `createSession` family). */
 export type SessionRecord = {

package/dist/types/ports/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../src/ports/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;OAKG;IACH,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;OAQG;IACH,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAErD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAExD;;;;OAIG;IACH,aAAa,CAAC,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CACzD,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../src/ports/session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB;;;;;OAKG;IACH,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;OAQG;IACH,qBAAqB,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAErD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IAExD;;;;OAIG;IACH,aAAa,CAAC,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,CACN,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACxB,UAAU,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;CAC5D,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA"}

package/dist/types/ports/token-store.d.ts

@@ -89,5 +89,17 @@ export type TokenStore = {
      * preferred; documented eventual lag acceptable.
      */
     revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>;
+    /**
+     * Optional: DPoP proof replay protection (RFC 9449 §11.1). Atomically
+     * record the proof's `jti` and reject if it's been seen within the TTL
+     * window. Returns `invalid_grant` (with `reuseSignal` omitted) when a
+     * `jti` is already present.
+     *
+     * Adapters without this method cannot satisfy DPoP at the token /
+     * userinfo endpoints; the framework's DPoP verifier returns
+     * `invalid_dpop_proof` when called against such a store. Memory adapter
+     * implements; production adapters follow in subsequent commits.
+     */
+    recordDpopJti?(jti: string, ttlMs: number): Promise<Result<void>>;
 };
 //# sourceMappingURL=token-store.d.ts.map

package/dist/types/ports/token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../src/ports/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAE9E;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAElD;;;OAGG;IACH,WAAW,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;;;;;;;;OAkBG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAEvC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAElE;;;;OAIG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAEnD;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAC9E,CAAA"}
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../src/ports/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAE9E;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAElD;;;OAGG;IACH,WAAW,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;;;;;;;;OAkBG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAEvC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAElE;;;;OAIG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAEnD;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAE7E;;;;;;;;;;OAUG;IACH,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAClE,CAAA"}

package/dist/types/types/authorization.d.ts

@@ -36,6 +36,29 @@ export type AuthorizationRequest = {
     uiLocales?: string[];
     /** Standard OIDC. */
     nonce?: string;
+    /**
+     * OIDC Core §5.5 — RP-requested claims, parsed from the `claims`
+     * parameter's JSON value. The library currently honors claim **names**
+     * (additive, bypasses scope gating) but does not enforce the
+     * `essential` / `value` / `values` qualifiers.
+     */
+    claimsRequest?: ClaimsRequest;
+};
+/**
+ * OIDC Core §5.5 `claims` parameter. Each section maps claim name to an
+ * optional qualifier object (`{essential, value, values}`) or `null`
+ * meaning "just request the claim without qualifiers".
+ */
+export type ClaimsRequest = {
+    /** Claims to include in the `/userinfo` response. */
+    userinfo?: Record<string, ClaimRequestEntry | null>;
+    /** Claims to include in the `id_token`. */
+    id_token?: Record<string, ClaimRequestEntry | null>;
+};
+export type ClaimRequestEntry = {
+    essential?: boolean;
+    value?: unknown;
+    values?: unknown[];
 };
 /**
  * In-memory authorization state produced by `domain/authorize.startAuthorize`

package/dist/types/types/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../src/types/authorization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,qBAAqB;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../src/types/authorization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,qBAAqB;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;CAC9B,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAA;IACnD,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAA;CACpD,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,EAAE,CAAA;CACnB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA"}

package/dist/types/types/error.d.ts

@@ -64,6 +64,12 @@ export type AuthError = {
     code: "internal_error";
     description: string;
     cause?: unknown;
+} | {
+    code: "invalid_dpop_proof";
+    description: string;
+    replaySignal?: {
+        jti: string;
+    };
 };
 export type AuthErrorCode = AuthError["code"];
 /** Narrow constructor helpers — keep call sites short and types tight. */
@@ -88,5 +94,8 @@ export declare const authError: {
     }) => AuthError;
     invalidTarget: (description: string) => AuthError;
     internalError: (description: string, cause?: unknown) => AuthError;
+    invalidDpopProof: (description: string, replaySignal?: {
+        jti: string;
+    }) => AuthError;
 };
 //# sourceMappingURL=error.d.ts.map

package/dist/types/types/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../src/types/error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AACjD;;;;;;GAMG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF,GACD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAI9C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAGnE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAG/C;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAID;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAEpE,MAAM,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAE7C,0EAA0E;AAC1E,eAAO,MAAM,SAAS;kCACU,MAAM,UAAU,MAAM,KAAG,SAAS;iCAKnC,MAAM,KAAG,SAAS;gCAKhC,MAAM,gBACL;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KACpE,SAAS;sCAKsB,MAAM,KAAG,SAAS;wCAIhB,MAAM,KAAG,SAAS;gCAI1B,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;+BAInB,MAAM,UAAU,OAAO,KAAG,SAAS;kCAKhC,MAAM,YAAY,MAAM,KAAG,SAAS;kCAMnD,MAAM,QACb;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC/C,SAAS;iCAMiB,MAAM,KAAG,SAAS;iCAIlB,MAAM,UAAU,OAAO,KAAG,SAAS;CAKjE,CAAA"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../src/types/error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AACjD;;;;;;GAMG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF,GACD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAI9C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAGnE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAG/C;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAID;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAWhE;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/B,CAAA;AAEL,MAAM,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAE7C,0EAA0E;AAC1E,eAAO,MAAM,SAAS;kCACU,MAAM,UAAU,MAAM,KAAG,SAAS;iCAKnC,MAAM,KAAG,SAAS;gCAKhC,MAAM,gBACL;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KACpE,SAAS;sCAKsB,MAAM,KAAG,SAAS;wCAIhB,MAAM,KAAG,SAAS;gCAI1B,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;+BAInB,MAAM,UAAU,OAAO,KAAG,SAAS;kCAKhC,MAAM,YAAY,MAAM,KAAG,SAAS;kCAMnD,MAAM,QACb;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC/C,SAAS;iCAMiB,MAAM,KAAG,SAAS;iCAIlB,MAAM,UAAU,OAAO,KAAG,SAAS;oCAMjD,MAAM,iBACJ;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAC7B,SAAS;CAKb,CAAA"}

package/dist/types/types/flow.d.ts

@@ -19,6 +19,7 @@
  *      needed at `/token` into the auth-code payload; `methodState` is
  *      dropped.
  */
+import type { ClaimsRequest } from "./authorization";
 import type { TenantId } from "./tenant";
 export type FlowRecord = {
     flowId: string;
@@ -53,6 +54,15 @@ export type FlowRecord = {
      * `appState`. Compared at callback against the consumed record.
      */
     nonce: string;
+    /**
+     * Relying party's OIDC `nonce` parameter (OIDC Core §3.1.2.1). Distinct
+     * from `nonce` (which is the framework's CSRF nonce for state-MAC
+     * binding). When present, must be echoed in the issued `id_token`
+     * (OIDC Core §2). Snapshotted into `CodePayload.appNonce` at success.
+     */
+    appNonce?: string;
+    /** OIDC Core §5.5 — RP-requested claims, parsed at `/authorize`. */
+    claimsRequest?: ClaimsRequest;
     /**
      * Relying-party → IdP PKCE. The RP generates the verifier and sends the
      * challenge to `/authorize`. Verified at `/token`.

package/dist/types/types/flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../../src/types/flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,QAAQ,CAAA;IAElB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAA;IAElB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;IACpB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,wCAAwC;IACxC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAElD;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEjC,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA"}
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../../src/types/flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,QAAQ,CAAA;IAElB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAA;IAElB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;IACpB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,wCAAwC;IACxC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAElD;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEjC,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA"}

package/dist/types/types/idp.d.ts

@@ -13,7 +13,7 @@ import type { AuthError } from "./error";
 import type { AnyAuthMethodFactory } from "./method";
 import type { Result } from "./result";
 import type { SubjectClaim, SubjectSchema } from "./subject";
-import type { StateKeyRing, TenantContext, TenantId, ThemeConfig } from "./tenant";
+import type { ClientConfig, StateKeyRing, TenantContext, TenantId, ThemeConfig } from "./tenant";
 import type { PickerContext, PickerMethod } from "./picker";
 /**
  * Input handed to the user's `success` callback. The framework provides
@@ -104,6 +104,66 @@ export type ExchangeAudience = (currentClaim: SubjectClaim, request: {
     /** Tenant the subject_token came from. */
     fromTenantId: string;
 }) => Promise<SubjectClaim | AuthError>;
+/**
+ * RFC 7591 Dynamic Client Registration request body, normalized to the
+ * library's type system. The framework's `/register` handler parses the
+ * raw JSON, validates structure, then calls the host's `registerClient`
+ * hook with this shape. The host owns persistence — writing through its
+ * own `ConfigStore` — and returns the final `ClientConfig`.
+ */
+export type RegisterClientRequest = {
+    client_name?: string;
+    redirect_uris: string[];
+    /** RFC 7591 §2 — defaults to `["authorization_code"]`. */
+    grant_types?: string[];
+    /** RFC 7591 §2 — defaults to `["code"]`. */
+    response_types?: string[];
+    /** RFC 7591 §2 — `"none"` = public client, otherwise confidential. */
+    token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post";
+    scope?: string;
+    /** OIDC RP-Initiated Logout 1.0 §2. */
+    post_logout_redirect_uris?: string[];
+    /** OIDC Core §8.1. */
+    sector_identifier_uri?: string;
+    /** Free-form metadata the host may interpret. */
+    contacts?: string[];
+};
+/**
+ * RFC 7591 §3.2.1 response body. Returned verbatim from `/register` when
+ * the host hook produces a `ClientConfig`. `client_secret` is included
+ * only for confidential clients; public clients omit it.
+ */
+export type RegisterClientResponse = {
+    client_id: string;
+    client_secret?: string;
+    client_id_issued_at: number;
+    client_secret_expires_at?: number;
+    redirect_uris: string[];
+    grant_types?: string[];
+    response_types?: string[];
+    token_endpoint_auth_method?: string;
+    client_name?: string;
+};
+/**
+ * Optional Dynamic Client Registration hook. Hosts that want to expose
+ * RFC 7591 client provisioning supply this; the framework validates the
+ * wire format, then defers persistence to the host. If absent, the
+ * `/register` endpoint returns `invalid_request` so RPs receive a clear
+ * "not enabled" signal rather than a 404.
+ *
+ * The hook receives the parsed request, the resolved tenant, and the
+ * plaintext client secret (if any) the framework minted — hosts hash it
+ * with `hashClientSecret` before storing on `ClientConfig.secretHash`,
+ * then return the final `ClientConfig` along with the secret in the
+ * `RegisterClientResponse` so the RP can record it.
+ */
+export type RegisterClient = (input: {
+    tenant: TenantContext;
+    request: RegisterClientRequest;
+}) => Promise<Result<{
+    client: ClientConfig;
+    secret?: string;
+}, AuthError>>;
 /**
  * Optional override for the default provider picker shown when an
  * `/authorize` request has multiple enabled methods and no `method_id`.
@@ -181,6 +241,12 @@ export type IdPOptions = {
      * Optional override for the default provider picker. See `RenderPicker`.
      */
     renderPicker?: RenderPicker;
+    /**
+     * Optional RFC 7591 Dynamic Client Registration hook. See
+     * `RegisterClient` for the contract. When absent, `/register` rejects
+     * with `invalid_request: "dynamic client registration is not enabled"`.
+     */
+    registerClient?: RegisterClient;
     /**
      * Optional hook that builds the `TenantContext.request.custom` blob for
      * each request the framework processes (the initial `/authorize`, the
@@ -199,6 +265,24 @@ export type IdPOptions = {
      * between an absent hook and one that returns `{}`.
      */
     buildCustomContext?: (req: Request) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    /**
+     * Optional vendor scope → claim-names map. Merged on top of OIDC Core
+     * §5.4 when building the id_token + `/userinfo` response. Lets a host
+     * expose its own identity vocabulary (`tenant_id`, `org_role`, etc.)
+     * via custom scope names. The standard §5.4 mapping always wins on
+     * collision, so an entry for `email` is silently ignored.
+     *
+     * Per-client scope allowlist still applies — a client must list a
+     * custom scope in `ClientConfig.scopes` to be allowed to request it.
+     *
+     * ```ts
+     * customScopeClaims: {
+     *   tenant: ["tenant_id", "tenant_role", "tenant_roles"],
+     *   org: ["organization_id", "org_role"],
+     * }
+     * ```
+     */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
     /**
      * Optional override for the framework's `Set-Cookie` defaults.
      *
@@ -230,5 +314,11 @@ export type IdP = {
     discovery: (req: Request) => Promise<Response>;
     revoke: (req: Request) => Promise<Response>;
     introspect: (req: Request) => Promise<Response>;
+    /** OIDC RP-Initiated Logout 1.0. */
+    endSession: (req: Request) => Promise<Response>;
+    /** RFC 9126 Pushed Authorization Requests. */
+    par: (req: Request) => Promise<Response>;
+    /** RFC 7591 Dynamic Client Registration. */
+    register: (req: Request) => Promise<Response>;
 };
 //# sourceMappingURL=idp.d.ts.map