@_mustachio/openauth 0.10.0 → 0.11.0

package/dist/types/types/idp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAC3C,yDAAyD;IACzD,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,KAAK,CAAC,EAAE;QACN,yDAAyD;QACzD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAClD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACnD,CAAA;IAED;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAChD,CAAA"}
+{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAC3C,yDAAyD;IACzD,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,0BAA0B,CAAC,EACvB,MAAM,GACN,qBAAqB,GACrB,oBAAoB,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,sBAAsB;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,KAAK,CAAC,EAAE;QACN,yDAAyD;QACzD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAClD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACnD,CAAA;IAED;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,oCAAoC;IACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,8CAA8C;IAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9C,CAAA"}

package/dist/types/types/tenant.d.ts

@@ -112,6 +112,26 @@ export type PublicClientConfig = {
     scopes: string[];
     /** Must be `true` for public clients per OAuth 2.1 §2.1.1. */
     pkceRequired: true;
+    /**
+     * Registered URIs to which `/end_session` may redirect after RP-initiated
+     * logout (OIDC RP-Initiated Logout 1.0 §2). Exact-match. If absent, the
+     * `/end_session` endpoint refuses any `post_logout_redirect_uri`.
+     */
+    postLogoutRedirectUris?: string[];
+    /**
+     * RFC 9126 §2: when `true`, the client MUST use Pushed Authorization
+     * Requests; a direct `GET /authorize` call without `request_uri` is
+     * rejected with `invalid_request`.
+     */
+    requirePushedAuthorizationRequests?: boolean;
+    /**
+     * OIDC Core §8.1 — when set, the subject identifier (`sub`) is derived
+     * as a pairwise pseudonym keyed by this string. Two clients sharing
+     * the same `sectorIdentifier` will see the same `sub`; different
+     * values yield different `sub`s for the same end user. Absent =
+     * public subject (sub is identical across all RPs).
+     */
+    sectorIdentifier?: string;
     /** Phase 8. */
     dpopRequired?: boolean;
 };
@@ -129,6 +149,23 @@ export type ConfidentialClientConfig = {
      * strongly discouraged; OAuth 2.1 §2.1.1 recommends PKCE for every client.
      */
     pkceRequired: boolean;
+    /**
+     * Registered URIs to which `/end_session` may redirect after RP-initiated
+     * logout (OIDC RP-Initiated Logout 1.0 §2). Exact-match.
+     */
+    postLogoutRedirectUris?: string[];
+    /**
+     * RFC 9126 §2: when `true`, the client MUST use Pushed Authorization
+     * Requests; a direct `GET /authorize` call without `request_uri` is
+     * rejected with `invalid_request`.
+     */
+    requirePushedAuthorizationRequests?: boolean;
+    /**
+     * OIDC Core §8.1 — see `PublicClientConfig.sectorIdentifier` for
+     * semantics. Same field; duplicated on each branch because the
+     * `ClientConfig` discriminated union doesn't share optional fields.
+     */
+    sectorIdentifier?: string;
     /** Phase 8. */
     dpopRequired?: boolean;
 };

package/dist/types/types/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/types/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,QAA6B,CAAA;AAExE,qFAAqF;AACrF,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8DAA8D;IAC9D,YAAY,EAAE,IAAI,CAAA;IAClB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAA;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,QAAQ,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,QAAQ,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE;QACP,GAAG,EAAE,OAAO,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,kFAAkF;IAClF,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/types/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,QAA6B,CAAA;AAExE,qFAAqF;AACrF,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8DAA8D;IAC9D,YAAY,EAAE,IAAI,CAAA;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAA;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,QAAQ,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,QAAQ,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE;QACP,GAAG,EAAE,OAAO,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,kFAAkF;IAClF,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA"}

package/dist/types/types/token.d.ts

@@ -6,6 +6,7 @@
  * Per AD9, access tokens are JWTs (ES256 by default, Ed25519 optional per
  * AD11) and refresh tokens are opaque server-side records.
  */
+import type { ClaimsRequest } from "./authorization";
 import type { SubjectClaim } from "./subject";
 import type { TenantId } from "./tenant";
 /**
@@ -39,9 +40,98 @@ export type CodePayload = {
     providerSubject: string;
     /** Typed-per-method properties from `MethodResult.success`. */
     properties: unknown;
+    /**
+     * Relying party's OIDC `nonce` (OIDC Core §3.1.2.1). Snapshotted from
+     * `FlowRecord.appNonce`. Echoed into the issued `id_token` when present.
+     */
+    appNonce?: string;
+    /**
+     * Seconds-since-epoch when end-user authentication completed
+     * (OIDC Core §2 `auth_time`). Stamped at the moment the method's
+     * `MethodResult.success` fires. Carried into the `id_token` and forward
+     * across refresh-token rotations.
+     */
+    authTime: number;
+    /** OIDC Core §5.5 — RP-requested claims; honored at id_token + /userinfo. */
+    claimsRequest?: ClaimsRequest;
     /** Auth-code TTL is 60 s — framework refuses anything longer. */
     expiresAt: number;
 };
+/**
+ * OIDC Core §5.1 `address` claim. Structured object value rather than a
+ * scalar — distinct from the rest of the profile fields.
+ */
+export type AddressClaim = {
+    formatted?: string;
+    street_address?: string;
+    locality?: string;
+    region?: string;
+    postal_code?: string;
+    country?: string;
+};
+/**
+ * OIDC Core §5.1 profile / email / phone / address claims, gated by the
+ * `profile` / `email` / `phone` / `address` scopes via §5.4. Reused by
+ * `IdTokenClaims` and the `/userinfo` response so the two surfaces share
+ * exactly one source of truth for scope→claim mapping.
+ *
+ * Every field is optional: presence depends on (a) which scopes were
+ * granted and (b) whether the host populated the matching key in
+ * `SubjectClaim.properties`.
+ */
+export type ScopedProfileClaims = {
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    middle_name?: string;
+    nickname?: string;
+    preferred_username?: string;
+    profile?: string;
+    picture?: string;
+    website?: string;
+    gender?: string;
+    birthdate?: string;
+    zoneinfo?: string;
+    locale?: string;
+    updated_at?: number;
+    email?: string;
+    email_verified?: boolean;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    address?: AddressClaim;
+};
+/**
+ * OIDC `id_token` JWT claims this IdP issues at `/token` when `openid`
+ * scope is granted (OIDC Core §2). Distinct from access-token claims:
+ *
+ *  - `aud` is the relying-party `client_id` (not the API audience).
+ *  - `nonce` echoes the RP's `/authorize` `nonce` parameter when present.
+ *  - `auth_time` is stable across refresh-token rotations (OIDC Core §12).
+ *  - `at_hash` is recommended whenever an id_token and access_token are
+ *    returned in the same response (§3.1.3.6).
+ *
+ * Standard OIDC claim names use snake_case on the wire; TypeScript field
+ * names match to keep the marshalling 1:1.
+ */
+export type IdTokenClaims = ScopedProfileClaims & {
+    iss: string;
+    sub: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    /** Seconds-since-epoch when end-user auth completed. */
+    auth_time?: number;
+    /** RP-supplied OIDC nonce, when present. MUST equal the `/authorize` value. */
+    nonce?: string;
+    /** Authentication Methods References (RFC 8176). */
+    amr?: string[];
+    /** Authentication Context Class Reference. */
+    acr?: string;
+    /** Authorized party — the client_id of the party the id_token is for. */
+    azp?: string;
+    /** Access-token hash (OIDC Core §3.1.3.6). */
+    at_hash?: string;
+};
 /** Access-token JWT claims this IdP issues. */
 export type AccessTokenClaims = {
     iss: string;
@@ -56,10 +146,30 @@ export type AccessTokenClaims = {
     /** Factory kind that originated this token. */
     mkind?: string;
     scope?: string;
+    /**
+     * Seconds-since-epoch when the end-user originally authenticated
+     * (OIDC Core §2). Stable across refresh-token rotation and across
+     * RFC 8693 token-exchange (§12 — exchanging an audience does NOT
+     * re-authenticate the user). Absent on `client_credentials` grants
+     * where there is no end-user.
+     *
+     * Carried on the access token so RFC 8693 `subject_token` consumers
+     * can propagate it without needing the original id_token. Resource
+     * servers typically ignore it; it's there for the IdP's own
+     * downstream issuance.
+     */
+    auth_time?: number;
     /** DPoP confirmation claim (Phase 8). */
     cnf?: {
         jkt: string;
     };
+    /**
+     * OIDC Core §5.5 — list of claim names the RP requested for the
+     * `/userinfo` response via the `claims` parameter. The resource server
+     * surface uses this to bypass scope-gating per §5.5; it is empty /
+     * absent when the RP did not use the `claims` parameter.
+     */
+    uic?: string[];
     /** The structured subject (matches `SubjectClaim`). Inlined for resource servers. */
     claim: SubjectClaim;
 };
@@ -87,6 +197,24 @@ export type RefreshTokenPayload = {
     methodId: string;
     /** Factory kind (`MethodConfig.kind`) that originated the chain. */
     methodKind: string;
+    /**
+     * Seconds-since-epoch when end-user authentication originally completed
+     * (OIDC Core §2 `auth_time`). Stable across refresh-token rotations —
+     * `auth_time` does **not** advance on refresh, only on re-authentication.
+     */
+    authTime: number;
+    /**
+     * RFC 7638 JWK thumbprint of the client's DPoP key (RFC 9449 §6.1).
+     * Present when the original token grant was DPoP-bound. Refresh-grant
+     * rotation REQUIRES a fresh DPoP proof whose thumbprint matches; absent
+     * = the token is plain Bearer and Bearer is acceptable on refresh.
+     */
+    dpopJkt?: string;
+    /**
+     * OIDC Core §12 — the original RP-requested claims, preserved so
+     * refresh-grant id_token + /userinfo responses keep returning them.
+     */
+    claimsRequest?: ClaimsRequest;
     /** Wall-clock issuance and absolute-expiry timestamps. */
     issuedAt: number;
     expiresAt: number;

package/dist/types/types/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/types/token.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAClD,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACxC,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,+DAA+D;IAC/D,UAAU,EAAE,OAAO,CAAA;IACnB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,iBAAiB;IACjB,GAAG,EAAE,QAAQ,CAAA;IACb,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yCAAyC;IACzC,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACrB,qFAAqF;IACrF,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/types/token.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAClD,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACxC,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,+DAA+D;IAC/D,UAAU,EAAE,OAAO,CAAA;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAEhC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IAExB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAE/B,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GAAG,mBAAmB,GAAG;IAChD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACd,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,iBAAiB;IACjB,GAAG,EAAE,QAAQ,CAAA;IACb,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yCAAyC;IACzC,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACrB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACd,qFAAqF;IACrF,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,CAAA;IACnB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,QAAQ,GAAG,MAAM,CAAA;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@_mustachio/openauth",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/adapters/memory/session-store.ts

@@ -8,7 +8,11 @@
  */
 import { authError } from "../../types/error"
 import type { FlowRecord } from "../../types/flow"
-import type { SessionRecord, SessionStore } from "../../ports/session-store"
+import type {
+  ParRecord,
+  SessionRecord,
+  SessionStore,
+} from "../../ports/session-store"
 import type { Result } from "../../types/result"
 import { err, ok } from "../../types/result"
 import type { Clock } from "./clock"
@@ -19,6 +23,11 @@ type StoredFlow = {
   expiresAt: number
 }
 
+type StoredPar = {
+  record: ParRecord
+  expiresAt: number
+}
+
 export type MemorySessionStoreOptions = {
   clock?: Clock
 }
@@ -27,6 +36,7 @@ export class MemorySessionStore implements SessionStore {
   #clock: Clock
   #flows = new Map<string, StoredFlow>()
   #sessions = new Map<string, SessionRecord>()
+  #par = new Map<string, StoredPar>()
 
   constructor(opts: MemorySessionStoreOptions = {}) {
     this.#clock = opts.clock ?? realClock
@@ -125,4 +135,37 @@ export class MemorySessionStore implements SessionStore {
     this.#sessions.delete(sessionId)
     return ok(undefined)
   }
+
+  async savePar(
+    requestUri: string,
+    payload: ParRecord,
+    ttl: number,
+  ): Promise<Result<void>> {
+    if (ttl <= 0) {
+      return err(
+        authError.internalError(`savePar: ttl must be positive, got ${ttl}`),
+      )
+    }
+    this.#par.set(requestUri, {
+      record: payload,
+      expiresAt: this.#clock() + ttl,
+    })
+    return ok(undefined)
+  }
+
+  async consumePar(requestUri: string): Promise<Result<ParRecord>> {
+    const stored = this.#par.get(requestUri)
+    if (!stored) {
+      return err(
+        authError.unknownState(
+          `par "${requestUri}" unknown or already consumed`,
+        ),
+      )
+    }
+    this.#par.delete(requestUri)
+    if (this.#clock() >= stored.expiresAt) {
+      return err(authError.unknownState(`par "${requestUri}" expired`))
+    }
+    return ok(stored.record)
+  }
 }

package/src/adapters/memory/token-store.ts

@@ -43,6 +43,8 @@ export class MemoryTokenStore implements TokenStore {
   #clock: Clock
   #codes = new Map<string, StoredCode>()
   #refresh = new Map<string, StoredRefresh>()
+  /** DPoP proof `jti` replay-protection map. Value is expiry timestamp. */
+  #dpopJtis = new Map<string, number>()
 
   constructor(opts: MemoryTokenStoreOptions = {}) {
     this.#clock = opts.clock ?? realClock
@@ -162,4 +164,18 @@ export class MemoryTokenStore implements TokenStore {
     }
     return ok(undefined)
   }
+
+  async recordDpopJti(jti: string, ttlMs: number): Promise<Result<void>> {
+    const now = this.#clock()
+    // Sweep expired entries opportunistically — keeps the map bounded
+    // under sustained load without a separate GC pass.
+    for (const [k, exp] of this.#dpopJtis) {
+      if (exp <= now) this.#dpopJtis.delete(k)
+    }
+    if (this.#dpopJtis.has(jti)) {
+      return err(authError.invalidGrant(`dpop jti "${jti}" replayed`))
+    }
+    this.#dpopJtis.set(jti, now + ttlMs)
+    return ok(undefined)
+  }
 }

package/src/client.ts

@@ -91,6 +91,14 @@ export interface Tokens {
    * The number of seconds until the access token expires.
    */
   expiresIn: number
+
+  /**
+   * The OIDC `id_token` (signed JWT), present when `scope=openid` was granted.
+   *
+   * Refresh-grant rotation reissues this with a stable `auth_time` per
+   * OIDC Core §12 and deliberately omits the original `nonce`.
+   */
+  idToken?: string
 }
 
 interface ResponseLike {
@@ -178,6 +186,18 @@ export interface AuthorizeOptions {
    * If there's only one provider configured, the user will be redirected to that.
    */
   provider?: string
+  /**
+   * OAuth scopes to request, e.g. `["openid", "email", "profile"]`.
+   *
+   * Pass `openid` to request an `id_token` at `/token` (OIDC Core §2). Pass
+   * `email` / `profile` / `phone` / `address` to opt into the standard §5.4
+   * profile claim sets on the id_token and `/userinfo` response.
+   *
+   * Accepts an array or a pre-joined space-separated string. When omitted,
+   * no `scope` is sent — the IdP's default grant applies, which typically
+   * does NOT include `openid` and therefore does NOT issue an id_token.
+   */
+  scope?: string | string[]
 }
 
 export interface AuthorizeResult {
@@ -588,6 +608,12 @@ export function createClient(input: ClientInput): Client {
       result.searchParams.set("response_type", response)
       result.searchParams.set("state", challenge.state)
       if (opts?.provider) result.searchParams.set("provider", opts.provider)
+      if (opts?.scope !== undefined) {
+        const scope = Array.isArray(opts.scope)
+          ? opts.scope.join(" ")
+          : opts.scope
+        if (scope) result.searchParams.set("scope", scope)
+      }
       if (opts?.pkce && response === "code") {
         const pkce = await generatePKCE()
         result.searchParams.set("code_challenge_method", "S256")
@@ -648,6 +674,9 @@ export function createClient(input: ClientInput): Client {
           access: json.access_token as string,
           refresh: json.refresh_token as string,
           expiresIn: json.expires_in as number,
+          ...(typeof json.id_token === "string"
+            ? { idToken: json.id_token as string }
+            : {}),
         },
       }
     },
@@ -691,6 +720,9 @@ export function createClient(input: ClientInput): Client {
           access: json.access_token as string,
           refresh: json.refresh_token as string,
           expiresIn: json.expires_in as number,
+          ...(typeof json.id_token === "string"
+            ? { idToken: json.id_token as string }
+            : {}),
         },
       }
     },

package/src/domain/authorize.ts

@@ -221,6 +221,10 @@ export async function startAuthorize(
     prompt: req.prompt,
     uiLocales: req.uiLocales,
     nonce,
+    ...(req.nonce !== undefined ? { appNonce: req.nonce } : {}),
+    ...(req.claimsRequest !== undefined
+      ? { claimsRequest: req.claimsRequest }
+      : {}),
     clientPkce: req.codeChallenge
       ? { challenge: req.codeChallenge, method: "S256" }
       : undefined,
@@ -387,6 +391,11 @@ async function issueCodeFromInlineSuccess(
       context: flow.context ?? null,
       providerSubject: result.providerSubject,
       properties: result.properties,
+      ...(flow.appNonce !== undefined ? { appNonce: flow.appNonce } : {}),
+      ...(flow.claimsRequest !== undefined
+        ? { claimsRequest: flow.claimsRequest }
+        : {}),
+      authTime: Math.floor(now / 1000),
       expiresAt: now + AUTH_CODE_TTL_MS,
     },
     AUTH_CODE_TTL_MS,

package/src/domain/callback.ts

@@ -207,6 +207,11 @@ async function translate(
           context: flow.context ?? null,
           providerSubject: result.providerSubject,
           properties: result.properties,
+          ...(flow.appNonce !== undefined ? { appNonce: flow.appNonce } : {}),
+          ...(flow.claimsRequest !== undefined
+            ? { claimsRequest: flow.claimsRequest }
+            : {}),
+          authTime: Math.floor(now / 1000),
           expiresAt: now + AUTH_CODE_TTL_MS,
         },
         AUTH_CODE_TTL_MS,

package/src/domain/client-credentials.ts

@@ -54,6 +54,8 @@ export type ClientCredentialsDeps = {
   issuerUrl: string
   clock: () => number
   newRefreshFamily?: () => string
+  /** See `IdPOptions.customScopeClaims`. Forwarded to `mintTokens`. */
+  customScopeClaims?: Record<string, ReadonlyArray<string>>
 }
 
 export async function clientCredentialsGrant(

package/src/domain/discovery.ts

@@ -19,11 +19,37 @@ export type DiscoveryDocument = {
   jwks_uri: string
   revocation_endpoint: string
   introspection_endpoint: string
+  /** OIDC RP-Initiated Logout 1.0 §2. */
+  end_session_endpoint: string
+  /** RFC 7591 §3.1. */
+  registration_endpoint: string
+  /** RFC 9126 §5. */
+  pushed_authorization_request_endpoint: string
+  /**
+   * RFC 9126 §5. True iff every client on this tenant is required to use
+   * PAR. We advertise `false` at the tenant level — the per-client toggle
+   * is read at request time.
+   */
+  require_pushed_authorization_requests: boolean
+  /** RFC 9449 §5.1 — DPoP algorithms accepted on proof JWTs. */
+  dpop_signing_alg_values_supported: string[]
   response_types_supported: string[]
   grant_types_supported: string[]
   subject_types_supported: string[]
   id_token_signing_alg_values_supported: string[]
   scopes_supported: string[]
+  /** OIDC Core §3 — registered claim names the IdP can return. */
+  claims_supported: string[]
+  /** OIDC Core §5.5 — `claims` request parameter is honored. */
+  claims_parameter_supported: boolean
+  /** OIDC Core §6.1 — JAR (`request` parameter). Not implemented. */
+  request_parameter_supported: boolean
+  /** OIDC Core §6.2 — JAR (`request_uri` parameter). Not implemented. */
+  request_uri_parameter_supported: boolean
+  /** OIDC Core §6.2 — whether `request_uri` values must be pre-registered. */
+  require_request_uri_registration: boolean
+  /** OIDC Core §3.1.2.1 — UI locales the OP can render. */
+  ui_locales_supported?: string[]
   token_endpoint_auth_methods_supported: string[]
   code_challenge_methods_supported: string[]
 }
@@ -38,14 +64,30 @@ export type DiscoveryDeps = {
     jwks: string
     revoke: string
     introspect: string
+    endSession: string
+    par: string
+    register: string
   }>
   /** Advertised scopes. Defaults to `["openid", "email", "profile"]`. */
   scopes?: string[]
+  /** Advertised UI locales. Defaults to `["en"]`. */
+  uiLocales?: string[]
+  /**
+   * Host-supplied scope → claim-names map. Each key adds a scope to
+   * `scopes_supported`; the union of values augments `claims_supported`.
+   * Mirrors `IdPOptions.customScopeClaims`.
+   */
+  customScopeClaims?: Record<string, ReadonlyArray<string>>
 }
 
 export function buildDiscoveryDocument(deps: DiscoveryDeps): DiscoveryDocument {
   const base = deps.issuerUrl.replace(/\/+$/, "")
   const p = deps.paths ?? {}
+  const customScopeKeys = Object.keys(deps.customScopeClaims ?? {})
+  const customClaimNames = new Set<string>()
+  for (const list of Object.values(deps.customScopeClaims ?? {})) {
+    for (const name of list) customClaimNames.add(name)
+  }
   return {
     issuer: deps.issuerUrl,
     authorization_endpoint: `${base}${p.authorize ?? "/authorize"}`,
@@ -54,15 +96,51 @@ export function buildDiscoveryDocument(deps: DiscoveryDeps): DiscoveryDocument {
     jwks_uri: `${base}${p.jwks ?? "/.well-known/jwks.json"}`,
     revocation_endpoint: `${base}${p.revoke ?? "/revoke"}`,
     introspection_endpoint: `${base}${p.introspect ?? "/introspect"}`,
+    end_session_endpoint: `${base}${p.endSession ?? "/end_session"}`,
+    registration_endpoint: `${base}${p.register ?? "/register"}`,
+    pushed_authorization_request_endpoint: `${base}${p.par ?? "/par"}`,
+    require_pushed_authorization_requests: false,
+    dpop_signing_alg_values_supported: ["ES256", "EdDSA"],
     response_types_supported: ["code"],
     grant_types_supported: [
       "authorization_code",
       "refresh_token",
       "client_credentials",
     ],
-    subject_types_supported: ["public"],
+    subject_types_supported: ["public", "pairwise"],
     id_token_signing_alg_values_supported: ["ES256", "EdDSA"],
-    scopes_supported: deps.scopes ?? ["openid", "email", "profile"],
+    scopes_supported: [
+      ...(deps.scopes ?? ["openid", "email", "profile"]),
+      ...customScopeKeys,
+    ],
+    claims_supported: [
+      "sub",
+      "iss",
+      "aud",
+      "exp",
+      "iat",
+      "auth_time",
+      "nonce",
+      "amr",
+      "at_hash",
+      "email",
+      "email_verified",
+      "name",
+      "given_name",
+      "family_name",
+      "preferred_username",
+      "picture",
+      "locale",
+      "phone_number",
+      "phone_number_verified",
+      "address",
+      ...customClaimNames,
+    ],
+    claims_parameter_supported: true,
+    request_parameter_supported: false,
+    request_uri_parameter_supported: false,
+    require_request_uri_registration: false,
+    ui_locales_supported: deps.uiLocales ?? ["en"],
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",