@_mustachio/openauth 0.10.0 → 0.12.0

package/dist/types/types/error.d.ts

@@ -64,6 +64,12 @@ export type AuthError = {
     code: "internal_error";
     description: string;
     cause?: unknown;
+} | {
+    code: "invalid_dpop_proof";
+    description: string;
+    replaySignal?: {
+        jti: string;
+    };
 };
 export type AuthErrorCode = AuthError["code"];
 /** Narrow constructor helpers — keep call sites short and types tight. */
@@ -88,5 +94,8 @@ export declare const authError: {
     }) => AuthError;
     invalidTarget: (description: string) => AuthError;
     internalError: (description: string, cause?: unknown) => AuthError;
+    invalidDpopProof: (description: string, replaySignal?: {
+        jti: string;
+    }) => AuthError;
 };
 //# sourceMappingURL=error.d.ts.map

package/dist/types/types/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../src/types/error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AACjD;;;;;;GAMG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF,GACD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAI9C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAGnE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAG/C;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAID;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAEpE,MAAM,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAE7C,0EAA0E;AAC1E,eAAO,MAAM,SAAS;kCACU,MAAM,UAAU,MAAM,KAAG,SAAS;iCAKnC,MAAM,KAAG,SAAS;gCAKhC,MAAM,gBACL;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KACpE,SAAS;sCAKsB,MAAM,KAAG,SAAS;wCAIhB,MAAM,KAAG,SAAS;gCAI1B,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;+BAInB,MAAM,UAAU,OAAO,KAAG,SAAS;kCAKhC,MAAM,YAAY,MAAM,KAAG,SAAS;kCAMnD,MAAM,QACb;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC/C,SAAS;iCAMiB,MAAM,KAAG,SAAS;iCAIlB,MAAM,UAAU,OAAO,KAAG,SAAS;CAKjE,CAAA"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../src/types/error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AACjD;;;;;;GAMG;GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF,GACD;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAI9C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAGnE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAG/C;IACE,IAAI,EAAE,kBAAkB,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAID;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAWhE;IACE,IAAI,EAAE,oBAAoB,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/B,CAAA;AAEL,MAAM,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;AAE7C,0EAA0E;AAC1E,eAAO,MAAM,SAAS;kCACU,MAAM,UAAU,MAAM,KAAG,SAAS;iCAKnC,MAAM,KAAG,SAAS;gCAKhC,MAAM,gBACL;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KACpE,SAAS;sCAKsB,MAAM,KAAG,SAAS;wCAIhB,MAAM,KAAG,SAAS;gCAI1B,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;gCAIlB,MAAM,KAAG,SAAS;+BAInB,MAAM,UAAU,OAAO,KAAG,SAAS;kCAKhC,MAAM,YAAY,MAAM,KAAG,SAAS;kCAMnD,MAAM,QACb;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC/C,SAAS;iCAMiB,MAAM,KAAG,SAAS;iCAIlB,MAAM,UAAU,OAAO,KAAG,SAAS;oCAMjD,MAAM,iBACJ;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAC7B,SAAS;CAKb,CAAA"}

package/dist/types/types/flow.d.ts

@@ -19,6 +19,7 @@
  *      needed at `/token` into the auth-code payload; `methodState` is
  *      dropped.
  */
+import type { ClaimsRequest } from "./authorization";
 import type { TenantId } from "./tenant";
 export type FlowRecord = {
     flowId: string;
@@ -53,6 +54,15 @@ export type FlowRecord = {
      * `appState`. Compared at callback against the consumed record.
      */
     nonce: string;
+    /**
+     * Relying party's OIDC `nonce` parameter (OIDC Core §3.1.2.1). Distinct
+     * from `nonce` (which is the framework's CSRF nonce for state-MAC
+     * binding). When present, must be echoed in the issued `id_token`
+     * (OIDC Core §2). Snapshotted into `CodePayload.appNonce` at success.
+     */
+    appNonce?: string;
+    /** OIDC Core §5.5 — RP-requested claims, parsed at `/authorize`. */
+    claimsRequest?: ClaimsRequest;
     /**
      * Relying-party → IdP PKCE. The RP generates the verifier and sends the
      * challenge to `/authorize`. Verified at `/token`.

package/dist/types/types/flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../../src/types/flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,QAAQ,CAAA;IAElB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAA;IAElB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;IACpB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,wCAAwC;IACxC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAElD;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEjC,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA"}
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../../src/types/flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,QAAQ,CAAA;IAElB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAA;IAElB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;IACpB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,wCAAwC;IACxC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAElD;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEjC,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA"}

package/dist/types/types/idp.d.ts

@@ -13,7 +13,7 @@ import type { AuthError } from "./error";
 import type { AnyAuthMethodFactory } from "./method";
 import type { Result } from "./result";
 import type { SubjectClaim, SubjectSchema } from "./subject";
-import type { StateKeyRing, TenantContext, TenantId, ThemeConfig } from "./tenant";
+import type { ClientConfig, StateKeyRing, TenantContext, TenantId, ThemeConfig } from "./tenant";
 import type { PickerContext, PickerMethod } from "./picker";
 /**
  * Input handed to the user's `success` callback. The framework provides
@@ -58,6 +58,56 @@ export type FailureEvent = {
     flowId?: string;
     error: AuthError;
 };
+/**
+ * Input to the optional `IdPOptions.onLogout` hook.
+ *
+ * Fires when an upstream provider notifies this IdP that a federated
+ * session has ended — today, a SAML front-channel `LogoutRequest`
+ * delivered to the SP's SLS endpoint. By the time this runs the library
+ * has already cryptographically verified the upstream logout message
+ * (XML-DSig via the SAML method), so the hook is purely the host's
+ * teardown point.
+ *
+ * The library deliberately does **not** know which OIDC `subject` an
+ * upstream identifier (`nameId`) maps to — that mapping lives in the
+ * host's `success` callback, not the library. So the host clears its
+ * own session and returns the subject (if any) whose library-issued
+ * tokens should be revoked; the library then runs the same
+ * `revokeAllForSubject` primitive `/end_session` uses. Returning
+ * nothing skips library-side revocation (the host handled everything,
+ * or there is nothing to revoke).
+ *
+ * Method-agnostic on purpose: any federation method that can verify an
+ * upstream logout signal reuses this. SAML SLO is the first caller;
+ * OIDC back-channel logout would be the next.
+ */
+export type LogoutEventInput = {
+    tenant: TenantContext;
+    methodId: string;
+    methodKind: string;
+    /** What kind of upstream logout this is. Extensible discriminant. */
+    reason: "upstream_slo";
+    /**
+     * Upstream subject identifier from the verified logout message
+     * (SAML `LogoutRequest/NameID`). Absent if the message omitted it.
+     */
+    nameId?: string;
+    /**
+     * Upstream session index from the verified logout message
+     * (SAML `SessionIndex`), when present. Lets a host that tracks
+     * per-session state scope its teardown.
+     */
+    sessionIndex?: string;
+};
+/**
+ * Return of `IdPOptions.onLogout`. `revokeSubject` names the OIDC
+ * subject whose library-issued refresh tokens the library should
+ * revoke (the host resolves it from `nameId` — only the host has that
+ * map). Omit / return nothing to skip library-side revocation.
+ */
+export type LogoutHookResult = {
+    revokeSubject?: string;
+} | void;
 /**
  * Optional hook called at `/token` time, after PKCE has succeeded and
  * after the `success` callback has produced a `SubjectClaim`, but
@@ -104,6 +154,66 @@ export type ExchangeAudience = (currentClaim: SubjectClaim, request: {
     /** Tenant the subject_token came from. */
     fromTenantId: string;
 }) => Promise<SubjectClaim | AuthError>;
+/**
+ * RFC 7591 Dynamic Client Registration request body, normalized to the
+ * library's type system. The framework's `/register` handler parses the
+ * raw JSON, validates structure, then calls the host's `registerClient`
+ * hook with this shape. The host owns persistence — writing through its
+ * own `ConfigStore` — and returns the final `ClientConfig`.
+ */
+export type RegisterClientRequest = {
+    client_name?: string;
+    redirect_uris: string[];
+    /** RFC 7591 §2 — defaults to `["authorization_code"]`. */
+    grant_types?: string[];
+    /** RFC 7591 §2 — defaults to `["code"]`. */
+    response_types?: string[];
+    /** RFC 7591 §2 — `"none"` = public client, otherwise confidential. */
+    token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post";
+    scope?: string;
+    /** OIDC RP-Initiated Logout 1.0 §2. */
+    post_logout_redirect_uris?: string[];
+    /** OIDC Core §8.1. */
+    sector_identifier_uri?: string;
+    /** Free-form metadata the host may interpret. */
+    contacts?: string[];
+};
+/**
+ * RFC 7591 §3.2.1 response body. Returned verbatim from `/register` when
+ * the host hook produces a `ClientConfig`. `client_secret` is included
+ * only for confidential clients; public clients omit it.
+ */
+export type RegisterClientResponse = {
+    client_id: string;
+    client_secret?: string;
+    client_id_issued_at: number;
+    client_secret_expires_at?: number;
+    redirect_uris: string[];
+    grant_types?: string[];
+    response_types?: string[];
+    token_endpoint_auth_method?: string;
+    client_name?: string;
+};
+/**
+ * Optional Dynamic Client Registration hook. Hosts that want to expose
+ * RFC 7591 client provisioning supply this; the framework validates the
+ * wire format, then defers persistence to the host. If absent, the
+ * `/register` endpoint returns `invalid_request` so RPs receive a clear
+ * "not enabled" signal rather than a 404.
+ *
+ * The hook receives the parsed request, the resolved tenant, and the
+ * plaintext client secret (if any) the framework minted — hosts hash it
+ * with `hashClientSecret` before storing on `ClientConfig.secretHash`,
+ * then return the final `ClientConfig` along with the secret in the
+ * `RegisterClientResponse` so the RP can record it.
+ */
+export type RegisterClient = (input: {
+    tenant: TenantContext;
+    request: RegisterClientRequest;
+}) => Promise<Result<{
+    client: ClientConfig;
+    secret?: string;
+}, AuthError>>;
 /**
  * Optional override for the default provider picker shown when an
  * `/authorize` request has multiple enabled methods and no `method_id`.
@@ -166,6 +276,27 @@ export type IdPOptions = {
         onSuccess?: (event: SuccessEvent) => Promise<void>;
         onFailure?: (event: FailureEvent) => Promise<void>;
     };
+    /**
+     * Optional hook fired when an upstream provider signals that a
+     * federated session ended — SAML front-channel Single Logout today.
+     * The library has already verified the signed logout message; this
+     * hook is where the host tears down its own session and names the
+     * OIDC subject (if any) whose library-issued tokens to revoke. See
+     * the `LogoutEventInput` / `LogoutHookResult` type docs.
+     *
+     * Unlike `hooks.onSuccess`/`onFailure` (observation only) this hook
+     * **influences** library behaviour — its return drives token
+     * revocation — so it sits at the top level alongside `success`.
+     *
+     * Absent ⇒ the library still verifies the logout, emits a
+     * `session_logout` audit event, and returns the protocol
+     * `LogoutResponse`, but performs no token revocation (it cannot map
+     * the upstream id to a subject without the host).
+     *
+     * If it throws, the SLS endpoint fails closed with an internal error
+     * rather than acknowledging a logout it could not fully process.
+     */
+    onLogout?: (input: LogoutEventInput) => Promise<LogoutHookResult> | LogoutHookResult;
     /**
      * Optional escape hatch for high-sensitivity deployments — see the
      * `PersistUpstreamTokens` type doc.
@@ -181,6 +312,12 @@ export type IdPOptions = {
      * Optional override for the default provider picker. See `RenderPicker`.
      */
     renderPicker?: RenderPicker;
+    /**
+     * Optional RFC 7591 Dynamic Client Registration hook. See
+     * `RegisterClient` for the contract. When absent, `/register` rejects
+     * with `invalid_request: "dynamic client registration is not enabled"`.
+     */
+    registerClient?: RegisterClient;
     /**
      * Optional hook that builds the `TenantContext.request.custom` blob for
      * each request the framework processes (the initial `/authorize`, the
@@ -199,6 +336,24 @@ export type IdPOptions = {
      * between an absent hook and one that returns `{}`.
      */
     buildCustomContext?: (req: Request) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    /**
+     * Optional vendor scope → claim-names map. Merged on top of OIDC Core
+     * §5.4 when building the id_token + `/userinfo` response. Lets a host
+     * expose its own identity vocabulary (`tenant_id`, `org_role`, etc.)
+     * via custom scope names. The standard §5.4 mapping always wins on
+     * collision, so an entry for `email` is silently ignored.
+     *
+     * Per-client scope allowlist still applies — a client must list a
+     * custom scope in `ClientConfig.scopes` to be allowed to request it.
+     *
+     * ```ts
+     * customScopeClaims: {
+     *   tenant: ["tenant_id", "tenant_role", "tenant_roles"],
+     *   org: ["organization_id", "org_role"],
+     * }
+     * ```
+     */
+    customScopeClaims?: Record<string, ReadonlyArray<string>>;
     /**
      * Optional override for the framework's `Set-Cookie` defaults.
      *
@@ -230,5 +385,11 @@ export type IdP = {
     discovery: (req: Request) => Promise<Response>;
     revoke: (req: Request) => Promise<Response>;
     introspect: (req: Request) => Promise<Response>;
+    /** OIDC RP-Initiated Logout 1.0. */
+    endSession: (req: Request) => Promise<Response>;
+    /** RFC 9126 Pushed Authorization Requests. */
+    par: (req: Request) => Promise<Response>;
+    /** RFC 7591 Dynamic Client Registration. */
+    register: (req: Request) => Promise<Response>;
 };
 //# sourceMappingURL=idp.d.ts.map

package/dist/types/types/idp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAC3C,yDAAyD;IACzD,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,KAAK,CAAC,EAAE;QACN,yDAAyD;QACzD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAClD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACnD,CAAA;IAED;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAChD,CAAA"}
+{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../../../src/types/idp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,WAAW,EACZ,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG;IAC3C,yDAAyD;IACzD,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,MAAM,EAAE,cAAc,CAAA;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAA;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IACP,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAA;IAChB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAA;CACrB,KACE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sEAAsE;IACtE,0BAA0B,CAAC,EACvB,MAAM,GACN,qBAAqB,GACrB,oBAAoB,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,sBAAsB;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE;IACnC,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,qBAAqB,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,YAAY,EAAE,EACvB,GAAG,EAAE,aAAa,KACf,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjC,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;OAKG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAErE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAA;IAEhD;;;;;;;;;OASG;IACH,SAAS,EAAE,YAAY,CAAA;IAEvB,WAAW,EAAE,WAAW,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,YAAY,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;IAE9C;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAE7C,QAAQ,EAAE,aAAa,CAAA;IAEvB;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,KAAK,CAAC,EAAE,WAAW,CAAA;IAEnB,KAAK,CAAC,EAAE;QACN,yDAAyD;QACzD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAClD,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACnD,CAAA;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,gBAAgB,KACpB,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAEjD;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAE7C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,EAAE,CACnB,GAAG,EAAE,OAAO,KACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAE/D;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,oCAAoC;IACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,8CAA8C;IAC9C,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9C,CAAA"}

package/dist/types/types/method.d.ts

@@ -54,6 +54,37 @@ export type AuthMethod<P = unknown, S = unknown> = {
      * same factory get distinct URL spaces).
      */
     routes: Record<string, MethodHandler<P, S>>;
+    /**
+     * Opt-in allowlist of route keys (same `"GET /metadata"` string form
+     * as `routes` keys) that the framework dispatches **without** a flow
+     * cookie or flow record — anonymous, unauthenticated GETs. The sole
+     * intended use is publishing static, per-instance descriptive
+     * documents (SAML SP metadata XML). The handler receives
+     * `ctx.flow === null` and `ctx.methodState === null` and MUST be a
+     * pure function of `ctx.tenant` + `ctx.dispatch` + its captured
+     * config — it must not assume an authenticated principal.
+     *
+     * Absent (the default for every method) ⇒ behaviour is unchanged:
+     * every `/m/<id>/*` request requires the `idp.flow` cookie. The
+     * cookie gate is skipped *only* for a route key a method explicitly
+     * lists here — fail-closed by construction.
+     */
+    publicRoutes?: ReadonlyArray<string>;
+    /**
+     * Opt-in: this method instance handles **unsolicited** upstream
+     * callbacks — a `POST /cb/<methodId>` carrying a provider assertion
+     * with no framework state envelope and no prior flow (SAML
+     * IdP-initiated SSO). When `true`, the framework, instead of
+     * rejecting a stateless callback, dispatches `GET /callback` with
+     * `flow === null` and a derived `dispatch` (issuer/ACS); the handler
+     * verifies the assertion and returns `success` **with
+     * `unsolicitedBinding`**. Absent (every method's default) ⇒ a
+     * stateless callback stays an `invalid_request` (the conservative
+     * default — many deployments do not want IdP-initiated). General
+     * capability, not SAML-specific; set per instance (a SAML instance
+     * sets it only when its config enables IdP-initiated).
+     */
+    unsolicitedCallback?: boolean;
     /**
      * Token-exchange function for the `/token` endpoint when the method
      * participates in client-credentials-style flows (e.g. `m2m`). Most
@@ -96,6 +127,46 @@ export type MethodContext<S = unknown> = {
      * and the relevant data is on `flow`).
      */
     dispatch: MethodDispatchData | null;
+    /**
+     * Per-method-instance scratch storage scoped to
+     * `(tenant.id, method.id)`. Survives across flows — distinct from
+     * `methodState`, which is per-flow.
+     *
+     * Most methods do NOT need this. It exists for cross-flow
+     * deduplication patterns such as SAML SP assertion-ID replay
+     * protection.
+     *
+     * Backed by `SessionStore.{saveScratch,readScratch,deleteScratch}`
+     * when those optional methods are implemented. Against adapters that
+     * don't implement them, every call returns
+     * `{ ok: false, error: unsupported }` — the method should surface a
+     * `MethodResult.error` with a clear message, not silently degrade.
+     */
+    methodScratch: MethodScratch;
+};
+/**
+ * Caller-facing API for per-method-instance scratch. The framework
+ * scopes user-supplied keys with a `(tenantId, methodId)` prefix before
+ * delegating to `SessionStore` — adapters never see raw method keys.
+ *
+ * Values are UTF-8 strings; methods JSON-encode if they want to stash
+ * objects. Keeping the port-level type narrow simplifies adapter
+ * implementations (one TEXT column, one Dynamo `S` attribute, etc.).
+ */
+export type MethodScratch = {
+    /**
+     * Persist `value` under `key` with the given TTL. Overwrites prior
+     * value for the same key. `ttlMs` must be positive.
+     */
+    put(key: string, value: string, ttlMs: number): Promise<Result<void>>;
+    /**
+     * Read the value previously stored at `key`. Returns `unknown_state`
+     * if the key is missing or expired (the underlying adapter MAY
+     * lazily evict expired entries on read).
+     */
+    get(key: string): Promise<Result<string>>;
+    /** Idempotent. Resolves `ok` whether the key existed or not. */
+    delete(key: string): Promise<Result<void>>;
 };
 /** Framework-supplied data available to the method at `/authorize` time. */
 export type MethodDispatchData = {
@@ -135,6 +206,27 @@ export type MethodResult<P = unknown, S = unknown> =
     saveMethodState?: S;
     /** Serialized into a `Cache-Control` header by the framework. */
     cache?: CachePolicy;
+    /**
+     * Verified upstream-logout notification. Set **only** by a
+     * flowless **public** logout route (e.g. SAML front-channel SLS)
+     * once it has cryptographically verified the inbound logout
+     * message. The method stays port-free — it proves authenticity
+     * and builds the protocol response (`response` = the signed
+     * `LogoutResponse` redirect / ack); the privileged side effect
+     * runs in the framework.
+     *
+     * When present on a public route the framework fires
+     * `IdPOptions.onLogout` and, if that returns `{ revokeSubject }`,
+     * runs `revokeAllForSubject` — then returns `response`. Ignored
+     * on non-public (flow-bearing) routes: an authenticated method
+     * route never logs anyone out. Mirrors the Phase 2 V′ pattern
+     * (`success.unsolicitedBinding`): an optional field on an
+     * existing variant, not a new `MethodResult` kind.
+     */
+    logout?: {
+        nameId?: string;
+        sessionIndex?: string;
+    };
 }
 /**
  * Authentication succeeded. The HTTP layer hands `providerSubject` +
@@ -147,6 +239,23 @@ export type MethodResult<P = unknown, S = unknown> =
     providerSubject: string;
     properties: P;
     setCookies?: SetCookie[];
+    /**
+     * RP binding for a **flowless** (unsolicited / IdP-initiated)
+     * authentication. Consulted **only** when the method ran with no
+     * `flow` (e.g. an unsolicited SAML Response — see
+     * `AuthMethod.unsolicitedCallback`). On the normal SP-initiated
+     * path a `flow` exists and this is ignored; on the flowless path
+     * it is **required** (the framework has no pending RP request to
+     * read `client_id` / `redirect_uri` / `scope` from, so the method
+     * supplies the operator-configured defaults). The framework still
+     * validates `clientId` / `redirectUri` against the tenant's
+     * registered client before issuing a code.
+     */
+    unsolicitedBinding?: {
+        clientId: string;
+        redirectUri: string;
+        scopes: string[];
+    };
 }
 /** User refused / failed auth in a non-error way (e.g. consent declined). */
  | {

package/dist/types/types/method.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method.d.ts","sourceRoot":"","sources":["../../../src/types/method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAEnE;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,IAAI;IACjD;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3C;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,IAAI,CAChC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,KAClB,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAEhC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI;IACvC,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAA;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,2EAA2E;IAC3E,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB;;;OAGG;IACH,WAAW,EAAE,CAAC,GAAG,IAAI,CAAA;IACrB,6DAA6D;IAC7D,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;CACpC,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO;AAC/C;;;;;;;;GAQG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,wEAAwE;IACxE,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB,eAAe,CAAC,EAAE,CAAC,CAAA;IACnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,SAAS,CAAA;IACf,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,CAAC,CAAA;IACb,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;CACzB;AACH,6EAA6E;GAC3E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;CAAE;AAC9D,kFAAkF;GAChF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,8CAA8C;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;CACrC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;AAEnC;;;;;;;;;;;;;;GAcG;AAMH,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,CAClD,GAAG,EAAE,6CAA6C;AAClD,GAAG,EAAE,2BAA2B;AAChC,GAAG,CACJ,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI;IACvE,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAA;IAEZ;;;;;;;;;;;;OAYG;IACH,YAAY,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAE7C;;;;;OAKG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE;QACb,6EAA6E;QAC7E,EAAE,EAAE,MAAM,CAAA;QACV,mEAAmE;QACnE,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,QAAQ,CAAA;QAClB,wCAAwC;QACxC,MAAM,EAAE,GAAG,CAAA;KACZ,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;CAChC,CAAA"}
+{"version":3,"file":"method.d.ts","sourceRoot":"","sources":["../../../src/types/method.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAA;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAEnE;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,IAAI;IACjD;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3C;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,IAAI,CAChC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,KAClB,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAEhC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI;IACvC,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAA;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,aAAa,CAAA;IACrB,2EAA2E;IAC3E,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB;;;OAGG;IACH,WAAW,EAAE,CAAC,GAAG,IAAI,CAAA;IACrB,6DAA6D;IAC7D,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACnC;;;;;;;;;;;;;;OAcG;IACH,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACrE;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACzC,gEAAgE;IAChE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;CAC3C,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO;AAC/C;;;;;;;;GAQG;AACD;IACE,IAAI,EAAE,WAAW,CAAA;IACjB,wEAAwE;IACxE,QAAQ,EAAE,QAAQ,CAAA;IAClB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB,eAAe,CAAC,EAAE,CAAC,CAAA;IACnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,EAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AACH;;;;GAIG;GACD;IACE,IAAI,EAAE,SAAS,CAAA;IACf,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,CAAC,CAAA;IACb,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;IACxB;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE;QACnB,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,MAAM,EAAE,MAAM,EAAE,CAAA;KACjB,CAAA;CACF;AACH,6EAA6E;GAC3E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAA;CAAE;AAC9D,kFAAkF;GAChF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,8CAA8C;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;CACrC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;AAEnC;;;;;;;;;;;;;;GAcG;AAMH,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,CAClD,GAAG,EAAE,6CAA6C;AAClD,GAAG,EAAE,2BAA2B;AAChC,GAAG,CACJ,CAAA;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI;IACvE,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAA;IAEZ;;;;;;;;;;;;OAYG;IACH,YAAY,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAE7C;;;;;OAKG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE;QACb,6EAA6E;QAC7E,EAAE,EAAE,MAAM,CAAA;QACV,mEAAmE;QACnE,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,QAAQ,CAAA;QAClB,wCAAwC;QACxC,MAAM,EAAE,GAAG,CAAA;KACZ,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;CAChC,CAAA"}

package/dist/types/types/tenant.d.ts

@@ -112,6 +112,26 @@ export type PublicClientConfig = {
     scopes: string[];
     /** Must be `true` for public clients per OAuth 2.1 §2.1.1. */
     pkceRequired: true;
+    /**
+     * Registered URIs to which `/end_session` may redirect after RP-initiated
+     * logout (OIDC RP-Initiated Logout 1.0 §2). Exact-match. If absent, the
+     * `/end_session` endpoint refuses any `post_logout_redirect_uri`.
+     */
+    postLogoutRedirectUris?: string[];
+    /**
+     * RFC 9126 §2: when `true`, the client MUST use Pushed Authorization
+     * Requests; a direct `GET /authorize` call without `request_uri` is
+     * rejected with `invalid_request`.
+     */
+    requirePushedAuthorizationRequests?: boolean;
+    /**
+     * OIDC Core §8.1 — when set, the subject identifier (`sub`) is derived
+     * as a pairwise pseudonym keyed by this string. Two clients sharing
+     * the same `sectorIdentifier` will see the same `sub`; different
+     * values yield different `sub`s for the same end user. Absent =
+     * public subject (sub is identical across all RPs).
+     */
+    sectorIdentifier?: string;
     /** Phase 8. */
     dpopRequired?: boolean;
 };
@@ -129,6 +149,23 @@ export type ConfidentialClientConfig = {
      * strongly discouraged; OAuth 2.1 §2.1.1 recommends PKCE for every client.
      */
     pkceRequired: boolean;
+    /**
+     * Registered URIs to which `/end_session` may redirect after RP-initiated
+     * logout (OIDC RP-Initiated Logout 1.0 §2). Exact-match.
+     */
+    postLogoutRedirectUris?: string[];
+    /**
+     * RFC 9126 §2: when `true`, the client MUST use Pushed Authorization
+     * Requests; a direct `GET /authorize` call without `request_uri` is
+     * rejected with `invalid_request`.
+     */
+    requirePushedAuthorizationRequests?: boolean;
+    /**
+     * OIDC Core §8.1 — see `PublicClientConfig.sectorIdentifier` for
+     * semantics. Same field; duplicated on each branch because the
+     * `ClientConfig` discriminated union doesn't share optional fields.
+     */
+    sectorIdentifier?: string;
     /** Phase 8. */
     dpopRequired?: boolean;
 };

package/dist/types/types/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/types/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,QAA6B,CAAA;AAExE,qFAAqF;AACrF,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8DAA8D;IAC9D,YAAY,EAAE,IAAI,CAAA;IAClB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAA;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,QAAQ,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,QAAQ,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE;QACP,GAAG,EAAE,OAAO,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,kFAAkF;IAClF,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../../src/types/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,QAA6B,CAAA;AAExE,qFAAqF;AACrF,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,CAAA;AAExB;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB,QAAQ,GACR,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,SAAS,GACT,QAAQ,CAAA;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8DAA8D;IAC9D,YAAY,EAAE,IAAI,CAAA;IAClB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,cAAc,CAAA;IACpB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAA;IAC5C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe;IACf,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,QAAQ,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,QAAQ,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE;QACP,GAAG,EAAE,OAAO,CAAA;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAA;CACF,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,QAAQ,CAAA;IAChB,kFAAkF;IAClF,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA"}