@_mustachio/openauth 0.10.0 → 0.12.0

package/src/ports/audit-log.ts

@@ -54,6 +54,10 @@ export type AuditEvent =
       subjectId: string
       /** Hash of the issued refresh token id — never the token itself. */
       refreshTokenIdHash?: string
+      /** OIDC Core §2 — set when the response carried an `id_token`. */
+      idTokenIssued?: boolean
+      /** RFC 9449 — set when the access token is DPoP-bound. */
+      dpopBound?: boolean
     }
   | {
       kind: "token_refreshed"
@@ -87,6 +91,44 @@ export type AuditEvent =
       clientId: string
       family: string
     }
+  | {
+      /**
+       * Emitted after a logout is processed. Two channels, discriminated
+       * by `via`:
+       *
+       *  - `rp_initiated` (or absent — the default): `/end_session`
+       *    (OIDC RP-Initiated Logout 1.0 §2), regardless of whether a
+       *    `post_logout_redirect_uri` was supplied. `subjectId` present
+       *    when an `id_token_hint` verified; absent otherwise.
+       *  - `upstream_slo`: an upstream IdP notified us a federated
+       *    session ended (SAML front-channel Single Logout). `methodId`
+       *    / `methodKind` identify the federation connection;
+       *    `subjectId` present only when the host's `onLogout` returned
+       *    a subject to revoke.
+       *
+       * `via` is general (OIDC back-channel logout would reuse
+       * `upstream_slo`), not SAML-specific surface.
+       */
+      kind: "session_logout"
+      tenantId: TenantId
+      clientId?: string
+      subjectId?: string
+      via?: "rp_initiated" | "upstream_slo"
+      methodId?: string
+      methodKind?: string
+    }
+  | {
+      /**
+       * Emitted when a DPoP proof's `jti` is presented within the replay
+       * window (RFC 9449 §11.1). The request was rejected with
+       * `invalid_dpop_proof`. Operators / SIEM use this to spot
+       * stolen-key replay attempts.
+       */
+      kind: "dpop_replay_detected"
+      tenantId: TenantId | null
+      /** First-half of the offending jti so logs can correlate without storing it. */
+      jtiPrefix: string
+    }
   | {
       kind: "flow_replay_attempt"
       tenantId: TenantId | null

package/src/ports/session-store.ts

@@ -83,6 +83,67 @@ export type SessionStore = {
   ): Promise<Result<void>>
   readSession?(sessionId: string): Promise<Result<SessionRecord>>
   revokeSession?(sessionId: string): Promise<Result<void>>
+
+  /**
+   * Optional: Pushed Authorization Request (RFC 9126) storage. Persists the
+   * pre-parsed `/authorize` parameters under an opaque `request_uri` for
+   * one-shot retrieval at `/authorize` time. Strong consistency + atomic
+   * delete-on-read — same semantics as `saveFlow` / `consumeFlow`.
+   *
+   * Adapters without these methods cannot satisfy `/par`; the framework's
+   * `/par` handler returns `invalid_request` when called against such a
+   * store. Implement both methods together (the framework only exposes
+   * the endpoint when both are present).
+   */
+  savePar?(
+    requestUri: string,
+    payload: ParRecord,
+    ttl: number,
+  ): Promise<Result<void>>
+  consumePar?(requestUri: string): Promise<Result<ParRecord>>
+
+  /**
+   * Optional: per-method-instance scratch storage. Survives across flows
+   * (unlike `methodState`, which is per-flow). Use cases include cross-flow
+   * deduplication state — e.g., a SAML SP method remembering recently-seen
+   * assertion IDs for replay protection.
+   *
+   * The framework scopes keys per `(tenantId, methodId)` before calling
+   * these — adapters see opaque, already-namespaced keys and store the
+   * UTF-8 string value verbatim. Methods JSON-encode if they want object
+   * state.
+   *
+   * Strong consistency + TTL respect (same semantics as flow records).
+   * `readScratch` returns `unknown_state` if the key is missing or
+   * expired. `deleteScratch` is idempotent.
+   *
+   * Adapters without these methods cannot host methods that depend on
+   * scratch; the framework surfaces a clear `unsupported` error through
+   * `MethodContext.methodScratch` at call time. Implement all three
+   * methods together — partial implementations are not supported.
+   */
+  saveScratch?(
+    key: string,
+    value: string,
+    ttlMs: number,
+  ): Promise<Result<void>>
+  readScratch?(key: string): Promise<Result<string>>
+  deleteScratch?(key: string): Promise<Result<void>>
+}
+
+/**
+ * Stored PAR payload. The `params` blob is the raw form/query record from
+ * `POST /par`, kept verbatim so the `/authorize` rehydrate path can feed
+ * it through the same Zod parser the direct path uses.
+ */
+export type ParRecord = {
+  requestUri: string
+  /** Raw key/value record as posted to `/par` (excluding auth fields). */
+  params: Record<string, string>
+  clientId: string
+  /** Wall-clock issuance + absolute expiry (ms). */
+  issuedAt: number
+  expiresAt: number
 }
 
 /** Optional long-lived session payload (used by `createSession` family). */

package/src/ports/token-store.ts

@@ -100,4 +100,17 @@ export type TokenStore = {
    * preferred; documented eventual lag acceptable.
    */
   revokeBySubject(tenantId: TenantId, subjectId: string): Promise<Result<void>>
+
+  /**
+   * Optional: DPoP proof replay protection (RFC 9449 §11.1). Atomically
+   * record the proof's `jti` and reject if it's been seen within the TTL
+   * window. Returns `invalid_grant` (with `reuseSignal` omitted) when a
+   * `jti` is already present.
+   *
+   * Adapters without this method cannot satisfy DPoP at the token /
+   * userinfo endpoints; the framework's DPoP verifier returns
+   * `invalid_dpop_proof` when called against such a store. Memory adapter
+   * implements; production adapters follow in subsequent commits.
+   */
+  recordDpopJti?(jti: string, ttlMs: number): Promise<Result<void>>
 }

package/src/types/authorization.ts

@@ -37,6 +37,31 @@ export type AuthorizationRequest = {
   uiLocales?: string[]
   /** Standard OIDC. */
   nonce?: string
+  /**
+   * OIDC Core §5.5 — RP-requested claims, parsed from the `claims`
+   * parameter's JSON value. The library currently honors claim **names**
+   * (additive, bypasses scope gating) but does not enforce the
+   * `essential` / `value` / `values` qualifiers.
+   */
+  claimsRequest?: ClaimsRequest
+}
+
+/**
+ * OIDC Core §5.5 `claims` parameter. Each section maps claim name to an
+ * optional qualifier object (`{essential, value, values}`) or `null`
+ * meaning "just request the claim without qualifiers".
+ */
+export type ClaimsRequest = {
+  /** Claims to include in the `/userinfo` response. */
+  userinfo?: Record<string, ClaimRequestEntry | null>
+  /** Claims to include in the `id_token`. */
+  id_token?: Record<string, ClaimRequestEntry | null>
+}
+
+export type ClaimRequestEntry = {
+  essential?: boolean
+  value?: unknown
+  values?: unknown[]
 }
 
 /**

package/src/types/error.ts

@@ -50,6 +50,21 @@ export type AuthError =
   // endpoints. Use for control-flow signalling that should never escape to a
   // standards-compliant client.
   | { code: "internal_error"; description: string; cause?: unknown }
+  // RFC 9449 §5.2 — DPoP proof verification failed (bad signature, htm/htu
+  // mismatch, iat outside window, replayed jti, missing/mismatched cnf.jkt).
+  // Returned as a 400 with `error="invalid_dpop_proof"` on form-body
+  // endpoints; on resource-server endpoints it becomes a 401 with
+  // `WWW-Authenticate: DPoP error="invalid_dpop_proof"`.
+  //
+  // `replaySignal`, when present, indicates `recordDpopJti` reported a
+  // jti already seen within the replay window. The HTTP layer uses this
+  // to emit a `dpop_replay_detected` audit event distinct from other
+  // proof failures.
+  | {
+      code: "invalid_dpop_proof"
+      description: string
+      replaySignal?: { jti: string }
+    }
 
 export type AuthErrorCode = AuthError["code"]
 
@@ -120,4 +135,12 @@ export const authError = {
     description,
     ...(cause !== undefined ? { cause } : {}),
   }),
+  invalidDpopProof: (
+    description: string,
+    replaySignal?: { jti: string },
+  ): AuthError => ({
+    code: "invalid_dpop_proof",
+    description,
+    ...(replaySignal !== undefined ? { replaySignal } : {}),
+  }),
 }

package/src/types/flow.ts

@@ -19,6 +19,7 @@
  *      needed at `/token` into the auth-code payload; `methodState` is
  *      dropped.
  */
+import type { ClaimsRequest } from "./authorization"
 import type { TenantId } from "./tenant"
 
 export type FlowRecord = {
@@ -56,6 +57,15 @@ export type FlowRecord = {
    * `appState`. Compared at callback against the consumed record.
    */
   nonce: string
+  /**
+   * Relying party's OIDC `nonce` parameter (OIDC Core §3.1.2.1). Distinct
+   * from `nonce` (which is the framework's CSRF nonce for state-MAC
+   * binding). When present, must be echoed in the issued `id_token`
+   * (OIDC Core §2). Snapshotted into `CodePayload.appNonce` at success.
+   */
+  appNonce?: string
+  /** OIDC Core §5.5 — RP-requested claims, parsed at `/authorize`. */
+  claimsRequest?: ClaimsRequest
   /**
    * Relying-party → IdP PKCE. The RP generates the verifier and sends the
    * challenge to `/authorize`. Verified at `/token`.

package/src/types/idp.ts

@@ -15,6 +15,7 @@ import type { AnyAuthMethodFactory } from "./method"
 import type { Result } from "./result"
 import type { SubjectClaim, SubjectSchema } from "./subject"
 import type {
+  ClientConfig,
   StateKeyRing,
   TenantContext,
   TenantId,
@@ -68,6 +69,56 @@ export type FailureEvent = {
   error: AuthError
 }
 
+/**
+ * Input to the optional `IdPOptions.onLogout` hook.
+ *
+ * Fires when an upstream provider notifies this IdP that a federated
+ * session has ended — today, a SAML front-channel `LogoutRequest`
+ * delivered to the SP's SLS endpoint. By the time this runs the library
+ * has already cryptographically verified the upstream logout message
+ * (XML-DSig via the SAML method), so the hook is purely the host's
+ * teardown point.
+ *
+ * The library deliberately does **not** know which OIDC `subject` an
+ * upstream identifier (`nameId`) maps to — that mapping lives in the
+ * host's `success` callback, not the library. So the host clears its
+ * own session and returns the subject (if any) whose library-issued
+ * tokens should be revoked; the library then runs the same
+ * `revokeAllForSubject` primitive `/end_session` uses. Returning
+ * nothing skips library-side revocation (the host handled everything,
+ * or there is nothing to revoke).
+ *
+ * Method-agnostic on purpose: any federation method that can verify an
+ * upstream logout signal reuses this. SAML SLO is the first caller;
+ * OIDC back-channel logout would be the next.
+ */
+export type LogoutEventInput = {
+  tenant: TenantContext
+  methodId: string
+  methodKind: string
+  /** What kind of upstream logout this is. Extensible discriminant. */
+  reason: "upstream_slo"
+  /**
+   * Upstream subject identifier from the verified logout message
+   * (SAML `LogoutRequest/NameID`). Absent if the message omitted it.
+   */
+  nameId?: string
+  /**
+   * Upstream session index from the verified logout message
+   * (SAML `SessionIndex`), when present. Lets a host that tracks
+   * per-session state scope its teardown.
+   */
+  sessionIndex?: string
+}
+
+/**
+ * Return of `IdPOptions.onLogout`. `revokeSubject` names the OIDC
+ * subject whose library-issued refresh tokens the library should
+ * revoke (the host resolves it from `nameId` — only the host has that
+ * map). Omit / return nothing to skip library-side revocation.
+ */
+export type LogoutHookResult = { revokeSubject?: string } | void
+
 /**
  * Optional hook called at `/token` time, after PKCE has succeeded and
  * after the `success` callback has produced a `SubjectClaim`, but
@@ -119,6 +170,69 @@ export type ExchangeAudience = (
   },
 ) => Promise<SubjectClaim | AuthError>
 
+/**
+ * RFC 7591 Dynamic Client Registration request body, normalized to the
+ * library's type system. The framework's `/register` handler parses the
+ * raw JSON, validates structure, then calls the host's `registerClient`
+ * hook with this shape. The host owns persistence — writing through its
+ * own `ConfigStore` — and returns the final `ClientConfig`.
+ */
+export type RegisterClientRequest = {
+  client_name?: string
+  redirect_uris: string[]
+  /** RFC 7591 §2 — defaults to `["authorization_code"]`. */
+  grant_types?: string[]
+  /** RFC 7591 §2 — defaults to `["code"]`. */
+  response_types?: string[]
+  /** RFC 7591 §2 — `"none"` = public client, otherwise confidential. */
+  token_endpoint_auth_method?:
+    | "none"
+    | "client_secret_basic"
+    | "client_secret_post"
+  scope?: string
+  /** OIDC RP-Initiated Logout 1.0 §2. */
+  post_logout_redirect_uris?: string[]
+  /** OIDC Core §8.1. */
+  sector_identifier_uri?: string
+  /** Free-form metadata the host may interpret. */
+  contacts?: string[]
+}
+
+/**
+ * RFC 7591 §3.2.1 response body. Returned verbatim from `/register` when
+ * the host hook produces a `ClientConfig`. `client_secret` is included
+ * only for confidential clients; public clients omit it.
+ */
+export type RegisterClientResponse = {
+  client_id: string
+  client_secret?: string
+  client_id_issued_at: number
+  client_secret_expires_at?: number
+  redirect_uris: string[]
+  grant_types?: string[]
+  response_types?: string[]
+  token_endpoint_auth_method?: string
+  client_name?: string
+}
+
+/**
+ * Optional Dynamic Client Registration hook. Hosts that want to expose
+ * RFC 7591 client provisioning supply this; the framework validates the
+ * wire format, then defers persistence to the host. If absent, the
+ * `/register` endpoint returns `invalid_request` so RPs receive a clear
+ * "not enabled" signal rather than a 404.
+ *
+ * The hook receives the parsed request, the resolved tenant, and the
+ * plaintext client secret (if any) the framework minted — hosts hash it
+ * with `hashClientSecret` before storing on `ClientConfig.secretHash`,
+ * then return the final `ClientConfig` along with the secret in the
+ * `RegisterClientResponse` so the RP can record it.
+ */
+export type RegisterClient = (input: {
+  tenant: TenantContext
+  request: RegisterClientRequest
+}) => Promise<Result<{ client: ClientConfig; secret?: string }, AuthError>>
+
 /**
  * Optional override for the default provider picker shown when an
  * `/authorize` request has multiple enabled methods and no `method_id`.
@@ -195,6 +309,30 @@ export type IdPOptions = {
     onFailure?: (event: FailureEvent) => Promise<void>
   }
 
+  /**
+   * Optional hook fired when an upstream provider signals that a
+   * federated session ended — SAML front-channel Single Logout today.
+   * The library has already verified the signed logout message; this
+   * hook is where the host tears down its own session and names the
+   * OIDC subject (if any) whose library-issued tokens to revoke. See
+   * the `LogoutEventInput` / `LogoutHookResult` type docs.
+   *
+   * Unlike `hooks.onSuccess`/`onFailure` (observation only) this hook
+   * **influences** library behaviour — its return drives token
+   * revocation — so it sits at the top level alongside `success`.
+   *
+   * Absent ⇒ the library still verifies the logout, emits a
+   * `session_logout` audit event, and returns the protocol
+   * `LogoutResponse`, but performs no token revocation (it cannot map
+   * the upstream id to a subject without the host).
+   *
+   * If it throws, the SLS endpoint fails closed with an internal error
+   * rather than acknowledging a logout it could not fully process.
+   */
+  onLogout?: (
+    input: LogoutEventInput,
+  ) => Promise<LogoutHookResult> | LogoutHookResult
+
   /**
    * Optional escape hatch for high-sensitivity deployments — see the
    * `PersistUpstreamTokens` type doc.
@@ -213,6 +351,13 @@ export type IdPOptions = {
    */
   renderPicker?: RenderPicker
 
+  /**
+   * Optional RFC 7591 Dynamic Client Registration hook. See
+   * `RegisterClient` for the contract. When absent, `/register` rejects
+   * with `invalid_request: "dynamic client registration is not enabled"`.
+   */
+  registerClient?: RegisterClient
+
   /**
    * Optional hook that builds the `TenantContext.request.custom` blob for
    * each request the framework processes (the initial `/authorize`, the
@@ -234,6 +379,25 @@ export type IdPOptions = {
     req: Request,
   ) => Record<string, unknown> | Promise<Record<string, unknown>>
 
+  /**
+   * Optional vendor scope → claim-names map. Merged on top of OIDC Core
+   * §5.4 when building the id_token + `/userinfo` response. Lets a host
+   * expose its own identity vocabulary (`tenant_id`, `org_role`, etc.)
+   * via custom scope names. The standard §5.4 mapping always wins on
+   * collision, so an entry for `email` is silently ignored.
+   *
+   * Per-client scope allowlist still applies — a client must list a
+   * custom scope in `ClientConfig.scopes` to be allowed to request it.
+   *
+   * ```ts
+   * customScopeClaims: {
+   *   tenant: ["tenant_id", "tenant_role", "tenant_roles"],
+   *   org: ["organization_id", "org_role"],
+   * }
+   * ```
+   */
+  customScopeClaims?: Record<string, ReadonlyArray<string>>
+
   /**
    * Optional override for the framework's `Set-Cookie` defaults.
    *
@@ -266,4 +430,10 @@ export type IdP = {
   discovery: (req: Request) => Promise<Response>
   revoke: (req: Request) => Promise<Response>
   introspect: (req: Request) => Promise<Response>
+  /** OIDC RP-Initiated Logout 1.0. */
+  endSession: (req: Request) => Promise<Response>
+  /** RFC 9126 Pushed Authorization Requests. */
+  par: (req: Request) => Promise<Response>
+  /** RFC 7591 Dynamic Client Registration. */
+  register: (req: Request) => Promise<Response>
 }

package/src/types/method.ts

@@ -56,6 +56,37 @@ export type AuthMethod<P = unknown, S = unknown> = {
    * same factory get distinct URL spaces).
    */
   routes: Record<string, MethodHandler<P, S>>
+  /**
+   * Opt-in allowlist of route keys (same `"GET /metadata"` string form
+   * as `routes` keys) that the framework dispatches **without** a flow
+   * cookie or flow record — anonymous, unauthenticated GETs. The sole
+   * intended use is publishing static, per-instance descriptive
+   * documents (SAML SP metadata XML). The handler receives
+   * `ctx.flow === null` and `ctx.methodState === null` and MUST be a
+   * pure function of `ctx.tenant` + `ctx.dispatch` + its captured
+   * config — it must not assume an authenticated principal.
+   *
+   * Absent (the default for every method) ⇒ behaviour is unchanged:
+   * every `/m/<id>/*` request requires the `idp.flow` cookie. The
+   * cookie gate is skipped *only* for a route key a method explicitly
+   * lists here — fail-closed by construction.
+   */
+  publicRoutes?: ReadonlyArray<string>
+  /**
+   * Opt-in: this method instance handles **unsolicited** upstream
+   * callbacks — a `POST /cb/<methodId>` carrying a provider assertion
+   * with no framework state envelope and no prior flow (SAML
+   * IdP-initiated SSO). When `true`, the framework, instead of
+   * rejecting a stateless callback, dispatches `GET /callback` with
+   * `flow === null` and a derived `dispatch` (issuer/ACS); the handler
+   * verifies the assertion and returns `success` **with
+   * `unsolicitedBinding`**. Absent (every method's default) ⇒ a
+   * stateless callback stays an `invalid_request` (the conservative
+   * default — many deployments do not want IdP-initiated). General
+   * capability, not SAML-specific; set per instance (a SAML instance
+   * sets it only when its config enables IdP-initiated).
+   */
+  unsolicitedCallback?: boolean
   /**
    * Token-exchange function for the `/token` endpoint when the method
    * participates in client-credentials-style flows (e.g. `m2m`). Most
@@ -102,6 +133,47 @@ export type MethodContext<S = unknown> = {
    * and the relevant data is on `flow`).
    */
   dispatch: MethodDispatchData | null
+  /**
+   * Per-method-instance scratch storage scoped to
+   * `(tenant.id, method.id)`. Survives across flows — distinct from
+   * `methodState`, which is per-flow.
+   *
+   * Most methods do NOT need this. It exists for cross-flow
+   * deduplication patterns such as SAML SP assertion-ID replay
+   * protection.
+   *
+   * Backed by `SessionStore.{saveScratch,readScratch,deleteScratch}`
+   * when those optional methods are implemented. Against adapters that
+   * don't implement them, every call returns
+   * `{ ok: false, error: unsupported }` — the method should surface a
+   * `MethodResult.error` with a clear message, not silently degrade.
+   */
+  methodScratch: MethodScratch
+}
+
+/**
+ * Caller-facing API for per-method-instance scratch. The framework
+ * scopes user-supplied keys with a `(tenantId, methodId)` prefix before
+ * delegating to `SessionStore` — adapters never see raw method keys.
+ *
+ * Values are UTF-8 strings; methods JSON-encode if they want to stash
+ * objects. Keeping the port-level type narrow simplifies adapter
+ * implementations (one TEXT column, one Dynamo `S` attribute, etc.).
+ */
+export type MethodScratch = {
+  /**
+   * Persist `value` under `key` with the given TTL. Overwrites prior
+   * value for the same key. `ttlMs` must be positive.
+   */
+  put(key: string, value: string, ttlMs: number): Promise<Result<void>>
+  /**
+   * Read the value previously stored at `key`. Returns `unknown_state`
+   * if the key is missing or expired (the underlying adapter MAY
+   * lazily evict expired entries on read).
+   */
+  get(key: string): Promise<Result<string>>
+  /** Idempotent. Resolves `ok` whether the key existed or not. */
+  delete(key: string): Promise<Result<void>>
 }
 
 /** Framework-supplied data available to the method at `/authorize` time. */
@@ -143,6 +215,27 @@ export type MethodResult<P = unknown, S = unknown> =
       saveMethodState?: S
       /** Serialized into a `Cache-Control` header by the framework. */
       cache?: CachePolicy
+      /**
+       * Verified upstream-logout notification. Set **only** by a
+       * flowless **public** logout route (e.g. SAML front-channel SLS)
+       * once it has cryptographically verified the inbound logout
+       * message. The method stays port-free — it proves authenticity
+       * and builds the protocol response (`response` = the signed
+       * `LogoutResponse` redirect / ack); the privileged side effect
+       * runs in the framework.
+       *
+       * When present on a public route the framework fires
+       * `IdPOptions.onLogout` and, if that returns `{ revokeSubject }`,
+       * runs `revokeAllForSubject` — then returns `response`. Ignored
+       * on non-public (flow-bearing) routes: an authenticated method
+       * route never logs anyone out. Mirrors the Phase 2 V′ pattern
+       * (`success.unsolicitedBinding`): an optional field on an
+       * existing variant, not a new `MethodResult` kind.
+       */
+      logout?: {
+        nameId?: string
+        sessionIndex?: string
+      }
     }
   /**
    * Authentication succeeded. The HTTP layer hands `providerSubject` +
@@ -155,6 +248,23 @@ export type MethodResult<P = unknown, S = unknown> =
       providerSubject: string
       properties: P
       setCookies?: SetCookie[]
+      /**
+       * RP binding for a **flowless** (unsolicited / IdP-initiated)
+       * authentication. Consulted **only** when the method ran with no
+       * `flow` (e.g. an unsolicited SAML Response — see
+       * `AuthMethod.unsolicitedCallback`). On the normal SP-initiated
+       * path a `flow` exists and this is ignored; on the flowless path
+       * it is **required** (the framework has no pending RP request to
+       * read `client_id` / `redirect_uri` / `scope` from, so the method
+       * supplies the operator-configured defaults). The framework still
+       * validates `clientId` / `redirectUri` against the tenant's
+       * registered client before issuing a code.
+       */
+      unsolicitedBinding?: {
+        clientId: string
+        redirectUri: string
+        scopes: string[]
+      }
     }
   /** User refused / failed auth in a non-error way (e.g. consent declined). */
   | { kind: "denied"; reason: string; setCookies?: SetCookie[] }

package/src/types/tenant.ts

@@ -128,6 +128,26 @@ export type PublicClientConfig = {
   scopes: string[]
   /** Must be `true` for public clients per OAuth 2.1 §2.1.1. */
   pkceRequired: true
+  /**
+   * Registered URIs to which `/end_session` may redirect after RP-initiated
+   * logout (OIDC RP-Initiated Logout 1.0 §2). Exact-match. If absent, the
+   * `/end_session` endpoint refuses any `post_logout_redirect_uri`.
+   */
+  postLogoutRedirectUris?: string[]
+  /**
+   * RFC 9126 §2: when `true`, the client MUST use Pushed Authorization
+   * Requests; a direct `GET /authorize` call without `request_uri` is
+   * rejected with `invalid_request`.
+   */
+  requirePushedAuthorizationRequests?: boolean
+  /**
+   * OIDC Core §8.1 — when set, the subject identifier (`sub`) is derived
+   * as a pairwise pseudonym keyed by this string. Two clients sharing
+   * the same `sectorIdentifier` will see the same `sub`; different
+   * values yield different `sub`s for the same end user. Absent =
+   * public subject (sub is identical across all RPs).
+   */
+  sectorIdentifier?: string
   /** Phase 8. */
   dpopRequired?: boolean
 }
@@ -146,6 +166,23 @@ export type ConfidentialClientConfig = {
    * strongly discouraged; OAuth 2.1 §2.1.1 recommends PKCE for every client.
    */
   pkceRequired: boolean
+  /**
+   * Registered URIs to which `/end_session` may redirect after RP-initiated
+   * logout (OIDC RP-Initiated Logout 1.0 §2). Exact-match.
+   */
+  postLogoutRedirectUris?: string[]
+  /**
+   * RFC 9126 §2: when `true`, the client MUST use Pushed Authorization
+   * Requests; a direct `GET /authorize` call without `request_uri` is
+   * rejected with `invalid_request`.
+   */
+  requirePushedAuthorizationRequests?: boolean
+  /**
+   * OIDC Core §8.1 — see `PublicClientConfig.sectorIdentifier` for
+   * semantics. Same field; duplicated on each branch because the
+   * `ClientConfig` discriminated union doesn't share optional fields.
+   */
+  sectorIdentifier?: string
   /** Phase 8. */
   dpopRequired?: boolean
 }