@absolutejs/auth 0.29.0-beta.0 → 0.29.0-beta.2

package/dist/index.js

@@ -4452,6 +4452,105 @@ var exchangeDeviceCode = async ({
   return { ...tokenSet, ok: true };
 };
 
+// src/oidc/clientAuth.ts
+var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var MAX_ASSERTION_LIFETIME_MINUTES = 5;
+var SECONDS_PER_MINUTE = 60;
+var MAX_ASSERTION_LIFETIME_MS = MAX_ASSERTION_LIFETIME_MINUTES * SECONDS_PER_MINUTE * MILLISECONDS_IN_A_SECOND;
+var jwksCache = new Map;
+var JWKS_CACHE_TTL_MS = SECONDS_PER_MINUTE * MILLISECONDS_IN_A_SECOND;
+var JWKS_FETCH_TIMEOUT_SECONDS = 5;
+var JWKS_FETCH_TIMEOUT_MS = JWKS_FETCH_TIMEOUT_SECONDS * MILLISECONDS_IN_A_SECOND;
+var fetchJwksUri = async (jwksUri) => {
+  const cached = jwksCache.get(jwksUri);
+  if (cached && Date.now() - cached.fetchedAt < JWKS_CACHE_TTL_MS) {
+    return cached.jwks;
+  }
+  try {
+    const response = await fetch(jwksUri, {
+      signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS)
+    });
+    if (!response.ok)
+      return;
+    const body = await response.json();
+    if (!Array.isArray(body.keys))
+      return;
+    jwksCache.set(jwksUri, { fetchedAt: Date.now(), jwks: body.keys });
+    return body.keys;
+  } catch {
+    return;
+  }
+};
+var resolveClientJwks = async (client) => {
+  if (client.jwks && client.jwks.length > 0)
+    return client.jwks;
+  if (client.jwksUri !== undefined)
+    return fetchJwksUri(client.jwksUri);
+  return;
+};
+var verifyAgainstAny = async (assertion, candidates) => {
+  for (const jwk of candidates) {
+    const verified = await verifyJwt(assertion, jwk);
+    if (verified !== undefined)
+      return verified;
+  }
+  return;
+};
+var verifyClientAssertion = async ({
+  assertion,
+  expectedAudience,
+  jtiStore,
+  resolveClient
+}) => {
+  const [, payloadSegment] = assertion.split(".");
+  if (payloadSegment === undefined)
+    return;
+  let payload;
+  try {
+    const parsed = JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+    if (typeof parsed !== "object" || parsed === null)
+      return;
+    payload = parsed;
+  } catch {
+    return;
+  }
+  const {
+    aud,
+    exp,
+    iss,
+    jti,
+    sub
+  } = payload;
+  if (typeof iss !== "string" || typeof sub !== "string" || iss !== sub || typeof exp !== "number") {
+    return;
+  }
+  const audMatches = typeof aud === "string" && aud === expectedAudience || Array.isArray(aud) && aud.includes(expectedAudience);
+  if (!audMatches)
+    return;
+  const expMs = exp * MILLISECONDS_IN_A_SECOND;
+  const now = Date.now();
+  if (expMs <= now || expMs - now > MAX_ASSERTION_LIFETIME_MS) {
+    return;
+  }
+  const client = await resolveClient(iss);
+  if (client === undefined)
+    return;
+  const candidates = await resolveClientJwks(client);
+  if (candidates === undefined || candidates.length === 0)
+    return;
+  const verified = await verifyAgainstAny(assertion, candidates);
+  if (verified === undefined)
+    return;
+  if (jtiStore !== undefined) {
+    if (typeof jti !== "string")
+      return;
+    const fresh = await jtiStore.recordIfFresh(client.clientId, jti, expMs);
+    if (!fresh)
+      return;
+  }
+  return client;
+};
+
 // src/oidc/dpop.ts
 var DEFAULT_MAX_AGE_MS = 60000;
 var SECONDS_TO_MS = 1000;
@@ -4496,6 +4595,138 @@ var verifyDpopProof = async ({
   return { jkt: await jwkThumbprint(header.jwk), jti };
 };
 
+// src/oidc/logout.ts
+var BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+var buildLogoutClaims = ({
+  clientId,
+  issuer,
+  now,
+  sub
+}) => ({
+  aud: clientId,
+  events: { [BACKCHANNEL_LOGOUT_EVENT]: {} },
+  iat: Math.floor(now / MILLISECONDS_IN_A_SECOND),
+  iss: issuer,
+  jti: crypto.randomUUID(),
+  sub
+});
+var resolvePostLogoutRedirect = ({
+  client,
+  requestedUri
+}) => {
+  if (requestedUri === undefined)
+    return;
+  const allow = client.postLogoutRedirectUris ?? [];
+  return allow.includes(requestedUri) ? requestedUri : undefined;
+};
+var verifyIdTokenHint = async ({
+  config,
+  idTokenHint
+}) => {
+  const verified = await verifyJwt(idTokenHint, config.signingKey.publicJwk);
+  const payload = verified?.payload;
+  if (payload === undefined || typeof payload.sub !== "string" || typeof payload.aud !== "string" || payload.iss !== config.issuer) {
+    return;
+  }
+  return { audClientId: payload.aud, sub: payload.sub };
+};
+var BACKCHANNEL_TIMEOUT_SECONDS = 5;
+var DEFAULT_BACKCHANNEL_TIMEOUT_MS = BACKCHANNEL_TIMEOUT_SECONDS * MILLISECONDS_IN_A_SECOND;
+var errorMessage = (error) => error instanceof Error ? error.message : String(error);
+var statusFromError = (error) => {
+  if (!(error instanceof Error))
+    return;
+  const match = /returned (\d+)/.exec(error.message);
+  return match?.[1] === undefined ? undefined : Number(match[1]);
+};
+var mintLogoutToken = async ({
+  clientId,
+  config,
+  now = Date.now(),
+  sub
+}) => signJwt(buildLogoutClaims({ clientId, issuer: config.issuer, now, sub }), config.signingKey);
+var postLogoutToken = async ({
+  endpointUrl,
+  fetchImpl,
+  logoutToken,
+  timeoutMs
+}) => {
+  const response = await fetchImpl(endpointUrl, {
+    body: new URLSearchParams({ logout_token: logoutToken }).toString(),
+    headers: {
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    method: "POST",
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  if (!response.ok) {
+    throw new Error(`Back-channel logout returned ${response.status}`);
+  }
+};
+var deliverLogoutToOne = async ({
+  clientId,
+  config,
+  endpointUrl,
+  fetchImpl,
+  logoutToken,
+  onError,
+  timeoutMs,
+  userId
+}) => {
+  try {
+    await postLogoutToken({ endpointUrl, fetchImpl, logoutToken, timeoutMs });
+  } catch (error) {
+    const delivery = {
+      attempts: 1,
+      clientId,
+      createdAt: Date.now(),
+      endpointUrl,
+      id: crypto.randomUUID(),
+      lastError: errorMessage(error),
+      lastStatus: statusFromError(error),
+      logoutToken,
+      userId
+    };
+    await config.logoutDeliveryStore?.recordFailure(delivery);
+    await onError?.(delivery);
+  }
+};
+var fanOutBackchannelLogout = async ({
+  config,
+  fetchImpl = globalThis.fetch,
+  now = Date.now(),
+  onError,
+  skipClientId,
+  timeoutMs = DEFAULT_BACKCHANNEL_TIMEOUT_MS,
+  userId
+}) => {
+  const clientIds = await config.refreshTokenStore.listClientIdsForUser(userId);
+  const targets = await Promise.all(clientIds.filter((clientId) => clientId !== skipClientId).map(async (clientId) => {
+    const client = await config.clientStore.findClient(clientId);
+    return client?.backchannelLogoutUri === undefined ? undefined : { client, endpointUrl: client.backchannelLogoutUri };
+  }));
+  const reachable = targets.filter((target) => target !== undefined);
+  await Promise.all(reachable.map(async ({ client, endpointUrl }) => {
+    const logoutToken = await mintLogoutToken({
+      clientId: client.clientId,
+      config,
+      now,
+      sub: userId
+    });
+    await deliverLogoutToOne({
+      clientId: client.clientId,
+      config,
+      endpointUrl,
+      fetchImpl,
+      logoutToken,
+      onError,
+      timeoutMs,
+      userId
+    });
+  }));
+  return reachable.map(({ client }) => client.clientId);
+};
+
 // src/oidc/routes.ts
 var HTTP_OK2 = 200;
 var HTTP_BAD_REQUEST2 = 400;
@@ -4549,6 +4780,7 @@ var oidcProviderRoutes = (config) => {
   const revokeRoute = `${oidcRoute}/revoke`;
   const deviceAuthorizationRoute = `${oidcRoute}/device_authorization`;
   const deviceApproveRoute = `${oidcRoute}/device/decision`;
+  const endSessionRoute = `${oidcRoute}/end_session`;
   const tokenUrl = `${issuer}${oidcRoute}/token`;
   const authenticateClient = async (clientId, clientSecret) => {
     const client = await clientStore.findClient(clientId);
@@ -4561,6 +4793,28 @@ var oidcProviderRoutes = (config) => {
     const matches = await constantTimeEqual(await hashToken(clientSecret), client.hashedSecret);
     return matches ? client : undefined;
   };
+  const authenticateTokenClient = async ({
+    basicClientId,
+    basicClientSecret,
+    bodyClientAssertion,
+    bodyClientAssertionType,
+    bodyClientId,
+    bodyClientSecret
+  }) => {
+    if (bodyClientAssertion !== undefined && bodyClientAssertionType === CLIENT_ASSERTION_TYPE) {
+      return verifyClientAssertion({
+        assertion: bodyClientAssertion,
+        expectedAudience: tokenUrl,
+        jtiStore: config.clientAssertionJtiStore,
+        resolveClient: clientStore.findClient
+      });
+    }
+    const clientId = bodyClientId ?? basicClientId;
+    const clientSecret = bodyClientSecret ?? basicClientSecret;
+    if (clientId === undefined)
+      return;
+    return authenticateClient(clientId, clientSecret);
+  };
   const grantAuthorizationCode = async (client, body, dpop) => {
     const {
       code,
@@ -4692,8 +4946,11 @@ var oidcProviderRoutes = (config) => {
   }
   const discovery = {
     authorization_endpoint: `${issuer}${authorizeRoute}`,
+    backchannel_logout_session_supported: false,
+    backchannel_logout_supported: true,
     code_challenge_methods_supported: ["S256"],
     dpop_signing_alg_values_supported: ["ES256"],
+    end_session_endpoint: `${issuer}${endSessionRoute}`,
     grant_types_supported: grantTypes,
     id_token_signing_alg_values_supported: ["ES256"],
     introspection_endpoint: `${issuer}${introspectRoute}`,
@@ -4706,12 +4963,55 @@ var oidcProviderRoutes = (config) => {
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",
-      "none"
-    ]
+      "none",
+      "private_key_jwt"
+    ],
+    token_endpoint_auth_signing_alg_values_supported: ["ES256"]
   };
   if (config.deviceAuthorizationStore) {
     discovery.device_authorization_endpoint = `${issuer}${deviceAuthorizationRoute}`;
   }
+  const handleEndSession = async ({
+    cookie,
+    inMemorySession,
+    query
+  }) => {
+    const hint = query.id_token_hint === undefined ? undefined : await verifyIdTokenHint({
+      config,
+      idTokenHint: query.id_token_hint
+    });
+    const clientId = hint?.audClientId ?? query.client_id;
+    const client = clientId === undefined ? undefined : await config.clientStore.findClient(clientId);
+    const userSession = await loadSessionFromSource({
+      authSessionStore,
+      session: inMemorySession,
+      userSessionId: cookie.value
+    });
+    const resolvedSub = hint?.sub ?? (userSession === undefined ? undefined : getUserId(userSession.user));
+    await clearSession({
+      authSessionStore,
+      cookie,
+      inMemorySession
+    });
+    if (resolvedSub !== undefined) {
+      await fanOutBackchannelLogout({
+        config,
+        skipClientId: clientId,
+        userId: resolvedSub
+      });
+    }
+    const redirectUri = client === undefined ? undefined : resolvePostLogoutRedirect({
+      client,
+      requestedUri: query.post_logout_redirect_uri
+    });
+    if (redirectUri === undefined) {
+      return jsonResponse({ ok: true }, HTTP_OK2);
+    }
+    const url = new URL(redirectUri);
+    if (query.state !== undefined)
+      url.searchParams.set("state", query.state);
+    return redirectTo(url.toString());
+  };
   return new Elysia15().use(sessionStore()).get(authorizeRoute, async ({ cookie: { user_session_id }, query, request, store }) => {
     const {
       client_id: clientId,
@@ -4791,12 +5091,14 @@ var oidcProviderRoutes = (config) => {
     })
   }).post(tokenRoute, async ({ body, headers }) => {
     const basic = readBasicAuth2(headers.authorization);
-    const clientId = basic.clientId ?? body.client_id;
-    const clientSecret = basic.clientSecret ?? body.client_secret;
-    if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
-    }
-    const client = await authenticateClient(clientId, clientSecret);
+    const client = await authenticateTokenClient({
+      basicClientId: basic.clientId,
+      basicClientSecret: basic.clientSecret,
+      bodyClientAssertion: body.client_assertion,
+      bodyClientAssertionType: body.client_assertion_type,
+      bodyClientId: body.client_id,
+      bodyClientSecret: body.client_secret
+    });
     if (client === undefined) {
       return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
     }
@@ -4816,6 +5118,8 @@ var oidcProviderRoutes = (config) => {
   }, {
     body: t12.Object({
       audience: t12.Optional(t12.String()),
+      client_assertion: t12.Optional(t12.String()),
+      client_assertion_type: t12.Optional(t12.String()),
       client_id: t12.Optional(t12.String()),
       client_secret: t12.Optional(t12.String()),
       code: t12.Optional(t12.String()),
@@ -4944,6 +5248,42 @@ var oidcProviderRoutes = (config) => {
     cookie: t12.Cookie({
       user_session_id: t12.Optional(userSessionIdTypebox)
     })
+  }).get(endSessionRoute, async ({
+    cookie: { user_session_id },
+    query,
+    store
+  }) => handleEndSession({
+    cookie: user_session_id,
+    inMemorySession: store.session,
+    query
+  }), {
+    cookie: t12.Cookie({
+      user_session_id: t12.Optional(userSessionIdTypebox)
+    }),
+    query: t12.Object({
+      client_id: t12.Optional(t12.String()),
+      id_token_hint: t12.Optional(t12.String()),
+      post_logout_redirect_uri: t12.Optional(t12.String()),
+      state: t12.Optional(t12.String())
+    })
+  }).post(endSessionRoute, async ({
+    body,
+    cookie: { user_session_id },
+    store
+  }) => handleEndSession({
+    cookie: user_session_id,
+    inMemorySession: store.session,
+    query: body
+  }), {
+    body: t12.Object({
+      client_id: t12.Optional(t12.String()),
+      id_token_hint: t12.Optional(t12.String()),
+      post_logout_redirect_uri: t12.Optional(t12.String()),
+      state: t12.Optional(t12.String())
+    }),
+    cookie: t12.Cookie({
+      user_session_id: t12.Optional(userSessionIdTypebox)
+    })
   }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery);
 };
 
@@ -7986,8 +8326,8 @@ var attemptOnce = async ({
   }
   return response.status;
 };
-var errorMessage = (error) => error instanceof Error ? error.message : String(error);
-var statusFromError = (error) => {
+var errorMessage2 = (error) => error instanceof Error ? error.message : String(error);
+var statusFromError2 = (error) => {
   if (!(error instanceof Error))
     return;
   const match = /returned (\d+)/.exec(error.message);
@@ -8007,8 +8347,8 @@ var persistFailure = async ({
     createdAt: Date.now(),
     endpointUrl: endpoint.url,
     envelope,
-    lastError: errorMessage(lastError),
-    lastStatus: statusFromError(lastError)
+    lastError: errorMessage2(lastError),
+    lastStatus: statusFromError2(lastError)
   };
   await deliveryStore.recordFailure(record);
 };
@@ -20083,6 +20423,7 @@ var createPostgresApiKeyStore = (db) => ({
   }
 });
 // src/oidc/inMemoryStores.ts
+var DEFAULT_LIST_LIMIT = 100;
 var createInMemoryAuthorizationCodeStore = () => {
   const codes = new Map;
   return {
@@ -20096,6 +20437,23 @@ var createInMemoryAuthorizationCodeStore = () => {
     }
   };
 };
+var createInMemoryClientAssertionJtiStore = () => {
+  const seen = new Map;
+  return {
+    recordIfFresh: async (clientId, jti, expiresAt) => {
+      const now = Date.now();
+      for (const [key, expiry] of seen) {
+        if (expiry < now)
+          seen.delete(key);
+      }
+      const composite = `${clientId}|${jti}`;
+      if (seen.has(composite))
+        return false;
+      seen.set(composite, expiresAt);
+      return true;
+    }
+  };
+};
 var createInMemoryDeviceAuthorizationStore = () => {
   const byDeviceCode = new Map;
   return {
@@ -20123,6 +20481,18 @@ var createInMemoryDeviceAuthorizationStore = () => {
     }
   };
 };
+var createInMemoryLogoutDeliveryStore = () => {
+  const failures = new Map;
+  return {
+    listFailed: async (limit = DEFAULT_LIST_LIMIT) => Array.from(failures.values()).sort((left, right) => right.createdAt - left.createdAt).slice(0, limit),
+    recordFailure: async (delivery) => {
+      failures.set(delivery.id, delivery);
+    },
+    removeFailure: async (deliveryId) => {
+      failures.delete(deliveryId);
+    }
+  };
+};
 var createInMemoryOAuthClientStore = (clients) => {
   const registry = new Map(clients.map((client) => [client.clientId, client]));
   return {
@@ -20144,17 +20514,38 @@ var createInMemoryOidcRefreshTokenStore = () => {
       }
     },
     getToken: async (tokenHash) => tokens.get(tokenHash),
+    listClientIdsForUser: async (userId) => {
+      const now = Date.now();
+      const active = Array.from(tokens.values()).filter((token) => token.userId === userId && token.expiresAt > now);
+      return Array.from(new Set(active.map((token) => token.clientId)));
+    },
     saveToken: async (token) => {
       tokens.set(token.tokenHash, { ...token });
     }
   };
 };
 // src/oidc/postgresStores.ts
+var URL_LENGTH = 2048;
+var DEFAULT_LIST_LIMIT2 = 100;
 var ID_LENGTH7 = 255;
+var oauthClientAssertionJtisTable = pgTable("auth_oauth_client_assertion_jtis", {
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  composite_key: varchar("composite_key", {
+    length: ID_LENGTH7
+  }).primaryKey(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  jti: varchar("jti", { length: ID_LENGTH7 }).notNull()
+});
 var oauthClientsTable = pgTable("auth_oauth_clients", {
+  backchannel_logout_uri: varchar("backchannel_logout_uri", {
+    length: URL_LENGTH
+  }),
   client_id: varchar("client_id", { length: ID_LENGTH7 }).primaryKey(),
   hashed_secret: varchar("hashed_secret", { length: ID_LENGTH7 }),
+  jwks_json: jsonb("jwks_json").$type(),
+  jwks_uri: varchar("jwks_uri", { length: URL_LENGTH }),
   name: varchar("name", { length: ID_LENGTH7 }).notNull(),
+  post_logout_redirect_uris: text("post_logout_redirect_uris").array(),
   redirect_uris: text("redirect_uris").array().notNull(),
   scopes: text("scopes").array().notNull()
 });
@@ -20184,6 +20575,17 @@ var oauthDeviceAuthorizationsTable = pgTable("auth_oauth_device_authorizations",
   user_code: varchar("user_code", { length: 16 }).notNull().unique(),
   user_sub: varchar("user_sub", { length: ID_LENGTH7 })
 });
+var oauthLogoutDeliveriesTable = pgTable("auth_oauth_logout_deliveries", {
+  attempts: bigint("attempts", { mode: "number" }).notNull(),
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  endpoint_url: varchar("endpoint_url", { length: URL_LENGTH }).notNull(),
+  id: varchar("id", { length: ID_LENGTH7 }).primaryKey(),
+  last_error: text("last_error"),
+  last_status: bigint("last_status", { mode: "number" }),
+  logout_token: text("logout_token").notNull(),
+  user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
+});
 var oauthRefreshTokensTable = pgTable("auth_oauth_refresh_tokens", {
   claims_json: jsonb("claims_json").$type(),
   client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
@@ -20195,12 +20597,27 @@ var oauthRefreshTokensTable = pgTable("auth_oauth_refresh_tokens", {
   user_id: varchar("user_id", { length: ID_LENGTH7 }).notNull()
 });
 var toClient2 = (row) => ({
+  backchannelLogoutUri: row.backchannel_logout_uri ?? undefined,
   clientId: row.client_id,
   hashedSecret: row.hashed_secret ?? undefined,
+  jwks: row.jwks_json ?? undefined,
+  jwksUri: row.jwks_uri ?? undefined,
   name: row.name,
+  postLogoutRedirectUris: row.post_logout_redirect_uris ?? undefined,
   redirectUris: row.redirect_uris,
   scopes: row.scopes
 });
+var toLogoutDelivery = (row) => ({
+  attempts: row.attempts,
+  clientId: row.client_id,
+  createdAt: row.created_at_ms,
+  endpointUrl: row.endpoint_url,
+  id: row.id,
+  lastError: row.last_error ?? undefined,
+  lastStatus: row.last_status ?? undefined,
+  logoutToken: row.logout_token,
+  userId: row.user_id
+});
 var toCode = (row) => ({
   claims: row.claims_json ?? undefined,
   clientId: row.client_id,
@@ -20259,7 +20676,9 @@ var toRefreshValues = (token) => ({
   user_id: token.userId
 });
 var createNeonAuthorizationCodeStore = (databaseUrl) => createPostgresAuthorizationCodeStore(createNeonDatabase(databaseUrl));
+var createNeonClientAssertionJtiStore = (databaseUrl) => createPostgresClientAssertionJtiStore(createNeonDatabase(databaseUrl));
 var createNeonDeviceAuthorizationStore = (databaseUrl) => createPostgresDeviceAuthorizationStore(createNeonDatabase(databaseUrl));
+var createNeonLogoutDeliveryStore = (databaseUrl) => createPostgresLogoutDeliveryStore(createNeonDatabase(databaseUrl));
 var createNeonOAuthClientStore = (databaseUrl) => createPostgresOAuthClientStore(createNeonDatabase(databaseUrl));
 var createNeonOidcRefreshTokenStore = (databaseUrl) => createPostgresOidcRefreshTokenStore(createNeonDatabase(databaseUrl));
 var createPostgresAuthorizationCodeStore = (db) => ({
@@ -20271,6 +20690,23 @@ var createPostgresAuthorizationCodeStore = (db) => ({
     await db.insert(oauthCodesTable).values(toCodeValues(code));
   }
 });
+var createPostgresClientAssertionJtiStore = (db) => ({
+  recordIfFresh: async (clientId, jti, expiresAt) => {
+    await db.delete(oauthClientAssertionJtisTable).where(lt(oauthClientAssertionJtisTable.expires_at_ms, Date.now()));
+    const compositeKey = `${clientId}|${jti}`;
+    try {
+      await db.insert(oauthClientAssertionJtisTable).values({
+        client_id: clientId,
+        composite_key: compositeKey,
+        expires_at_ms: expiresAt,
+        jti
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+});
 var createPostgresDeviceAuthorizationStore = (db) => ({
   deleteByDeviceCodeHash: async (deviceCodeHash) => {
     await db.delete(oauthDeviceAuthorizationsTable).where(eq(oauthDeviceAuthorizationsTable.device_code_hash, deviceCodeHash));
@@ -20300,6 +20736,28 @@ var createPostgresDeviceAuthorizationStore = (db) => ({
     await db.update(oauthDeviceAuthorizationsTable).set({ status, user_sub: userSub ?? null }).where(eq(oauthDeviceAuthorizationsTable.device_code_hash, deviceCodeHash));
   }
 });
+var createPostgresLogoutDeliveryStore = (db) => ({
+  listFailed: async (limit = DEFAULT_LIST_LIMIT2) => {
+    const rows = await db.select().from(oauthLogoutDeliveriesTable).orderBy(desc(oauthLogoutDeliveriesTable.created_at_ms)).limit(limit);
+    return rows.map(toLogoutDelivery);
+  },
+  recordFailure: async (delivery) => {
+    await db.insert(oauthLogoutDeliveriesTable).values({
+      attempts: delivery.attempts,
+      client_id: delivery.clientId,
+      created_at_ms: delivery.createdAt,
+      endpoint_url: delivery.endpointUrl,
+      id: delivery.id,
+      last_error: delivery.lastError ?? null,
+      last_status: delivery.lastStatus ?? null,
+      logout_token: delivery.logoutToken,
+      user_id: delivery.userId
+    });
+  },
+  removeFailure: async (deliveryId) => {
+    await db.delete(oauthLogoutDeliveriesTable).where(eq(oauthLogoutDeliveriesTable.id, deliveryId));
+  }
+});
 var createPostgresOAuthClientStore = (db) => ({
   findClient: async (clientId) => {
     const [row] = await db.select().from(oauthClientsTable).where(eq(oauthClientsTable.client_id, clientId)).limit(1);
@@ -20318,6 +20776,10 @@ var createPostgresOidcRefreshTokenStore = (db) => ({
     const [row] = await db.select().from(oauthRefreshTokensTable).where(eq(oauthRefreshTokensTable.token_hash, tokenHash)).limit(1);
     return row ? toRefresh(row) : undefined;
   },
+  listClientIdsForUser: async (userId) => {
+    const rows = await db.selectDistinct({ client_id: oauthRefreshTokensTable.client_id }).from(oauthRefreshTokensTable).where(and(eq(oauthRefreshTokensTable.user_id, userId), gt(oauthRefreshTokensTable.expires_at_ms, Date.now())));
+    return rows.map((row) => row.client_id);
+  },
   saveToken: async (token) => {
     await db.insert(oauthRefreshTokensTable).values(toRefreshValues(token));
   }
@@ -21451,11 +21913,11 @@ var createPostgresPasswordlessTokenStore = (db) => ({
   }
 });
 // src/webhooks/inMemoryStore.ts
-var DEFAULT_LIST_LIMIT = 100;
+var DEFAULT_LIST_LIMIT3 = 100;
 var createInMemoryWebhookDeliveryStore = () => {
   const failures = new Map;
   return {
-    listFailed: async (limit = DEFAULT_LIST_LIMIT) => Array.from(failures.values()).sort((left, right) => right.createdAt - left.createdAt).slice(0, limit),
+    listFailed: async (limit = DEFAULT_LIST_LIMIT3) => Array.from(failures.values()).sort((left, right) => right.createdAt - left.createdAt).slice(0, limit),
     recordFailure: async (delivery) => {
       failures.set(delivery.envelope.id, delivery);
     },
@@ -21466,12 +21928,12 @@ var createInMemoryWebhookDeliveryStore = () => {
 };
 // src/webhooks/postgresStore.ts
 var ID_LENGTH15 = 255;
-var URL_LENGTH = 2048;
-var DEFAULT_LIST_LIMIT2 = 100;
+var URL_LENGTH2 = 2048;
+var DEFAULT_LIST_LIMIT4 = 100;
 var webhookDeliveriesTable = pgTable("auth_webhook_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
-  endpoint_url: varchar("endpoint_url", { length: URL_LENGTH }).notNull(),
+  endpoint_url: varchar("endpoint_url", { length: URL_LENGTH2 }).notNull(),
   envelope_id: varchar("envelope_id", { length: ID_LENGTH15 }).primaryKey(),
   envelope_json: jsonb("envelope_json").$type().notNull(),
   last_error: text("last_error"),
@@ -21487,7 +21949,7 @@ var toDelivery = (row) => ({
 });
 var createNeonWebhookDeliveryStore = (databaseUrl) => createPostgresWebhookDeliveryStore(createNeonDatabase(databaseUrl));
 var createPostgresWebhookDeliveryStore = (db) => ({
-  listFailed: async (limit = DEFAULT_LIST_LIMIT2) => {
+  listFailed: async (limit = DEFAULT_LIST_LIMIT4) => {
     const rows = await db.select().from(webhookDeliveriesTable).orderBy(desc(webhookDeliveriesTable.created_at_ms)).limit(limit);
     return rows.map(toDelivery);
   },
@@ -21742,8 +22204,10 @@ export {
   verifyPkce,
   verifyPassword,
   verifyJwt,
+  verifyIdTokenHint,
   verifyHcaptcha,
   verifyDpopProof,
+  verifyClientAssertion,
   verifyAuditChain,
   verifyApiKey,
   verifyAccessToken,
@@ -21780,6 +22244,7 @@ export {
   resolveSetupSession,
   resolveScimOrganization,
   resolveProviderClientConfiguration,
+  resolvePostLogoutRedirect,
   resolvePermissions,
   resolveOAuthTokenExpiresAt,
   resolveOAuthAuthorization,
@@ -21807,9 +22272,12 @@ export {
   oidcProviderRoutes,
   oidcProviderOptions,
   oauthRefreshTokensTable,
+  oauthLogoutDeliveriesTable,
   oauthDeviceAuthorizationsTable,
   oauthCodesTable,
   oauthClientsTable,
+  oauthClientAssertionJtisTable,
+  mintLogoutToken,
   mfaTotpRoutes,
   mfaRoutes,
   mfaEnrollmentsTable,
@@ -21858,6 +22326,7 @@ export {
   generateEncryptionKey,
   generateBackupCodes,
   fingerprintDevice,
+  fanOutBackchannelLogout,
   extractPropFromIdentity,
   exportAuditCsv,
   exchangeToken,
@@ -21909,11 +22378,13 @@ export {
   createPostgresOidcRefreshTokenStore,
   createPostgresOAuthClientStore,
   createPostgresMfaStore,
+  createPostgresLogoutDeliveryStore,
   createPostgresLoginHistoryStore,
   createPostgresLockoutStore,
   createPostgresKnownDeviceStore,
   createPostgresDeviceAuthorizationStore,
   createPostgresCredentialStore,
+  createPostgresClientAssertionJtiStore,
   createPostgresAuthorizationCodeStore,
   createPostgresAuditSink,
   createPostgresApiKeyStore,
@@ -21935,6 +22406,7 @@ export {
   createNeonOAuthLinkedProviderCredentialResolver,
   createNeonOAuthClientStore,
   createNeonMfaStore,
+  createNeonLogoutDeliveryStore,
   createNeonLoginHistoryStore,
   createNeonLockoutStore,
   createNeonLinkedProviderStores,
@@ -21942,6 +22414,7 @@ export {
   createNeonDeviceAuthorizationStore,
   createNeonDatabase,
   createNeonCredentialStore,
+  createNeonClientAssertionJtiStore,
   createNeonAuthorizationCodeStore,
   createNeonAuthSessionStore,
   createNeonAuditSink,
@@ -21965,12 +22438,14 @@ export {
   createInMemoryOidcRefreshTokenStore,
   createInMemoryOAuthClientStore,
   createInMemoryMfaStore,
+  createInMemoryLogoutDeliveryStore,
   createInMemoryLoginHistoryStore,
   createInMemoryLockoutStore,
   createInMemoryLinkedProviderStores,
   createInMemoryKnownDeviceStore,
   createInMemoryDeviceAuthorizationStore,
   createInMemoryCredentialStore,
+  createInMemoryClientAssertionJtiStore,
   createInMemoryCheckCache,
   createInMemoryAuthorizationCodeStore,
   createInMemoryAuthSessionStore,
@@ -22036,8 +22511,9 @@ export {
   DEFAULT_INVITATION_TTL_MS,
   DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   DEFAULT_BACKUP_CODE_COUNT,
+  CLIENT_ASSERTION_TYPE,
   AuthIdentityConflictError
 };
 
-//# debugId=451C9751C02E5E2164756E2164756E21
+//# debugId=A9BAB004D30595D664756E2164756E21
 //# sourceMappingURL=index.js.map