@absolutejs/auth 0.29.0-beta.1 → 0.29.0-beta.3

package/dist/index.js

@@ -4452,6 +4452,105 @@ var exchangeDeviceCode = async ({
   return { ...tokenSet, ok: true };
 };
 
+// src/oidc/clientAuth.ts
+var CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+var MAX_ASSERTION_LIFETIME_MINUTES = 5;
+var SECONDS_PER_MINUTE = 60;
+var MAX_ASSERTION_LIFETIME_MS = MAX_ASSERTION_LIFETIME_MINUTES * SECONDS_PER_MINUTE * MILLISECONDS_IN_A_SECOND;
+var jwksCache = new Map;
+var JWKS_CACHE_TTL_MS = SECONDS_PER_MINUTE * MILLISECONDS_IN_A_SECOND;
+var JWKS_FETCH_TIMEOUT_SECONDS = 5;
+var JWKS_FETCH_TIMEOUT_MS = JWKS_FETCH_TIMEOUT_SECONDS * MILLISECONDS_IN_A_SECOND;
+var fetchJwksUri = async (jwksUri) => {
+  const cached = jwksCache.get(jwksUri);
+  if (cached && Date.now() - cached.fetchedAt < JWKS_CACHE_TTL_MS) {
+    return cached.jwks;
+  }
+  try {
+    const response = await fetch(jwksUri, {
+      signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS)
+    });
+    if (!response.ok)
+      return;
+    const body = await response.json();
+    if (!Array.isArray(body.keys))
+      return;
+    jwksCache.set(jwksUri, { fetchedAt: Date.now(), jwks: body.keys });
+    return body.keys;
+  } catch {
+    return;
+  }
+};
+var resolveClientJwks = async (client) => {
+  if (client.jwks && client.jwks.length > 0)
+    return client.jwks;
+  if (client.jwksUri !== undefined)
+    return fetchJwksUri(client.jwksUri);
+  return;
+};
+var verifyAgainstAny = async (assertion, candidates) => {
+  for (const jwk of candidates) {
+    const verified = await verifyJwt(assertion, jwk);
+    if (verified !== undefined)
+      return verified;
+  }
+  return;
+};
+var verifyClientAssertion = async ({
+  assertion,
+  expectedAudience,
+  jtiStore,
+  resolveClient
+}) => {
+  const [, payloadSegment] = assertion.split(".");
+  if (payloadSegment === undefined)
+    return;
+  let payload;
+  try {
+    const parsed = JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+    if (typeof parsed !== "object" || parsed === null)
+      return;
+    payload = parsed;
+  } catch {
+    return;
+  }
+  const {
+    aud,
+    exp,
+    iss,
+    jti,
+    sub
+  } = payload;
+  if (typeof iss !== "string" || typeof sub !== "string" || iss !== sub || typeof exp !== "number") {
+    return;
+  }
+  const audMatches = typeof aud === "string" && aud === expectedAudience || Array.isArray(aud) && aud.includes(expectedAudience);
+  if (!audMatches)
+    return;
+  const expMs = exp * MILLISECONDS_IN_A_SECOND;
+  const now = Date.now();
+  if (expMs <= now || expMs - now > MAX_ASSERTION_LIFETIME_MS) {
+    return;
+  }
+  const client = await resolveClient(iss);
+  if (client === undefined)
+    return;
+  const candidates = await resolveClientJwks(client);
+  if (candidates === undefined || candidates.length === 0)
+    return;
+  const verified = await verifyAgainstAny(assertion, candidates);
+  if (verified === undefined)
+    return;
+  if (jtiStore !== undefined) {
+    if (typeof jti !== "string")
+      return;
+    const fresh = await jtiStore.recordIfFresh(client.clientId, jti, expMs);
+    if (!fresh)
+      return;
+  }
+  return client;
+};
+
 // src/oidc/dpop.ts
 var DEFAULT_MAX_AGE_MS = 60000;
 var SECONDS_TO_MS = 1000;
@@ -4628,11 +4727,218 @@ var fanOutBackchannelLogout = async ({
   return reachable.map(({ client }) => client.clientId);
 };
 
+// src/oidc/registration.ts
+var REG_TOKEN_BYTES = 32;
+var CLIENT_ID_BYTES = 16;
+var mintRegistrationToken = async (clientId) => {
+  const plain = generateSecureToken(REG_TOKEN_BYTES);
+  return {
+    plain,
+    record: {
+      clientId,
+      createdAt: Date.now(),
+      tokenHash: await hashToken(plain)
+    }
+  };
+};
+var metadataToClient = (clientId, metadata, transform) => {
+  const requestedScopes = metadata.scope === undefined || metadata.scope.length === 0 ? [] : metadata.scope.split(" ").filter((entry) => entry.length > 0);
+  const base = {
+    backchannelLogoutUri: metadata.backchannel_logout_uri,
+    clientId,
+    jwks: metadata.jwks,
+    jwksUri: metadata.jwks_uri,
+    name: metadata.client_name ?? clientId,
+    postLogoutRedirectUris: metadata.post_logout_redirect_uris,
+    redirectUris: metadata.redirect_uris ?? [],
+    scopes: requestedScopes
+  };
+  return { ...base, ...transform, clientId };
+};
+var clientToMetadata = (client) => ({
+  backchannel_logout_uri: client.backchannelLogoutUri,
+  client_id: client.clientId,
+  client_name: client.name,
+  jwks: client.jwks,
+  jwks_uri: client.jwksUri,
+  post_logout_redirect_uris: client.postLogoutRedirectUris,
+  redirect_uris: client.redirectUris,
+  scope: client.scopes.join(" ")
+});
+var readRegistrationAccessToken = (authorization) => {
+  const prefix = "Bearer ";
+  if (authorization === undefined || !authorization.startsWith(prefix)) {
+    return;
+  }
+  return authorization.slice(prefix.length).trim();
+};
+var authorizeManagement = async ({
+  authorization,
+  clientId,
+  registrationTokenStore
+}) => {
+  const presented = readRegistrationAccessToken(authorization);
+  if (presented === undefined)
+    return false;
+  const record = await registrationTokenStore.findByTokenHash(await hashToken(presented));
+  return record?.clientId === clientId;
+};
+var deleteRegisteredClient = async ({
+  authorization,
+  clientId,
+  clientStore,
+  registrationTokenStore
+}) => {
+  if (clientStore.deleteClient === undefined) {
+    return {
+      body: { error: "unsupported_response_type" },
+      status: 501
+    };
+  }
+  const authed = await authorizeManagement({
+    authorization,
+    clientId,
+    registrationTokenStore
+  });
+  if (!authed)
+    return { body: { error: "invalid_token" }, status: 401 };
+  await clientStore.deleteClient(clientId);
+  await registrationTokenStore.deleteByClientId(clientId);
+  return { status: 204 };
+};
+var getRegisteredClient = async ({
+  authorization,
+  clientId,
+  clientStore,
+  registrationTokenStore
+}) => {
+  const authed = await authorizeManagement({
+    authorization,
+    clientId,
+    registrationTokenStore
+  });
+  if (!authed)
+    return { body: { error: "invalid_token" }, status: 401 };
+  const client = await clientStore.findClient(clientId);
+  if (client === undefined) {
+    return { body: { error: "invalid_client" }, status: 404 };
+  }
+  return { body: clientToMetadata(client), status: 200 };
+};
+var registerClient = async ({
+  clientStore,
+  initialAccessTokenStore,
+  metadata,
+  onClientRegistration,
+  presentedInitialAccessToken,
+  registrationBaseUrl,
+  registrationTokenStore
+}) => {
+  if (clientStore.saveClient === undefined || clientStore.findClient === undefined) {
+    return {
+      body: { error: "unsupported_response_type" },
+      ok: false,
+      status: 501
+    };
+  }
+  if (initialAccessTokenStore !== undefined) {
+    if (presentedInitialAccessToken === undefined) {
+      return { body: { error: "invalid_token" }, ok: false, status: 401 };
+    }
+    const consumed = await initialAccessTokenStore.consumeToken(await hashToken(presentedInitialAccessToken));
+    if (!consumed) {
+      return { body: { error: "invalid_token" }, ok: false, status: 401 };
+    }
+  }
+  if (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0) {
+    return {
+      body: { error: "invalid_redirect_uri" },
+      ok: false,
+      status: 400
+    };
+  }
+  const decision = await onClientRegistration?.({ metadata }) ?? { allow: true };
+  if (!decision.allow) {
+    return {
+      body: {
+        error: "invalid_client_metadata",
+        error_description: decision.denyReason
+      },
+      ok: false,
+      status: 403
+    };
+  }
+  const clientId = generateSecureToken(CLIENT_ID_BYTES);
+  const client = metadataToClient(clientId, metadata, decision.transform);
+  await clientStore.saveClient(client);
+  const regToken = await mintRegistrationToken(clientId);
+  await registrationTokenStore.saveToken(regToken.record);
+  return {
+    body: {
+      ...clientToMetadata(client),
+      registration_access_token: regToken.plain,
+      registration_client_uri: `${registrationBaseUrl}/${clientId}`
+    },
+    ok: true
+  };
+};
+var updateRegisteredClient = async ({
+  authorization,
+  clientId,
+  clientStore,
+  metadata,
+  onClientRegistration,
+  registrationTokenStore
+}) => {
+  if (clientStore.updateClient === undefined) {
+    return {
+      body: { error: "unsupported_response_type" },
+      status: 501
+    };
+  }
+  const authed = await authorizeManagement({
+    authorization,
+    clientId,
+    registrationTokenStore
+  });
+  if (!authed)
+    return { body: { error: "invalid_token" }, status: 401 };
+  const decision = await onClientRegistration?.({ metadata }) ?? { allow: true };
+  if (!decision.allow) {
+    return {
+      body: {
+        error: "invalid_client_metadata",
+        error_description: decision.denyReason
+      },
+      status: 403
+    };
+  }
+  if (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0) {
+    return {
+      body: { error: "invalid_redirect_uri" },
+      status: 400
+    };
+  }
+  const updated = metadataToClient(clientId, metadata, decision.transform);
+  await clientStore.updateClient(clientId, updated);
+  const rotated = await mintRegistrationToken(clientId);
+  await registrationTokenStore.saveToken(rotated.record);
+  return {
+    body: {
+      ...clientToMetadata(updated),
+      registration_access_token: rotated.plain
+    },
+    status: 200
+  };
+};
+
 // src/oidc/routes.ts
 var HTTP_OK2 = 200;
+var HTTP_NO_CONTENT = 204;
+var HTTP_FOUND = 302;
 var HTTP_BAD_REQUEST2 = 400;
 var HTTP_UNAUTHORIZED2 = 401;
-var HTTP_FOUND = 302;
+var HTTP_NOT_IMPLEMENTED = 501;
 var CODE_TTL_MINUTES = 10;
 var CODE_TTL_MS = MILLISECONDS_IN_A_MINUTE * CODE_TTL_MINUTES;
 var TOKEN_BYTES3 = 32;
@@ -4682,6 +4988,8 @@ var oidcProviderRoutes = (config) => {
   const deviceAuthorizationRoute = `${oidcRoute}/device_authorization`;
   const deviceApproveRoute = `${oidcRoute}/device/decision`;
   const endSessionRoute = `${oidcRoute}/end_session`;
+  const registrationRoute = `${oidcRoute}/register`;
+  const registrationBaseUrl = `${issuer}${registrationRoute}`;
   const tokenUrl = `${issuer}${oidcRoute}/token`;
   const authenticateClient = async (clientId, clientSecret) => {
     const client = await clientStore.findClient(clientId);
@@ -4694,6 +5002,28 @@ var oidcProviderRoutes = (config) => {
     const matches = await constantTimeEqual(await hashToken(clientSecret), client.hashedSecret);
     return matches ? client : undefined;
   };
+  const authenticateTokenClient = async ({
+    basicClientId,
+    basicClientSecret,
+    bodyClientAssertion,
+    bodyClientAssertionType,
+    bodyClientId,
+    bodyClientSecret
+  }) => {
+    if (bodyClientAssertion !== undefined && bodyClientAssertionType === CLIENT_ASSERTION_TYPE) {
+      return verifyClientAssertion({
+        assertion: bodyClientAssertion,
+        expectedAudience: tokenUrl,
+        jtiStore: config.clientAssertionJtiStore,
+        resolveClient: clientStore.findClient
+      });
+    }
+    const clientId = bodyClientId ?? basicClientId;
+    const clientSecret = bodyClientSecret ?? basicClientSecret;
+    if (clientId === undefined)
+      return;
+    return authenticateClient(clientId, clientSecret);
+  };
   const grantAuthorizationCode = async (client, body, dpop) => {
     const {
       code,
@@ -4842,12 +5172,17 @@ var oidcProviderRoutes = (config) => {
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",
-      "none"
-    ]
+      "none",
+      "private_key_jwt"
+    ],
+    token_endpoint_auth_signing_alg_values_supported: ["ES256"]
   };
   if (config.deviceAuthorizationStore) {
     discovery.device_authorization_endpoint = `${issuer}${deviceAuthorizationRoute}`;
   }
+  if (config.clientRegistrationTokenStore !== undefined) {
+    discovery.registration_endpoint = registrationBaseUrl;
+  }
   const handleEndSession = async ({
     cookie,
     inMemorySession,
@@ -4968,12 +5303,14 @@ var oidcProviderRoutes = (config) => {
     })
   }).post(tokenRoute, async ({ body, headers }) => {
     const basic = readBasicAuth2(headers.authorization);
-    const clientId = basic.clientId ?? body.client_id;
-    const clientSecret = basic.clientSecret ?? body.client_secret;
-    if (clientId === undefined) {
-      return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
-    }
-    const client = await authenticateClient(clientId, clientSecret);
+    const client = await authenticateTokenClient({
+      basicClientId: basic.clientId,
+      basicClientSecret: basic.clientSecret,
+      bodyClientAssertion: body.client_assertion,
+      bodyClientAssertionType: body.client_assertion_type,
+      bodyClientId: body.client_id,
+      bodyClientSecret: body.client_secret
+    });
     if (client === undefined) {
       return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
     }
@@ -4993,6 +5330,8 @@ var oidcProviderRoutes = (config) => {
   }, {
     body: t12.Object({
       audience: t12.Optional(t12.String()),
+      client_assertion: t12.Optional(t12.String()),
+      client_assertion_type: t12.Optional(t12.String()),
       client_id: t12.Optional(t12.String()),
       client_secret: t12.Optional(t12.String()),
       code: t12.Optional(t12.String()),
@@ -5157,6 +5496,96 @@ var oidcProviderRoutes = (config) => {
     cookie: t12.Cookie({
       user_session_id: t12.Optional(userSessionIdTypebox)
     })
+  }).post(registrationRoute, async ({ body, headers }) => {
+    if (config.clientRegistrationTokenStore === undefined) {
+      return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
+    }
+    const presented = headers.authorization?.startsWith("Bearer ") ? headers.authorization.slice("Bearer ".length).trim() : undefined;
+    const result = await registerClient({
+      clientStore,
+      initialAccessTokenStore: config.initialAccessTokenStore,
+      metadata: body,
+      onClientRegistration: config.onClientRegistration,
+      presentedInitialAccessToken: presented,
+      registrationBaseUrl,
+      registrationTokenStore: config.clientRegistrationTokenStore
+    });
+    return jsonResponse(result.body, result.ok ? HTTP_OK2 : result.status);
+  }, {
+    body: t12.Object({
+      backchannel_logout_uri: t12.Optional(t12.String()),
+      client_name: t12.Optional(t12.String()),
+      jwks: t12.Optional(t12.Any()),
+      jwks_uri: t12.Optional(t12.String()),
+      post_logout_redirect_uris: t12.Optional(t12.Array(t12.String())),
+      redirect_uris: t12.Optional(t12.Array(t12.String())),
+      scope: t12.Optional(t12.String())
+    }),
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    })
+  }).get(`${registrationRoute}/:clientId`, async ({ headers, params: { clientId } }) => {
+    if (config.clientRegistrationTokenStore === undefined) {
+      return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
+    }
+    const result = await getRegisteredClient({
+      authorization: headers.authorization,
+      clientId,
+      clientStore,
+      registrationTokenStore: config.clientRegistrationTokenStore
+    });
+    return jsonResponse(result.body, result.status);
+  }, {
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    }),
+    params: t12.Object({ clientId: t12.String() })
+  }).put(`${registrationRoute}/:clientId`, async ({ body, headers, params: { clientId } }) => {
+    if (config.clientRegistrationTokenStore === undefined) {
+      return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
+    }
+    const result = await updateRegisteredClient({
+      authorization: headers.authorization,
+      clientId,
+      clientStore,
+      metadata: body,
+      onClientRegistration: config.onClientRegistration,
+      registrationTokenStore: config.clientRegistrationTokenStore
+    });
+    return jsonResponse(result.body, result.status);
+  }, {
+    body: t12.Object({
+      backchannel_logout_uri: t12.Optional(t12.String()),
+      client_name: t12.Optional(t12.String()),
+      jwks: t12.Optional(t12.Any()),
+      jwks_uri: t12.Optional(t12.String()),
+      post_logout_redirect_uris: t12.Optional(t12.Array(t12.String())),
+      redirect_uris: t12.Optional(t12.Array(t12.String())),
+      scope: t12.Optional(t12.String())
+    }),
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    }),
+    params: t12.Object({ clientId: t12.String() })
+  }).delete(`${registrationRoute}/:clientId`, async ({ headers, params: { clientId } }) => {
+    if (config.clientRegistrationTokenStore === undefined) {
+      return jsonResponse({ error: "unsupported_response_type" }, HTTP_NOT_IMPLEMENTED);
+    }
+    const result = await deleteRegisteredClient({
+      authorization: headers.authorization,
+      clientId,
+      clientStore,
+      registrationTokenStore: config.clientRegistrationTokenStore
+    });
+    if (result.status === HTTP_NO_CONTENT) {
+      return new Response(null, { status: HTTP_NO_CONTENT });
+    }
+    return jsonResponse(result.body, result.status);
+  }, {
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    }),
+    params: t12.Object({ clientId: t12.String() })
   }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery);
 };
 
@@ -20310,6 +20739,23 @@ var createInMemoryAuthorizationCodeStore = () => {
     }
   };
 };
+var createInMemoryClientAssertionJtiStore = () => {
+  const seen = new Map;
+  return {
+    recordIfFresh: async (clientId, jti, expiresAt) => {
+      const now = Date.now();
+      for (const [key, expiry] of seen) {
+        if (expiry < now)
+          seen.delete(key);
+      }
+      const composite = `${clientId}|${jti}`;
+      if (seen.has(composite))
+        return false;
+      seen.set(composite, expiresAt);
+      return true;
+    }
+  };
+};
 var createInMemoryDeviceAuthorizationStore = () => {
   const byDeviceCode = new Map;
   return {
@@ -20349,10 +20795,49 @@ var createInMemoryLogoutDeliveryStore = () => {
     }
   };
 };
+var createInMemoryClientRegistrationTokenStore = () => {
+  const byHash = new Map;
+  return {
+    deleteByClientId: async (clientId) => {
+      for (const [hash, token] of byHash) {
+        if (token.clientId === clientId)
+          byHash.delete(hash);
+      }
+    },
+    findByTokenHash: async (tokenHash) => byHash.get(tokenHash),
+    saveToken: async (token) => {
+      for (const [hash, existing] of byHash) {
+        if (existing.clientId === token.clientId)
+          byHash.delete(hash);
+      }
+      byHash.set(token.tokenHash, { ...token });
+    }
+  };
+};
+var createInMemoryInitialAccessTokenStore = (initialHashes = []) => {
+  const remaining = new Set(initialHashes);
+  return {
+    consumeToken: async (tokenHash) => {
+      if (!remaining.has(tokenHash))
+        return false;
+      remaining.delete(tokenHash);
+      return true;
+    }
+  };
+};
 var createInMemoryOAuthClientStore = (clients) => {
   const registry = new Map(clients.map((client) => [client.clientId, client]));
   return {
-    findClient: async (clientId) => registry.get(clientId)
+    deleteClient: async (clientId) => {
+      registry.delete(clientId);
+    },
+    findClient: async (clientId) => registry.get(clientId),
+    saveClient: async (client) => {
+      registry.set(client.clientId, { ...client });
+    },
+    updateClient: async (clientId, client) => {
+      registry.set(clientId, { ...client });
+    }
   };
 };
 var createInMemoryOidcRefreshTokenStore = () => {
@@ -20384,12 +20869,27 @@ var createInMemoryOidcRefreshTokenStore = () => {
 var URL_LENGTH = 2048;
 var DEFAULT_LIST_LIMIT2 = 100;
 var ID_LENGTH7 = 255;
+var oauthClientAssertionJtisTable = pgTable("auth_oauth_client_assertion_jtis", {
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  composite_key: varchar("composite_key", {
+    length: ID_LENGTH7
+  }).primaryKey(),
+  expires_at_ms: bigint("expires_at_ms", { mode: "number" }).notNull(),
+  jti: varchar("jti", { length: ID_LENGTH7 }).notNull()
+});
+var oauthClientRegistrationTokensTable = pgTable("auth_oauth_client_registration_tokens", {
+  client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
+  created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
+  token_hash: varchar("token_hash", { length: ID_LENGTH7 }).primaryKey()
+});
 var oauthClientsTable = pgTable("auth_oauth_clients", {
   backchannel_logout_uri: varchar("backchannel_logout_uri", {
     length: URL_LENGTH
   }),
   client_id: varchar("client_id", { length: ID_LENGTH7 }).primaryKey(),
   hashed_secret: varchar("hashed_secret", { length: ID_LENGTH7 }),
+  jwks_json: jsonb("jwks_json").$type(),
+  jwks_uri: varchar("jwks_uri", { length: URL_LENGTH }),
   name: varchar("name", { length: ID_LENGTH7 }).notNull(),
   post_logout_redirect_uris: text("post_logout_redirect_uris").array(),
   redirect_uris: text("redirect_uris").array().notNull(),
@@ -20421,6 +20921,9 @@ var oauthDeviceAuthorizationsTable = pgTable("auth_oauth_device_authorizations",
   user_code: varchar("user_code", { length: 16 }).notNull().unique(),
   user_sub: varchar("user_sub", { length: ID_LENGTH7 })
 });
+var oauthInitialAccessTokensTable = pgTable("auth_oauth_initial_access_tokens", {
+  token_hash: varchar("token_hash", { length: ID_LENGTH7 }).primaryKey()
+});
 var oauthLogoutDeliveriesTable = pgTable("auth_oauth_logout_deliveries", {
   attempts: bigint("attempts", { mode: "number" }).notNull(),
   client_id: varchar("client_id", { length: ID_LENGTH7 }).notNull(),
@@ -20446,6 +20949,8 @@ var toClient2 = (row) => ({
   backchannelLogoutUri: row.backchannel_logout_uri ?? undefined,
   clientId: row.client_id,
   hashedSecret: row.hashed_secret ?? undefined,
+  jwks: row.jwks_json ?? undefined,
+  jwksUri: row.jwks_uri ?? undefined,
   name: row.name,
   postLogoutRedirectUris: row.post_logout_redirect_uris ?? undefined,
   redirectUris: row.redirect_uris,
@@ -20520,7 +21025,10 @@ var toRefreshValues = (token) => ({
   user_id: token.userId
 });
 var createNeonAuthorizationCodeStore = (databaseUrl) => createPostgresAuthorizationCodeStore(createNeonDatabase(databaseUrl));
+var createNeonClientAssertionJtiStore = (databaseUrl) => createPostgresClientAssertionJtiStore(createNeonDatabase(databaseUrl));
+var createNeonClientRegistrationTokenStore = (databaseUrl) => createPostgresClientRegistrationTokenStore(createNeonDatabase(databaseUrl));
 var createNeonDeviceAuthorizationStore = (databaseUrl) => createPostgresDeviceAuthorizationStore(createNeonDatabase(databaseUrl));
+var createNeonInitialAccessTokenStore = (databaseUrl) => createPostgresInitialAccessTokenStore(createNeonDatabase(databaseUrl));
 var createNeonLogoutDeliveryStore = (databaseUrl) => createPostgresLogoutDeliveryStore(createNeonDatabase(databaseUrl));
 var createNeonOAuthClientStore = (databaseUrl) => createPostgresOAuthClientStore(createNeonDatabase(databaseUrl));
 var createNeonOidcRefreshTokenStore = (databaseUrl) => createPostgresOidcRefreshTokenStore(createNeonDatabase(databaseUrl));
@@ -20533,6 +21041,47 @@ var createPostgresAuthorizationCodeStore = (db) => ({
     await db.insert(oauthCodesTable).values(toCodeValues(code));
   }
 });
+var createPostgresClientAssertionJtiStore = (db) => ({
+  recordIfFresh: async (clientId, jti, expiresAt) => {
+    await db.delete(oauthClientAssertionJtisTable).where(lt(oauthClientAssertionJtisTable.expires_at_ms, Date.now()));
+    const compositeKey = `${clientId}|${jti}`;
+    try {
+      await db.insert(oauthClientAssertionJtisTable).values({
+        client_id: clientId,
+        composite_key: compositeKey,
+        expires_at_ms: expiresAt,
+        jti
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+});
+var createPostgresClientRegistrationTokenStore = (db) => ({
+  deleteByClientId: async (clientId) => {
+    await db.delete(oauthClientRegistrationTokensTable).where(eq(oauthClientRegistrationTokensTable.client_id, clientId));
+  },
+  findByTokenHash: async (tokenHash) => {
+    const [row] = await db.select().from(oauthClientRegistrationTokensTable).where(eq(oauthClientRegistrationTokensTable.token_hash, tokenHash)).limit(1);
+    if (!row)
+      return;
+    const token = {
+      clientId: row.client_id,
+      createdAt: row.created_at_ms,
+      tokenHash: row.token_hash
+    };
+    return token;
+  },
+  saveToken: async (token) => {
+    await db.delete(oauthClientRegistrationTokensTable).where(eq(oauthClientRegistrationTokensTable.client_id, token.clientId));
+    await db.insert(oauthClientRegistrationTokensTable).values({
+      client_id: token.clientId,
+      created_at_ms: token.createdAt,
+      token_hash: token.tokenHash
+    });
+  }
+});
 var createPostgresDeviceAuthorizationStore = (db) => ({
   deleteByDeviceCodeHash: async (deviceCodeHash) => {
     await db.delete(oauthDeviceAuthorizationsTable).where(eq(oauthDeviceAuthorizationsTable.device_code_hash, deviceCodeHash));
@@ -20562,6 +21111,12 @@ var createPostgresDeviceAuthorizationStore = (db) => ({
     await db.update(oauthDeviceAuthorizationsTable).set({ status, user_sub: userSub ?? null }).where(eq(oauthDeviceAuthorizationsTable.device_code_hash, deviceCodeHash));
   }
 });
+var createPostgresInitialAccessTokenStore = (db) => ({
+  consumeToken: async (tokenHash) => {
+    const deleted = await db.delete(oauthInitialAccessTokensTable).where(eq(oauthInitialAccessTokensTable.token_hash, tokenHash)).returning({ token_hash: oauthInitialAccessTokensTable.token_hash });
+    return deleted.length > 0;
+  }
+});
 var createPostgresLogoutDeliveryStore = (db) => ({
   listFailed: async (limit = DEFAULT_LIST_LIMIT2) => {
     const rows = await db.select().from(oauthLogoutDeliveriesTable).orderBy(desc(oauthLogoutDeliveriesTable.created_at_ms)).limit(limit);
@@ -20584,10 +21139,30 @@ var createPostgresLogoutDeliveryStore = (db) => ({
     await db.delete(oauthLogoutDeliveriesTable).where(eq(oauthLogoutDeliveriesTable.id, deliveryId));
   }
 });
+var toClientValues2 = (client) => ({
+  backchannel_logout_uri: client.backchannelLogoutUri ?? null,
+  client_id: client.clientId,
+  hashed_secret: client.hashedSecret ?? null,
+  jwks_json: client.jwks ?? null,
+  jwks_uri: client.jwksUri ?? null,
+  name: client.name,
+  post_logout_redirect_uris: client.postLogoutRedirectUris ?? null,
+  redirect_uris: client.redirectUris,
+  scopes: client.scopes
+});
 var createPostgresOAuthClientStore = (db) => ({
+  deleteClient: async (clientId) => {
+    await db.delete(oauthClientsTable).where(eq(oauthClientsTable.client_id, clientId));
+  },
   findClient: async (clientId) => {
     const [row] = await db.select().from(oauthClientsTable).where(eq(oauthClientsTable.client_id, clientId)).limit(1);
     return row ? toClient2(row) : undefined;
+  },
+  saveClient: async (client) => {
+    await db.insert(oauthClientsTable).values(toClientValues2(client));
+  },
+  updateClient: async (clientId, client) => {
+    await db.update(oauthClientsTable).set(toClientValues2(client)).where(eq(oauthClientsTable.client_id, clientId));
   }
 });
 var createPostgresOidcRefreshTokenStore = (db) => ({
@@ -22033,6 +22608,7 @@ export {
   verifyIdTokenHint,
   verifyHcaptcha,
   verifyDpopProof,
+  verifyClientAssertion,
   verifyAuditChain,
   verifyApiKey,
   verifyAccessToken,
@@ -22040,6 +22616,7 @@ export {
   validateSession,
   validateEmailDeliverability,
   userSessionIdTypebox,
+  updateRegisteredClient,
   trustDevice,
   toPublicJwk,
   switchActiveSession,
@@ -22077,6 +22654,7 @@ export {
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
   removeFromSessionRing,
+  registerClient,
   refreshableProviderOptions,
   recordLoginAttempt,
   readSessionRing,
@@ -22098,9 +22676,12 @@ export {
   oidcProviderOptions,
   oauthRefreshTokensTable,
   oauthLogoutDeliveriesTable,
+  oauthInitialAccessTokensTable,
   oauthDeviceAuthorizationsTable,
   oauthCodesTable,
   oauthClientsTable,
+  oauthClientRegistrationTokensTable,
+  oauthClientAssertionJtisTable,
   mintLogoutToken,
   mfaTotpRoutes,
   mfaRoutes,
@@ -22143,6 +22724,7 @@ export {
   hasOrganizationScope,
   getUserSessionId,
   getStatus,
+  getRegisteredClient,
   generateTotpSecret,
   generateTotp,
   generateSigningKey,
@@ -22162,6 +22744,7 @@ export {
   encryptSecret,
   denyDeviceAuthorization,
   deleteWarrant,
+  deleteRegisteredClient,
   defineProvidersConfiguration,
   defineAuthSettings,
   defineAuthHtmxConfig,
@@ -22206,8 +22789,11 @@ export {
   createPostgresLoginHistoryStore,
   createPostgresLockoutStore,
   createPostgresKnownDeviceStore,
+  createPostgresInitialAccessTokenStore,
   createPostgresDeviceAuthorizationStore,
   createPostgresCredentialStore,
+  createPostgresClientRegistrationTokenStore,
+  createPostgresClientAssertionJtiStore,
   createPostgresAuthorizationCodeStore,
   createPostgresAuditSink,
   createPostgresApiKeyStore,
@@ -22234,9 +22820,12 @@ export {
   createNeonLockoutStore,
   createNeonLinkedProviderStores,
   createNeonKnownDeviceStore,
+  createNeonInitialAccessTokenStore,
   createNeonDeviceAuthorizationStore,
   createNeonDatabase,
   createNeonCredentialStore,
+  createNeonClientRegistrationTokenStore,
+  createNeonClientAssertionJtiStore,
   createNeonAuthorizationCodeStore,
   createNeonAuthSessionStore,
   createNeonAuditSink,
@@ -22265,8 +22854,11 @@ export {
   createInMemoryLockoutStore,
   createInMemoryLinkedProviderStores,
   createInMemoryKnownDeviceStore,
+  createInMemoryInitialAccessTokenStore,
   createInMemoryDeviceAuthorizationStore,
   createInMemoryCredentialStore,
+  createInMemoryClientRegistrationTokenStore,
+  createInMemoryClientAssertionJtiStore,
   createInMemoryCheckCache,
   createInMemoryAuthorizationCodeStore,
   createInMemoryAuthSessionStore,
@@ -22332,8 +22924,9 @@ export {
   DEFAULT_INVITATION_TTL_MS,
   DEFAULT_CREDENTIAL_SESSION_TTL_MS,
   DEFAULT_BACKUP_CODE_COUNT,
+  CLIENT_ASSERTION_TYPE,
   AuthIdentityConflictError
 };
 
-//# debugId=9518CC46948D590564756E2164756E21
+//# debugId=670CF7C3F8CEA35064756E2164756E21
 //# sourceMappingURL=index.js.map