@absolutejs/auth 0.29.0-beta.1 → 0.29.0-beta.3

package/dist/mfa/challenge.d.ts

@@ -28,10 +28,10 @@ export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute
             query: unknown;
             headers: unknown;
             response: {
+                401: "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
                     readonly status: "authenticated";
                 };
-                401: "No MFA challenge in progress" | "Invalid MFA code";
                 422: {
                     type: "validation";
                     on: string;

package/dist/mfa/routes.d.ts

@@ -26,11 +26,11 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
+                401: "Authentication required";
                 200: {
                     readonly secret: string;
                     readonly uri: string;
                 };
-                401: "Authentication required";
                 422: {
                     type: "validation";
                     on: string;
@@ -53,11 +53,11 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
+                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
+                401: "Authentication required";
                 200: {
                     readonly backupCodes: string[];
                 };
-                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
                 422: {
                     type: "validation";
                     on: string;
@@ -80,10 +80,10 @@ export declare const mfaRoutes: <UserType>(config: MfaRouteProps<UserType>) => E
             query: unknown;
             headers: unknown;
             response: {
+                401: "No MFA challenge in progress" | "Invalid MFA code";
                 200: {
                     readonly status: "authenticated";
                 };
-                401: "No MFA challenge in progress" | "Invalid MFA code";
                 422: {
                     type: "validation";
                     on: string;

package/dist/mfa/totp.d.ts

@@ -26,11 +26,11 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
             query: unknown;
             headers: unknown;
             response: {
+                401: "Authentication required";
                 200: {
                     readonly secret: string;
                     readonly uri: string;
                 };
-                401: "Authentication required";
                 422: {
                     type: "validation";
                     on: string;
@@ -53,11 +53,11 @@ export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCou
             query: unknown;
             headers: unknown;
             response: {
+                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
+                401: "Authentication required";
                 200: {
                     readonly backupCodes: string[];
                 };
-                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
-                401: "Authentication required";
                 422: {
                     type: "validation";
                     on: string;

package/dist/oidc/clientAuth.d.ts

@@ -0,0 +1,8 @@
+import type { ClientAssertionJtiStore, OAuthClient } from './types';
+export declare const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+export declare const verifyClientAssertion: ({ assertion, expectedAudience, jtiStore, resolveClient }: {
+    assertion: string;
+    expectedAudience: string;
+    jtiStore?: ClientAssertionJtiStore;
+    resolveClient: (clientId: string) => Promise<OAuthClient | undefined>;
+}) => Promise<OAuthClient | undefined>;

package/dist/oidc/config.d.ts

@@ -1,10 +1,13 @@
 import type { RouteString } from '../types';
 import { type SigningKey } from './keys';
-import type { AuthorizationCodeStore, DeviceAuthorizationStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { OnClientRegistration } from './registration';
+import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
 export type OidcProviderConfig<UserType> = {
     accessTokenTtlMs?: number;
     authorizationCodeStore: AuthorizationCodeStore;
+    clientAssertionJtiStore?: ClientAssertionJtiStore;
+    clientRegistrationTokenStore?: ClientRegistrationTokenStore;
     clientStore: OAuthClientStore;
     deviceAuthorizationStore?: DeviceAuthorizationStore;
     deviceCodeTtlMs?: number;
@@ -27,9 +30,11 @@ export type OidcProviderConfig<UserType> = {
     getUserId: (user: UserType) => string;
     idTokenTtlMs?: number;
     issuer: string;
+    initialAccessTokenStore?: InitialAccessTokenStore;
     loginUrl?: string;
     logoutDeliveryStore?: LogoutDeliveryStore;
     oidcRoute?: RouteString;
+    onClientRegistration?: OnClientRegistration;
     refreshTokenStore: OidcRefreshTokenStore;
     refreshTokenTtlMs?: number;
     signingKey: SigningKey;

package/dist/oidc/inMemoryStores.d.ts

@@ -1,6 +1,9 @@
-import type { AuthorizationCodeStore, DeviceAuthorizationStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const createInMemoryAuthorizationCodeStore: () => AuthorizationCodeStore;
+export declare const createInMemoryClientAssertionJtiStore: () => ClientAssertionJtiStore;
 export declare const createInMemoryDeviceAuthorizationStore: () => DeviceAuthorizationStore;
 export declare const createInMemoryLogoutDeliveryStore: () => LogoutDeliveryStore;
+export declare const createInMemoryClientRegistrationTokenStore: () => ClientRegistrationTokenStore;
+export declare const createInMemoryInitialAccessTokenStore: (initialHashes?: string[]) => InitialAccessTokenStore;
 export declare const createInMemoryOAuthClientStore: (clients: OAuthClient[]) => OAuthClientStore;
 export declare const createInMemoryOidcRefreshTokenStore: () => OidcRefreshTokenStore;

package/dist/oidc/postgresStores.d.ts

@@ -1,5 +1,148 @@
 import { type AnyPgDatabase } from '../stores/postgres';
-import type { AuthorizationCodeStore, DeviceAuthorizationStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+export declare const oauthClientAssertionJtisTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_oauth_client_assertion_jtis";
+    schema: undefined;
+    columns: {
+        client_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "client_id";
+            tableName: "auth_oauth_client_assertion_jtis";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        composite_key: import("drizzle-orm/pg-core").PgColumn<{
+            name: "composite_key";
+            tableName: "auth_oauth_client_assertion_jtis";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at_ms";
+            tableName: "auth_oauth_client_assertion_jtis";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        jti: import("drizzle-orm/pg-core").PgColumn<{
+            name: "jti";
+            tableName: "auth_oauth_client_assertion_jtis";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const oauthClientRegistrationTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_oauth_client_registration_tokens";
+    schema: undefined;
+    columns: {
+        client_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "client_id";
+            tableName: "auth_oauth_client_registration_tokens";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at_ms";
+            tableName: "auth_oauth_client_registration_tokens";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        token_hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash";
+            tableName: "auth_oauth_client_registration_tokens";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export declare const oauthClientsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_clients";
     schema: undefined;
@@ -61,6 +204,44 @@ export declare const oauthClientsTable: import("drizzle-orm/pg-core").PgTableWit
         }, {}, {
             length: 255;
         }>;
+        jwks_json: import("drizzle-orm/pg-core").PgColumn<{
+            name: "jwks_json";
+            tableName: "auth_oauth_clients";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: JsonWebKey[];
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: JsonWebKey[];
+        }>;
+        jwks_uri: import("drizzle-orm/pg-core").PgColumn<{
+            name: "jwks_uri";
+            tableName: "auth_oauth_clients";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 2048;
+        }>;
         name: import("drizzle-orm/pg-core").PgColumn<{
             name: "name";
             tableName: "auth_oauth_clients";
@@ -644,6 +825,32 @@ export declare const oauthDeviceAuthorizationsTable: import("drizzle-orm/pg-core
     };
     dialect: "pg";
 }>;
+export declare const oauthInitialAccessTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_oauth_initial_access_tokens";
+    schema: undefined;
+    columns: {
+        token_hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token_hash";
+            tableName: "auth_oauth_initial_access_tokens";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export declare const oauthLogoutDeliveriesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_logout_deliveries";
     schema: undefined;
@@ -992,12 +1199,18 @@ export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTa
     dialect: "pg";
 }>;
 export declare const createNeonAuthorizationCodeStore: (databaseUrl: string) => AuthorizationCodeStore;
+export declare const createNeonClientAssertionJtiStore: (databaseUrl: string) => ClientAssertionJtiStore;
+export declare const createNeonClientRegistrationTokenStore: (databaseUrl: string) => ClientRegistrationTokenStore;
 export declare const createNeonDeviceAuthorizationStore: (databaseUrl: string) => DeviceAuthorizationStore;
+export declare const createNeonInitialAccessTokenStore: (databaseUrl: string) => InitialAccessTokenStore;
 export declare const createNeonLogoutDeliveryStore: (databaseUrl: string) => LogoutDeliveryStore;
 export declare const createNeonOAuthClientStore: (databaseUrl: string) => OAuthClientStore;
 export declare const createNeonOidcRefreshTokenStore: (databaseUrl: string) => OidcRefreshTokenStore;
 export declare const createPostgresAuthorizationCodeStore: (db: AnyPgDatabase) => AuthorizationCodeStore;
+export declare const createPostgresClientAssertionJtiStore: (db: AnyPgDatabase) => ClientAssertionJtiStore;
+export declare const createPostgresClientRegistrationTokenStore: (db: AnyPgDatabase) => ClientRegistrationTokenStore;
 export declare const createPostgresDeviceAuthorizationStore: (db: AnyPgDatabase) => DeviceAuthorizationStore;
+export declare const createPostgresInitialAccessTokenStore: (db: AnyPgDatabase) => InitialAccessTokenStore;
 export declare const createPostgresLogoutDeliveryStore: (db: AnyPgDatabase) => LogoutDeliveryStore;
 export declare const createPostgresOAuthClientStore: (db: AnyPgDatabase) => OAuthClientStore;
 export declare const createPostgresOidcRefreshTokenStore: (db: AnyPgDatabase) => OidcRefreshTokenStore;

package/dist/oidc/registration.d.ts

@@ -0,0 +1,131 @@
+import type { ClientRegistrationTokenStore, InitialAccessTokenStore, OAuthClient, OAuthClientStore } from './types';
+export type ClientRegistrationMetadata = {
+    backchannel_logout_uri?: string;
+    client_name?: string;
+    jwks?: JsonWebKey[];
+    jwks_uri?: string;
+    post_logout_redirect_uris?: string[];
+    redirect_uris?: string[];
+    scope?: string;
+};
+export type ClientRegistrationDecision = {
+    allow: false;
+    denyReason: string;
+} | {
+    allow: true;
+    transform?: Partial<OAuthClient>;
+};
+export type OnClientRegistration = (context: {
+    metadata: ClientRegistrationMetadata;
+}) => ClientRegistrationDecision | Promise<ClientRegistrationDecision>;
+export type RegisterClientResult = {
+    body: {
+        error: string;
+        error_description?: string;
+    };
+    ok: false;
+    status: 400 | 401 | 403 | 501;
+} | {
+    body: ClientRegistrationMetadata & {
+        client_id: string;
+        registration_access_token: string;
+        registration_client_uri: string;
+    };
+    ok: true;
+};
+export declare const deleteRegisteredClient: ({ authorization, clientId, clientStore, registrationTokenStore }: {
+    authorization: string | undefined;
+    clientId: string;
+    clientStore: OAuthClientStore;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<{
+    readonly body: {
+        readonly error: "unsupported_response_type";
+    };
+    readonly status: 501;
+} | {
+    readonly body: {
+        readonly error: "invalid_token";
+    };
+    readonly status: 401;
+} | {
+    readonly status: 204;
+    readonly body?: undefined;
+}>;
+export declare const getRegisteredClient: ({ authorization, clientId, clientStore, registrationTokenStore }: {
+    authorization: string | undefined;
+    clientId: string;
+    clientStore: OAuthClientStore;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<{
+    readonly body: {
+        readonly error: "invalid_token";
+    };
+    readonly status: 401;
+} | {
+    readonly body: {
+        readonly error: "invalid_client";
+    };
+    readonly status: 404;
+} | {
+    readonly body: ClientRegistrationMetadata & {
+        client_id: string;
+    };
+    readonly status: 200;
+}>;
+export declare const registerClient: ({ clientStore, initialAccessTokenStore, metadata, onClientRegistration, presentedInitialAccessToken, registrationBaseUrl, registrationTokenStore }: {
+    clientStore: OAuthClientStore;
+    initialAccessTokenStore?: InitialAccessTokenStore;
+    metadata: ClientRegistrationMetadata;
+    onClientRegistration?: OnClientRegistration;
+    presentedInitialAccessToken?: string;
+    registrationBaseUrl: string;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<RegisterClientResult>;
+export declare const updateRegisteredClient: ({ authorization, clientId, clientStore, metadata, onClientRegistration, registrationTokenStore }: {
+    authorization: string | undefined;
+    clientId: string;
+    clientStore: OAuthClientStore;
+    metadata: ClientRegistrationMetadata;
+    onClientRegistration?: OnClientRegistration;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<{
+    readonly body: {
+        readonly error: "unsupported_response_type";
+        readonly error_description?: undefined;
+    };
+    readonly status: 501;
+} | {
+    readonly body: {
+        readonly error: "invalid_token";
+        readonly error_description?: undefined;
+    };
+    readonly status: 401;
+} | {
+    readonly body: {
+        readonly error: "invalid_client_metadata";
+        readonly error_description: string;
+    };
+    readonly status: 403;
+} | {
+    readonly body: {
+        readonly error: "invalid_redirect_uri";
+        readonly error_description?: undefined;
+    };
+    readonly status: 400;
+} | {
+    readonly body: {
+        readonly registration_access_token: string;
+        readonly backchannel_logout_uri?: string;
+        readonly client_name?: string;
+        readonly jwks?: JsonWebKey[];
+        readonly jwks_uri?: string;
+        readonly post_logout_redirect_uris?: string[];
+        readonly redirect_uris?: string[];
+        readonly scope?: string;
+        readonly client_id: string;
+        readonly error?: undefined;
+        readonly error_description?: undefined;
+    };
+    readonly status: 200;
+}>;

package/dist/oidc/routes.d.ts

@@ -65,6 +65,8 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                 grant_type?: string | undefined;
                 code?: string | undefined;
                 redirect_uri?: string | undefined;
+                client_assertion?: string | undefined;
+                client_assertion_type?: string | undefined;
                 code_verifier?: string | undefined;
                 subject_token?: string | undefined;
                 subject_token_type?: string | undefined;
@@ -245,6 +247,126 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             };
         };
     };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                jwks?: any;
+                scope?: string | undefined;
+                backchannel_logout_uri?: string | undefined;
+                client_name?: string | undefined;
+                jwks_uri?: string | undefined;
+                post_logout_redirect_uris?: string[] | undefined;
+                redirect_uris?: string[] | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":clientId": {
+            get: {
+                body: unknown;
+                params: {
+                    clientId: string;
+                };
+                query: unknown;
+                headers: {
+                    authorization?: string | undefined;
+                };
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":clientId": {
+            put: {
+                body: {
+                    jwks?: any;
+                    scope?: string | undefined;
+                    backchannel_logout_uri?: string | undefined;
+                    client_name?: string | undefined;
+                    jwks_uri?: string | undefined;
+                    post_logout_redirect_uris?: string[] | undefined;
+                    redirect_uris?: string[] | undefined;
+                };
+                params: {
+                    clientId: string;
+                };
+                query: unknown;
+                headers: {
+                    authorization?: string | undefined;
+                };
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        ":clientId": {
+            delete: {
+                body: unknown;
+                params: {
+                    clientId: string;
+                };
+                query: unknown;
+                headers: {
+                    authorization?: string | undefined;
+                };
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
 } & {
     [x: string]: {
         get: {

package/dist/oidc/types.d.ts

@@ -2,13 +2,34 @@ export type OAuthClient = {
     backchannelLogoutUri?: string;
     clientId: string;
     hashedSecret?: string;
+    jwks?: JsonWebKey[];
+    jwksUri?: string;
     name: string;
     postLogoutRedirectUris?: string[];
     redirectUris: string[];
     scopes: string[];
 };
+export type ClientAssertionJtiStore = {
+    recordIfFresh: (clientId: string, jti: string, expiresAt: number) => Promise<boolean>;
+};
 export type OAuthClientStore = {
+    deleteClient?: (clientId: string) => Promise<void>;
     findClient: (clientId: string) => Promise<OAuthClient | undefined>;
+    saveClient?: (client: OAuthClient) => Promise<void>;
+    updateClient?: (clientId: string, client: OAuthClient) => Promise<void>;
+};
+export type ClientRegistrationToken = {
+    clientId: string;
+    createdAt: number;
+    tokenHash: string;
+};
+export type ClientRegistrationTokenStore = {
+    deleteByClientId: (clientId: string) => Promise<void>;
+    findByTokenHash: (tokenHash: string) => Promise<ClientRegistrationToken | undefined>;
+    saveToken: (token: ClientRegistrationToken) => Promise<void>;
+};
+export type InitialAccessTokenStore = {
+    consumeToken: (tokenHash: string) => Promise<boolean>;
 };
 export type AuthorizationCode = {
     claims?: Record<string, unknown>;