@absolutejs/auth 0.54.7 → 0.54.9

package/dist/oidc/clientIdMetadata.d.ts

@@ -0,0 +1,32 @@
+import type { OAuthClient } from './types';
+export type ClientIdMetadataDocument = {
+    client_id: string;
+    client_name?: string;
+    redirect_uris: string[];
+    grant_types?: string[];
+    response_types?: string[];
+    token_endpoint_auth_method?: 'none' | 'private_key_jwt' | 'self_signed_tls_client_auth';
+    application_type?: 'native' | 'web';
+    client_uri?: string;
+    logo_uri?: string;
+    policy_uri?: string;
+    tos_uri?: string;
+    jwks_uri?: string;
+    jwks?: {
+        keys: JsonWebKey[];
+    };
+    scope?: string;
+};
+export declare const validateClientIdMetadataDocument: (document: ClientIdMetadataDocument, expectedClientId: string) => string[];
+export declare const clientIdMetadataToOAuthClient: (document: ClientIdMetadataDocument) => OAuthClient;
+/** Resolve an HTTPS URL client_id into OAuth client metadata without prior
+    registration. Network access is injected so callers can enforce DNS/IP/redirect
+    policy with @absolutejs/egress. Redirects are forbidden and documents are capped
+    at 5 KiB per the IETF Client ID Metadata Document security guidance. */
+export declare const createClientIdMetadataResolver: ({ fetch: fetcher, allow, cacheTtlMs, maxBytes, now }: {
+    fetch: (input: string | URL, init?: RequestInit) => Promise<Response>;
+    allow?: (clientId: string) => boolean | Promise<boolean>;
+    cacheTtlMs?: number;
+    maxBytes?: number;
+    now?: () => number;
+}) => (clientId: string) => Promise<OAuthClient | undefined>;

package/dist/oidc/config.d.ts

@@ -13,6 +13,7 @@ export type OidcProviderConfig<UserType> = {
     clientAssertionJtiStore?: ClientAssertionJtiStore;
     clientRegistrationTokenStore?: ClientRegistrationTokenStore;
     clientStore: OAuthClientStore;
+    resolveClientIdMetadata?: (clientId: string) => Promise<OAuthClient | undefined>;
     deviceAuthorizationStore?: DeviceAuthorizationStore;
     deviceCodeTtlMs?: number;
     devicePollIntervalSeconds?: number;

package/dist/oidc/dpop.d.ts

@@ -12,7 +12,8 @@ export type DpopResult = {
     jkt: string;
     jti?: string;
 };
-export declare const verifyDpopProof: ({ htm, htu, isUsedJti, maxAgeMs, now, proof }: {
+export declare const verifyDpopProof: ({ accessToken, htm, htu, isUsedJti, maxAgeMs, now, proof }: {
+    accessToken?: string;
     htm: string;
     htu: string;
     isUsedJti?: (jti: string) => boolean | Promise<boolean>;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.54.7",
+	"version": "0.54.9",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -98,6 +98,7 @@
 		"eslint-plugin-security": "^4.0.0",
 		"globals": "^17.4.0",
 		"prettier": "3.5.3",
+		"react": "^19.2.7",
 		"solid-js": "^1.9.13",
 		"svelte": "^5.55.9",
 		"typescript": "5.8.3",