@absolutejs/auth 0.65.1 → 0.65.3

package/dist/mfa/totp.d.ts

@@ -0,0 +1,91 @@
+import { Elysia } from 'elysia';
+import { type MfaRouteProps } from './config';
+export declare const mfaTotpRoutes: <UserType>({ authSessionStore, backupCodeCount, encryptionKey, getUserId, issuer, managementAuthMaxAgeMs, mfaStore, onMfaEnrolled, totpSetupRoute, totpVerifyRoute }: MfaRouteProps<UserType>) => Elysia<"", {
+    decorator: {};
+    store: {
+        session: import("..").SessionRecord<UserType>;
+        unregisteredSession: import("..").UnregisteredSessionRecord;
+    };
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        post: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                401: "Recent authentication required" | "Authentication required";
+                200: {
+                    readonly secret: string;
+                    readonly uri: string;
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                code: string;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                400: "No TOTP enrollment in progress" | "Invalid TOTP code";
+                401: "Recent authentication required" | "Authentication required";
+                200: {
+                    readonly backupCodes: string[];
+                };
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/mfa/types.d.ts

@@ -0,0 +1,58 @@
+import type { VerificationPurpose } from '../verification/types';
+export type MfaFactorType = 'backup_codes' | 'sms' | 'totp';
+export type MfaEnrollment = {
+    backupCodeHashes: string[];
+    createdAt: number;
+    lastUsedAt?: number;
+    smsFailedAttempts?: number;
+    smsPendingCodeHash?: string;
+    smsPendingCodeExpiresAt?: number;
+    smsPendingPurpose?: VerificationPurpose;
+    smsProviderReference?: string;
+    smsCodeSentAt?: number;
+    /** Opaque generation binding every update to the currently active challenge. */
+    smsChallengeId?: string;
+    smsPhone?: string;
+    smsVerified: boolean;
+    totpFailedAttempts?: number;
+    totpSecretCiphertext?: string;
+    totpVerified: boolean;
+    updatedAt: number;
+    userId: string;
+};
+export type MFAStore = {
+    /** Atomically reserves the SMS slot only when the resend cooldown has elapsed. */
+    claimSmsChallenge: (input: {
+        challengeId: string;
+        cooldownCutoff: number;
+        enrollment: MfaEnrollment;
+    }) => Promise<boolean>;
+    completeSmsChallenge: (input: {
+        challengeId: string;
+        lastUsedAt?: number;
+        smsVerified: boolean;
+        userId: string;
+    }) => Promise<boolean>;
+    finalizeSmsChallenge: (input: {
+        challengeId: string;
+        expiresAt: number;
+        hash?: string;
+        providerReference?: string;
+        userId: string;
+    }) => Promise<boolean>;
+    getEnrollment: (userId: string) => Promise<MfaEnrollment | undefined>;
+    listEnrollments: () => Promise<MfaEnrollment[]>;
+    removeEnrollment: (userId: string) => Promise<void>;
+    recordSmsFailure: (input: {
+        challengeId: string;
+        maxAttempts: number;
+        userId: string;
+    }) => Promise<number | undefined>;
+    rollbackSmsChallenge: (input: {
+        challengeId: string;
+        previous?: MfaEnrollment;
+        userId: string;
+    }) => Promise<void>;
+    saveEnrollment: (enrollment: MfaEnrollment) => Promise<void>;
+};
+export declare const isMfaEnrolled: (enrollment: MfaEnrollment | undefined) => boolean;

package/dist/migrations/generate.d.ts

@@ -0,0 +1,2 @@
+import { type PgTable } from 'drizzle-orm/pg-core';
+export declare const tablesToInitSql: (tables: PgTable[]) => string;

package/dist/migrations/index.d.ts

@@ -0,0 +1,6 @@
+import type { BlockMigrations } from './types';
+export type BlockName = 'adaptive' | 'agents' | 'apikeys' | 'audit' | 'credentials' | 'fga' | 'linkedProviders' | 'lockout' | 'mfa' | 'oidc' | 'organizations' | 'passwordless' | 'portal' | 'roles' | 'scim' | 'sessions' | 'sso' | 'vault' | 'vc' | 'webauthn' | 'webhooks';
+export declare const blockMigrations: Record<BlockName, BlockMigrations>;
+export { runMigrations } from './runner';
+export type { MigrationClient, MigrationQueryResult, MigrationRunResult, RunMigrationsOptions } from './runner';
+export type { Migration, BlockMigrations } from './types';

package/dist/migrations/runner.d.ts

@@ -0,0 +1,22 @@
+import { type BlockName } from './index';
+export type RunMigrationsOptions = {
+    /** Existing SQL client. When provided, the runner does not create or close a pool. */
+    client?: MigrationClient;
+    /** Postgres connection string used by the default Neon-compatible pool. */
+    databaseUrl?: string;
+    /** Subset of blocks to apply. Omit to apply every block the package ships. */
+    blocks?: BlockName[];
+    /** Optional logger; defaults to console.log. Pass `() => undefined` for silent mode. */
+    log?: (message: string) => void;
+};
+export type MigrationRunResult = {
+    applied: string[];
+    skipped: string[];
+};
+export type MigrationQueryResult = {
+    rows: unknown[];
+};
+export type MigrationClient = {
+    query: (text: string, values?: readonly unknown[]) => Promise<MigrationQueryResult>;
+};
+export declare const runMigrations: ({ blocks, client, databaseUrl, log }: RunMigrationsOptions) => Promise<MigrationRunResult>;

package/dist/migrations/types.d.ts

@@ -0,0 +1,14 @@
+export type Migration = {
+    /** Stable identifier — stored in `auth_migrations` to track applied state. Must be
+     *  monotonically ordered within a block (e.g. `0001_init`, `0002_add_foo_column`). */
+    id: string;
+    /** Idempotent SQL. Use `CREATE TABLE IF NOT EXISTS` so re-running is a no-op even if
+     *  the consumer wired the tables by hand before adopting the migration runner. */
+    sql: string;
+};
+export type BlockMigrations = {
+    /** Block name as used in the CLI's `--blocks` flag and in `runMigrations({ blocks })`.
+     *  Convention: same string as the `src/<block>/` directory. */
+    block: string;
+    migrations: Migration[];
+};

package/dist/oidc/clientAuth.d.ts

@@ -0,0 +1,19 @@
+import type { ClientAssertionJtiStore, OAuthClient } from './types';
+export declare const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+export declare const verifyClientAssertion: ({ assertion, expectedAudience, jtiStore, resolveClient }: {
+    assertion: string;
+    expectedAudience: string;
+    jtiStore?: ClientAssertionJtiStore;
+    resolveClient: (clientId: string) => Promise<OAuthClient | undefined>;
+}) => Promise<OAuthClient | undefined>;
+export declare const verifyJwtSignedByClient: ({ jwt, client }: {
+    client: OAuthClient;
+    jwt: string;
+}) => Promise<{
+    header: {
+        [k: string]: any;
+    };
+    payload: {
+        [k: string]: any;
+    };
+} | undefined>;

package/dist/oidc/clientIdMetadata.d.ts

@@ -0,0 +1,28 @@
+import type { OAuthClient } from './types';
+export type ClientIdMetadataDocument = {
+    client_id: string;
+    client_name?: string;
+    redirect_uris: string[];
+    grant_types?: string[];
+    response_types?: string[];
+    token_endpoint_auth_method?: 'none' | 'private_key_jwt' | 'self_signed_tls_client_auth';
+    application_type?: 'native' | 'web';
+    client_uri?: string;
+    logo_uri?: string;
+    policy_uri?: string;
+    tos_uri?: string;
+    jwks_uri?: string;
+    jwks?: {
+        keys: JsonWebKey[];
+    };
+    scope?: string;
+};
+export declare const clientIdMetadataToOAuthClient: (document: ClientIdMetadataDocument) => OAuthClient;
+export declare const createClientIdMetadataResolver: ({ fetch: fetcher, allow, cacheTtlMs, maxBytes, now }: {
+    fetch: (input: string | URL, init?: RequestInit) => Promise<Response>;
+    allow?: (clientId: string) => boolean | Promise<boolean>;
+    cacheTtlMs?: number;
+    maxBytes?: number;
+    now?: () => number;
+}) => (clientId: string) => Promise<OAuthClient | undefined>;
+export declare const validateClientIdMetadataDocument: (document: ClientIdMetadataDocument, expectedClientId: string) => string[];

package/dist/oidc/config.d.ts

@@ -0,0 +1,307 @@
+import type { RouteString } from '../types';
+import { type SigningKey, type SigningKeyIdentity } from './keys';
+import type { OnClientRegistered, OnClientRegistration } from './registration';
+import type { VciConfig } from './vci';
+import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
+export declare const DEFAULT_OIDC_ROUTE: RouteString;
+export type PublicTokenGrantResult = {
+    body: Record<string, unknown>;
+    status: number;
+};
+export type OidcProviderConfig<UserType> = {
+    /** Additional non-conflicting RFC 8414 metadata. Reserved core OAuth keys
+     * cannot be replaced. Used by profiles such as open agent registration. */
+    additionalDiscoveryMetadata?: Record<string, unknown>;
+    /** Public extension grants whose bearer material is carried in their body
+     * (for example an agent claim_token). They run before OAuth client auth. */
+    publicTokenGrantTypes?: string[];
+    handlePublicTokenGrant?: (context: {
+        body: Record<string, string | undefined>;
+        request: Request;
+    }) => Promise<PublicTokenGrantResult | undefined>;
+    accessTokenTtlMs?: number | ((context: {
+        scopes: string[];
+    }) => number);
+    acrValuesSupported?: string[];
+    authorizationCodeStore: AuthorizationCodeStore;
+    clientAssertionJtiStore?: ClientAssertionJtiStore;
+    clientRegistrationTokenStore?: ClientRegistrationTokenStore;
+    clientStore: OAuthClientStore;
+    resolveClientIdMetadata?: (clientId: string) => Promise<OAuthClient | undefined>;
+    deviceAuthorizationStore?: DeviceAuthorizationStore;
+    deviceCodeTtlMs?: number;
+    devicePollIntervalSeconds?: number;
+    backchannelAuthStore?: BackchannelAuthStore;
+    backchannelAuthTtlMs?: number;
+    backchannelPollIntervalSeconds?: number;
+    resolveBackchannelUser?: (hint: {
+        client: OAuthClient;
+        loginHint: string;
+    }) => Promise<{
+        sub: string;
+    } | undefined>;
+    onBackchannelAuthRequest?: (context: {
+        authReqId: string;
+        bindingMessage: string | undefined;
+        clientId: string;
+        scopes: string[];
+        userSub: string;
+    }) => Promise<void> | void;
+    getAccessTokenClaims?: (context: {
+        audience?: string;
+        clientId: string;
+        scopes: string[];
+        sub: string;
+    }) => Record<string, unknown> | Promise<Record<string, unknown>>;
+    getClaims?: (user: UserType) => Record<string, unknown>;
+    consentUrl?: string;
+    needsConsent?: (context: {
+        client: {
+            clientId: string;
+            name: string;
+        };
+        requestedScopes: string[];
+        user: UserType;
+    }) => boolean | Promise<boolean>;
+    getGrantedScopes?: (context: {
+        client: {
+            clientId: string;
+            name: string;
+        };
+        requestedScopes: string[];
+        user: UserType;
+    }) => string[] | undefined | Promise<string[] | undefined>;
+    getUserId: (user: UserType) => string;
+    getUserInfo?: (sub: string) => Promise<Record<string, unknown> | undefined>;
+    idTokenTtlMs?: number;
+    issuer: string;
+    dpopNonce?: {
+        secret: string;
+    };
+    extractTlsClientCert?: (headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined;
+    getAcr?: (context: {
+        scopes: string[];
+        user: UserType;
+    }) => string | undefined;
+    initialAccessTokenStore?: InitialAccessTokenStore;
+    loginUrl?: string;
+    logoutDeliveryStore?: LogoutDeliveryStore;
+    oidcRoute?: RouteString;
+    onClientRegistration?: OnClientRegistration;
+    /** Fires after RFC 7591 registration has been persisted and has a generated client id. */
+    onClientRegistered?: OnClientRegistered;
+    /** Fires after an authenticated user authorizes an OAuth authorization-code
+     * request and the final granted scopes are known, before the code is issued. */
+    onAuthorizationCodeApproved?: (context: {
+        clientId: string;
+        scopes: string[];
+        userSub: string;
+    }) => void | Promise<void>;
+    /** Fires after the authenticated user approves an RFC 8628 device request. */
+    onDeviceAuthorizationApproved?: (context: {
+        clientId: string;
+        scopes: string[];
+        userSub: string;
+    }) => void | Promise<void>;
+    pushedAuthorizationRequestStore?: PushedAuthorizationRequestStore;
+    pushedAuthorizationRequestTtlMs?: number;
+    refreshTokenStore: OidcRefreshTokenStore;
+    refreshTokenTtlMs?: number;
+    /** Previous public signing identities retained only for the bounded token
+     * overlap window after rotation. The active `signingKey` always signs new
+     * tokens and is published first. Private material does not belong here. */
+    previousSigningKeys?: readonly SigningKeyIdentity[];
+    signingKey: SigningKey;
+    strictFapi?: boolean;
+    vciConfig?: VciConfig;
+};
+export type TokenExchangeResult = {
+    error: 'invalid_grant' | 'invalid_scope';
+    ok: false;
+} | {
+    accessToken: string;
+    expiresIn: number;
+    ok: true;
+    scope: string;
+};
+export declare const exchangeToken: <UserType>({ actorClientId, audience, config, dpopJkt, now, requestedScopes, subjectToken }: {
+    actorClientId: string;
+    audience?: string;
+    config: OidcProviderConfig<UserType>;
+    dpopJkt?: string;
+    now?: number;
+    requestedScopes?: string[];
+    subjectToken: string;
+}) => Promise<TokenExchangeResult>;
+export declare const issueTokenSet: <UserType>({ acr, audience, claims, clientCertThumbprint, clientId, config, dpopJkt, nonce, now, scopes, sub }: {
+    acr?: string;
+    audience?: string;
+    claims?: Record<string, unknown>;
+    clientCertThumbprint?: string;
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    dpopJkt?: string;
+    nonce?: string;
+    now?: number;
+    scopes: string[];
+    sub: string;
+}) => Promise<{
+    access_token: string;
+    expires_in: number;
+    id_token: string;
+    refresh_token: string;
+    scope: string;
+    token_type: "Bearer" | "DPoP";
+}>;
+export declare const mcpProtectedResourceMetadata: ({ issuer, resource, scopes }: {
+    issuer: string;
+    resource: string;
+    scopes?: string[];
+}) => {
+    authorization_servers: string[];
+    resource: string;
+    scopes_supported: string[];
+};
+export declare const verifyPkce: (codeVerifier: string, codeChallenge: string) => Promise<boolean>;
+export type TokenIntrospection = {
+    active: false;
+} | {
+    active: true;
+    client_id: string;
+    exp: number;
+    iat: number;
+    scope: string;
+    sub: string;
+    token_type: 'access_token' | 'refresh_token';
+};
+export type TokenTypeHint = 'access_token' | 'refresh_token';
+export declare const introspectToken: <UserType>({ config, hint, now, token }: {
+    config: OidcProviderConfig<UserType>;
+    hint?: TokenTypeHint;
+    now?: number;
+    token: string;
+}) => Promise<{
+    active: false;
+} | {
+    active: true;
+    client_id: string;
+    exp: number;
+    iat: number;
+    scope: string;
+    sub: string;
+    token_type: "access_token";
+} | {
+    active: true;
+    client_id: string;
+    exp: number;
+    iat: number;
+    scope: string;
+    sub: string;
+    token_type: "refresh_token";
+}>;
+export declare const revokeRefreshToken: <UserType>(config: OidcProviderConfig<UserType>, token: string) => Promise<boolean>;
+export type DeviceAuthorizationResponse = {
+    device_code: string;
+    expires_in: number;
+    interval: number;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+};
+export declare const issueDeviceAuthorization: <UserType>({ clientId, config, now, requestedScopes }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    now?: number;
+    requestedScopes: string[];
+}) => Promise<DeviceAuthorizationResponse>;
+export type DeviceDecisionResult = {
+    error: 'already_decided' | 'expired_token' | 'invalid_user_code' | 'not_configured';
+    ok: false;
+} | {
+    ok: true;
+};
+export declare const approveDeviceAuthorization: <UserType>({ config, userCode, userSub }: {
+    config: OidcProviderConfig<UserType>;
+    userCode: string;
+    userSub: string;
+}) => Promise<DeviceDecisionResult>;
+export declare const denyDeviceAuthorization: <UserType>({ config, userCode }: {
+    config: OidcProviderConfig<UserType>;
+    userCode: string;
+}) => Promise<DeviceDecisionResult>;
+export type DeviceCodeExchangeError = 'access_denied' | 'authorization_pending' | 'expired_token' | 'invalid_grant' | 'slow_down';
+export type DeviceCodeExchangeResult = {
+    access_token: string;
+    expires_in: number;
+    id_token: string;
+    ok: true;
+    refresh_token: string;
+    scope: string;
+    token_type: 'Bearer' | 'DPoP';
+} | {
+    error: DeviceCodeExchangeError;
+    ok: false;
+};
+export declare const exchangeDeviceCode: <UserType>({ clientId, config, deviceCode, dpopJkt, now }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    deviceCode: string;
+    dpopJkt?: string;
+    now?: number;
+}) => Promise<DeviceCodeExchangeResult>;
+export declare const CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
+export type BackchannelAuthResponse = {
+    auth_req_id: string;
+    expires_in: number;
+    interval: number;
+};
+export type BackchannelAuthError = 'expired_login_hint_token' | 'invalid_client' | 'invalid_request' | 'unknown_user_id';
+export declare const issueBackchannelAuth: <UserType>({ clientId, config, loginHint, bindingMessage, now, requestedScopes }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    loginHint: string;
+    bindingMessage?: string;
+    now?: number;
+    requestedScopes: string[];
+}) => Promise<{
+    error: BackchannelAuthError;
+    ok: false;
+} | ({
+    ok: true;
+} & BackchannelAuthResponse)>;
+export type BackchannelDecisionResult = {
+    error: 'already_decided' | 'expired_token' | 'invalid_auth_req_id' | 'not_configured';
+    ok: false;
+} | {
+    ok: true;
+};
+export declare const approveBackchannelAuth: <UserType>({ authReqId, config, userSub }: {
+    authReqId: string;
+    config: OidcProviderConfig<UserType>;
+    userSub?: string;
+}) => Promise<BackchannelDecisionResult>;
+export declare const denyBackchannelAuth: <UserType>({ authReqId, config }: {
+    authReqId: string;
+    config: OidcProviderConfig<UserType>;
+}) => Promise<BackchannelDecisionResult>;
+export type BackchannelExchangeError = 'access_denied' | 'authorization_pending' | 'expired_token' | 'invalid_grant' | 'slow_down';
+export type BackchannelExchangeResult = {
+    access_token: string;
+    expires_in: number;
+    id_token: string;
+    ok: true;
+    refresh_token: string;
+    scope: string;
+    token_type: 'Bearer' | 'DPoP';
+} | {
+    error: BackchannelExchangeError;
+    ok: false;
+};
+export declare const exchangeBackchannelAuth: <UserType>({ authReqId, clientCertThumbprint, clientId, config, dpopJkt, now }: {
+    authReqId: string;
+    clientCertThumbprint?: string;
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    dpopJkt?: string;
+    now?: number;
+}) => Promise<BackchannelExchangeResult>;

package/dist/oidc/dpop.d.ts

@@ -0,0 +1,23 @@
+export declare const extractDpopNonceClaim: (proof: string) => string | undefined;
+export declare const mintDpopNonce: ({ now, secret }: {
+    now?: number;
+    secret: string;
+}) => Promise<string>;
+export declare const verifyDpopNonce: ({ now, nonce, secret }: {
+    nonce: string;
+    now?: number;
+    secret: string;
+}) => Promise<boolean>;
+export type DpopResult = {
+    jkt: string;
+    jti?: string;
+};
+export declare const verifyDpopProof: ({ accessToken, htm, htu, isUsedJti, maxAgeMs, now, proof }: {
+    accessToken?: string;
+    htm: string;
+    htu: string;
+    isUsedJti?: (jti: string) => boolean | Promise<boolean>;
+    maxAgeMs?: number;
+    now?: number;
+    proof: string | undefined;
+}) => Promise<DpopResult | undefined>;

package/dist/oidc/inMemoryStores.d.ts

@@ -0,0 +1,11 @@
+import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
+export declare const createInMemoryAuthorizationCodeStore: () => AuthorizationCodeStore;
+export declare const createInMemoryBackchannelAuthStore: () => BackchannelAuthStore;
+export declare const createInMemoryClientAssertionJtiStore: () => ClientAssertionJtiStore;
+export declare const createInMemoryClientRegistrationTokenStore: () => ClientRegistrationTokenStore;
+export declare const createInMemoryDeviceAuthorizationStore: () => DeviceAuthorizationStore;
+export declare const createInMemoryInitialAccessTokenStore: (initialHashes?: string[]) => InitialAccessTokenStore;
+export declare const createInMemoryLogoutDeliveryStore: () => LogoutDeliveryStore;
+export declare const createInMemoryOAuthClientStore: (clients: OAuthClient[]) => OAuthClientStore;
+export declare const createInMemoryOidcRefreshTokenStore: () => OidcRefreshTokenStore;
+export declare const createInMemoryPushedAuthorizationRequestStore: () => PushedAuthorizationRequestStore;

package/dist/oidc/inMemoryVciStores.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialNonceStore, CredentialOfferStore } from './vci';
+export declare const createInMemoryCredentialNonceStore: () => CredentialNonceStore;
+export declare const createInMemoryCredentialOfferStore: () => CredentialOfferStore;

package/dist/oidc/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Declaration-stable OIDC provider entry point.
+ *
+ * Server applications that only need to issue and verify OAuth/OIDC tokens
+ * should import this subpath instead of loading every optional Auth feature
+ * through the package root.
+ */
+export type { OidcProviderConfig } from './config';
+export { generateSigningKey, jwkThumbprint, signJwt, signingVerificationKeys, toPublicJwk, verifyJwt, verifyJwtWithKeys, type SigningKey, type SigningKeyIdentity } from './keys';
+export { revokeOAuthClientCredentials } from './operator';
+export { createNeonAuthorizationCodeStore, createNeonClientAssertionJtiStore, createNeonClientRegistrationTokenStore, createNeonDeviceAuthorizationStore, createNeonInitialAccessTokenStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createPostgresAuthorizationCodeStore, createPostgresClientAssertionJtiStore, createPostgresClientRegistrationTokenStore, createPostgresDeviceAuthorizationStore, createPostgresInitialAccessTokenStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore } from './postgresStores';
+export type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, OAuthClient, OAuthClientStore, OidcRefreshTokenConnection, OidcRefreshTokenStore } from './types';

package/dist/oidc/jar.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthClient } from './types';
+export type JarParseResult = {
+    error: 'invalid_request_object';
+    ok: false;
+} | {
+    ok: true;
+    params: Record<string, string>;
+};
+export declare const parseSignedRequestObject: ({ client, expectedIssuer, jwt, now }: {
+    client: OAuthClient;
+    expectedIssuer: string;
+    jwt: string;
+    now?: number;
+}) => Promise<JarParseResult>;

package/dist/oidc/keys.d.ts

@@ -0,0 +1,50 @@
+export type SigningKeyIdentity = {
+    kid: string;
+    publicJwk: JsonWebKey;
+};
+/** ES256 signing material can remain local for development or be delegated to
+ * a non-exportable KMS/HSM adapter. External signers return the 64-byte JOSE
+ * ECDSA signature (r || s), not an ASN.1 DER envelope. */
+export type SigningKey = SigningKeyIdentity & ({
+    privateJwk: JsonWebKey;
+    sign?: never;
+} | {
+    privateJwk?: never;
+    sign: (input: Uint8Array) => Promise<Uint8Array>;
+});
+declare const generateSigningKey: () => Promise<SigningKey>;
+declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
+declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey, typ?: string) => Promise<string>;
+declare const toPublicJwk: (key: SigningKeyIdentity) => {
+    alg: string;
+    crv: string | undefined;
+    kid: string;
+    kty: string | undefined;
+    use: string;
+    x: string | undefined;
+    y: string | undefined;
+};
+declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promise<{
+    header: {
+        [k: string]: any;
+    };
+    payload: {
+        [k: string]: any;
+    };
+} | undefined>;
+/** Resolves the active signing identity followed by still-valid previous
+ * public identities. Duplicate key IDs fail closed because a JWT `kid` must
+ * identify exactly one verification key during an overlap window. */
+declare const signingVerificationKeys: (active: SigningKeyIdentity, previous?: readonly SigningKeyIdentity[]) => SigningKeyIdentity[];
+/** Verifies an Absolute Auth JWT against the exact public identity named by
+ * its protected `kid` header. This keeps already-issued tokens valid while a
+ * previous public key remains in the configured overlap window. */
+declare const verifyJwtWithKeys: (token: string, keys: readonly SigningKeyIdentity[]) => Promise<{
+    header: {
+        [k: string]: any;
+    };
+    payload: {
+        [k: string]: any;
+    };
+} | undefined>;
+export { generateSigningKey, jwkThumbprint, signingVerificationKeys, signJwt, toPublicJwk, verifyJwt, verifyJwtWithKeys };