@aooth/auth 0.1.18 → 0.1.19

package/dist/authz.mjs

@@ -1,5 +1,5 @@
 import { t as defaultClock } from "./clock-Bdsep_1j.mjs";
-import { a as PendingAuthorizationStore, i as DEFAULT_PENDING_TTL_MS, n as AuthCodeStoreMemory, o as PendingAuthorizationStoreMemory, t as AuthCodeStore } from "./auth-code-store-Dqc4rEOx.mjs";
+import { c as PendingAuthorizationStoreMemory, i as AuthCodeStoreMemory, n as DynamicClientStoreMemory, o as DEFAULT_PENDING_TTL_MS, r as AuthCodeStore, s as PendingAuthorizationStore, t as DynamicClientStore } from "./dynamic-client-store-DLRfntHr.mjs";
 import { timingSafeEqual } from "node:crypto";
 import { SignJWT, exportJWK, importPKCS8, importSPKI } from "jose";
 //#region src/authz/authz-errors.ts
@@ -115,9 +115,14 @@ var RegisteredClientPolicy = class {
 			idToken,
 			accessToken: client.accessToken === true,
 			tokenPolicy: client.tokenPolicy ? structuredClone(client.tokenPolicy) : {},
+			...client.clientName !== void 0 && { clientName: client.clientName },
 			...scope !== void 0 && { scope }
 		};
 	}
+	/** Known-ness probe for `CompositeClientPolicy` dispatch (static registry, sync). */
+	hasClient(clientId) {
+		return this.clients.has(clientId);
+	}
 	authenticateClient(args) {
 		const client = this.requireClient(args.clientId);
 		if ((client.type ?? "public") !== "confidential") return;
@@ -161,29 +166,290 @@ function timingSafeEqualStr(a, b) {
 //#endregion
 //#region src/authz/composite-client-policy.ts
 /**
-* Runs Tier-1 and Tier-2 side by side, dispatching on the **presence of
-* `client_id`** (AUTH-SERVER.md §10): a request with a `client_id` is a
-* registered client, one without is a loopback CLI. The split is the safety
-* boundary — a registered client is routed only to {@link RegisteredClientPolicy}
-* (which enforces ITS redirect allowlist, so it cannot smuggle a loopback
-* redirect), and a no-`client_id` request is routed only to the loopback policy
-* (so it cannot claim to be a registered client). Each sub-policy still owns its
-* own redirect validation; this only picks which one runs.
+* Runs the tiers side by side, dispatching on the **presence and ownership of
+* `client_id`** (AUTH-SERVER.md §10, OAUTH.md R2): a request without a
+* `client_id` is a loopback CLI; one with a `client_id` belongs to the static
+* registry when it knows the id (`hasClient`), else to the dynamic policy. The
+* split is the safety boundary — each sub-policy still enforces ITS OWN
+* redirect allowlist (so a registered client cannot smuggle a loopback
+* redirect and a no-`client_id` request cannot claim to be registered), and
+* static-first dispatch means a dynamic registration can never shadow a static
+* client id. `authenticateClient` routes through the SAME picker: a dynamic
+* `client_id` must be authenticated by the dynamic policy (existence check,
+* PKCE binds), never rejected by the static registry that doesn't know it.
 */
 var CompositeClientPolicy = class {
 	loopback;
 	registered;
+	dynamic;
 	constructor(opts) {
+		if (!opts.registered && !opts.dynamic) throw new Error("CompositeClientPolicy requires at least one of `registered` / `dynamic` — with only loopback there is nothing to compose");
+		if (opts.registered && opts.dynamic && typeof opts.registered.hasClient !== "function") throw new Error("CompositeClientPolicy: `registered` must implement hasClient() when composed with `dynamic`");
 		this.loopback = opts.loopback;
 		this.registered = opts.registered;
+		this.dynamic = opts.dynamic;
 	}
 	resolveClient(args) {
-		return args.clientId ? this.registered.resolveClient(args) : this.loopback.resolveClient(args);
+		if (!args.clientId) return this.loopback.resolveClient(args);
+		const picked = this.pickForClientId(args.clientId);
+		return picked instanceof Promise ? picked.then((p) => p.resolveClient(args)) : picked.resolveClient(args);
 	}
 	authenticateClient(args) {
-		if (args.clientId) return this.registered.authenticateClient?.(args);
+		if (!args.clientId) return;
+		const picked = this.pickForClientId(args.clientId);
+		return picked instanceof Promise ? picked.then((p) => p.authenticateClient?.(args)) : picked.authenticateClient?.(args);
+	}
+	/**
+	* Ownership dispatch for a presented `client_id` — static registry first
+	* (when it knows the id), dynamic otherwise. Sync when the probe is sync
+	* (the static registry's is), preserving the callers' sync fast path.
+	*/
+	pickForClientId(clientId) {
+		if (!this.registered) return this.dynamic;
+		if (!this.dynamic) return this.registered;
+		const known = this.registered.hasClient(clientId);
+		return known instanceof Promise ? known.then((k) => k ? this.registered : this.dynamic) : known ? this.registered : this.dynamic;
+	}
+};
+//#endregion
+//#region src/authz/client-registration.ts
+/** A typed RFC 7591 registration failure; `message` becomes `error_description`. */
+var ClientRegistrationError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "ClientRegistrationError";
+		this.code = code;
+	}
+};
+/** Grant/response types the v1 authorization server supports (auth-code + PKCE only). */
+const SUPPORTED_GRANT_TYPES = ["authorization_code"];
+const SUPPORTED_RESPONSE_TYPES = ["code"];
+/** RFC 6749 §3.3 scope-token charset: printable ASCII minus space, `"` and `\`. */
+const SCOPE_TOKEN_RE = /^[\x21\x23-\x5B\x5D-\x7E]+$/u;
+const DEFAULT_MAX_REDIRECT_URIS = 5;
+const DEFAULT_MAX_REDIRECT_URI_LENGTH = 512;
+const DEFAULT_MAX_CLIENT_NAME_LENGTH = 128;
+const DEFAULT_MAX_SCOPE_LENGTH = 256;
+/**
+* `client_name` is attacker-supplied text that ends up on the consent prompt.
+* Strip every control (Cc) and format (Cf) character — that kills CR/LF, the
+* Unicode bidi overrides (U+202A–202E, U+2066–2069) used to visually reverse
+* a name, and zero-width characters used to forge lookalikes — then trim and
+* cap. Rendering it as a TEXT node (never markup) is the consent form's job;
+* this is defense in depth, not the whole defense.
+*/
+function sanitizeClientName(name, maxLength) {
+	const cleaned = name.replace(/[\p{Cc}\p{Cf}]/gu, "").trim();
+	if (cleaned.length === 0) return void 0;
+	return cleaned.slice(0, maxLength);
+}
+function asStringArray(value, field) {
+	if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) throw new ClientRegistrationError("invalid_client_metadata", `${field} must be an array of strings`);
+	return value;
+}
+/**
+* `true` when `uri` is an acceptable dynamic-client redirect target (OAUTH.md
+* R2): an `https://` URL with an explicit host (stored for EXACT matching — no
+* wildcards, no prefixes) or a loopback literal per the Tier-1 RFC 8252 rules.
+* Custom schemes are rejected in v1. A fragment is rejected outright (RFC 6749
+* §3.1.2: the redirection endpoint URI MUST NOT include a fragment component).
+*/
+function isAcceptableRedirectUri(uri) {
+	let url;
+	try {
+		url = new URL(uri);
+	} catch {
+		return false;
+	}
+	if (url.hash !== "") return false;
+	if (isLoopbackRedirectUri(uri)) return true;
+	return url.protocol === "https:" && url.hostname !== "" && url.username === "" && url.password === "";
+}
+/**
+* Validate + normalize an RFC 7591 registration request body into a
+* {@link NewDynamicClient}, or THROW a {@link ClientRegistrationError}.
+*
+* Normalization is allowed by RFC 7591 §2 (the server MAY replace requested
+* metadata with its own values) and is load-bearing for real connectors:
+* `grant_types` / `response_types` are INTERSECTED with what the server
+* supports (a connector requesting `["authorization_code", "refresh_token"]`
+* registers with `["authorization_code"]` — the 201 echo of the narrowed set
+* is the contract) rather than rejected. `token_endpoint_auth_method` defaults
+* to `"none"` when absent (v1 is public-clients-only, so the RFC's
+* `client_secret_basic` default is unsupported), but an EXPLICIT non-`"none"`
+* ask is rejected — never silently downgrade a client that asked for a secret.
+* Unknown fields are ignored and never echoed.
+*/
+function validateClientRegistration(body, opts) {
+	if (typeof body !== "object" || body === null || Array.isArray(body)) throw new ClientRegistrationError("invalid_client_metadata", "registration request must be a JSON object");
+	const req = body;
+	const maxUris = opts?.maxRedirectUris ?? DEFAULT_MAX_REDIRECT_URIS;
+	const maxUriLength = opts?.maxRedirectUriLength ?? DEFAULT_MAX_REDIRECT_URI_LENGTH;
+	if (req.redirect_uris === void 0) throw new ClientRegistrationError("invalid_redirect_uri", "redirect_uris is required");
+	const redirectUris = [...new Set(asStringArray(req.redirect_uris, "redirect_uris"))];
+	if (redirectUris.length === 0) throw new ClientRegistrationError("invalid_redirect_uri", "redirect_uris must be non-empty");
+	if (redirectUris.length > maxUris) throw new ClientRegistrationError("invalid_redirect_uri", `redirect_uris accepts at most ${maxUris} entries`);
+	for (const uri of redirectUris) if (uri.length > maxUriLength || !isAcceptableRedirectUri(uri)) throw new ClientRegistrationError("invalid_redirect_uri", "each redirect_uri must be an https URL with an explicit host or a loopback literal, without a fragment");
+	if ((req.token_endpoint_auth_method ?? "none") !== "none") throw new ClientRegistrationError("invalid_client_metadata", "only token_endpoint_auth_method \"none\" is supported");
+	const grantTypes = req.grant_types === void 0 ? [...SUPPORTED_GRANT_TYPES] : asStringArray(req.grant_types, "grant_types").filter((g) => SUPPORTED_GRANT_TYPES.includes(g));
+	if (grantTypes.length === 0) throw new ClientRegistrationError("invalid_client_metadata", "grant_types must include authorization_code");
+	const responseTypes = req.response_types === void 0 ? [...SUPPORTED_RESPONSE_TYPES] : asStringArray(req.response_types, "response_types").filter((r) => SUPPORTED_RESPONSE_TYPES.includes(r));
+	if (responseTypes.length === 0) throw new ClientRegistrationError("invalid_client_metadata", "response_types must include code");
+	let clientName;
+	if (req.client_name !== void 0) {
+		if (typeof req.client_name !== "string") throw new ClientRegistrationError("invalid_client_metadata", "client_name must be a string");
+		clientName = sanitizeClientName(req.client_name, opts?.maxClientNameLength ?? DEFAULT_MAX_CLIENT_NAME_LENGTH);
+	}
+	let scope;
+	if (req.scope !== void 0) {
+		if (typeof req.scope !== "string") throw new ClientRegistrationError("invalid_client_metadata", "scope must be a string");
+		if (req.scope.length > (opts?.maxScopeLength ?? DEFAULT_MAX_SCOPE_LENGTH)) throw new ClientRegistrationError("invalid_client_metadata", "scope is too long");
+		const tokens = req.scope.split(/\s+/u).filter(Boolean);
+		if (tokens.some((t) => !SCOPE_TOKEN_RE.test(t))) throw new ClientRegistrationError("invalid_client_metadata", "scope contains invalid characters");
+		const kept = opts?.allowedScopes ? tokens.filter((t) => opts.allowedScopes.includes(t)) : tokens;
+		if (kept.length > 0) scope = kept.join(" ");
+	}
+	return {
+		redirectUris,
+		tokenEndpointAuthMethod: "none",
+		grantTypes,
+		responseTypes,
+		...clientName !== void 0 && { clientName },
+		...scope !== void 0 && { scope }
+	};
+}
+const DEFAULT_MAX_CLIENTS = 1e3;
+/**
+* The RFC 7591 registration operation behind `POST {issuer}/register`
+* (OAUTH.md R2): validate → guard → lazy GC of never-used rows → hard cap →
+* persist. Framework-free — `@aooth/auth-moost`'s controller endpoint is a
+* thin HTTP adapter over `register()`, and non-moost servers can call it
+* directly.
+*/
+var DynamicClientRegistration = class {
+	store;
+	maxClients;
+	unusedClientTtlMs;
+	guard;
+	validation;
+	clock;
+	constructor(opts) {
+		this.store = opts.store;
+		this.maxClients = opts.maxClients ?? DEFAULT_MAX_CLIENTS;
+		this.unusedClientTtlMs = opts.unusedClientTtlMs;
+		this.guard = opts.guard;
+		this.validation = opts.validation;
+		this.clock = opts.clock ?? defaultClock;
+	}
+	/** Validate and persist a registration request body; returns the minted client. */
+	async register(body) {
+		const metadata = validateClientRegistration(body, this.validation);
+		await this.guard?.({ metadata });
+		if (this.unusedClientTtlMs !== void 0) await this.store.deleteUnusedBefore(this.clock.now() - this.unusedClientTtlMs);
+		if (await this.store.count() >= this.maxClients) throw new ClientRegistrationError("invalid_client_metadata", "registration limit reached");
+		return this.store.create(metadata);
+	}
+};
+//#endregion
+//#region src/authz/dynamic-client-policy.ts
+const DEFAULT_DYNAMIC_TOKEN_POLICY = {
+	kind: "dynamic-session",
+	ttl: 720 * 60 * 6e4
+};
+/**
+* Policy for RFC 7591 dynamically-registered public clients (OAUTH.md R2) on
+* the `ClientRedirectPolicy` seam. `resolveClient` authorizes the client +
+* `redirect_uri` against ITS registered allowlist and resolves the granted
+* scope + token policy; `authenticateClient` re-checks existence at `/token`
+* (`token_endpoint_auth_method: "none"` ⇒ no secret — PKCE is the binding, and
+* a registration garbage-collected mid-flight fails closed). Dynamic clients
+* receive an access token only — NO `id_token` in v1 (OAUTH.md R6).
+*
+* INVARIANT: the returned {@link ResolvedClient} always carries `clientId`, so
+* the minted code records it and the token endpoint's symmetric client binding
+* applies — a dynamic code redeemed without (or with another) `client_id` is
+* rejected exactly like a Tier-2 code.
+*/
+var DynamicClientPolicy = class {
+	store;
+	tokenPolicy;
+	allowedScopes;
+	clock;
+	constructor(opts) {
+		this.store = opts.store;
+		this.tokenPolicy = opts.tokenPolicy ?? DEFAULT_DYNAMIC_TOKEN_POLICY;
+		this.allowedScopes = opts.allowedScopes;
+		this.clock = opts.clock ?? defaultClock;
+	}
+	async resolveClient(args) {
+		const client = await this.requireClient(args.clientId);
+		if (!redirectAllowed(client, args.redirectUri)) throw new AuthorizeError("invalid_redirect", "redirect_uri is not registered for this client");
+		const scope = this.grantScope(client, args.scope);
+		try {
+			await this.store.touch(client.clientId, this.clock.now());
+		} catch {}
+		return {
+			clientId: client.clientId,
+			redirectUri: args.redirectUri,
+			accessToken: true,
+			tokenPolicy: structuredClone(this.tokenPolicy),
+			...client.clientName !== void 0 && { clientName: client.clientName },
+			...scope !== void 0 && { scope }
+		};
+	}
+	/**
+	* `/token`-side check: the client must still exist (fail closed when the
+	* registration was deleted/GC'd between authorize and redemption). No secret
+	* is checked — public client, PKCE is the binding; a spurious
+	* `client_secret` is ignored.
+	*/
+	async authenticateClient(args) {
+		await this.requireClient(args.clientId);
+	}
+	/** Known-ness probe for `CompositeClientPolicy` dispatch. */
+	async hasClient(clientId) {
+		return await this.store.get(clientId) !== null;
+	}
+	async requireClient(clientId) {
+		const client = clientId ? await this.store.get(clientId) : null;
+		if (!client) throw new AuthorizeError("invalid_client", "unknown client");
+		return client;
+	}
+	grantScope(client, requested) {
+		if (!requested) return void 0;
+		let granted = requested.split(/\s+/u).filter(Boolean);
+		if (this.allowedScopes) granted = granted.filter((s) => this.allowedScopes.includes(s));
+		if (client.scope !== void 0) {
+			const registered = new Set(client.scope.split(/\s+/u).filter(Boolean));
+			granted = granted.filter((s) => registered.has(s));
+		}
+		return granted.length > 0 ? granted.join(" ") : void 0;
 	}
 };
+/**
+* Exact match against the registered allowlist, with ONE relaxation: for a
+* loopback redirect the PORT is ignored (RFC 8252 §7.3 — native/CLI clients
+* bind an ephemeral port per run, so the AS MUST allow a variable port).
+* Scheme, host, path and query still must match a registered loopback entry
+* exactly; `https` entries never get the relaxation.
+*/
+function redirectAllowed(client, uri) {
+	if (client.redirectUris.includes(uri)) return true;
+	if (!isLoopbackRedirectUri(uri)) return false;
+	let presented;
+	try {
+		presented = new URL(uri);
+	} catch {
+		return false;
+	}
+	if (presented.hash !== "") return false;
+	return client.redirectUris.some((registered) => {
+		if (!isLoopbackRedirectUri(registered)) return false;
+		const reg = new URL(registered);
+		return reg.protocol === presented.protocol && reg.hostname === presented.hostname && reg.pathname === presented.pathname && reg.search === presented.search;
+	});
+}
 //#endregion
 //#region src/authz/id-token-signer.ts
 /**
@@ -252,4 +518,92 @@ var IdTokenSigner = class {
 	}
 };
 //#endregion
-export { AuthCodeStore, AuthCodeStoreMemory, AuthorizeError, CompositeClientPolicy, DEFAULT_PENDING_TTL_MS, IdTokenSigner, LoopbackClientPolicy, NoopOidcClaimsResolver, OidcClaimsResolver, PendingAuthorizationStore, PendingAuthorizationStoreMemory, RegisteredClientPolicy, isLoopbackRedirectUri, scopeGrants };
+//#region src/authz/server-metadata.ts
+/**
+* Strip a trailing slash from an issuer identifier. RFC 8414 mandates EXACT
+* (byte-identical) string comparison of issuer values, so every document that
+* spells the issuer must canonicalize it the same way — same rule as
+* `IdTokenSigner`. Shared by the AS metadata and protected-resource builders.
+*/
+function canonicalizeIssuer(issuer) {
+	return issuer.replace(/\/$/u, "");
+}
+/**
+* Build the RFC 8414 discovery document for this authorization server. Pure —
+* no I/O, no framework: mount the result on any HTTP stack (including the
+* RFC 8414 path-insertion form rooted at the HTTP origin,
+* `/.well-known/oauth-authorization-server/<issuer-path>`).
+*
+* Capability fields are fixed to what the server actually implements:
+* `response_types_supported` `["code"]`, `grant_types_supported`
+* `["authorization_code"]`, `code_challenge_methods_supported` `["S256"]`
+* (PKCE is mandatory — it is the binding for public clients). Optional fields
+* are omitted entirely (no `undefined` keys) so the serialized JSON carries
+* only what was configured.
+*/
+function buildAuthorizationServerMetadata(opts) {
+	const issuer = canonicalizeIssuer(opts.issuer);
+	const authMethods = opts.tokenEndpointAuthMethodsSupported ?? ["none", "client_secret_post"];
+	return {
+		issuer,
+		authorization_endpoint: opts.authorizationEndpoint ?? `${issuer}/authorize`,
+		token_endpoint: opts.tokenEndpoint ?? `${issuer}/token`,
+		...opts.registrationEndpoint !== void 0 && { registration_endpoint: opts.registrationEndpoint },
+		...opts.jwksUri !== void 0 && { jwks_uri: opts.jwksUri },
+		response_types_supported: ["code"],
+		grant_types_supported: ["authorization_code"],
+		code_challenge_methods_supported: ["S256"],
+		token_endpoint_auth_methods_supported: authMethods.includes("none") ? authMethods : ["none", ...authMethods],
+		...opts.scopesSupported !== void 0 && { scopes_supported: opts.scopesSupported }
+	};
+}
+//#endregion
+//#region src/authz/resource-metadata.ts
+/**
+* Build the RFC 9728 protected-resource document. Pure — no I/O, no framework;
+* mount it on any HTTP stack. Optional fields are omitted entirely (no
+* `undefined` keys) so the serialized JSON carries only what was configured.
+*/
+function buildProtectedResourceMetadata(opts) {
+	return {
+		resource: opts.resource,
+		authorization_servers: opts.authorizationServers.map((iss) => canonicalizeIssuer(iss)),
+		bearer_methods_supported: opts.bearerMethodsSupported ?? ["header"],
+		...opts.scopesSupported !== void 0 && { scopes_supported: opts.scopesSupported },
+		...opts.resourceName !== void 0 && { resource_name: opts.resourceName }
+	};
+}
+/**
+* Header-injection defense: challenge parameter values can carry
+* attacker-influenced input (an `error_description` echoing request data, a
+* scope from a token). A raw CR/LF would terminate the header and let that
+* input inject arbitrary response headers (response splitting), so CR/LF — and
+* every other C0 control char plus DEL — are STRIPPED outright. `\` and `"`
+* are then backslash-escaped per the RFC 7235 quoted-string grammar so a value
+* cannot close its quote and smuggle extra challenge params.
+*/
+function sanitizeQuotedStringValue(value) {
+	return value.replace(/[\u0000-\u001F\u007F]/gu, "").replace(/(["\\])/gu, "\\$1");
+}
+/**
+* Build the VALUE of an RFC 6750 `WWW-Authenticate` Bearer challenge, e.g.
+* `Bearer resource_metadata="https://...", error="invalid_token"`. With no
+* options (or all absent) it degrades to the bare scheme `Bearer`. Every
+* parameter is emitted as a quoted-string (RFC 6750 style) in a fixed order:
+* `realm`, `error`, `error_description`, `resource_metadata`, `scope`. All
+* values pass through {@link sanitizeQuotedStringValue} — see its security note.
+*/
+function buildWwwAuthenticateBearerChallenge(opts) {
+	const params = [];
+	const push = (name, value) => {
+		if (value !== void 0) params.push(`${name}="${sanitizeQuotedStringValue(value)}"`);
+	};
+	push("realm", opts?.realm);
+	push("error", opts?.error);
+	push("error_description", opts?.errorDescription);
+	push("resource_metadata", opts?.resourceMetadataUrl);
+	push("scope", opts?.scope);
+	return params.length === 0 ? "Bearer" : `Bearer ${params.join(", ")}`;
+}
+//#endregion
+export { AuthCodeStore, AuthCodeStoreMemory, AuthorizeError, ClientRegistrationError, CompositeClientPolicy, DEFAULT_PENDING_TTL_MS, DynamicClientPolicy, DynamicClientRegistration, DynamicClientStore, DynamicClientStoreMemory, IdTokenSigner, LoopbackClientPolicy, NoopOidcClaimsResolver, OidcClaimsResolver, PendingAuthorizationStore, PendingAuthorizationStoreMemory, RegisteredClientPolicy, buildAuthorizationServerMetadata, buildProtectedResourceMetadata, buildWwwAuthenticateBearerChallenge, canonicalizeIssuer, isLoopbackRedirectUri, scopeGrants, validateClientRegistration };

package/dist/{auth-code-store-B_m51OSB.cjs → dynamic-client-store-DAStgv2j.cjs}

@@ -35,7 +35,9 @@ var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
 			createdAt: now,
 			expiresAt: now + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.clientName !== void 0 && { clientName: rec.clientName },
 			...rec.clientState !== void 0 && { clientState: rec.clientState },
+			...rec.resource !== void 0 && { resource: rec.resource },
 			...rec.scope !== void 0 && { scope: rec.scope },
 			...rec.nonce !== void 0 && { nonce: rec.nonce },
 			...rec.idToken !== void 0 && { idToken: rec.idToken },
@@ -100,6 +102,7 @@ var AuthCodeStoreMemory = class extends AuthCodeStore {
 			expiresAt: this.clock.now() + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
 			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.resource !== void 0 && { resource: rec.resource },
 			...rec.nonce !== void 0 && { nonce: rec.nonce },
 			...rec.idToken !== void 0 && { idToken: rec.idToken },
 			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
@@ -117,6 +120,65 @@ var AuthCodeStoreMemory = class extends AuthCodeStore {
 	}
 };
 //#endregion
+//#region src/authz/dynamic-client-store.ts
+/**
+* Storage seam for dynamically-registered clients (OAUTH.md R2). Long-lived
+* (unlike the pending-auth / auth-code stores): a connector caches its
+* `client_id` and reuses it across grants, so rows survive until deleted or
+* garbage-collected as never-used. An in-memory impl ships for single-process
+* apps + tests; a durable impl (atscript-db) slots under the same
+* `DYNAMIC_CLIENT_STORE_TOKEN` (from `@aooth/auth-moost`).
+*/
+var DynamicClientStore = class {};
+/**
+* In-memory {@link DynamicClientStore} — the reference impl for a
+* single-process app + tests. `structuredClone` on read/write isolates callers.
+*/
+var DynamicClientStoreMemory = class extends DynamicClientStore {
+	store = /* @__PURE__ */ new Map();
+	clock;
+	constructor(opts) {
+		super();
+		this.clock = opts?.clock ?? require_clock.defaultClock;
+	}
+	async create(rec) {
+		const row = {
+			clientId: (0, node_crypto.randomUUID)(),
+			redirectUris: [...rec.redirectUris],
+			tokenEndpointAuthMethod: rec.tokenEndpointAuthMethod,
+			grantTypes: [...rec.grantTypes],
+			responseTypes: [...rec.responseTypes],
+			createdAt: this.clock.now(),
+			...rec.clientName !== void 0 && { clientName: rec.clientName },
+			...rec.scope !== void 0 && { scope: rec.scope }
+		};
+		this.store.set(row.clientId, structuredClone(row));
+		return structuredClone(row);
+	}
+	async get(clientId) {
+		const row = this.store.get(clientId);
+		return row ? structuredClone(row) : null;
+	}
+	async delete(clientId) {
+		return this.store.delete(clientId);
+	}
+	async count() {
+		return this.store.size;
+	}
+	async touch(clientId, at) {
+		const row = this.store.get(clientId);
+		if (row) row.lastUsedAt = at;
+	}
+	async deleteUnusedBefore(cutoff) {
+		let removed = 0;
+		for (const [id, row] of this.store) if (row.lastUsedAt === void 0 && row.createdAt < cutoff) {
+			this.store.delete(id);
+			removed++;
+		}
+		return removed;
+	}
+};
+//#endregion
 Object.defineProperty(exports, "AuthCodeStore", {
 	enumerable: true,
 	get: function() {
@@ -141,6 +203,18 @@ Object.defineProperty(exports, "DEFAULT_PENDING_TTL_MS", {
 		return DEFAULT_PENDING_TTL_MS;
 	}
 });
+Object.defineProperty(exports, "DynamicClientStore", {
+	enumerable: true,
+	get: function() {
+		return DynamicClientStore;
+	}
+});
+Object.defineProperty(exports, "DynamicClientStoreMemory", {
+	enumerable: true,
+	get: function() {
+		return DynamicClientStoreMemory;
+	}
+});
 Object.defineProperty(exports, "PendingAuthorizationStore", {
 	enumerable: true,
 	get: function() {

package/dist/{auth-code-store-Dqc4rEOx.mjs → dynamic-client-store-DLRfntHr.mjs}

@@ -35,7 +35,9 @@ var PendingAuthorizationStoreMemory = class extends PendingAuthorizationStore {
 			createdAt: now,
 			expiresAt: now + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.clientName !== void 0 && { clientName: rec.clientName },
 			...rec.clientState !== void 0 && { clientState: rec.clientState },
+			...rec.resource !== void 0 && { resource: rec.resource },
 			...rec.scope !== void 0 && { scope: rec.scope },
 			...rec.nonce !== void 0 && { nonce: rec.nonce },
 			...rec.idToken !== void 0 && { idToken: rec.idToken },
@@ -100,6 +102,7 @@ var AuthCodeStoreMemory = class extends AuthCodeStore {
 			expiresAt: this.clock.now() + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
 			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.resource !== void 0 && { resource: rec.resource },
 			...rec.nonce !== void 0 && { nonce: rec.nonce },
 			...rec.idToken !== void 0 && { idToken: rec.idToken },
 			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
@@ -117,4 +120,63 @@ var AuthCodeStoreMemory = class extends AuthCodeStore {
 	}
 };
 //#endregion
-export { PendingAuthorizationStore as a, DEFAULT_PENDING_TTL_MS as i, AuthCodeStoreMemory as n, PendingAuthorizationStoreMemory as o, DEFAULT_CODE_TTL_MS as r, AuthCodeStore as t };
+//#region src/authz/dynamic-client-store.ts
+/**
+* Storage seam for dynamically-registered clients (OAUTH.md R2). Long-lived
+* (unlike the pending-auth / auth-code stores): a connector caches its
+* `client_id` and reuses it across grants, so rows survive until deleted or
+* garbage-collected as never-used. An in-memory impl ships for single-process
+* apps + tests; a durable impl (atscript-db) slots under the same
+* `DYNAMIC_CLIENT_STORE_TOKEN` (from `@aooth/auth-moost`).
+*/
+var DynamicClientStore = class {};
+/**
+* In-memory {@link DynamicClientStore} — the reference impl for a
+* single-process app + tests. `structuredClone` on read/write isolates callers.
+*/
+var DynamicClientStoreMemory = class extends DynamicClientStore {
+	store = /* @__PURE__ */ new Map();
+	clock;
+	constructor(opts) {
+		super();
+		this.clock = opts?.clock ?? defaultClock;
+	}
+	async create(rec) {
+		const row = {
+			clientId: randomUUID(),
+			redirectUris: [...rec.redirectUris],
+			tokenEndpointAuthMethod: rec.tokenEndpointAuthMethod,
+			grantTypes: [...rec.grantTypes],
+			responseTypes: [...rec.responseTypes],
+			createdAt: this.clock.now(),
+			...rec.clientName !== void 0 && { clientName: rec.clientName },
+			...rec.scope !== void 0 && { scope: rec.scope }
+		};
+		this.store.set(row.clientId, structuredClone(row));
+		return structuredClone(row);
+	}
+	async get(clientId) {
+		const row = this.store.get(clientId);
+		return row ? structuredClone(row) : null;
+	}
+	async delete(clientId) {
+		return this.store.delete(clientId);
+	}
+	async count() {
+		return this.store.size;
+	}
+	async touch(clientId, at) {
+		const row = this.store.get(clientId);
+		if (row) row.lastUsedAt = at;
+	}
+	async deleteUnusedBefore(cutoff) {
+		let removed = 0;
+		for (const [id, row] of this.store) if (row.lastUsedAt === void 0 && row.createdAt < cutoff) {
+			this.store.delete(id);
+			removed++;
+		}
+		return removed;
+	}
+};
+//#endregion
+export { DEFAULT_CODE_TTL_MS as a, PendingAuthorizationStoreMemory as c, AuthCodeStoreMemory as i, DynamicClientStoreMemory as n, DEFAULT_PENDING_TTL_MS as o, AuthCodeStore as r, PendingAuthorizationStore as s, DynamicClientStore as t };