@aooth/auth 0.1.46 → 0.1.48

package/dist/authz.mjs

@@ -1,7 +1,37 @@
 import { t as defaultClock } from "./clock-Bdsep_1j.mjs";
-import { c as PendingAuthorizationStoreMemory, i as AuthCodeStoreMemory, n as DynamicClientStoreMemory, o as DEFAULT_PENDING_TTL_MS, r as AuthCodeStore, s as PendingAuthorizationStore, t as DynamicClientStore } from "./dynamic-client-store-DLRfntHr.mjs";
-import { timingSafeEqual } from "node:crypto";
+import { t as generateOpaqueToken } from "./opaque-token-BaMOrC1A.mjs";
+import { c as PendingAuthorizationStoreMemory, i as AuthCodeStoreMemory, n as DynamicClientStoreMemory, o as DEFAULT_PENDING_TTL_MS, r as AuthCodeStore, s as PendingAuthorizationStore, t as DynamicClientStore } from "./dynamic-client-store-B1JwFHdP.mjs";
+import { createHash, timingSafeEqual } from "node:crypto";
 import { SignJWT, exportJWK, importPKCS8, importSPKI } from "jose";
+//#region src/authz/token-policy.ts
+/**
+* Default refresh-token (grant) lifetime for {@link TokenPolicy.refresh} when
+* no `ttl` is given: 30 days. Deliberately independent of the session tier's
+* `AuthCredentialOptions.refresh.ttl` — an authz grant's lifetime is the
+* policy's decision, never inherited from browser-session posture.
+*/
+const DEFAULT_AUTHZ_REFRESH_TTL_MS = 720 * 60 * 6e4;
+/**
+* Flatten a {@link TokenPolicy} into the `AuthCredential.issue()` options a
+* token endpoint forwards. The refresh dimension applies only to client-bound
+* grants — the family is stamped with `metadata.authzClientId`, the binding
+* the `refresh_token` grant enforces — so a clientless (loopback) grant
+* ignores `policy.refresh`. `refresh: false` otherwise: an authz mint never
+* rides the instance-level session refresh config (no orphaned refresh row
+* for a policy that didn't opt in). Lives HERE, next to the policy type and
+* its default ttl, so every HTTP adapter applies the same semantics.
+*/
+function tokenPolicyToIssueOptions(policy, clientId) {
+	const withRefresh = policy.refresh !== void 0 && clientId !== void 0;
+	return {
+		...policy.payload,
+		...policy.kind !== void 0 && { kind: policy.kind },
+		...policy.ttl !== void 0 && { ttl: policy.ttl },
+		refresh: withRefresh ? { ttl: policy.refresh?.ttl ?? 2592e6 } : false,
+		...withRefresh && { metadata: { authzClientId: clientId } }
+	};
+}
+//#endregion
 //#region src/authz/authz-errors.ts
 /** A typed authorization-server failure. */
 var AuthorizeError = class extends Error {
@@ -59,6 +89,15 @@ var LoopbackClientPolicy = class {
 	}
 };
 //#endregion
+//#region src/utils/timing-safe.ts
+/** Constant-time string compare that also fails closed on a length mismatch. */
+function timingSafeEqualStr(a, b) {
+	const ab = Buffer.from(a, "utf8");
+	const bb = Buffer.from(b, "utf8");
+	if (ab.length !== bb.length) return false;
+	return timingSafeEqual(ab, bb);
+}
+//#endregion
 //#region src/authz/oidc-claims-resolver.ts
 /**
 * Resolves the OIDC profile claims to embed in an `id_token` for a given user +
@@ -156,13 +195,6 @@ var RegisteredClientPolicy = class {
 		return granted.length > 0 ? granted.join(" ") : void 0;
 	}
 };
-/** Constant-time string compare that also fails closed on a length mismatch. */
-function timingSafeEqualStr(a, b) {
-	const ab = Buffer.from(a, "utf8");
-	const bb = Buffer.from(b, "utf8");
-	if (ab.length !== bb.length) return false;
-	return timingSafeEqual(ab, bb);
-}
 //#endregion
 //#region src/authz/composite-client-policy.ts
 /**
@@ -212,6 +244,30 @@ var CompositeClientPolicy = class {
 	}
 };
 //#endregion
+//#region src/authz/client-secret.ts
+/**
+* Mint a confidential dynamic client's secret (RFC 7591 `client_secret`) — a
+* plain {@link generateOpaqueToken} mint. Returned to the registrant ONCE in
+* the registration response; only its {@link hashClientSecret} digest is
+* stored.
+*/
+function mintClientSecret() {
+	return generateOpaqueToken();
+}
+/**
+* Storage digest for a client secret — plain SHA-256 (hex). No KDF/salt on
+* purpose: the secret is high-entropy server-minted material (never a human
+* password), so brute-forcing the digest is infeasible and a per-row salt
+* buys nothing.
+*/
+function hashClientSecret(secret) {
+	return createHash("sha256").update(secret, "utf8").digest("hex");
+}
+/** Constant-time check of a presented secret against a stored digest. */
+function verifyClientSecret(secret, hash) {
+	return timingSafeEqualStr(hashClientSecret(secret), hash);
+}
+//#endregion
 //#region src/authz/client-registration.ts
 /** A typed RFC 7591 registration failure; `message` becomes `error_description`. */
 var ClientRegistrationError = class extends Error {
@@ -222,9 +278,11 @@ var ClientRegistrationError = class extends Error {
 		this.code = code;
 	}
 };
-/** Grant/response types the v1 authorization server supports (auth-code + PKCE only). */
-const SUPPORTED_GRANT_TYPES = ["authorization_code"];
+/** Grant/response types the authorization server supports (auth-code + PKCE, plus refresh). */
+const SUPPORTED_GRANT_TYPES = ["authorization_code", "refresh_token"];
 const SUPPORTED_RESPONSE_TYPES = ["code"];
+/** Token-endpoint auth methods DCR accepts (both advertised in the RFC 8414 document). */
+const SUPPORTED_TOKEN_ENDPOINT_AUTH_METHODS = ["none", "client_secret_post"];
 /** RFC 6749 §3.3 scope-token charset: printable ASCII minus space, `"` and `\`. */
 const SCOPE_TOKEN_RE = /^[\x21\x23-\x5B\x5D-\x7E]+$/u;
 const DEFAULT_MAX_REDIRECT_URIS = 5;
@@ -273,13 +331,14 @@ function isAcceptableRedirectUri(uri) {
 * Normalization is allowed by RFC 7591 §2 (the server MAY replace requested
 * metadata with its own values) and is load-bearing for real connectors:
 * `grant_types` / `response_types` are INTERSECTED with what the server
-* supports (a connector requesting `["authorization_code", "refresh_token"]`
-* registers with `["authorization_code"]` — the 201 echo of the narrowed set
-* is the contract) rather than rejected. `token_endpoint_auth_method` defaults
-* to `"none"` when absent (v1 is public-clients-only, so the RFC's
-* `client_secret_basic` default is unsupported), but an EXPLICIT non-`"none"`
-* ask is rejected — never silently downgrade a client that asked for a secret.
-* Unknown fields are ignored and never echoed.
+* supports (an unsupported grant is dropped from the echo — the 201 echo of
+* the narrowed set is the contract) rather than rejected, but the result must
+* still include `authorization_code` (it is the only way to establish a grant;
+* `refresh_token` alone mints nothing). `token_endpoint_auth_method` defaults
+* to `"none"` when absent (the RFC's `client_secret_basic` default is
+* unsupported — secrets travel in the POST form body); an EXPLICIT ask outside
+* the allowed set is rejected — never silently downgrade a client that asked
+* for a secret. Unknown fields are ignored and never echoed.
 */
 function validateClientRegistration(body, opts) {
 	if (typeof body !== "object" || body === null || Array.isArray(body)) throw new ClientRegistrationError("invalid_client_metadata", "registration request must be a JSON object");
@@ -291,9 +350,11 @@ function validateClientRegistration(body, opts) {
 	if (redirectUris.length === 0) throw new ClientRegistrationError("invalid_redirect_uri", "redirect_uris must be non-empty");
 	if (redirectUris.length > maxUris) throw new ClientRegistrationError("invalid_redirect_uri", `redirect_uris accepts at most ${maxUris} entries`);
 	for (const uri of redirectUris) if (uri.length > maxUriLength || !isAcceptableRedirectUri(uri)) throw new ClientRegistrationError("invalid_redirect_uri", "each redirect_uri must be an https URL with an explicit host or a loopback literal, without a fragment");
-	if ((req.token_endpoint_auth_method ?? "none") !== "none") throw new ClientRegistrationError("invalid_client_metadata", "only token_endpoint_auth_method \"none\" is supported");
+	const allowedAuthMethods = (opts?.allowedTokenEndpointAuthMethods ?? SUPPORTED_TOKEN_ENDPOINT_AUTH_METHODS).filter((m) => SUPPORTED_TOKEN_ENDPOINT_AUTH_METHODS.includes(m));
+	const authMethod = req.token_endpoint_auth_method ?? "none";
+	if (typeof authMethod !== "string" || !allowedAuthMethods.includes(authMethod)) throw new ClientRegistrationError("invalid_client_metadata", `only token_endpoint_auth_method ${allowedAuthMethods.map((m) => `"${m}"`).join(" / ")} is supported`);
 	const grantTypes = req.grant_types === void 0 ? [...SUPPORTED_GRANT_TYPES] : asStringArray(req.grant_types, "grant_types").filter((g) => SUPPORTED_GRANT_TYPES.includes(g));
-	if (grantTypes.length === 0) throw new ClientRegistrationError("invalid_client_metadata", "grant_types must include authorization_code");
+	if (!grantTypes.includes("authorization_code")) throw new ClientRegistrationError("invalid_client_metadata", "grant_types must include authorization_code");
 	const responseTypes = req.response_types === void 0 ? [...SUPPORTED_RESPONSE_TYPES] : asStringArray(req.response_types, "response_types").filter((r) => SUPPORTED_RESPONSE_TYPES.includes(r));
 	if (responseTypes.length === 0) throw new ClientRegistrationError("invalid_client_metadata", "response_types must include code");
 	let clientName;
@@ -312,7 +373,7 @@ function validateClientRegistration(body, opts) {
 	}
 	return {
 		redirectUris,
-		tokenEndpointAuthMethod: "none",
+		tokenEndpointAuthMethod: authMethod,
 		grantTypes,
 		responseTypes,
 		...clientName !== void 0 && { clientName },
@@ -323,9 +384,9 @@ const DEFAULT_MAX_CLIENTS = 1e3;
 /**
 * The RFC 7591 registration operation behind `POST {issuer}/register`
 * (OAUTH.md R2): validate → guard → lazy GC of never-used rows → hard cap →
-* persist. Framework-free — `@aooth/auth-moost`'s controller endpoint is a
-* thin HTTP adapter over `register()`, and non-moost servers can call it
-* directly.
+* mint secret (confidential) → persist. Framework-free — `@aooth/auth-moost`'s
+* controller endpoint is a thin HTTP adapter over `register()`, and non-moost
+* servers can call it directly.
 */
 var DynamicClientRegistration = class {
 	store;
@@ -342,12 +403,28 @@ var DynamicClientRegistration = class {
 		this.validation = opts.validation;
 		this.clock = opts.clock ?? defaultClock;
 	}
-	/** Validate and persist a registration request body; returns the minted client. */
+	/**
+	* Validate and persist a registration request body; returns the minted
+	* client. For a `client_secret_post` registration the returned record
+	* additionally carries the plaintext `clientSecret` (the ONE disclosure —
+	* only its SHA-256 digest is stored).
+	*/
 	async register(body) {
 		const metadata = validateClientRegistration(body, this.validation);
 		await this.guard?.({ metadata });
 		if (this.unusedClientTtlMs !== void 0) await this.store.deleteUnusedBefore(this.clock.now() - this.unusedClientTtlMs);
 		if (await this.store.count() >= this.maxClients) throw new ClientRegistrationError("invalid_client_metadata", "registration limit reached");
+		if (metadata.tokenEndpointAuthMethod === "client_secret_post") {
+			const clientSecret = mintClientSecret();
+			return {
+				...await this.store.create({
+					...metadata,
+					clientSecretHash: hashClientSecret(clientSecret)
+				}),
+				clientSecret,
+				clientSecretExpiresAt: 0
+			};
+		}
 		return this.store.create(metadata);
 	}
 };
@@ -358,13 +435,14 @@ const DEFAULT_DYNAMIC_TOKEN_POLICY = {
 	ttl: 720 * 60 * 6e4
 };
 /**
-* Policy for RFC 7591 dynamically-registered public clients (OAUTH.md R2) on
-* the `ClientRedirectPolicy` seam. `resolveClient` authorizes the client +
+* Policy for RFC 7591 dynamically-registered clients (OAUTH.md R2) on the
+* `ClientRedirectPolicy` seam. `resolveClient` authorizes the client +
 * `redirect_uri` against ITS registered allowlist and resolves the granted
 * scope + token policy; `authenticateClient` re-checks existence at `/token`
-* (`token_endpoint_auth_method: "none"` ⇒ no secret — PKCE is the binding, and
-* a registration garbage-collected mid-flight fails closed). Dynamic clients
-* receive an access token only — NO `id_token` in v1 (OAUTH.md R6).
+* (a registration garbage-collected mid-flight fails closed) and, for a
+* `client_secret_post` registration, validates the presented secret against
+* the stored digest (public `"none"` clients: PKCE is the binding). Dynamic
+* clients receive an access token only — NO `id_token` in v1 (OAUTH.md R6).
 *
 * INVARIANT: the returned {@link ResolvedClient} always carries `clientId`, so
 * the minted code records it and the token endpoint's symmetric client binding
@@ -400,12 +478,16 @@ var DynamicClientPolicy = class {
 	}
 	/**
 	* `/token`-side check: the client must still exist (fail closed when the
-	* registration was deleted/GC'd between authorize and redemption). No secret
-	* is checked — public client, PKCE is the binding; a spurious
-	* `client_secret` is ignored.
+	* registration was deleted/GC'd between authorize and redemption). A client
+	* registered with `token_endpoint_auth_method: "client_secret_post"` must
+	* additionally present its minted `client_secret` (constant-time check
+	* against the stored digest). For a public (`"none"`) client no secret is
+	* checked — PKCE is the binding; a spurious `client_secret` is ignored.
 	*/
 	async authenticateClient(args) {
-		await this.requireClient(args.clientId);
+		const client = await this.requireClient(args.clientId);
+		if (client.tokenEndpointAuthMethod !== "client_secret_post") return;
+		if (client.clientSecretHash === void 0 || args.clientSecret === void 0 || !verifyClientSecret(args.clientSecret, client.clientSecretHash)) throw new AuthorizeError("invalid_client", "client authentication failed");
 	}
 	/** Known-ness probe for `CompositeClientPolicy` dispatch. */
 	async hasClient(clientId) {
@@ -536,7 +618,9 @@ function canonicalizeIssuer(issuer) {
 *
 * Capability fields are fixed to what the server actually implements:
 * `response_types_supported` `["code"]`, `grant_types_supported`
-* `["authorization_code"]`, `code_challenge_methods_supported` `["S256"]`
+* `["authorization_code", "refresh_token"]` (the grant is implemented server-
+* wide; whether a given client's grant mints a refresh token is per-policy —
+* `TokenPolicy.refresh`), `code_challenge_methods_supported` `["S256"]`
 * (PKCE is mandatory — it is the binding for public clients). Optional fields
 * are omitted entirely (no `undefined` keys) so the serialized JSON carries
 * only what was configured.
@@ -551,7 +635,7 @@ function buildAuthorizationServerMetadata(opts) {
 		...opts.registrationEndpoint !== void 0 && { registration_endpoint: opts.registrationEndpoint },
 		...opts.jwksUri !== void 0 && { jwks_uri: opts.jwksUri },
 		response_types_supported: ["code"],
-		grant_types_supported: ["authorization_code"],
+		grant_types_supported: ["authorization_code", "refresh_token"],
 		code_challenge_methods_supported: ["S256"],
 		token_endpoint_auth_methods_supported: authMethods.includes("none") ? authMethods : ["none", ...authMethods],
 		...opts.scopesSupported !== void 0 && { scopes_supported: opts.scopesSupported }
@@ -606,4 +690,4 @@ function buildWwwAuthenticateBearerChallenge(opts) {
 	return params.length === 0 ? "Bearer" : `Bearer ${params.join(", ")}`;
 }
 //#endregion
-export { AuthCodeStore, AuthCodeStoreMemory, AuthorizeError, ClientRegistrationError, CompositeClientPolicy, DEFAULT_PENDING_TTL_MS, DynamicClientPolicy, DynamicClientRegistration, DynamicClientStore, DynamicClientStoreMemory, IdTokenSigner, LoopbackClientPolicy, NoopOidcClaimsResolver, OidcClaimsResolver, PendingAuthorizationStore, PendingAuthorizationStoreMemory, RegisteredClientPolicy, buildAuthorizationServerMetadata, buildProtectedResourceMetadata, buildWwwAuthenticateBearerChallenge, canonicalizeIssuer, isLoopbackRedirectUri, scopeGrants, validateClientRegistration };
+export { AuthCodeStore, AuthCodeStoreMemory, AuthorizeError, ClientRegistrationError, CompositeClientPolicy, DEFAULT_AUTHZ_REFRESH_TTL_MS, DEFAULT_PENDING_TTL_MS, DynamicClientPolicy, DynamicClientRegistration, DynamicClientStore, DynamicClientStoreMemory, IdTokenSigner, LoopbackClientPolicy, NoopOidcClaimsResolver, OidcClaimsResolver, PendingAuthorizationStore, PendingAuthorizationStoreMemory, RegisteredClientPolicy, buildAuthorizationServerMetadata, buildProtectedResourceMetadata, buildWwwAuthenticateBearerChallenge, canonicalizeIssuer, hashClientSecret, isLoopbackRedirectUri, mintClientSecret, scopeGrants, tokenPolicyToIssueOptions, validateClientRegistration, verifyClientSecret };

package/dist/{store-BG6m6oSJ.d.mts → clock-DJ_eroHW.d.cts}

@@ -50,6 +50,34 @@ interface CredentialMetadata {
    * the `listSessions({ kind })` filter. Absent ⇒ an ordinary interactive session.
    */
   credentialKind?: string;
+  /**
+   * OAuth `client_id` this token family was minted for by the authorization
+   * server's token endpoint (`@aooth/auth-moost`'s `AuthorizeController`) —
+   * the binding the `refresh_token` grant enforces: a refresh token redeems
+   * only for the client it was issued to, and a family WITHOUT this stamp
+   * (e.g. a browser session) is never redeemable at the OAuth token endpoint.
+   * Written by the authz tier, carried across rotation like all metadata.
+   */
+  authzClientId?: string;
+  /**
+   * Per-family access-token lifetime in ms — stamped by `issue()` when a
+   * refresh token is minted with a per-mint `ttl` override, and consulted on
+   * every refresh so rotated access tokens keep the authority fixed at mint
+   * time (a 15-min-policy token must not come back as the instance default
+   * after a refresh). Absent ⇒ refresh mints with the instance `accessTtl`.
+   */
+  accessTtl?: number;
+  /**
+   * Per-family rotation semantics — stamped `"always"` by `issue()` whenever a
+   * refresh token is minted via the per-mint `IssueOptions.refresh` object, and
+   * honored by `refresh()` OVER the instance config. Same mint-time-authority
+   * mechanism as {@link accessTtl}: a per-mint family (e.g. an OAuth grant with
+   * a 60-day ceiling) keeps its fixed ceiling even on an instance whose
+   * browser sessions rotate `'sliding'` — rotation must never extend the
+   * grant's lifetime. Absent ⇒ the instance rotation applies (ordinary
+   * sessions are unaffected).
+   */
+  refreshRotation?: "none" | "always" | "sliding";
 }
 /**
  * Persisted state of a credential — the fixed **envelope**. A consumer's
@@ -145,6 +173,14 @@ interface IssueResult {
   accessExpiresAt: number;
   refreshExpiresAt?: number;
 }
+/**
+ * Result of redeeming a refresh token: the fresh pair plus the id of the user
+ * whose family was rotated — the caller (e.g. the OAuth `refresh_token` grant)
+ * presented only an opaque token, so this is where it learns the subject.
+ */
+interface RefreshResult extends IssueResult {
+  userId: string;
+}
 /**
  * Refresh token configuration.
  */
@@ -260,4 +296,17 @@ interface DenylistStore {
   cleanup(): Promise<number>;
 }
 //#endregion
-export { CredentialState as a, RefreshConfig as c, CredentialMetadata as i, SessionEnricher as l, DenylistStore as n, EnrichedSession as o, AuthContext as r, IssueResult as s, CredentialStore as t, SessionInfo as u };
+//#region src/utils/clock.d.ts
+/**
+ * Minimal time abstraction shared across stores and orchestrators.
+ *
+ * Defaults to wall-clock; tests inject a fake clock to deterministically
+ * advance time. Kept tiny (single `now()` method) so any timing primitive
+ * — Date, performance.now-ish, monotonic, etc. — can be plugged in.
+ */
+interface Clock {
+  now(): number;
+}
+declare const defaultClock: Clock;
+//#endregion
+export { AuthContext as a, EnrichedSession as c, RefreshResult as d, SessionEnricher as f, DenylistStore as i, IssueResult as l, defaultClock as n, CredentialMetadata as o, SessionInfo as p, CredentialStore as r, CredentialState as s, Clock as t, RefreshConfig as u };

package/dist/{store-BG6m6oSJ.d.cts → clock-DJ_eroHW.d.mts}

@@ -50,6 +50,34 @@ interface CredentialMetadata {
    * the `listSessions({ kind })` filter. Absent ⇒ an ordinary interactive session.
    */
   credentialKind?: string;
+  /**
+   * OAuth `client_id` this token family was minted for by the authorization
+   * server's token endpoint (`@aooth/auth-moost`'s `AuthorizeController`) —
+   * the binding the `refresh_token` grant enforces: a refresh token redeems
+   * only for the client it was issued to, and a family WITHOUT this stamp
+   * (e.g. a browser session) is never redeemable at the OAuth token endpoint.
+   * Written by the authz tier, carried across rotation like all metadata.
+   */
+  authzClientId?: string;
+  /**
+   * Per-family access-token lifetime in ms — stamped by `issue()` when a
+   * refresh token is minted with a per-mint `ttl` override, and consulted on
+   * every refresh so rotated access tokens keep the authority fixed at mint
+   * time (a 15-min-policy token must not come back as the instance default
+   * after a refresh). Absent ⇒ refresh mints with the instance `accessTtl`.
+   */
+  accessTtl?: number;
+  /**
+   * Per-family rotation semantics — stamped `"always"` by `issue()` whenever a
+   * refresh token is minted via the per-mint `IssueOptions.refresh` object, and
+   * honored by `refresh()` OVER the instance config. Same mint-time-authority
+   * mechanism as {@link accessTtl}: a per-mint family (e.g. an OAuth grant with
+   * a 60-day ceiling) keeps its fixed ceiling even on an instance whose
+   * browser sessions rotate `'sliding'` — rotation must never extend the
+   * grant's lifetime. Absent ⇒ the instance rotation applies (ordinary
+   * sessions are unaffected).
+   */
+  refreshRotation?: "none" | "always" | "sliding";
 }
 /**
  * Persisted state of a credential — the fixed **envelope**. A consumer's
@@ -145,6 +173,14 @@ interface IssueResult {
   accessExpiresAt: number;
   refreshExpiresAt?: number;
 }
+/**
+ * Result of redeeming a refresh token: the fresh pair plus the id of the user
+ * whose family was rotated — the caller (e.g. the OAuth `refresh_token` grant)
+ * presented only an opaque token, so this is where it learns the subject.
+ */
+interface RefreshResult extends IssueResult {
+  userId: string;
+}
 /**
  * Refresh token configuration.
  */
@@ -260,4 +296,17 @@ interface DenylistStore {
   cleanup(): Promise<number>;
 }
 //#endregion
-export { CredentialState as a, RefreshConfig as c, CredentialMetadata as i, SessionEnricher as l, DenylistStore as n, EnrichedSession as o, AuthContext as r, IssueResult as s, CredentialStore as t, SessionInfo as u };
+//#region src/utils/clock.d.ts
+/**
+ * Minimal time abstraction shared across stores and orchestrators.
+ *
+ * Defaults to wall-clock; tests inject a fake clock to deterministically
+ * advance time. Kept tiny (single `now()` method) so any timing primitive
+ * — Date, performance.now-ish, monotonic, etc. — can be plugged in.
+ */
+interface Clock {
+  now(): number;
+}
+declare const defaultClock: Clock;
+//#endregion
+export { AuthContext as a, EnrichedSession as c, RefreshResult as d, SessionEnricher as f, DenylistStore as i, IssueResult as l, defaultClock as n, CredentialMetadata as o, SessionInfo as p, CredentialStore as r, CredentialState as s, Clock as t, RefreshConfig as u };

package/dist/{dynamic-client-store-DLRfntHr.mjs → dynamic-client-store-B1JwFHdP.mjs}

@@ -150,6 +150,7 @@ var DynamicClientStoreMemory = class extends DynamicClientStore {
 			responseTypes: [...rec.responseTypes],
 			createdAt: this.clock.now(),
 			...rec.clientName !== void 0 && { clientName: rec.clientName },
+			...rec.clientSecretHash !== void 0 && { clientSecretHash: rec.clientSecretHash },
 			...rec.scope !== void 0 && { scope: rec.scope }
 		};
 		this.store.set(row.clientId, structuredClone(row));

package/dist/{dynamic-client-store-DzqdUwnw.d.cts → dynamic-client-store-DJgtMjPw.d.mts}

@@ -1,4 +1,5 @@
-import { t as Clock } from "./clock-BjXa0LXb.cjs";
+import { t as Clock } from "./clock-DJ_eroHW.mjs";
+import { r as IssueOptions } from "./auth-credential-C3qebKuy.mjs";
 
 //#region src/authz/token-policy.d.ts
 /**
@@ -24,7 +25,41 @@ interface TokenPolicy {
    * is persisted on the pending-authorization + auth-code records.
    */
   payload?: Record<string, unknown>;
+  /**
+   * Opt-in refresh dimension (OAuth 2.1 `refresh_token` grant): when set, the
+   * token endpoint mints a rotating refresh token alongside the access token
+   * and redeems `grant_type=refresh_token` for the family. `ttl` is the
+   * refresh-token (i.e. grant) lifetime in ms — defaults to
+   * {@link DEFAULT_AUTHZ_REFRESH_TTL_MS} (30 days). Absent ⇒ today's behavior:
+   * access token only, re-consent at expiry.
+   *
+   * Honored only for grants bound to a registered `client_id` (Tier-2 /
+   * dynamic clients) — the family is stamped with `metadata.authzClientId` and
+   * a refresh token redeems only for that client. A clientless (Tier-1
+   * loopback) grant has nothing to bind to, so the flag is IGNORED there.
+   */
+  refresh?: {
+    ttl?: number;
+  };
 }
+/**
+ * Default refresh-token (grant) lifetime for {@link TokenPolicy.refresh} when
+ * no `ttl` is given: 30 days. Deliberately independent of the session tier's
+ * `AuthCredentialOptions.refresh.ttl` — an authz grant's lifetime is the
+ * policy's decision, never inherited from browser-session posture.
+ */
+declare const DEFAULT_AUTHZ_REFRESH_TTL_MS: number;
+/**
+ * Flatten a {@link TokenPolicy} into the `AuthCredential.issue()` options a
+ * token endpoint forwards. The refresh dimension applies only to client-bound
+ * grants — the family is stamped with `metadata.authzClientId`, the binding
+ * the `refresh_token` grant enforces — so a clientless (loopback) grant
+ * ignores `policy.refresh`. `refresh: false` otherwise: an authz mint never
+ * rides the instance-level session refresh config (no orphaned refresh row
+ * for a policy that didn't opt in). Lives HERE, next to the policy type and
+ * its default ttl, so every HTTP adapter applies the same semantics.
+ */
+declare function tokenPolicyToIssueOptions(policy: TokenPolicy, clientId: string | undefined): IssueOptions;
 //#endregion
 //#region src/authz/pending-authorization-store.d.ts
 /**
@@ -239,13 +274,15 @@ declare class AuthCodeStoreMemory extends AuthCodeStore {
 }
 //#endregion
 //#region src/authz/dynamic-client-store.d.ts
+/** Token-endpoint auth methods a dynamic client may register with. */
+type DynamicClientAuthMethod = "none" | "client_secret_post";
 /**
  * One dynamically-registered OAuth client (RFC 7591) — the record behind a
- * connector-style public client that self-registered at `POST /register`.
+ * connector-style client that self-registered at `POST /register`.
  * Everything here is **registrant-supplied** (post-validation) except
- * `clientId` and the timestamps: treat `clientName` as untrusted display text
- * and `redirectUris` as the exact-match delivery allowlist that
- * `DynamicClientPolicy` enforces at `/authorize`.
+ * `clientId`, `clientSecretHash` and the timestamps: treat `clientName` as
+ * untrusted display text and `redirectUris` as the exact-match delivery
+ * allowlist that `DynamicClientPolicy` enforces at `/authorize`.
  */
 interface DynamicClient {
   /** Store-minted opaque client identifier (the DCR response `client_id`). */
@@ -254,8 +291,18 @@ interface DynamicClient {
   clientName?: string;
   /** Validated redirect allowlist — https exact-match entries and/or loopback literals. */
   redirectUris: string[];
-  /** v1 supports public clients only — PKCE is the binding, no secret exists. */
-  tokenEndpointAuthMethod: "none";
+  /**
+   * `"none"` (public — PKCE is the binding) or `"client_secret_post"`
+   * (confidential — a server-minted secret is additionally checked at `/token`).
+   */
+  tokenEndpointAuthMethod: DynamicClientAuthMethod;
+  /**
+   * SHA-256 hex digest of the minted `client_secret` — present iff
+   * `tokenEndpointAuthMethod` is `"client_secret_post"`. The plaintext secret
+   * is returned ONCE in the registration response and never stored; see
+   * `hashClientSecret` / `verifyClientSecret`.
+   */
+  clientSecretHash?: string;
   /** Registered grant types (narrowed to what the server supports). */
   grantTypes: string[];
   /** Registered response types (narrowed to what the server supports). */
@@ -275,7 +322,9 @@ interface DynamicClient {
 interface NewDynamicClient {
   clientName?: string;
   redirectUris: string[];
-  tokenEndpointAuthMethod: "none";
+  tokenEndpointAuthMethod: DynamicClientAuthMethod;
+  /** Digest of the minted secret (confidential clients) — see {@link DynamicClient.clientSecretHash}. */
+  clientSecretHash?: string;
   grantTypes: string[];
   responseTypes: string[];
   scope?: string;
@@ -327,4 +376,4 @@ declare class DynamicClientStoreMemory extends DynamicClientStore {
   deleteUnusedBefore(cutoff: number): Promise<number>;
 }
 //#endregion
-export { TokenPolicy as _, NewDynamicClient as a, AuthCodeStoreMemory as c, DEFAULT_PENDING_TTL_MS as d, NewPendingAuthorization as f, PendingAuthorizationStoreMemoryOptions as g, PendingAuthorizationStoreMemory as h, DynamicClientStoreMemoryOptions as i, AuthCodeStoreMemoryOptions as l, PendingAuthorizationStore as m, DynamicClientStore as n, AuthCode as o, PendingAuthorization as p, DynamicClientStoreMemory as r, AuthCodeStore as s, DynamicClient as t, NewAuthCode as u };
+export { PendingAuthorizationStoreMemoryOptions as _, DynamicClientStoreMemoryOptions as a, tokenPolicyToIssueOptions as b, AuthCodeStore as c, NewAuthCode as d, DEFAULT_PENDING_TTL_MS as f, PendingAuthorizationStoreMemory as g, PendingAuthorizationStore as h, DynamicClientStoreMemory as i, AuthCodeStoreMemory as l, PendingAuthorization as m, DynamicClientAuthMethod as n, NewDynamicClient as o, NewPendingAuthorization as p, DynamicClientStore as r, AuthCode as s, DynamicClient as t, AuthCodeStoreMemoryOptions as u, DEFAULT_AUTHZ_REFRESH_TTL_MS as v, TokenPolicy as y };

package/dist/{dynamic-client-store-oHEsQaJg.d.mts → dynamic-client-store-DbiSLOj0.d.cts}

@@ -1,4 +1,5 @@
-import { t as Clock } from "./clock-BjXa0LXb.mjs";
+import { t as Clock } from "./clock-DJ_eroHW.cjs";
+import { r as IssueOptions } from "./auth-credential-CEijxoGU.cjs";
 
 //#region src/authz/token-policy.d.ts
 /**
@@ -24,7 +25,41 @@ interface TokenPolicy {
    * is persisted on the pending-authorization + auth-code records.
    */
   payload?: Record<string, unknown>;
+  /**
+   * Opt-in refresh dimension (OAuth 2.1 `refresh_token` grant): when set, the
+   * token endpoint mints a rotating refresh token alongside the access token
+   * and redeems `grant_type=refresh_token` for the family. `ttl` is the
+   * refresh-token (i.e. grant) lifetime in ms — defaults to
+   * {@link DEFAULT_AUTHZ_REFRESH_TTL_MS} (30 days). Absent ⇒ today's behavior:
+   * access token only, re-consent at expiry.
+   *
+   * Honored only for grants bound to a registered `client_id` (Tier-2 /
+   * dynamic clients) — the family is stamped with `metadata.authzClientId` and
+   * a refresh token redeems only for that client. A clientless (Tier-1
+   * loopback) grant has nothing to bind to, so the flag is IGNORED there.
+   */
+  refresh?: {
+    ttl?: number;
+  };
 }
+/**
+ * Default refresh-token (grant) lifetime for {@link TokenPolicy.refresh} when
+ * no `ttl` is given: 30 days. Deliberately independent of the session tier's
+ * `AuthCredentialOptions.refresh.ttl` — an authz grant's lifetime is the
+ * policy's decision, never inherited from browser-session posture.
+ */
+declare const DEFAULT_AUTHZ_REFRESH_TTL_MS: number;
+/**
+ * Flatten a {@link TokenPolicy} into the `AuthCredential.issue()` options a
+ * token endpoint forwards. The refresh dimension applies only to client-bound
+ * grants — the family is stamped with `metadata.authzClientId`, the binding
+ * the `refresh_token` grant enforces — so a clientless (loopback) grant
+ * ignores `policy.refresh`. `refresh: false` otherwise: an authz mint never
+ * rides the instance-level session refresh config (no orphaned refresh row
+ * for a policy that didn't opt in). Lives HERE, next to the policy type and
+ * its default ttl, so every HTTP adapter applies the same semantics.
+ */
+declare function tokenPolicyToIssueOptions(policy: TokenPolicy, clientId: string | undefined): IssueOptions;
 //#endregion
 //#region src/authz/pending-authorization-store.d.ts
 /**
@@ -239,13 +274,15 @@ declare class AuthCodeStoreMemory extends AuthCodeStore {
 }
 //#endregion
 //#region src/authz/dynamic-client-store.d.ts
+/** Token-endpoint auth methods a dynamic client may register with. */
+type DynamicClientAuthMethod = "none" | "client_secret_post";
 /**
  * One dynamically-registered OAuth client (RFC 7591) — the record behind a
- * connector-style public client that self-registered at `POST /register`.
+ * connector-style client that self-registered at `POST /register`.
  * Everything here is **registrant-supplied** (post-validation) except
- * `clientId` and the timestamps: treat `clientName` as untrusted display text
- * and `redirectUris` as the exact-match delivery allowlist that
- * `DynamicClientPolicy` enforces at `/authorize`.
+ * `clientId`, `clientSecretHash` and the timestamps: treat `clientName` as
+ * untrusted display text and `redirectUris` as the exact-match delivery
+ * allowlist that `DynamicClientPolicy` enforces at `/authorize`.
  */
 interface DynamicClient {
   /** Store-minted opaque client identifier (the DCR response `client_id`). */
@@ -254,8 +291,18 @@ interface DynamicClient {
   clientName?: string;
   /** Validated redirect allowlist — https exact-match entries and/or loopback literals. */
   redirectUris: string[];
-  /** v1 supports public clients only — PKCE is the binding, no secret exists. */
-  tokenEndpointAuthMethod: "none";
+  /**
+   * `"none"` (public — PKCE is the binding) or `"client_secret_post"`
+   * (confidential — a server-minted secret is additionally checked at `/token`).
+   */
+  tokenEndpointAuthMethod: DynamicClientAuthMethod;
+  /**
+   * SHA-256 hex digest of the minted `client_secret` — present iff
+   * `tokenEndpointAuthMethod` is `"client_secret_post"`. The plaintext secret
+   * is returned ONCE in the registration response and never stored; see
+   * `hashClientSecret` / `verifyClientSecret`.
+   */
+  clientSecretHash?: string;
   /** Registered grant types (narrowed to what the server supports). */
   grantTypes: string[];
   /** Registered response types (narrowed to what the server supports). */
@@ -275,7 +322,9 @@ interface DynamicClient {
 interface NewDynamicClient {
   clientName?: string;
   redirectUris: string[];
-  tokenEndpointAuthMethod: "none";
+  tokenEndpointAuthMethod: DynamicClientAuthMethod;
+  /** Digest of the minted secret (confidential clients) — see {@link DynamicClient.clientSecretHash}. */
+  clientSecretHash?: string;
   grantTypes: string[];
   responseTypes: string[];
   scope?: string;
@@ -327,4 +376,4 @@ declare class DynamicClientStoreMemory extends DynamicClientStore {
   deleteUnusedBefore(cutoff: number): Promise<number>;
 }
 //#endregion
-export { TokenPolicy as _, NewDynamicClient as a, AuthCodeStoreMemory as c, DEFAULT_PENDING_TTL_MS as d, NewPendingAuthorization as f, PendingAuthorizationStoreMemoryOptions as g, PendingAuthorizationStoreMemory as h, DynamicClientStoreMemoryOptions as i, AuthCodeStoreMemoryOptions as l, PendingAuthorizationStore as m, DynamicClientStore as n, AuthCode as o, PendingAuthorization as p, DynamicClientStoreMemory as r, AuthCodeStore as s, DynamicClient as t, NewAuthCode as u };
+export { PendingAuthorizationStoreMemoryOptions as _, DynamicClientStoreMemoryOptions as a, tokenPolicyToIssueOptions as b, AuthCodeStore as c, NewAuthCode as d, DEFAULT_PENDING_TTL_MS as f, PendingAuthorizationStoreMemory as g, PendingAuthorizationStore as h, DynamicClientStoreMemory as i, AuthCodeStoreMemory as l, PendingAuthorization as m, DynamicClientAuthMethod as n, NewDynamicClient as o, NewPendingAuthorization as p, DynamicClientStore as r, AuthCode as s, DynamicClient as t, AuthCodeStoreMemoryOptions as u, DEFAULT_AUTHZ_REFRESH_TTL_MS as v, TokenPolicy as y };

package/dist/{dynamic-client-store-DAStgv2j.cjs → dynamic-client-store-DykM9QOT.cjs}

@@ -150,6 +150,7 @@ var DynamicClientStoreMemory = class extends DynamicClientStore {
 			responseTypes: [...rec.responseTypes],
 			createdAt: this.clock.now(),
 			...rec.clientName !== void 0 && { clientName: rec.clientName },
+			...rec.clientSecretHash !== void 0 && { clientSecretHash: rec.clientSecretHash },
 			...rec.scope !== void 0 && { scope: rec.scope }
 		};
 		this.store.set(row.clientId, structuredClone(row));