@better-auth/oauth-provider 1.7.9 → 1.8.0-beta.0

package/dist/{authorize-D8r6mvZx.mjs → authorize-92EtLsBi.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as claimsRequestParameterSchema, C as clientJwksSchema, D as STANDARD_CLAIM_NAMES, E as STANDARD_CLAIMS, M as getRequestedUserInfoClaims, N as isValidOidcClaimsRequest, O as getSupportedClaims, S as authorizationQuerySchema, _ as logStartupSeedFailure, a as invalidateRefreshFamily, b as ResourceUriSchema, c as normalizeClientCredentialsScopes, d as assertIdentifierValid, f as extractRepeatedResourceFromForm, g as logEnforcePerClientResourcesResolution, h as isAudienceClaimAllowed, j as filterClaimsRequestUserInfoClaims, k as canSatisfyEssentialAcrRequest, l as validateClientCredentialsScopes, m as invalidateResourceCache, o as tokenEndpoint, p as getResource, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as JWS_ALGORITHMS, v as resolveResourcePolicy, w as clientRegistrationRequestSchema, x as SafeUrlSchema, y as seedResourcesOnce } from "./introspect-7WCMPe5Z.mjs";
-import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-DKU5wblX.mjs";
+import { A as getAcrValuesSupported, C as authorizationQuerySchema, D as STANDARD_CLAIMS, F as getRequestedUserInfoClaims, I as isValidOidcClaimsRequest, M as canSatisfyEssentialAcrRequest, N as claimsRequestParameterSchema, O as STANDARD_CLAIM_NAMES, P as filterClaimsRequestUserInfoClaims, S as SafeUrlSchema, T as clientRegistrationRequestSchema, _ as logStartupSeedFailure, a as tokenEndpoint, b as userInfoResource, c as normalizeClientCredentialsScopes, d as JWS_ALGORITHMS, f as assertIdentifierValid, g as logEnforcePerClientResourcesResolution, h as isAudienceClaimAllowed, i as invalidateRefreshFamily, j as resolveAuthenticationContext, k as getSupportedClaims, l as validateClientCredentialsScopes, m as invalidateResourceCache, o as userInfoEndpoint, p as getResource, s as findToken, t as introspectEndpoint, u as getEndpointUrl, v as resolveResourcePolicy, w as clientJwksSchema, x as ResourceUriSchema, y as seedResourcesOnce } from "./introspect-CEo9Q06v.mjs";
+import { $ as validateOAuthProviderExtensions, A as storeClientSecret, E as removePromptFromQuery, F as validateClientCredentials, J as getSupportedGrantTypes, K as getExtensionInteractionRequest, L as verifyOAuthQueryParams, N as toResourceList, O as resolveSubjectIdentifier, Q as validateExtensionClientMetadata, R as applyOAuthProviderMetadataExtensions, S as parsePrompt, T as removeMaxAgeFromQuery, U as getClientDiscoveries, W as getExtensionClientMetadataFields, Y as hasExtensionClientMetadata, Z as isExtensionTokenEndpointAuthMethod, _ as mergeDiscoveryMetadata, a as decryptStoredClientSecret, b as parseBearerToken, c as extractClientCredentials, d as getConsentReferenceId, f as getJwtPlugin, g as isSessionFreshForSignedQuery, h as isPKCERequired, i as consentCovers, j as storeToken, k as searchParamsToQuery, l as findConsent, n as assertNotTrustedClient, o as deriveSectorIdentifier, q as getSupportedAuthMethods, r as clientAllowsGrant, s as destructureCredentials, t as applyFormParams, tt as stripReservedOAuthClientMetadataExtensions, u as getClient, w as readFormParams, x as parseClientMetadata } from "./utils-BMNe8Sg2.mjs";
 import { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-DVUrz-nv.mjs";
+import { t as PACKAGE_VERSION } from "./version-DeABnmP9.mjs";
 import { isBrowserFetchRequest } from "@better-auth/core/utils/fetch-metadata";
 import { isLoopbackHost, isLoopbackIP, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { appendQueryParams } from "@better-auth/core/utils/url";
@@ -11,16 +11,16 @@ import { generateRandomString, makeSignature } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";
 import { logger } from "@better-auth/core/env";
 import * as z from "zod";
-import { defineRequestState, getCurrentAdapter, runWithTransaction } from "@better-auth/core/context";
 import { BetterAuthError } from "@better-auth/core/error";
+import { CLIENT_ASSERTION_TYPE, DPOP_SIGNING_ALGORITHMS, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from "@better-auth/core/oauth2";
+import { defineRequestState, getCurrentAdapter, hasRequestState, runWithTransaction } from "@better-auth/core/context";
 import { deleteSessionCookie, parseSetCookieHeader } from "better-auth/cookies";
 import { mergeSchema } from "better-auth/db";
-import { CLIENT_ASSERTION_TYPE, DPOP_SIGNING_ALGORITHMS, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from "@better-auth/core/oauth2";
 import { createHash } from "@better-auth/utils/hash";
 import { getJwks, stripAccessTokenAuthorizationScheme } from "better-auth/oauth2";
-import { compactVerify, createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
 import { isNativePrivateUseRedirectUri } from "@better-auth/core/utils/redirect-uri";
 import { resolveSigningKey, signJWT, toExpJWT } from "better-auth/plugins";
+import { compactVerify, createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
 import { encodeDeterministicId } from "@better-auth/core/db/internal";
 //#region src/consent.ts
 async function consentEndpoint(ctx, opts, authorize) {
@@ -31,7 +31,7 @@ async function consentEndpoint(ctx, opts, authorize) {
 		error: "invalid_request"
 	});
 	const query = new URLSearchParams(_query);
-	const originalRequestedScopes = query.get("scope")?.split(" ") ?? [];
+	const originalRequestedScopes = query.get("scope")?.split(" ").filter((scope) => scope) ?? [];
 	const supportedClaims = getSupportedClaims(opts);
 	const originalRequestedUserInfoClaims = getRequestedUserInfoClaims(query.get("claims"), supportedClaims);
 	const clientId = query.get("client_id");
@@ -39,7 +39,7 @@ async function consentEndpoint(ctx, opts, authorize) {
 		error_description: "client_id is required",
 		error: "invalid_client"
 	});
-	const requestedScopes = ctx.body.scope?.split(" ");
+	const requestedScopes = ctx.body.scope?.split(" ").filter((scope) => scope);
 	if (requestedScopes) {
 		if (!requestedScopes.every((sc) => originalRequestedScopes?.includes(sc))) throw new APIError("BAD_REQUEST", {
 			error_description: "Scope not originally requested",
@@ -52,11 +52,25 @@ async function consentEndpoint(ctx, opts, authorize) {
 		error_description: "Claim not originally requested",
 		error: "invalid_request"
 	});
-	if (!(ctx.body.accept === true)) return {
-		redirect: true,
-		url: formatErrorURL(query.get("redirect_uri") ?? "", "access_denied", "User denied access", query.get("state") ?? void 0, getIssuer(ctx, opts))
-	};
 	const session = await getSessionFromCtx(ctx);
+	if (!(ctx.body.accept === true)) {
+		const interaction = getExtensionInteractionRequest(opts, searchParamsToQuery(query));
+		if (interaction) return {
+			redirect: true,
+			url: await interaction.handler.deny({
+				ctx,
+				value: interaction.value,
+				userId: session?.user.id
+			}).catch((error) => getAPIErrorURL(ctx, error, interaction.handler.errorPage?.({
+				ctx,
+				value: interaction.value
+			})))
+		};
+		return {
+			redirect: true,
+			url: formatErrorURL(query.get("redirect_uri") ?? "", "access_denied", "User denied access", query.get("state") ?? void 0, getIssuer(ctx, opts))
+		};
+	}
 	const hasLoginPrompt = parsePrompt(query.get("prompt") ?? "").has("login");
 	const hasSatisfiedLoginPrompt = hasLoginPrompt && isSessionFreshForSignedQuery(session?.session.createdAt, oauthRequest?.signedQueryIssuedAt);
 	if (hasLoginPrompt && !hasSatisfiedLoginPrompt) {
@@ -64,28 +78,12 @@ async function consentEndpoint(ctx, opts, authorize) {
 		ctx.query = searchParamsToQuery(query);
 		return await authorize(ctx);
 	}
-	const referenceId = await opts.postLogin?.consentReferenceId?.({
+	const referenceId = await getConsentReferenceId(opts, {
 		user: session?.user,
 		session: session?.session,
 		scopes: requestedScopes ?? originalRequestedScopes
 	});
-	const foundConsent = await ctx.context.adapter.findOne({
-		model: "oauthConsent",
-		where: [
-			{
-				field: "clientId",
-				value: clientId
-			},
-			{
-				field: "userId",
-				value: session?.user.id
-			},
-			...referenceId ? [{
-				field: "referenceId",
-				value: referenceId
-			}] : []
-		]
-	});
+	const foundConsent = await findConsent(ctx, clientId, session?.user.id, referenceId);
 	const iat = Math.floor(Date.now() / 1e3);
 	const resource = query.getAll("resource");
 	const consent = {
@@ -130,7 +128,10 @@ async function consentEndpoint(ctx, opts, authorize) {
 		authorizationQuery = removeMaxAgeFromQuery(authorizationQuery);
 	}
 	ctx.query = searchParamsToQuery(authorizationQuery);
-	return await authorize(ctx, { postLogin: oauthRequest?.postLoginClearedForSession !== void 0 && oauthRequest.postLoginClearedForSession === session?.session.id });
+	return await authorize(ctx, {
+		postLogin: oauthRequest?.postLoginClearedForSession !== void 0 && oauthRequest.postLoginClearedForSession === session?.session.id,
+		consentAccepted: true
+	});
 }
 //#endregion
 //#region src/continue.ts
@@ -186,6 +187,7 @@ const BACKCHANNEL_LOGOUT_EVENT_URI = "http://schemas.openid.net/event/backchanne
 const LOGOUT_TOKEN_JWT_TYP = "logout+jwt";
 const LOGOUT_TOKEN_LIFETIME_SECONDS = 120;
 const BACKCHANNEL_DISPATCH_TIMEOUT_MS = 5e3;
+const FRONTCHANNEL_LOGOUT_TIMEOUT_MS = 3e3;
 /**
 * Signs a Back-Channel Logout Token per OIDC Back-Channel Logout 1.0 §2.4.
 *
@@ -227,11 +229,12 @@ async function signLogoutToken(ctx, options, resolvedKey, claims) {
 * Token revocation runs regardless of the JWT plugin (refresh-token revocation
 * has no dependency on signing). Only Logout Token delivery needs the JWT
 * plugin, so a plan may contain token identifiers with no delivery targets.
+* Front-channel URIs sign nothing and are planned in either mode.
 *
 * Returns `null` when there is nothing to do, so the caller can skip the
 * background handoff entirely.
 */
-async function prepareBackchannelLogoutPlan(ctx, opts, input) {
+async function prepareSessionLogoutPlan(ctx, opts, input) {
 	const { sessionId, userId } = input;
 	if (!userId) return null;
 	const logger = ctx.context.logger;
@@ -263,24 +266,38 @@ async function prepareBackchannelLogoutPlan(ctx, opts, input) {
 		const accessToRevokeIds = accessTokens.filter((t) => !t.revoked).map((t) => t.id);
 		const refreshToRevokeIds = refreshTokens.filter((t) => !t.revoked && !t.scopes?.includes("offline_access")).map((t) => t.id);
 		const eligibleClients = opts.disableJwtPlugin ? [] : clients.filter((c) => Boolean(c.backchannelLogoutUri) && !c.disabled);
+		const backchannelTargets = (await Promise.all(eligibleClients.map(async (client) => {
+			try {
+				return {
+					client,
+					sub: await resolveSubjectIdentifier(userId, client, opts)
+				};
+			} catch (error) {
+				logger.warn(`back-channel logout: unable to resolve subject for client ${client.clientId}`, error);
+				return null;
+			}
+		}))).filter((target) => target !== null);
+		const issuer = getIssuer(ctx, opts);
 		return {
 			accessTokenIds: accessToRevokeIds,
 			refreshTokenIds: refreshToRevokeIds,
 			sessionId,
-			targets: (await Promise.all(eligibleClients.map(async (client) => {
+			backchannelTargets,
+			frontchannelLogoutUris: clients.flatMap((client) => {
+				if (!client.frontchannelLogoutUri || client.disabled) return [];
 				try {
-					return {
-						client,
-						sub: await resolveSubjectIdentifier(userId, client, opts)
-					};
+					const uri = new URL(client.frontchannelLogoutUri);
+					uri.searchParams.set("iss", issuer);
+					uri.searchParams.set("sid", sessionId);
+					return [uri.toString()];
 				} catch (error) {
-					logger.warn(`back-channel logout: unable to resolve subject for client ${client.clientId}`, error);
-					return null;
+					logger.warn(`front-channel logout: invalid frontchannel_logout_uri for client ${client.clientId}`, error);
+					return [];
 				}
-			}))).filter((target) => target !== null)
+			})
 		};
 	} catch (error) {
-		logger.error("back-channel logout planning failed", error);
+		logger.error("logout planning failed", error);
 		return null;
 	}
 }
@@ -289,7 +306,7 @@ async function prepareBackchannelLogoutPlan(ctx, opts, input) {
 * `session.delete.after` after the row is consumed and, for transactional
 * callers, only after the transaction commits.
 */
-async function applyBackchannelLogoutPlan(ctx, plan) {
+async function applySessionLogoutPlan(ctx, plan) {
 	const revokedAt = /* @__PURE__ */ new Date();
 	const adapter = await getCurrentAdapter(ctx.context.adapter);
 	const revocations = await Promise.allSettled([plan.accessTokenIds.length > 0 ? adapter.updateMany({
@@ -310,7 +327,7 @@ async function applyBackchannelLogoutPlan(ctx, plan) {
 		update: { revoked: revokedAt }
 	}) : Promise.resolve()]);
 	for (const result of revocations) if (result.status === "rejected") ctx.context.logger.error("back-channel logout: token revocation update failed", result.reason);
-	if (plan.targets.length > 0) await deliverBackchannelLogoutTokens(ctx, plan);
+	if (plan.backchannelTargets.length > 0) await deliverBackchannelLogoutTokens(ctx, plan);
 }
 /**
 * Asynchronous phase: sign one Logout Token per target client and POST it to
@@ -331,7 +348,7 @@ async function deliverBackchannelLogoutTokens(ctx, plan) {
 	const iat = Math.floor(Date.now() / 1e3);
 	const exp = iat + LOGOUT_TOKEN_LIFETIME_SECONDS;
 	const resolvedKey = jwtPluginOptions?.jwt?.sign ? null : await resolveSigningKey(ctx, jwtPluginOptions);
-	await Promise.allSettled(plan.targets.map(async ({ client, sub }) => {
+	await Promise.allSettled(plan.backchannelTargets.map(async ({ client, sub }) => {
 		try {
 			const jti = generateRandomString(32, "a-z", "A-Z", "0-9");
 			const token = await signLogoutToken(ctx, jwtPluginOptions, resolvedKey, {
@@ -359,6 +376,30 @@ async function deliverBackchannelLogoutTokens(ctx, plan) {
 		}
 	}));
 }
+/**
+* Front-channel logout URIs collected from sessions deleted during the current
+* request. `session.delete.after` records them only once the deletion has
+* committed, so a vetoed or rolled-back delete never reaches the logout page.
+*/
+const frontchannelLogoutUrisState = defineRequestState(() => []);
+/**
+* Records a committed plan's front-channel URIs for the logout page of the
+* current request. Deletions outside a request (no browser to render iframes)
+* have nowhere to deliver them, so they are dropped.
+*/
+async function recordFrontchannelLogoutUris(uris) {
+	if (uris.length === 0 || !await hasRequestState()) return;
+	const recorded = await frontchannelLogoutUrisState.get();
+	await frontchannelLogoutUrisState.set([...recorded, ...uris]);
+}
+/**
+* Returns and clears the front-channel URIs recorded during this request.
+*/
+async function takeFrontchannelLogoutUris() {
+	const recorded = await frontchannelLogoutUrisState.get();
+	await frontchannelLogoutUrisState.set([]);
+	return recorded;
+}
 const LOGOUT_CONFIRMATION_TTL_SECONDS = 300;
 const LOGOUT_CONFIRMATION_COOKIE_SUFFIX = ".oauth_logout_confirmation";
 function escapeHtml(value) {
@@ -379,14 +420,16 @@ function isBrowserNavigation(ctx) {
 	const accept = headers.get("accept") ?? "";
 	return headers.get("sec-fetch-mode") === "navigate" || accept.includes("text/html") || accept.includes("application/xhtml+xml");
 }
-function logoutPage(title, body, status = 200) {
-	return new Response(`<!doctype html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title></head><body>${body}</body></html>`, {
+const LOGOUT_PAGE_CSP = "default-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'";
+function logoutPage(title, body, status = 200, page = {}) {
+	return new Response(`<!doctype html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title>${page.head ?? ""}</head><body>${body}</body></html>`, {
 		status,
 		headers: {
 			"cache-control": "no-store",
-			"content-security-policy": "default-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+			"content-security-policy": page.contentSecurityPolicy ?? LOGOUT_PAGE_CSP,
 			"content-type": "text/html; charset=utf-8",
 			pragma: "no-cache",
+			"referrer-policy": "no-referrer",
 			"x-content-type-options": "nosniff"
 		}
 	});
@@ -407,6 +450,53 @@ function logoutConfirmationPage(ctx) {
 function logoutSuccessPage(note) {
 	return logoutPage("Logged out", `<main><p data-oidc-logout-state="logged-out">${note ? `Logged out. ${escapeHtml(note)}` : "Logged out."}</p></main>`);
 }
+const FRONTCHANNEL_LOGOUT_SCRIPT = `(function () {
+	var status = document.querySelector("[data-oidc-logout-state]");
+	var redirectUri = status.getAttribute("data-post-logout-redirect-uri");
+	var frames = document.querySelectorAll("iframe");
+	var pending = frames.length;
+	var finished = false;
+	function finish() {
+		if (finished) return;
+		finished = true;
+		if (redirectUri) {
+			window.location.replace(redirectUri);
+			return;
+		}
+		status.setAttribute("data-oidc-logout-state", "logged-out");
+		status.textContent = status.getAttribute("data-logged-out-message");
+	}
+	function settle() {
+		pending -= 1;
+		if (pending <= 0) finish();
+	}
+	for (var i = 0; i < frames.length; i++) {
+		frames[i].addEventListener("load", settle);
+		frames[i].addEventListener("error", settle);
+	}
+	setTimeout(finish, ${FRONTCHANNEL_LOGOUT_TIMEOUT_MS});
+})();`;
+let frontchannelLogoutScriptHash;
+/**
+* OIDC Front-Channel Logout 1.0 §3 logout page: one hidden iframe per relying
+* party, then a redirect to the verified `post_logout_redirect_uri` or a
+* logged-out message. The OP session has already ended when this renders.
+* Without JavaScript the iframes still load, and a meta refresh performs the
+* redirect.
+*/
+async function frontchannelLogoutPage(uris, redirect) {
+	frontchannelLogoutScriptHash ??= createHash("SHA-256", "base64").digest(FRONTCHANNEL_LOGOUT_SCRIPT);
+	const scriptHash = await frontchannelLogoutScriptHash;
+	const frameOrigins = [...new Set(uris.map((uri) => new URL(uri).origin))];
+	const loggedOutMessage = redirect.note ? `Logged out. ${redirect.note}` : "Logged out.";
+	const iframes = uris.map((uri) => `<iframe hidden src="${escapeHtml(uri)}"></iframe>`).join("");
+	const redirectAttribute = redirect.uri ? ` data-post-logout-redirect-uri="${escapeHtml(redirect.uri)}"` : "";
+	const noscript = redirect.uri ? `<noscript><a href="${escapeHtml(redirect.uri)}">Continue</a></noscript>` : `<noscript><p>${escapeHtml(loggedOutMessage)}</p></noscript>`;
+	return logoutPage("Signing out", `<main><p data-oidc-logout-state="pending" data-logged-out-message="${escapeHtml(loggedOutMessage)}"${redirectAttribute}>Signing out of connected applications&hellip;</p>${noscript}</main>${iframes}<script>${FRONTCHANNEL_LOGOUT_SCRIPT}<\/script>`, 200, {
+		head: redirect.uri ? `<noscript><meta http-equiv="refresh" content="${Math.ceil(FRONTCHANNEL_LOGOUT_TIMEOUT_MS / 1e3)};url=${escapeHtml(redirect.uri)}"></noscript>` : void 0,
+		contentSecurityPolicy: `${LOGOUT_PAGE_CSP}; frame-src ${frameOrigins.join(" ")}; script-src 'sha256-${scriptHash}'`
+	});
+}
 function logoutErrorPage(description, status) {
 	return logoutPage("Logout error", `<main><h1>Logout error</h1><p data-oidc-logout-state="error">${escapeHtml(description)}</p></main>`, status);
 }
@@ -604,6 +694,22 @@ async function confirmationRequired(ctx, currentSession, confirmation = {}) {
 	await setLogoutConfirmationState(ctx, currentSession.session.id, confirmation);
 	return logoutConfirmationPage(ctx);
 }
+const UNREGISTERED_REDIRECT_NOTE = "The requested post-logout redirect was not registered.";
+/**
+* Response once the session has ended. A browser navigation renders the
+* front-channel logout page when relying parties must be notified; otherwise
+* the caller gets the verified redirect, the success page, or an empty result.
+*/
+async function loggedOutResponse(ctx, redirect) {
+	const note = redirect.invalid ? UNREGISTERED_REDIRECT_NOTE : void 0;
+	const frontchannelLogoutUris = await takeFrontchannelLogoutUris();
+	if (frontchannelLogoutUris.length > 0 && isBrowserNavigation(ctx)) return frontchannelLogoutPage(frontchannelLogoutUris, {
+		uri: redirect.uri,
+		note
+	});
+	if (redirect.uri) return handleRedirect(ctx, redirect.uri);
+	return isBrowserNavigation(ctx) ? logoutSuccessPage(note) : null;
+}
 async function completeConfirmedLogout(ctx, opts) {
 	const state = await getLogoutConfirmationState(ctx);
 	const currentSession = await getCurrentBrowserSession(ctx);
@@ -612,14 +718,13 @@ async function completeConfirmedLogout(ctx, opts) {
 	if (!currentSession) {
 		clearLogoutConfirmationState(ctx);
 		if (redirect.uri) return handleRedirect(ctx, redirect.uri);
-		return isBrowserNavigation(ctx) ? logoutSuccessPage(redirect.invalid ? "The requested post-logout redirect was not registered." : void 0) : logoutProtocolError(ctx, "BAD_REQUEST", "invalid_request", "No active session is available for logout");
+		return isBrowserNavigation(ctx) ? logoutSuccessPage(redirect.invalid ? UNREGISTERED_REDIRECT_NOTE : void 0) : logoutProtocolError(ctx, "BAD_REQUEST", "invalid_request", "No active session is available for logout");
 	}
 	if (state.sessionId && state.sessionId !== currentSession.session.id) return logoutProtocolError(ctx, "BAD_REQUEST", "invalid_request", "The logout confirmation is invalid or expired");
 	await deleteLogoutSession(ctx, currentSession.session);
 	deleteSessionCookie(ctx);
 	clearLogoutConfirmationState(ctx);
-	if (redirect.uri) return handleRedirect(ctx, redirect.uri);
-	return isBrowserNavigation(ctx) ? logoutSuccessPage(redirect.invalid ? "The requested post-logout redirect was not registered." : void 0) : null;
+	return loggedOutResponse(ctx, redirect);
 }
 /**
 * RP-Initiated Logout (OIDC RP-Initiated Logout 1.0). The RP presents a signed
@@ -630,7 +735,9 @@ async function completeConfirmedLogout(ctx, opts) {
 *
 * Session termination goes through `internalAdapter.deleteSession`, which fires
 * `session.delete.after` so the hook drives revocation and back-channel
-* notifications to every RP with tokens on the session.
+* notifications to every RP with tokens on the session. When the browser
+* navigates here, RPs with a `frontchannel_logout_uri` are then notified
+* through hidden iframes before the redirect.
 *
 * @see https://openid.net/specs/openid-connect-rpinitiated-1_0.html
 */
@@ -674,8 +781,7 @@ async function rpInitiatedLogoutEndpoint(ctx, opts) {
 	if (sessionToDelete) await deleteLogoutSession(ctx, sessionToDelete);
 	if (matchesCurrentSession) deleteSessionCookie(ctx);
 	clearLogoutConfirmationState(ctx);
-	if (redirect.uri) return handleRedirect(ctx, redirect.uri);
-	return isBrowserNavigation(ctx) ? logoutSuccessPage(redirect.invalid ? "The requested post-logout redirect was not registered." : void 0) : null;
+	return loggedOutResponse(ctx, redirect);
 }
 /**
 * Completes the browser confirmation flow for RP-Initiated Logout. This route
@@ -729,7 +835,9 @@ function authServerMetadata(ctx, opts, overrides) {
 		authorization_response_iss_parameter_supported: true,
 		dpop_signing_alg_values_supported: overrides?.dpop_signing_alg_values_supported ?? [...DPOP_SIGNING_ALGORITHMS],
 		backchannel_logout_supported: backchannelSupported,
-		backchannel_logout_session_supported: backchannelSupported
+		backchannel_logout_session_supported: backchannelSupported,
+		frontchannel_logout_supported: true,
+		frontchannel_logout_session_supported: true
 	};
 }
 /**
@@ -772,7 +880,7 @@ function oidcServerMetadata(ctx, opts) {
 		claims_parameter_supported: true,
 		userinfo_endpoint: `${baseURL}/oauth2/userinfo`,
 		subject_types_supported: opts.pairwiseSecret ? ["public", "pairwise"] : ["public"],
-		acr_values_supported: ["0"],
+		acr_values_supported: getAcrValuesSupported(opts),
 		id_token_signing_alg_values_supported: (() => {
 			if (opts.disableJwtPlugin) return ["HS256"];
 			const primary = jwtPluginOptions?.jwks?.keyPairConfig?.alg ?? "EdDSA";
@@ -846,7 +954,8 @@ const oauthProviderOpenIdConfigMetadata = (auth, opts) => {
 *
 * A failing issue is routed by its first path segment via `errorCodesByField`:
 * - missing required (`invalid_type` + "received undefined") → `.missing`
-* - unsupported value (`invalid_value`) → `.invalid`
+* - unsupported value (`invalid_value`) or a value a refinement rejected
+*   (`custom`, also inside a union branch) → `.invalid`
 * - anything else (wrong type, duplicated params, bad format) → `defaultError`
 *
 * For enum fields that need to distinguish missing from unsupported, compose
@@ -855,16 +964,19 @@ const oauthProviderOpenIdConfigMetadata = (auth, opts) => {
 * enum value.
 */
 function createOAuthEndpoint(path, options, handler) {
-	const { redirectOnError, onValidationError: userHook, errorCodesByField, defaultError = "invalid_request", ...rest } = options;
-	if (!redirectOnError) return createAuthEndpoint(path, {
-		...rest,
-		onValidationError: async (args) => {
-			if (userHook) await userHook(args);
-			throw new APIError$1("BAD_REQUEST", { ...mapIssuesToOAuthError(args.issues, errorCodesByField, defaultError) });
-		}
-	}, handler);
-	const redirect = redirectOnError;
+	const { redirectOnError, onValidationError: userHook, errorCodesByField, defaultError = "invalid_request", formParams, ...rest } = options;
+	if (!redirectOnError && !formParams) {
+		const noStore = rest.metadata?.noStore === true;
+		return createAuthEndpoint(path, {
+			...rest,
+			onValidationError: async (args) => {
+				if (userHook) await userHook(args);
+				throw new APIError$1("BAD_REQUEST", mapIssuesToOAuthError(args.issues, errorCodesByField, defaultError), noStore ? NO_STORE_HEADERS : void 0);
+			}
+		}, handler);
+	}
 	const { body: bodySchema, query: querySchema, ...forwarded } = rest;
+	if (formParams) forwarded.cloneRequest = true;
 	async function validateSlot(ctx, slot, schema) {
 		if (!schema) return { ok: true };
 		const result = await schema.safeParseAsync(ctx[slot] ?? {});
@@ -876,15 +988,19 @@ function createOAuthEndpoint(path, options, handler) {
 			message: result.error.message,
 			issues: result.error.issues
 		});
+		const error = mapIssuesToOAuthError(result.error.issues, errorCodesByField, defaultError);
+		if (!redirectOnError) throw new APIError$1("BAD_REQUEST", error);
 		return {
 			ok: false,
-			response: redirect({
-				...mapIssuesToOAuthError(result.error.issues, errorCodesByField, defaultError),
+			response: redirectOnError({
+				...error,
 				ctx
 			})
 		};
 	}
 	return createAuthEndpoint(path, forwarded, async (ctx) => {
+		const form = formParams && ctx.request ? await readFormParams(ctx.request) : void 0;
+		if (form) ctx.body = applyFormParams(form, ctx.body ?? {}, formParams?.repeatable);
 		const body = await validateSlot(ctx, "body", bodySchema);
 		if (!body.ok) return body.response;
 		const query = await validateSlot(ctx, "query", querySchema);
@@ -902,18 +1018,32 @@ function mapIssuesToOAuthError(issues, errorCodesByField, defaultError = "invali
 	const fieldKey = typeof first === "string" ? first : void 0;
 	const mapping = fieldKey ? errorCodesByField?.[fieldKey] : void 0;
 	const field = issue.path?.length ? z.core.toDotPath(issue.path) : "";
+	const invalidValue = findInvalidValueIssue(issue);
 	return {
-		error: resolveErrorCode(issue, mapping, defaultError),
-		error_description: describeIssue(issue, field)
+		error: resolveErrorCode(issue, invalidValue, mapping, defaultError),
+		error_description: describeIssue(invalidValue ?? issue, field)
 	};
 }
-function resolveErrorCode(issue, mapping, defaultError) {
+function resolveErrorCode(issue, invalidValue, mapping, defaultError) {
 	if (typeof mapping === "string") return mapping;
 	if (isMissingValueIssue(issue)) return mapping?.missing ?? defaultError;
-	if (issue.code === "invalid_value") return mapping?.invalid ?? defaultError;
+	if (invalidValue) return mapping?.invalid ?? defaultError;
 	return defaultError;
 }
 /**
+* Returns the issue that routes to `errorCodesByField[field].invalid`: an
+* unsupported enum value, or a value of the expected type that a refinement
+* rejected, such as a resource URI with a fragment. A union reports a
+* refinement failure as `invalid_union`, so its branches are searched too.
+*/
+function findInvalidValueIssue(issue) {
+	if (issue.code === "invalid_value" || issue.code === "custom") return issue;
+	if (issue.code === "invalid_union") for (const branch of issue.errors) {
+		const rejected = branch.find((nested) => nested.code === "custom");
+		if (rejected) return rejected;
+	}
+}
+/**
 * Returns `true` for issues that represent an absent required value. Zod v4
 * strips `input` from published issues, so the signal is the `invalid_type`
 * code combined with a message suffix of "received undefined". The suffix is
@@ -1032,136 +1162,16 @@ function validatePublicClientJwks(input) {
 		jwks: { keys }
 	};
 }
-//#endregion
-//#region src/client-metadata.ts
-const OAUTH_CLIENT_RECORD_FIELD_NAMES = Object.freeze(Object.keys({
-	clientId: true,
-	clientSecret: true,
-	clientDiscoveryId: true,
-	disabled: true,
-	scopes: true,
-	clientCredentialsScopes: true,
-	userId: true,
-	createdAt: true,
-	updatedAt: true,
-	expiresAt: true,
-	name: true,
-	uri: true,
-	icon: true,
-	contacts: true,
-	tos: true,
-	policy: true,
-	softwareId: true,
-	softwareVersion: true,
-	softwareStatement: true,
-	redirectUris: true,
-	postLogoutRedirectUris: true,
-	backchannelLogoutUri: true,
-	backchannelLogoutSessionRequired: true,
-	tokenEndpointAuthMethod: true,
-	grantTypes: true,
-	responseTypes: true,
-	applicationType: true,
-	jwks: true,
-	jwksUri: true,
-	requirePKCE: true,
-	dpopBoundAccessTokens: true,
-	skipConsent: true,
-	enableEndSession: true,
-	subjectType: true,
-	referenceId: true,
-	metadata: true
-}));
 /**
-* Canonical wire fields emitted by schemaToOAuth. They are mapped explicitly
-* and therefore must never also survive inside the opaque metadata envelope.
+* Throws `invalid_client_metadata` unless `jwks` is a public JWK Set that
+* {@link validatePublicClientJwks} accepts.
 */
-const OAUTH_CLIENT_WIRE_FIELD_NAMES = [
-	"client_id",
-	"client_secret",
-	"client_secret_expires_at",
-	"scope",
-	"user_id",
-	"client_id_issued_at",
-	"client_name",
-	"client_uri",
-	"logo_uri",
-	"contacts",
-	"tos_uri",
-	"policy_uri",
-	"jwks",
-	"jwks_uri",
-	"software_id",
-	"software_version",
-	"software_statement",
-	"redirect_uris",
-	"post_logout_redirect_uris",
-	"backchannel_logout_uri",
-	"backchannel_logout_session_required",
-	"token_endpoint_auth_method",
-	"grant_types",
-	"response_types",
-	"application_type",
-	"disabled",
-	"skip_consent",
-	"enable_end_session",
-	"require_pkce",
-	"dpop_bound_access_tokens",
-	"subject_type",
-	"reference_id"
-];
-const OPAQUE_METADATA_RESERVED_FIELDS = new Set([
-	...OAUTH_CLIENT_RECORD_FIELD_NAMES,
-	...OAUTH_CLIENT_WIRE_FIELD_NAMES,
-	"public",
-	"type",
-	"resources",
-	"client_credentials_scopes"
-]);
-const CIMD_FORBIDDEN_SERVER_FIELD_NAMES = new Set([
-	"disabled",
-	"client_secret",
-	"client_secret_expires_at",
-	"client_id_issued_at",
-	"skip_consent",
-	"enable_end_session",
-	"require_pkce",
-	"reference_id",
-	"user_id",
-	"resources",
-	"clientSecret",
-	"clientDiscoveryId",
-	"skipConsent",
-	"enableEndSession",
-	"requirePKCE",
-	"referenceId",
-	"userId",
-	"clientId",
-	"applicationType",
-	"tokenEndpointAuthMethod",
-	"redirectUris",
-	"postLogoutRedirectUris",
-	"grantTypes",
-	"responseTypes",
-	"scopes",
-	"expiresAt",
-	"createdAt",
-	"updatedAt",
-	"softwareId",
-	"softwareVersion",
-	"softwareStatement",
-	"backchannelLogoutUri",
-	"backchannelLogoutSessionRequired",
-	"jwksUri",
-	"dpopBoundAccessTokens",
-	"subjectType"
-]);
-function isForbiddenCimdClientMetadataField(field) {
-	return CIMD_FORBIDDEN_SERVER_FIELD_NAMES.has(field);
-}
-function stripReservedOAuthClientMetadataExtensions(metadata) {
-	if (!metadata) return void 0;
-	return Object.fromEntries(Object.entries(metadata).filter(([field]) => !OPAQUE_METADATA_RESERVED_FIELDS.has(field)));
+function assertValidClientJwks(jwks) {
+	const result = validatePublicClientJwks(jwks);
+	if (!result.valid) throw new APIError("BAD_REQUEST", {
+		error: "invalid_client_metadata",
+		error_description: result.error
+	});
 }
 //#endregion
 //#region src/oauthClient/privileges.ts
@@ -1492,8 +1502,20 @@ async function consumeClientAssertion(ctx, opts, params) {
 * Validates: signature, iss=client_id, sub=client_id, aud=the endpoint serving
 * the assertion or the normalized OP issuer, exp, assertion max lifetime,
 * jti uniqueness (replay prevention).
+*
+* Returns the client record the signature was checked against, so a caller that
+* mutates the client can guard its write on exactly that snapshot.
+*
+* With `endpointAudienceOnly`, the issuer is not an accepted audience, so only
+* an assertion whose `aud` includes `expectedAudience` verifies. Endpoints that
+* change client credentials use it, so an assertion minted for the token
+* endpoint or the issuer cannot be redirected to them.
+*
+* `assertClient` runs on the looked-up client before any key is fetched or the
+* jti is consumed, so a caller can refuse a client it does not serve without
+* spending the assertion or reaching out to a `jwks_uri`.
 */
-async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertionType, clientIdHint, expectedAudience) {
+async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertionType, clientIdHint, expectedAudience, options) {
 	if (clientAssertionType !== CLIENT_ASSERTION_TYPE) throw new APIError$1("BAD_REQUEST", {
 		error_description: "unsupported client_assertion_type",
 		error: "invalid_client"
@@ -1531,7 +1553,7 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 	});
 	const client = await getClient(ctx, opts, clientId);
 	if (!client) throw new APIError$1("BAD_REQUEST", {
-		error_description: "unknown client",
+		error_description: "client not found",
 		error: "invalid_client"
 	});
 	if (client.disabled) throw new APIError$1("BAD_REQUEST", {
@@ -1542,10 +1564,11 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 		error_description: "client is not registered for private_key_jwt authentication",
 		error: "invalid_client"
 	});
+	options?.assertClient?.(client);
 	const jwks = await fetchClientJwks(ctx, opts, client);
 	const endpointAudience = expectedAudience ?? `${ctx.context.baseURL}/oauth2/token`;
 	const issuerAudience = getIssuer(ctx, opts);
-	const acceptedAudiences = [...new Set([endpointAudience, issuerAudience])];
+	const acceptedAudiences = options?.endpointAudienceOnly ? [endpointAudience] : [...new Set([endpointAudience, issuerAudience])];
 	const verifyOpts = {
 		issuer: clientId,
 		subject: clientId,
@@ -1581,7 +1604,10 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 		payload,
 		expectedAudience: acceptedAudience
 	});
-	return { clientId };
+	return {
+		clientId,
+		client
+	};
 }
 //#endregion
 //#region src/utils/initial-access-token.ts
@@ -1659,6 +1685,21 @@ function resolveRegistrationResponseTypes(client, grantTypes) {
 	if (client.response_types) return client.response_types;
 	return grantTypes.includes("authorization_code") ? ["code"] : void 0;
 }
+/**
+* The requested grants this server supports. Clients such as MCP connectors
+* send one grant union to every server, so a metadata document or a dynamic
+* registration may list grants this server does not issue. Throws when the
+* request shares no grant with the server.
+*/
+function resolveMutuallySupportedGrantTypes(opts, grantTypes) {
+	const supportedGrantTypes = new Set(getSupportedGrantTypes(opts));
+	const mutualGrantTypes = grantTypes.filter((grantType) => supportedGrantTypes.has(grantType));
+	if (mutualGrantTypes.length === 0) throw new APIError("BAD_REQUEST", {
+		error: "invalid_client_metadata",
+		error_description: `no mutually supported grant_type among ${grantTypes.join(", ")}`
+	});
+	return mutualGrantTypes;
+}
 function applyOAuthClientRegistrationDefaults(client, defaultApplicationType = "web") {
 	const grantTypes = resolveRegistrationGrantTypes(client);
 	return {
@@ -1684,15 +1725,15 @@ function isNonHttpRedirectUri(redirectUri) {
 /**
 * Server-owned default for dynamic registrations that omit `application_type`.
 * `"infer"` classifies as native when any redirect URI uses a non-http(s)
-* scheme, because a web client can never register one. Every URI is then
-* validated against the native rules. A sent `application_type` is never
-* overridden because `applyOAuthClientRegistrationDefaults` only fills the
-* absent field.
+* scheme or http on an exact loopback host, because a web client can never
+* register either. Every URI is then validated against the native rules. A
+* sent `application_type` is never overridden because
+* `applyOAuthClientRegistrationDefaults` only fills the absent field.
 */
 function resolveDynamicRegistrationDefaultApplicationType(opts, client) {
 	const configured = opts.clientRegistrationDefaultApplicationType ?? "web";
 	if (configured !== "infer") return configured;
-	return (client.redirect_uris ?? []).some(isNonHttpRedirectUri) ? "native" : "web";
+	return (client.redirect_uris ?? []).some((uri) => isNonHttpRedirectUri(uri) || isExactLoopbackHttpRedirectUri(uri)) ? "native" : "web";
 }
 function invalidRedirectUri(description) {
 	throw new APIError("BAD_REQUEST", {
@@ -1710,6 +1751,10 @@ function getRawHttpHostname(redirectUri) {
 	}
 	return (hostAndPort.split(":")[0] ?? "").toLowerCase();
 }
+function isExactLoopbackHttpRedirectUri(redirectUri) {
+	const hostname = getRawHttpHostname(redirectUri);
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
 function assertDynamicRegistrationResourcesAllowed(opts, requestedResources) {
 	const allowedResources = new Set([...opts.clientRegistrationDefaultResources ?? [], ...opts.clientRegistrationAllowedResources ?? []]);
 	for (const identifier of requestedResources) if (!allowedResources.has(identifier)) throw new APIError("BAD_REQUEST", {
@@ -1745,8 +1790,6 @@ function validateClientRedirectUri(redirectUri, applicationType) {
 	const isHttps = url.protocol === "https:";
 	if (/^localhost\.+$/i.test(url.hostname)) invalidRedirectUri(`redirect URI localhost must not include trailing dots: ${redirectUri}`);
 	const isRedirectLoopback = isLoopbackIP(url.hostname) || url.hostname === "localhost";
-	const rawHttpHostname = getRawHttpHostname(redirectUri);
-	const isAllowedNativeHttpLoopback = rawHttpHostname === "localhost" || rawHttpHostname === "127.0.0.1" || rawHttpHostname === "[::1]";
 	if (applicationType === "web") {
 		if (!isHttps || isRedirectLoopback) invalidRedirectUri(`web clients require https redirect URIs on non-loopback hosts: ${redirectUri}`);
 		return;
@@ -1756,20 +1799,59 @@ function validateClientRedirectUri(redirectUri, applicationType) {
 		return;
 	}
 	if (isHttp) {
-		if (!isAllowedNativeHttpLoopback) invalidRedirectUri(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${redirectUri}`);
+		if (!isExactLoopbackHttpRedirectUri(redirectUri)) invalidRedirectUri(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${redirectUri}`);
 		return;
 	}
 	if (!isNativePrivateUseRedirectUri(url)) invalidRedirectUri(`native private-use redirect URI schemes must not use a reserved scheme; they must be an authority-free reverse-domain URI or a custom-scheme URI with a host and a path: ${redirectUri}`);
 }
-function assertValidRegistrationJwks(jwks) {
-	const result = validatePublicClientJwks(jwks);
-	if (!result.valid) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: result.error
-	});
+/**
+* Rejects a URI the server will POST to unless it is an absolute https URL
+* with no fragment or credentials on a publicly routable host. Back-channel
+* endpoints use it as an SSRF guard, since the server, not the browser, calls
+* them.
+*/
+function assertPublicRoutableHttpsUri(field, uri) {
+	const reject = (description) => {
+		throw new APIError("BAD_REQUEST", {
+			error: "invalid_client_metadata",
+			error_description: `${field} ${description}`
+		});
+	};
+	let url;
+	try {
+		url = new URL(uri);
+	} catch {
+		return reject("must be an absolute URL");
+	}
+	if (uri.includes("#")) reject("must not include a fragment component");
+	if (url.protocol !== "https:") reject("must use https");
+	if (url.username || url.password) reject("must not contain credentials");
+	if (isPrivateHostname(url.hostname)) reject("must not point to a private or reserved address");
+}
+const REGISTRATION_REQUEST_FIELDS = new Set(Object.keys(clientRegistrationRequestSchema.shape));
+/**
+* Splits a dynamic registration request into its core fields and the fields
+* extensions define, which are stored in the client's `metadata`. Any other
+* unrecognized field is ignored (RFC 7591 §2), so a registrant cannot set
+* server-only fields or arbitrary `metadata`.
+*/
+function splitRegistrationRequest(input, opts) {
+	return {
+		body: Object.fromEntries(Object.entries(input).filter(([field]) => REGISTRATION_REQUEST_FIELDS.has(field))),
+		metadata: pickExtensionClientMetadata(input, opts)
+	};
+}
+/**
+* The top-level fields of a registration that extensions declare, which are
+* stored in the client's `metadata`.
+*/
+function pickExtensionClientMetadata(input, opts) {
+	const extensionFields = getExtensionClientMetadataFields(opts);
+	const metadata = Object.fromEntries(Object.entries(input).filter(([field]) => extensionFields.has(field)));
+	return Object.keys(metadata).length ? metadata : void 0;
 }
 async function registerEndpoint(ctx, opts) {
-	const body = ctx.body;
+	const { body, metadata } = splitRegistrationRequest(ctx.body, opts);
 	if (!opts.allowDynamicClientRegistration) throw new APIError("FORBIDDEN", {
 		error: "access_denied",
 		error_description: "Client registration is disabled"
@@ -1781,8 +1863,15 @@ async function registerEndpoint(ctx, opts) {
 		"WWW-Authenticate": "Bearer",
 		...NO_STORE_HEADERS
 	});
+	const grantTypes = body.grant_types?.length ? resolveMutuallySupportedGrantTypes(opts, body.grant_types) : body.grant_types;
+	const droppedAuthorizationCode = body.grant_types?.includes("authorization_code") && !grantTypes?.includes("authorization_code");
+	const registrationMetadata = {
+		...body,
+		grant_types: grantTypes,
+		response_types: droppedAuthorizationCode ? void 0 : body.response_types
+	};
 	if (!session && !isTokenAuthorized) {
-		if (body.grant_types?.includes("client_credentials")) throw new APIError("BAD_REQUEST", {
+		if (registrationMetadata.grant_types?.includes("client_credentials")) throw new APIError("BAD_REQUEST", {
 			error: "invalid_client_metadata",
 			error_description: "client_credentials grant requires authenticated registration"
 		});
@@ -1794,7 +1883,10 @@ async function registerEndpoint(ctx, opts) {
 		session: session.session
 	}) : void 0);
 	const response = await createOAuthClientRegistration(ctx, opts, {
-		metadata: body,
+		metadata: {
+			...registrationMetadata,
+			metadata
+		},
 		registrationSource: "dynamic",
 		userId: referenceId ? void 0 : session?.session.userId,
 		referenceId,
@@ -1827,16 +1919,14 @@ async function checkOAuthClient(client, opts, settings) {
 		error_description: "Redirect URIs are required for authorization_code and implicit grant types"
 	});
 	for (const uri of clientWithDefaults.redirect_uris ?? []) validateClientRedirectUri(uri, applicationType ?? (isClientMetadataDocument ? "native" : "web"));
-	const supportedGrantTypes = new Set(getSupportedGrantTypes(opts));
-	if (isClientMetadataDocument) {
-		if (!grantTypes.some((grantType) => supportedGrantTypes.has(grantType))) throw new APIError("BAD_REQUEST", {
+	if (isClientMetadataDocument) resolveMutuallySupportedGrantTypes(opts, grantTypes);
+	else {
+		const supportedGrantTypes = new Set(getSupportedGrantTypes(opts));
+		for (const grantType of grantTypes) if (!supportedGrantTypes.has(grantType)) throw new APIError("BAD_REQUEST", {
 			error: "invalid_client_metadata",
-			error_description: `no mutually supported grant_type among ${grantTypes.join(", ")}`
+			error_description: `unsupported grant_type ${grantType}`
 		});
-	} else for (const grantType of grantTypes) if (!supportedGrantTypes.has(grantType)) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: `unsupported grant_type ${grantType}`
-	});
+	}
 	if (grantTypes.includes("authorization_code") && !responseTypes?.includes("code")) throw new APIError("BAD_REQUEST", {
 		error: "invalid_client_metadata",
 		error_description: "When 'authorization_code' grant type is used, 'code' response type must be included"
@@ -1916,7 +2006,7 @@ async function checkOAuthClient(client, opts, settings) {
 				error_description: "jwks_uri must be a valid URL"
 			});
 		}
-		if (clientWithDefaults.jwks) assertValidRegistrationJwks(clientWithDefaults.jwks);
+		if (clientWithDefaults.jwks) assertValidClientJwks(clientWithDefaults.jwks);
 	}
 	if (tokenEndpointAuthMethod === "private_key_jwt" && !clientWithDefaults.jwks && !clientWithDefaults.jwks_uri) throw new APIError("BAD_REQUEST", {
 		error: "invalid_client_metadata",
@@ -1927,32 +2017,40 @@ async function checkOAuthClient(client, opts, settings) {
 			error: "invalid_client_metadata",
 			error_description: "backchannel_logout_uri requires the jwt plugin (disableJwtPlugin must be false)"
 		});
+		assertPublicRoutableHttpsUri("backchannel_logout_uri", clientWithDefaults.backchannel_logout_uri);
+	}
+	if (clientWithDefaults.frontchannel_logout_uri !== void 0) {
 		let url;
 		try {
-			url = new URL(clientWithDefaults.backchannel_logout_uri);
+			url = new URL(clientWithDefaults.frontchannel_logout_uri);
 		} catch {
 			throw new APIError("BAD_REQUEST", {
 				error: "invalid_client_metadata",
-				error_description: "backchannel_logout_uri must be an absolute URL"
+				error_description: "frontchannel_logout_uri must be an absolute URL"
 			});
 		}
-		if (clientWithDefaults.backchannel_logout_uri.includes("#")) throw new APIError("BAD_REQUEST", {
-			error: "invalid_client_metadata",
-			error_description: "backchannel_logout_uri must not include a fragment component"
-		});
-		if (url.protocol !== "https:") throw new APIError("BAD_REQUEST", {
+		if (clientWithDefaults.frontchannel_logout_uri.includes("#")) throw new APIError("BAD_REQUEST", {
 			error: "invalid_client_metadata",
-			error_description: "backchannel_logout_uri must use https"
+			error_description: "frontchannel_logout_uri must not include a fragment component"
 		});
 		if (url.username || url.password) throw new APIError("BAD_REQUEST", {
 			error: "invalid_client_metadata",
-			error_description: "backchannel_logout_uri must not contain credentials"
+			error_description: "frontchannel_logout_uri must not contain credentials"
+		});
+		const isHttpOrHttps = url.protocol === "https:" || url.protocol === "http:";
+		const sharesRedirectOrigin = (clientWithDefaults.redirect_uris ?? []).some((redirectUri) => {
+			try {
+				return new URL(redirectUri).origin === url.origin;
+			} catch {
+				return false;
+			}
 		});
-		if (isPrivateHostname(url.hostname)) throw new APIError("BAD_REQUEST", {
+		if (!isHttpOrHttps || !sharesRedirectOrigin) throw new APIError("BAD_REQUEST", {
 			error: "invalid_client_metadata",
-			error_description: "backchannel_logout_uri must not point to a private or reserved address"
+			error_description: "frontchannel_logout_uri must use the scheme, host, and port of a registered redirect_uri"
 		});
 	}
+	if (!settings?.skipExtensionValidation) await validateExtensionClientMetadata(opts, clientWithDefaults, client.metadata);
 }
 const CLIENT_REGISTRATION_COLLISION = Symbol("client-registration-collision");
 function isClientRegistrationCollision(error) {
@@ -1979,7 +2077,8 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 	const isExtensionAuthMethod = isExtensionTokenEndpointAuthMethod(opts, body.token_endpoint_auth_method);
 	await checkOAuthClient(body, opts, {
 		registrationSource: input.registrationSource,
-		ctx
+		ctx,
+		skipExtensionValidation: input.registrationSource === "clientMetadataDocument" && Boolean(input.existingClient)
 	});
 	const clientId = input.clientId ?? opts.generateClientId?.() ?? generateRandomString(32, "a-z", "A-Z");
 	const clientSecret = isPublic || isPrivateKeyJwt || isExtensionAuthMethod ? void 0 : opts.generateClientSecret?.() || generateRandomString(32, "a-z", "A-Z");
@@ -2009,6 +2108,7 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 	});
 	schema.clientCredentialsScopes = input.registrationSource === "clientMetadataDocument" ? input.existingClient?.clientCredentialsScopes ?? [] : input.registrationSource === "managed" ? input.clientCredentialsScopes ?? [] : [];
 	schema.clientDiscoveryId = input.registrationSource === "clientMetadataDocument" ? input.clientDiscoveryId : null;
+	schema.sectorIdentifier = deriveSectorIdentifier(clientId, body.redirect_uris);
 	if (input.registrationSource === "clientMetadataDocument" && body.application_type === void 0) schema.applicationType = null;
 	const requestedResources = input.registrationSource === "clientMetadataDocument" ? [] : input.requestedResources ?? [];
 	if (input.registrationSource === "dynamic") assertDynamicRegistrationResourcesAllowed(opts, requestedResources);
@@ -2022,6 +2122,19 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 		let storedClient;
 		let created = false;
 		if (existingClient) {
+			let metadata;
+			if (hasExtensionClientMetadata(opts)) {
+				const extensionFields = getExtensionClientMetadataFields(opts);
+				const merged = stripReservedOAuthClientMetadataExtensions(mergeDocumentExtensionMetadata(extensionFields, (await adapter.findOne({
+					model: clientModel,
+					where: [{
+						field: "clientId",
+						value: clientId
+					}]
+				}))?.metadata, body.metadata));
+				await validateExtensionClientMetadata(opts, body, merged);
+				if (extensionFields.size > 0) metadata = merged && Object.keys(merged).length > 0 ? JSON.stringify(merged) : null;
+			}
 			const updatedClient = await adapter.update({
 				model: clientModel,
 				where: [{
@@ -2033,9 +2146,11 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 				}],
 				update: {
 					...schema,
+					metadata,
 					disabled: existingClient.disabled,
 					skipConsent: existingClient.skipConsent,
 					enableEndSession: existingClient.enableEndSession,
+					sectorIdentifier: existingClient.sectorIdentifier ? schema.sectorIdentifier : null,
 					createdAt: existingClient.createdAt,
 					updatedAt: /* @__PURE__ */ new Date(iat * 1e3)
 				}
@@ -2140,6 +2255,20 @@ function assertClientDiscoveryOwnership(client, clientDiscoveryId) {
 	});
 }
 /**
+* The `metadata` a metadata document registration stores. The document owns the
+* fields extensions declare, so a refresh replaces them, including removing
+* ones it no longer declares. Other stored keys, such as ones an admin set, are
+* kept.
+*/
+function mergeDocumentExtensionMetadata(extensionFields, storedMetadata, documentMetadata) {
+	const owned = ([field]) => extensionFields.has(field);
+	const metadata = {
+		...Object.fromEntries(Object.entries(parseClientMetadata(storedMetadata) ?? {}).filter((entry) => !owned(entry))),
+		...Object.fromEntries(Object.entries(documentMetadata ?? {}).filter(owned))
+	};
+	return Object.keys(metadata).length ? metadata : void 0;
+}
+/**
 * First-party persistence seam for a validated Client ID Metadata Document.
 *
 * This operation owns both initial creation and atomic replacement. It never
@@ -2159,18 +2288,20 @@ async function registerClientMetadataDocument(ctx, opts, input) {
 		error: "invalid_client_metadata",
 		error_description: "Client ID Metadata Document clients cannot use a shared secret"
 	});
-	const registrationInput = {
+	const toRegistrationInput = (existingClient) => ({
 		...input,
+		existingClient,
 		metadata: {
 			...input.metadata,
+			metadata: pickExtensionClientMetadata(input.metadata, opts),
 			token_endpoint_auth_method: input.metadata.token_endpoint_auth_method ?? "none",
 			client_secret: void 0,
 			client_secret_expires_at: void 0
 		},
 		registrationSource: "clientMetadataDocument"
-	};
+	});
 	try {
-		return await persistOAuthClientRegistration(ctx, opts, registrationInput);
+		return await persistOAuthClientRegistration(ctx, opts, toRegistrationInput(input.existingClient));
 	} catch (error) {
 		if (!isClientRegistrationCollision(error)) throw error;
 		const clientModel = opts.schema?.oauthClient?.modelName ?? "oauthClient";
@@ -2196,10 +2327,7 @@ async function registerClientMetadataDocument(ctx, opts, input) {
 			})) throw error.cause;
 		}
 		try {
-			return await persistOAuthClientRegistration(ctx, opts, {
-				...registrationInput,
-				existingClient: currentClient
-			});
+			return await persistOAuthClientRegistration(ctx, opts, toRegistrationInput(currentClient));
 		} catch (retryError) {
 			if (isClientRegistrationCollision(retryError)) throw retryError.cause;
 			throw retryError;
@@ -2248,7 +2376,7 @@ async function createOAuthClientEndpoint(ctx, opts, settings) {
 	return ctx.json(responseBody);
 }
 function oauthToSchema(input) {
-	const { client_id: clientId, client_secret: clientSecret, client_secret_expires_at: _expiresAt, scope: _scope, user_id: userId, client_id_issued_at: _createdAt, client_name: name, client_uri: uri, logo_uri: icon, contacts, tos_uri: tos, policy_uri: policy, jwks: inputJwks, jwks_uri: jwksUri, software_id: softwareId, software_version: softwareVersion, software_statement: softwareStatement, redirect_uris: redirectUris, post_logout_redirect_uris: postLogoutRedirectUris, backchannel_logout_uri: backchannelLogoutUri, backchannel_logout_session_required: backchannelLogoutSessionRequired, token_endpoint_auth_method: tokenEndpointAuthMethod, grant_types: grantTypes, response_types: responseTypes, application_type: applicationType, disabled, skip_consent: skipConsent, enable_end_session: enableEndSession, require_pkce: requirePKCE, dpop_bound_access_tokens: dpopBoundAccessTokens, subject_type: subjectType, reference_id: referenceId, metadata: inputMetadata } = input;
+	const { client_id: clientId, client_secret: clientSecret, client_secret_expires_at: _expiresAt, scope: _scope, user_id: userId, client_id_issued_at: _createdAt, client_name: name, client_uri: uri, logo_uri: icon, contacts, tos_uri: tos, policy_uri: policy, jwks: inputJwks, jwks_uri: jwksUri, software_id: softwareId, software_version: softwareVersion, software_statement: softwareStatement, redirect_uris: redirectUris, post_logout_redirect_uris: postLogoutRedirectUris, backchannel_logout_uri: backchannelLogoutUri, backchannel_logout_session_required: backchannelLogoutSessionRequired, frontchannel_logout_uri: frontchannelLogoutUri, frontchannel_logout_session_required: frontchannelLogoutSessionRequired, token_endpoint_auth_method: tokenEndpointAuthMethod, grant_types: grantTypes, response_types: responseTypes, application_type: applicationType, disabled, skip_consent: skipConsent, enable_end_session: enableEndSession, require_pkce: requirePKCE, dpop_bound_access_tokens: dpopBoundAccessTokens, subject_type: subjectType, reference_id: referenceId, metadata: inputMetadata } = input;
 	const expiresAt = _expiresAt ? /* @__PURE__ */ new Date(Number(_expiresAt) * 1e3) : void 0;
 	const createdAt = _createdAt ? /* @__PURE__ */ new Date(_createdAt * 1e3) : void 0;
 	const scopes = _scope?.split(" ");
@@ -2275,6 +2403,8 @@ function oauthToSchema(input) {
 		postLogoutRedirectUris,
 		backchannelLogoutUri,
 		backchannelLogoutSessionRequired,
+		frontchannelLogoutUri,
+		frontchannelLogoutSessionRequired,
 		tokenEndpointAuthMethod,
 		grantTypes,
 		responseTypes,
@@ -2297,7 +2427,7 @@ function oauthToSchema(input) {
 * @returns
 */
 function schemaToOAuth(input) {
-	const { clientId, clientSecret, disabled, scopes, userId, createdAt, updatedAt: _updatedAt, expiresAt, name, uri, icon, contacts, tos, policy, softwareId, softwareVersion, softwareStatement, redirectUris, postLogoutRedirectUris, backchannelLogoutUri, backchannelLogoutSessionRequired, tokenEndpointAuthMethod, grantTypes, responseTypes, applicationType, jwks, jwksUri, skipConsent, enableEndSession, requirePKCE, dpopBoundAccessTokens, subjectType, referenceId, metadata } = input;
+	const { clientId, clientSecret, disabled, scopes, userId, createdAt, updatedAt: _updatedAt, expiresAt, name, uri, icon, contacts, tos, policy, softwareId, softwareVersion, softwareStatement, redirectUris, postLogoutRedirectUris, backchannelLogoutUri, backchannelLogoutSessionRequired, frontchannelLogoutUri, frontchannelLogoutSessionRequired, tokenEndpointAuthMethod, grantTypes, responseTypes, applicationType, jwks, jwksUri, skipConsent, enableEndSession, requirePKCE, dpopBoundAccessTokens, subjectType, referenceId, metadata } = input;
 	const _expiresAt = expiresAt ? Math.round(new Date(expiresAt).getTime() / 1e3) : void 0;
 	const _createdAt = createdAt ? Math.round(new Date(createdAt).getTime() / 1e3) : void 0;
 	const _scopes = scopes?.join(" ");
@@ -2324,6 +2454,8 @@ function schemaToOAuth(input) {
 		post_logout_redirect_uris: postLogoutRedirectUris ?? void 0,
 		backchannel_logout_uri: backchannelLogoutUri ?? void 0,
 		backchannel_logout_session_required: backchannelLogoutSessionRequired ?? void 0,
+		frontchannel_logout_uri: frontchannelLogoutUri ?? void 0,
+		frontchannel_logout_session_required: frontchannelLogoutSessionRequired ?? void 0,
 		token_endpoint_auth_method: tokenEndpointAuthMethod ?? void 0,
 		grant_types: grantTypes ?? void 0,
 		response_types: responseTypes ?? void 0,
@@ -2421,10 +2553,7 @@ async function deleteClientEndpoint(ctx, opts) {
 	await assertClientPrivileges(ctx, session, opts, "delete", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
-	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
-		error_description: "trusted clients must be updated manually",
-		error: "invalid_client"
-	});
+	assertNotTrustedClient(opts, clientId);
 	const client = await getClient(ctx, opts, clientId);
 	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
@@ -2448,21 +2577,26 @@ async function updateClientEndpoint(ctx, opts, settings) {
 	await assertClientPrivileges(ctx, session, opts, "update", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
-	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
-		error_description: "trusted clients must be updated manually",
-		error: "invalid_client"
-	});
+	assertNotTrustedClient(opts, clientId);
 	const client = await getClient(ctx, opts, clientId);
 	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
 		error: "not_found"
 	});
-	const { client_credentials_scopes: rawClientCredentialsScopes, ...updates } = ctx.body.update;
+	const { client_credentials_scopes: rawClientCredentialsScopes, backchannel_logout_uri: backchannelLogoutUri, frontchannel_logout_uri: frontchannelLogoutUri, ...otherUpdates } = ctx.body.update;
+	const clearsBackchannelLogout = backchannelLogoutUri === null;
+	const clearsFrontchannelLogout = frontchannelLogoutUri === null;
+	const updates = {
+		...otherUpdates,
+		...backchannelLogoutUri != null ? { backchannel_logout_uri: backchannelLogoutUri } : {},
+		...frontchannelLogoutUri != null ? { frontchannel_logout_uri: frontchannelLogoutUri } : {}
+	};
+	const hasUpdates = Object.keys(updates).length > 0 || clearsBackchannelLogout || clearsFrontchannelLogout;
 	const ownsClient = client.userId ? client.userId === session.user.id : client.referenceId && opts.clientReference ? client.referenceId === await opts.clientReference(session) : false;
-	const isCrossOwnerScopeConfiguration = !ownsClient && settings?.admin && rawClientCredentialsScopes !== void 0 && Object.keys(updates).length === 0;
+	const isCrossOwnerScopeConfiguration = !ownsClient && settings?.admin && rawClientCredentialsScopes !== void 0 && !hasUpdates;
 	if (!ownsClient && !isCrossOwnerScopeConfiguration) throw new APIError("UNAUTHORIZED");
 	if (isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes", clientId);
-	if (Object.keys(updates).length === 0 && rawClientCredentialsScopes === void 0) {
+	if (!hasUpdates && rawClientCredentialsScopes === void 0) {
 		const res = schemaToOAuth(client);
 		res.client_secret = void 0;
 		if (settings?.admin) return {
@@ -2478,11 +2612,34 @@ async function updateClientEndpoint(ctx, opts, settings) {
 		validateClientCredentialsScopes(clientCredentialsScopes, finalGrantTypes, finalTokenEndpointAuthMethod, opts);
 		if (clientCredentialsScopes.length > 0 && !isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes", clientId);
 	}
-	await checkOAuthClient({
-		...schemaToOAuth(client),
-		...updates
-	}, opts, { ctx });
+	const updatedMetadata = {
+		...schemaToOAuth({
+			...client,
+			metadata: void 0
+		}),
+		...updates,
+		metadata: updates.metadata ?? parseClientMetadata(client.metadata)
+	};
+	if (clearsBackchannelLogout) {
+		updatedMetadata.backchannel_logout_uri = void 0;
+		updatedMetadata.backchannel_logout_session_required = void 0;
+	}
+	if (clearsFrontchannelLogout) {
+		updatedMetadata.frontchannel_logout_uri = void 0;
+		updatedMetadata.frontchannel_logout_session_required = void 0;
+	}
+	await checkOAuthClient(updatedMetadata, opts, { ctx });
 	const schemaUpdates = { ...oauthToSchema(updates) };
+	if (updates.redirect_uris && client.sectorIdentifier) schemaUpdates.sectorIdentifier = deriveSectorIdentifier(client.clientId, updates.redirect_uris);
+	if (clearsBackchannelLogout) {
+		schemaUpdates.backchannelLogoutUri = null;
+		schemaUpdates.backchannelLogoutSessionRequired = null;
+	}
+	if (clearsFrontchannelLogout) {
+		schemaUpdates.frontchannelLogoutUri = null;
+		schemaUpdates.frontchannelLogoutSessionRequired = null;
+	}
+	if (updates.metadata !== void 0 && schemaUpdates.metadata === void 0) schemaUpdates.metadata = null;
 	if (!finalGrantTypes.includes("client_credentials") || finalTokenEndpointAuthMethod === "none") schemaUpdates.clientCredentialsScopes = [];
 	else if (clientCredentialsScopes !== void 0) schemaUpdates.clientCredentialsScopes = clientCredentialsScopes;
 	if (updates.token_endpoint_auth_method) if (updates.token_endpoint_auth_method === "private_key_jwt") schemaUpdates.clientSecret = null;
@@ -2519,10 +2676,7 @@ async function rotateClientSecretEndpoint(ctx, opts) {
 	await assertClientPrivileges(ctx, session, opts, "rotate", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
-	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
-		error_description: "trusted clients must be updated manually",
-		error: "invalid_client"
-	});
+	assertNotTrustedClient(opts, clientId);
 	const client = await getClient(ctx, opts, clientId);
 	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
@@ -2559,6 +2713,57 @@ async function rotateClientSecretEndpoint(ctx, opts) {
 		clientSecret: (opts.prefix?.clientSecret ?? "") + clientSecret
 	});
 }
+/**
+* The write is guarded on the exact key set the assertion was verified against.
+* A concurrent rotation changes that value, so the stale request loses instead
+* of overwriting a newer key set.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc7523#section-3
+*/
+async function rotateClientKeysEndpoint(ctx, opts) {
+	if (!opts.allowClientKeyRotation) throw new APIError("FORBIDDEN", {
+		error: "access_denied",
+		error_description: "Client key rotation is disabled"
+	});
+	const { body } = ctx;
+	assertValidClientJwks(body.jwks);
+	const { client } = await verifyClientAssertion(ctx, opts, body.client_assertion, body.client_assertion_type, void 0, getEndpointUrl({
+		context: ctx.context,
+		request: void 0
+	}, "/oauth2/client/rotate-keys"), {
+		endpointAudienceOnly: true,
+		assertClient: (candidate) => assertRotatable(opts, candidate)
+	});
+	if (!await ctx.context.adapter.incrementOne({
+		model: "oauthClient",
+		where: [{
+			field: "clientId",
+			value: client.clientId
+		}, {
+			field: "jwks",
+			value: client.jwks
+		}],
+		increment: {},
+		set: {
+			jwks: JSON.stringify(body.jwks),
+			updatedAt: /* @__PURE__ */ new Date()
+		}
+	})) throw new APIError("CONFLICT", {
+		error: "invalid_request",
+		error_description: "client keys changed while rotating; retry with a fresh client assertion"
+	});
+	return {
+		client_id: client.clientId,
+		jwks: body.jwks
+	};
+}
+function assertRotatable(opts, client) {
+	assertNotTrustedClient(opts, client.clientId);
+	if (client.clientDiscoveryId || client.jwksUri || !client.jwks) throw new APIError("BAD_REQUEST", {
+		error: "invalid_client",
+		error_description: "client keys are not stored inline; rotate them where the client publishes them"
+	});
+}
 //#endregion
 //#region src/oauthClient/index.ts
 const tokenEndpointAuthMethodSchema = z.string().trim().min(1);
@@ -2580,6 +2785,8 @@ const adminCreateOAuthClient = (opts) => createAuthEndpoint("/admin/oauth2/creat
 		post_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
 		backchannel_logout_uri: SafeUrlSchema.optional(),
 		backchannel_logout_session_required: z.boolean().optional(),
+		frontchannel_logout_uri: SafeUrlSchema.optional(),
+		frontchannel_logout_session_required: z.boolean().optional(),
 		token_endpoint_auth_method: tokenEndpointAuthMethodSchema.optional(),
 		application_type: z.enum(["web", "native"]).optional(),
 		jwks: clientJwksSchema.optional(),
@@ -2753,6 +2960,8 @@ const createOAuthClient = (opts) => createAuthEndpoint("/oauth2/create-client",
 		post_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
 		backchannel_logout_uri: SafeUrlSchema.optional(),
 		backchannel_logout_session_required: z.boolean().optional(),
+		frontchannel_logout_uri: SafeUrlSchema.optional(),
+		frontchannel_logout_session_required: z.boolean().optional(),
 		token_endpoint_auth_method: tokenEndpointAuthMethodSchema.optional(),
 		application_type: z.enum(["web", "native"]).optional(),
 		jwks: clientJwksSchema.optional(),
@@ -2942,8 +3151,10 @@ const adminUpdateOAuthClient = (opts) => createAuthEndpoint("/admin/oauth2/updat
 			software_version: z.string().optional(),
 			software_statement: z.string().optional(),
 			post_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
-			backchannel_logout_uri: SafeUrlSchema.optional(),
+			backchannel_logout_uri: SafeUrlSchema.nullable().optional(),
 			backchannel_logout_session_required: z.boolean().optional(),
+			frontchannel_logout_uri: SafeUrlSchema.nullable().optional(),
+			frontchannel_logout_session_required: z.boolean().optional(),
 			application_type: z.enum(["web", "native"]).optional(),
 			grant_types: grantTypesSchema.optional(),
 			client_credentials_scopes: z.array(z.string().trim().min(1)).optional(),
@@ -2981,8 +3192,10 @@ const updateOAuthClient = (opts) => createAuthEndpoint("/oauth2/update-client",
 			software_version: z.string().optional(),
 			software_statement: z.string().optional(),
 			post_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
-			backchannel_logout_uri: SafeUrlSchema.optional(),
+			backchannel_logout_uri: SafeUrlSchema.nullable().optional(),
 			backchannel_logout_session_required: z.boolean().optional(),
+			frontchannel_logout_uri: SafeUrlSchema.nullable().optional(),
+			frontchannel_logout_session_required: z.boolean().optional(),
 			application_type: z.enum(["web", "native"]).optional(),
 			grant_types: grantTypesSchema.optional(),
 			response_types: z.array(z.enum(["code"])).optional()
@@ -3003,6 +3216,29 @@ const rotateClientSecret = (opts) => createAuthEndpoint("/oauth2/client/rotate-s
 }, async (ctx) => {
 	return rotateClientSecretEndpoint(ctx, opts);
 });
+/**
+* Replaces a `private_key_jwt` client's own signing keys. The client proves it
+* holds a current key with a client assertion, so no session is needed.
+*/
+const rotateClientKeys = (opts) => createOAuthEndpoint("/oauth2/client/rotate-keys", {
+	method: "POST",
+	body: z.object({
+		client_assertion: z.string(),
+		client_assertion_type: z.string(),
+		jwks: clientJwksSchema
+	}),
+	errorCodesByField: {
+		client_assertion: "invalid_client",
+		client_assertion_type: "invalid_client",
+		jwks: "invalid_client_metadata"
+	},
+	metadata: {
+		noStore: true,
+		openapi: { description: "Replaces the signing keys of a private_key_jwt client. The request is authenticated by a client assertion signed with one of the client's current keys and addressed to this endpoint. Keys left out of the new set stop verifying at once." }
+	}
+}, async (ctx) => {
+	return rotateClientKeysEndpoint(ctx, opts);
+});
 const deleteOAuthClient = (opts) => createAuthEndpoint("/oauth2/delete-client", {
 	method: "POST",
 	use: [sessionMiddleware],
@@ -3449,112 +3685,47 @@ const adminUnlinkClientResource = (opts) => createAuthEndpoint("/admin/oauth2/re
 //#endregion
 //#region src/revoke.ts
 /**
-* IMPORTANT NOTES:
-* Revocation follows RFC7009
+* Revocation follows RFC 7009
 * https://datatracker.ietf.org/doc/html/rfc7009
-* - APIError: Continue catches (returnable to client)
-* - Error: Should immediately stop catches (internal error)
+*
+* A token this server cannot find is already unusable, so it resolves as a
+* successful no-op (§2.2). Only explicit protocol errors surface.
 */
 /**
-* Revokes a JWT access token against the configured JWKs.
-*
 * A JWT access token is self-contained and never stored, so there is nothing to
 * delete. Once the token is confirmed to be a valid JWT for this server, the
 * endpoint reports `unsupported_token_type` (RFC 7009 §2.2.1) instead of a
 * silent success, so callers can tell that no server-side revocation happened.
-* An expired JWT or a JWT with an audience rejected by the OAuth resource model
-* is already inactive and still resolves as a successful no-op. Session-bound
-* tokens (carrying `sid`) are cut off early by the session-liveness check in
-* introspection and userinfo.
+* A JWT with an audience rejected by the OAuth resource model is already
+* inactive and resolves as a successful no-op. Session-bound tokens (carrying
+* `sid`) are cut off early by the session-liveness check in introspection and
+* userinfo.
 */
-async function revokeJwtAccessToken(ctx, opts, token) {
-	const jwtPlugin = opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context);
-	const jwtPluginOptions = jwtPlugin?.options;
-	try {
-		const verified = await jwtVerify(token, createLocalJWKSet(await getJwks(token, {
-			jwksFetch: jwtPluginOptions?.jwks?.remoteUrl ? jwtPluginOptions.jwks.remoteUrl : async () => {
-				return (await jwtPlugin?.endpoints.getJwks(ctx))?.response;
-			},
-			jwksCacheKey: jwtPlugin
-		})), { issuer: jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL });
-		const userInfoAudience = `${ctx.context.baseURL}/oauth2/userinfo`;
-		if (!verified.payload.azp || !await isAudienceClaimAllowed(ctx, opts, verified.payload.aud, [userInfoAudience])) return null;
-	} catch (error) {
-		if (error instanceof Error) {
-			if (error.name === "TypeError" || error.name === "JWSInvalid") throw new APIError$1("BAD_REQUEST", {
-				error_description: "invalid JWT signature",
-				error: "invalid_request"
-			});
-			else if (error.name === "JWTExpired") return null;
-			else if (error.name === "JWTInvalid") return null;
-			throw error;
-		}
-		throw new Error(error);
-	}
+async function revokeJwtAccessToken(ctx, opts, payload) {
+	if (!await isAudienceClaimAllowed(ctx, opts, payload.aud, [userInfoResource(ctx.context.baseURL)])) return null;
 	throw new APIError$1("BAD_REQUEST", {
 		error_description: "JWT access tokens are self-contained and cannot be revoked server-side",
 		error: "unsupported_token_type"
 	});
 }
-/**
-* Searches for an opaque access token in the database and validates it
-*/
-async function revokeOpaqueAccessToken(ctx, opts, token, clientId) {
-	let tokenValue = token;
-	if (opts.prefix?.opaqueAccessToken) if (tokenValue.startsWith(opts.prefix.opaqueAccessToken)) tokenValue = tokenValue.replace(opts.prefix.opaqueAccessToken, "");
-	else throw new APIError$1("BAD_REQUEST", {
-		error_description: "opaque access token not found",
-		error: "invalid_request"
-	});
-	const accessToken = await ctx.context.adapter.findOne({
-		model: "oauthAccessToken",
-		where: [{
-			field: "token",
-			value: await getStoredToken(opts.storeTokens, tokenValue, "access_token")
-		}]
-	});
-	if (!accessToken) throw new APIError$1("BAD_REQUEST", {
-		error_description: "opaque access token not found",
-		error: "invalid_request"
-	});
-	if (!accessToken.clientId || accessToken.clientId !== clientId) return null;
-	accessToken.id ? await ctx.context.adapter.delete({
+async function revokeOpaqueAccessToken(ctx, accessToken) {
+	await ctx.context.adapter.delete({
 		model: "oauthAccessToken",
-		where: [{
+		where: accessToken.id ? [{
 			field: "id",
 			value: accessToken.id
-		}]
-	}) : await ctx.context.adapter.delete({
-		model: "oauthAccessToken",
-		where: [{
+		}] : [{
 			field: "token",
 			value: accessToken.token
 		}]
 	});
 }
-/**
-* Validates a refresh token in the session store.
-*/
-async function revokeRefreshToken(ctx, opts, token, clientId) {
-	const refreshToken = await ctx.context.adapter.findOne({
-		model: "oauthRefreshToken",
-		where: [{
-			field: "token",
-			value: await getStoredToken(opts.storeTokens, token, "refresh_token")
-		}]
-	});
-	if (!refreshToken) throw new APIError$1("BAD_REQUEST", {
-		error_description: "token not found",
-		error: "invalid_request"
-	});
+async function revokeRefreshToken(ctx, refreshToken, clientId) {
+	const { userId } = refreshToken;
 	if (refreshToken.revoked) {
-		await invalidateRefreshFamily(ctx, clientId, refreshToken.userId);
-		throw new APIError$1("BAD_REQUEST", {
-			error_description: "refresh token revoked",
-			error: "invalid_request"
-		});
+		await invalidateRefreshFamily(ctx, clientId, userId);
+		return;
 	}
-	if (!refreshToken.clientId || refreshToken.clientId !== clientId) return null;
 	const iat = Math.floor(Date.now() / 1e3);
 	if (!await ctx.context.adapter.incrementOne({
 		model: "oauthRefreshToken",
@@ -3569,11 +3740,8 @@ async function revokeRefreshToken(ctx, opts, token, clientId) {
 		increment: {},
 		set: { revoked: /* @__PURE__ */ new Date(iat * 1e3) }
 	})) {
-		await invalidateRefreshFamily(ctx, clientId, refreshToken.userId);
-		throw new APIError$1("BAD_REQUEST", {
-			error_description: "refresh token revoked",
-			error: "invalid_request"
-		});
+		await invalidateRefreshFamily(ctx, clientId, userId);
+		return;
 	}
 	await ctx.context.adapter.deleteMany({
 		model: "oauthAccessToken",
@@ -3583,33 +3751,8 @@ async function revokeRefreshToken(ctx, opts, token, clientId) {
 		}]
 	});
 }
-/**
-* We don't know the access token format so we try to validate it
-* as a JWT first, then as an opaque token.
-*/
-async function revokeAccessToken(ctx, opts, clientId, token) {
-	try {
-		return await revokeJwtAccessToken(ctx, opts, token);
-	} catch (err) {
-		if (err instanceof APIError$1) {
-			if (err.body?.error === "unsupported_token_type") throw err;
-		} else if (err instanceof Error) throw err;
-		else throw new Error(err);
-	}
-	try {
-		return await revokeOpaqueAccessToken(ctx, opts, token, clientId);
-	} catch (err) {
-		if (err instanceof APIError$1) {} else if (err instanceof Error) throw err;
-		else throw new Error("Unknown error validating access token");
-	}
-	throw new APIError$1("BAD_REQUEST", {
-		error_description: "Invalid access token",
-		error: "invalid_request"
-	});
-}
 async function revokeEndpoint(ctx, opts) {
 	let { token, token_type_hint } = ctx.body;
-	if (token_type_hint !== "access_token" && token_type_hint !== "refresh_token") token_type_hint = void 0;
 	const { clientId: client_id, clientSecret: client_secret, preVerified, authMethod } = destructureCredentials(await extractClientCredentials(ctx, opts, `${ctx.context.baseURL}/oauth2/revoke`));
 	if (!client_id) throw new APIError$1("UNAUTHORIZED", {
 		error_description: "missing required credentials",
@@ -3622,38 +3765,23 @@ async function revokeEndpoint(ctx, opts) {
 	});
 	const client = await validateClientCredentials(ctx, opts, client_id, client_secret, void 0, preVerified, void 0, authMethod);
 	try {
-		if (token_type_hint === void 0 || token_type_hint === "access_token") try {
-			return await revokeAccessToken(ctx, opts, client.clientId, token);
-		} catch (error) {
-			if (error instanceof APIError$1) {
-				if (token_type_hint === "access_token" || error.body?.error === "unsupported_token_type") throw error;
-			} else if (error instanceof Error) throw error;
-			else throw new Error(error);
-		}
-		if (token_type_hint === void 0 || token_type_hint === "refresh_token") try {
-			return await revokeRefreshToken(ctx, opts, (await decodeRefreshToken(opts, token)).token, client.clientId);
-		} catch (error) {
-			if (error instanceof APIError$1) {
-				if (token_type_hint === "refresh_token") throw error;
-			} else if (error instanceof Error) throw error;
-			else throw new Error(error);
+		const found = await findToken(ctx, opts, token, token_type_hint);
+		if (!found) return null;
+		if ((found.type === "jwt" ? found.payload.azp : found.record.clientId) !== client.clientId) {
+			if (client.tokenEndpointAuthMethod === "none") return null;
+			throw new APIError$1("BAD_REQUEST", {
+				error_description: "client is not authorized to revoke the presented token",
+				error: "invalid_request"
+			});
 		}
-		throw new APIError$1("BAD_REQUEST", {
-			error_description: "token not found",
-			error: "invalid_request"
-		});
+		if (found.type === "jwt") return await revokeJwtAccessToken(ctx, opts, found.payload);
+		if (found.type === "opaque") await revokeOpaqueAccessToken(ctx, found.record);
+		else await revokeRefreshToken(ctx, found.record, client.clientId);
+		return null;
 	} catch (error) {
-		if (error instanceof APIError$1) {
-			if (error.body?.error === "unsupported_token_type") throw error;
-			if (error.name === "BAD_REQUEST") return null;
-			throw error;
-		} else if (error instanceof Error) {
-			logger.error("Introspection error:", error.message, error.stack);
-			throw new APIError$1("INTERNAL_SERVER_ERROR");
-		} else {
-			logger.error("Introspection error:", error);
-			throw new APIError$1("INTERNAL_SERVER_ERROR");
-		}
+		if (error instanceof APIError$1) throw error;
+		logger.error("Revocation error:", error);
+		throw new APIError$1("INTERNAL_SERVER_ERROR");
 	}
 }
 //#endregion
@@ -3692,6 +3820,10 @@ const schema = {
 				type: "string",
 				required: false
 			},
+			sectorIdentifier: {
+				type: "string",
+				required: false
+			},
 			scopes: {
 				type: "string[]",
 				required: false
@@ -3770,6 +3902,14 @@ const schema = {
 				type: "boolean",
 				required: false
 			},
+			frontchannelLogoutUri: {
+				type: "string",
+				required: false
+			},
+			frontchannelLogoutSessionRequired: {
+				type: "boolean",
+				required: false
+			},
 			tokenEndpointAuthMethod: {
 				type: "string",
 				required: false
@@ -4018,6 +4158,14 @@ const schema = {
 			type: "date",
 			required: false
 		},
+		acr: {
+			type: "string",
+			required: false
+		},
+		amr: {
+			type: "string[]",
+			required: false
+		},
 		confirmation: {
 			type: "json",
 			required: false
@@ -4198,7 +4346,7 @@ const rpInitiatedLogoutRequestSchema = z.object({
 });
 const oAuthState = defineRequestState(() => null);
 const getOAuthProviderState = oAuthState.get;
-const backchannelLogoutPlansByContext = /* @__PURE__ */ new WeakMap();
+const sessionLogoutPlansByContext = /* @__PURE__ */ new WeakMap();
 const signedQueryIssuedAtMsKey = "signedQueryIssuedAtMs";
 function getServerContextSignedQueryIssuedAt(value) {
 	const issuedAtMs = typeof value === "number" ? value : typeof value === "string" ? Number(value) : void 0;
@@ -4222,6 +4370,8 @@ const oauthProvider = (options) => {
 	if (clientRegistrationAllowedScopes) {
 		for (const sc of clientRegistrationAllowedScopes) if (!scopes.has(sc)) throw new BetterAuthError(`clientRegistrationAllowedScope ${sc} not found in scopes`);
 	}
+	const acrValuesSupported = options.authenticationContext?.acrValuesSupported;
+	if (acrValuesSupported && (acrValuesSupported.length === 0 || acrValuesSupported.includes(""))) throw new BetterAuthError("authenticationContext.acrValuesSupported must list at least one non-empty acr value");
 	for (const sc of options.advertisedMetadata?.scopes_supported ?? []) if (!scopes?.has(sc)) throw new BetterAuthError(`advertisedMetadata.scopes_supported ${sc} not found in scopes`);
 	const configuredResourceIdentifiers = new Set((options.resources ?? []).map((resource) => typeof resource === "string" ? resource : resource.identifier));
 	for (const [optionName, identifiers] of [["clientRegistrationDefaultResources", options.clientRegistrationDefaultResources], ["clientRegistrationAllowedResources", options.clientRegistrationAllowedResources]]) for (const identifier of identifiers ?? []) if (!configuredResourceIdentifiers.has(identifier)) throw new BetterAuthError(`${optionName} resource ${identifier} not found in resources`);
@@ -4313,12 +4463,19 @@ const oauthProvider = (options) => {
 						schema: { type: "string" },
 						description: "OAuth 2.1 response type (e.g., 'code')"
 					},
+					{
+						name: "user_code",
+						in: "query",
+						required: false,
+						schema: { type: "string" },
+						description: "Device user code to approve instead of an authorization request (requires oauthDeviceAuthorization())"
+					},
 					{
 						name: "client_id",
 						in: "query",
-						required: true,
+						required: false,
 						schema: { type: "string" },
-						description: "OAuth 2.1 client ID"
+						description: "OAuth 2.1 client ID, required for authorization requests (not for user_code)"
 					},
 					{
 						name: "redirect_uri",
@@ -4443,6 +4600,10 @@ const oauthProvider = (options) => {
 		onRequest: handleIssuerMetadataRequest,
 		init: async (ctx) => {
 			if (ctx.options.secondaryStorage && ctx.options.session?.storeSessionInDatabase !== true) throw new BetterAuthError("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");
+			if (opts.allowClientKeyRotation) {
+				const gap = ctx.adapter.id === "memory" ? "the memory adapter" : ctx.options.advanced?.database?.generateId === "serial" ? "`advanced.database.generateId: \"serial\"`" : void 0;
+				if (gap) throw new BetterAuthError(`\`allowClientKeyRotation\` requires single-use client assertions, which ${gap} does not enforce`);
+			}
 			await seedResourcesOnce(ctx, opts).catch((error) => logStartupSeedFailure(ctx, error));
 			logEnforcePerClientResourcesResolution(opts);
 			if (!opts.disableJwtPlugin) {
@@ -4458,25 +4619,26 @@ const oauthProvider = (options) => {
 			return { options: { databaseHooks: { session: { delete: {
 				async before(session, hookCtx) {
 					if (!hookCtx) return;
-					const plan = await prepareBackchannelLogoutPlan(hookCtx, opts, {
+					const plan = await prepareSessionLogoutPlan(hookCtx, opts, {
 						sessionId: session.id,
 						userId: session.userId
 					});
 					if (!plan) return;
-					const logoutPlanBySessionId = backchannelLogoutPlansByContext.get(hookCtx) ?? /* @__PURE__ */ new Map();
+					const logoutPlanBySessionId = sessionLogoutPlansByContext.get(hookCtx) ?? /* @__PURE__ */ new Map();
 					logoutPlanBySessionId.set(session.id, plan);
-					backchannelLogoutPlansByContext.set(hookCtx, logoutPlanBySessionId);
+					sessionLogoutPlansByContext.set(hookCtx, logoutPlanBySessionId);
 				},
 				async after(session, hookCtx) {
 					if (!hookCtx) return;
-					const logoutPlanBySessionId = backchannelLogoutPlansByContext.get(hookCtx);
+					const logoutPlanBySessionId = sessionLogoutPlansByContext.get(hookCtx);
 					if (!logoutPlanBySessionId) return;
 					const plan = logoutPlanBySessionId.get(session.id);
 					logoutPlanBySessionId.delete(session.id);
-					if (logoutPlanBySessionId.size === 0) backchannelLogoutPlansByContext.delete(hookCtx);
+					if (logoutPlanBySessionId.size === 0) sessionLogoutPlansByContext.delete(hookCtx);
 					if (!plan) return;
-					const logoutTask = applyBackchannelLogoutPlan(hookCtx, plan).catch((error) => {
-						hookCtx.context.logger.error("Back-channel logout failed after session deletion", error);
+					await recordFrontchannelLogoutUris(plan.frontchannelLogoutUris);
+					const logoutTask = applySessionLogoutPlan(hookCtx, plan).catch((error) => {
+						hookCtx.context.logger.error("Logout notification failed after session deletion", error);
 					});
 					await hookCtx.context.runInBackgroundOrAwait(logoutTask);
 				}
@@ -4620,7 +4782,7 @@ const oauthProvider = (options) => {
 			}),
 			oauth2Token: createOAuthEndpoint("/oauth2/token", {
 				method: "POST",
-				cloneRequest: true,
+				formParams: { repeatable: ["resource", "audience"] },
 				body: z.object({
 					grant_type: z.string().trim().min(1),
 					client_id: z.string().optional(),
@@ -4761,15 +4923,11 @@ const oauthProvider = (options) => {
 					}
 				}
 			}, async (ctx) => {
-				if (ctx.request) {
-					const repeated = await extractRepeatedResourceFromForm(ctx.request);
-					if (repeated && repeated.length > 1) ctx.body.resource = repeated;
-				}
 				return tokenEndpoint(ctx, opts);
 			}),
 			oauth2Introspect: createOAuthEndpoint("/oauth2/introspect", {
 				method: "POST",
-				cloneRequest: true,
+				formParams: {},
 				body: z.object({
 					client_id: z.string().optional(),
 					client_secret: z.string().optional(),
@@ -4886,7 +5044,7 @@ const oauthProvider = (options) => {
 			}),
 			oauth2Revoke: createOAuthEndpoint("/oauth2/revoke", {
 				method: "POST",
-				cloneRequest: true,
+				formParams: {},
 				body: z.object({
 					client_id: z.string().optional(),
 					client_secret: z.string().optional(),
@@ -5064,7 +5222,7 @@ const oauthProvider = (options) => {
 					openapi: {
 						description: "RP-Initiated Logout endpoint. Accepts standard logout parameters through GET or an application/x-www-form-urlencoded POST body, plus JSON for Better Auth generated-client calls. Requests without a usable id_token_hint may require explicit OP confirmation.",
 						responses: { "200": {
-							description: "Logout completed, or an HTML confirmation page was returned for browser navigation. A redirect is used only for an exact registered post_logout_redirect_uri.",
+							description: "Logout completed, or an HTML page was returned for browser navigation — a confirmation page, or the OIDC front-channel logout page when clients with a registered frontchannel_logout_uri hold tokens on the session. A redirect is used only for an exact registered post_logout_redirect_uri.",
 							content: {
 								"application/json": { schema: {
 									type: "object",
@@ -5080,7 +5238,10 @@ const oauthProvider = (options) => {
 										}
 									}
 								} },
-								"text/html": { schema: { type: "string" } }
+								"text/html": { schema: {
+									type: "string",
+									description: "Logout confirmation page, or the OIDC Front-Channel Logout page with one hidden iframe per registered RP"
+								} }
 							}
 						} }
 					}
@@ -5101,7 +5262,7 @@ const oauthProvider = (options) => {
 			}),
 			registerOAuthClient: createOAuthEndpoint("/oauth2/register", {
 				method: "POST",
-				body: clientRegistrationRequestSchema,
+				body: clientRegistrationRequestSchema.loose(),
 				errorCodesByField: {
 					redirect_uris: "invalid_redirect_uri",
 					post_logout_redirect_uris: "invalid_redirect_uri",
@@ -5205,6 +5366,15 @@ const oauthProvider = (options) => {
 										type: "boolean",
 										description: "Whether the RP requires a `sid` claim in every Logout Token"
 									},
+									frontchannel_logout_uri: {
+										type: "string",
+										format: "uri",
+										description: "RP URL rendered in a hidden iframe on the OP's logout page when the end-user's OP session terminates"
+									},
+									frontchannel_logout_session_required: {
+										type: "boolean",
+										description: "Whether the RP requires `iss` and `sid` query parameters on its front-channel logout URI. The OP always sends both."
+									},
 									token_endpoint_auth_method: {
 										type: "string",
 										description: "Requested authentication method for the token endpoint"
@@ -5257,6 +5427,7 @@ const oauthProvider = (options) => {
 			adminUpdateOAuthClient: adminUpdateOAuthClient(opts),
 			updateOAuthClient: updateOAuthClient(opts),
 			rotateClientSecret: rotateClientSecret(opts),
+			rotateClientKeys: rotateClientKeys(opts),
 			deleteOAuthClient: deleteOAuthClient(opts),
 			getOAuthConsent: getOAuthConsent(opts),
 			getOAuthConsents: getOAuthConsents(opts),
@@ -5297,6 +5468,11 @@ const oauthProvider = (options) => {
 				window: opts.rateLimit?.register?.window ?? 60,
 				max: opts.rateLimit?.register?.max ?? 5
 			}] : [],
+			...opts.rateLimit?.rotateClientKeys !== false ? [{
+				pathMatcher: (path) => path === "/oauth2/client/rotate-keys",
+				window: opts.rateLimit?.rotateClientKeys?.window ?? 60,
+				max: opts.rateLimit?.rotateClientKeys?.max ?? 5
+			}] : [],
 			...opts.rateLimit?.userinfo !== false ? [{
 				pathMatcher: (path) => path === "/oauth2/userinfo",
 				window: opts.rateLimit?.userinfo?.window ?? 60,
@@ -5375,8 +5551,20 @@ const handleRedirect = (ctx, uri) => {
 	};
 	else throw ctx.redirect(uri);
 };
-function redirectWithPromptNoneError(ctx, opts, query, error, description) {
-	return handleRedirect(ctx, formatErrorURL(query.redirect_uri, error, description, query.state, getIssuer(ctx, opts)));
+/** Sends an OAuth error to the client's redirect URI, or to the error page without one. */
+function redirectWithAuthorizationError(ctx, opts, query, error, description) {
+	return handleRedirect(ctx, query.redirect_uri ? formatErrorURL(query.redirect_uri, error, description, query.state, getIssuer(ctx, opts)) : getErrorURL(ctx, error, description));
+}
+/**
+* Returns the URL that reports an `APIError`: `errorPage` when given, otherwise
+* the provider error page. Rethrows anything else.
+*/
+function getAPIErrorURL(ctx, error, errorPage) {
+	if (!(error instanceof APIError$1)) throw error;
+	const body = error.body;
+	const code = body?.error ?? "invalid_request";
+	const description = body?.error_description ?? "invalid request";
+	return errorPage ? formatErrorURL(errorPage, code, description) : getErrorURL(ctx, code, description);
 }
 /**
 * Validates that the issuer URL
@@ -5538,13 +5726,45 @@ function authorizeRedirectOnError(opts) {
 	};
 }
 async function authorizeEndpoint(ctx, opts, settings) {
-	if (opts.grantTypes && !opts.grantTypes.includes("authorization_code")) throw new APIError$1("NOT_FOUND");
 	if (!ctx.request) throw new APIError$1("UNAUTHORIZED", {
 		error_description: "request not found",
 		error: "invalid_request"
 	});
 	const request = ctx.request;
 	let query = getAuthorizationRequestParameters(ctx, settings);
+	const interaction = getExtensionInteractionRequest(opts, query);
+	if (interaction) {
+		if (settings?.isAuthorize === true && !await getSessionFromCtx(ctx)) {
+			ctx.query = { [interaction.parameter]: interaction.value };
+			return redirectWithPromptCode(ctx, opts, "login");
+		}
+		const errorPage = interaction.handler.errorPage?.({
+			ctx,
+			value: interaction.value
+		});
+		const toErrorURL = (error) => getAPIErrorURL(ctx, error, errorPage);
+		let interactionRequest;
+		try {
+			interactionRequest = await interaction.handler.load({
+				ctx,
+				opts,
+				value: interaction.value,
+				signedQuery: settings?.isAuthorize === true ? void 0 : query
+			});
+			if (interactionRequest.client.disabled) throw new APIError$1("BAD_REQUEST", {
+				error: "client_disabled",
+				error_description: "client is disabled"
+			});
+		} catch (error) {
+			return handleRedirect(ctx, toErrorURL(error));
+		}
+		return runAuthorizationInteraction(ctx, opts, request.headers, settings, {
+			...interactionRequest,
+			approve: (approval) => interactionRequest.approve(approval).catch(toErrorURL),
+			errorURL: toErrorURL
+		});
+	}
+	if (opts.grantTypes && !opts.grantTypes.includes("authorization_code")) throw new APIError$1("NOT_FOUND");
 	ctx.query = query;
 	const requestObject = getStringParameter(query.request);
 	const requestUri = getStringParameter(query.request_uri);
@@ -5601,12 +5821,10 @@ async function authorizeEndpoint(ctx, opts, settings) {
 		error_description: "response_type is required",
 		ctx
 	});
-	const promptSet = ctx.query?.prompt ? parsePrompt(ctx.query?.prompt) : void 0;
-	const promptNone = promptSet?.has("none") ?? false;
-	if (promptSet?.has("select_account") && !opts.selectAccount?.page) return handleRedirect(ctx, getErrorURL(ctx, `unsupported_prompt_select_account`, "unsupported prompt type"));
+	if ((ctx.query?.prompt ? parsePrompt(ctx.query?.prompt) : void 0)?.has("select_account") && !opts.selectAccount?.page) return handleRedirect(ctx, getErrorURL(ctx, `unsupported_prompt_select_account`, "unsupported prompt type"));
 	if (!(query.response_type === "code")) return handleRedirect(ctx, getErrorURL(ctx, "unsupported_response_type", "unsupported response type"));
 	const client = await getClient(ctx, opts, query.client_id);
-	if (!client) return handleRedirect(ctx, getErrorURL(ctx, "invalid_client", "client_id is required"));
+	if (!client) return handleRedirect(ctx, getErrorURL(ctx, "invalid_client", "client not found"));
 	if (client.disabled) return handleRedirect(ctx, getErrorURL(ctx, "client_disabled", "client is disabled"));
 	if (!clientAllowsGrant(client, "authorization_code")) return handleRedirect(ctx, getErrorURL(ctx, "unauthorized_client", "client is not authorized to use the authorization_code grant"));
 	const registeredUris = client.redirectUris ?? [];
@@ -5636,8 +5854,7 @@ async function authorizeEndpoint(ctx, opts, settings) {
 	const openidRequested = requestedScopes.includes("openid");
 	if (query.claims !== void 0 && !openidRequested) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, "invalid_request", "openid scope must be requested when using the claims parameter", query.state, getIssuer(ctx, opts)));
 	if (openidRequested && !isValidOidcClaimsRequest(query.claims)) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, "invalid_request", "claims must be a valid Claims request object", query.state, getIssuer(ctx, opts)));
-	if (openidRequested && !canSatisfyEssentialAcrRequest(query.claims, "0")) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, "access_denied", "essential acr requirement cannot be met", query.state, getIssuer(ctx, opts)));
-	const requestedUserInfoClaims = getRequestedUserInfoClaims(query.claims, getSupportedClaims(opts));
+	if (openidRequested && !getAcrValuesSupported(opts).some((acr) => canSatisfyEssentialAcrRequest(query.claims, acr))) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, "access_denied", "essential acr requirement cannot be met", query.state, getIssuer(ctx, opts)));
 	if (query.resource !== void 0) try {
 		await resolveResourcePolicy(ctx, opts, {
 			resource: query.resource,
@@ -5663,12 +5880,35 @@ async function authorizeEndpoint(ctx, opts, settings) {
 		if (!query.code_challenge || !query.code_challenge_method) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, "invalid_request", "code_challenge and code_challenge_method must both be provided", query.state, getIssuer(ctx, opts)));
 		if (!["S256"].includes(query.code_challenge_method)) return handleRedirect(ctx, formatErrorURL(query.redirect_uri, "invalid_request", "invalid code_challenge method, only S256 is supported", query.state, getIssuer(ctx, opts)));
 	}
-	const requestedResources = toResourceList(query.resource) ?? [];
+	return runAuthorizationInteraction(ctx, opts, request.headers, settings, {
+		query,
+		client,
+		approve: (approval) => createAuthorizationCodeURL(ctx, opts, {
+			...approval,
+			query: approval.query,
+			clientId: client.clientId,
+			resource: toResourceList(approval.query.resource) ?? []
+		})
+	});
+}
+/**
+* Sends the user to the next required interaction page, or approves the
+* request once none remain.
+*/
+async function runAuthorizationInteraction(ctx, opts, headers, settings, request) {
+	let { query } = request;
+	const { client } = request;
+	ctx.query = query;
+	const scopes = query.scope?.split(" ").filter((scope) => scope) ?? [];
+	const userInfoClaims = getRequestedUserInfoClaims(query.claims, getSupportedClaims(opts));
+	const resources = toResourceList(query.resource) ?? [];
+	const promptSet = query.prompt ? parsePrompt(query.prompt) : void 0;
+	const promptNone = promptSet?.has("none") ?? false;
 	const session = await getSessionFromCtx(ctx);
 	const maxAgeSeconds = query.max_age;
 	const hasSatisfiedMaxAge = session != null && maxAgeSeconds !== void 0 && isWithinMaxAge(new Date(session.session.createdAt), maxAgeSeconds, /* @__PURE__ */ new Date());
 	if (!session || session != null && maxAgeSeconds !== void 0 && !hasSatisfiedMaxAge || promptSet?.has("login") || promptSet?.has("create")) {
-		if (promptNone) return redirectWithPromptNoneError(ctx, opts, query, "login_required", "authentication required");
+		if (promptNone) return redirectWithAuthorizationError(ctx, opts, query, "login_required", "authentication required");
 		return redirectWithPromptCode(ctx, opts, promptSet?.has("create") ? "create" : "login");
 	}
 	if (hasSatisfiedMaxAge) {
@@ -5678,89 +5918,79 @@ async function authorizeEndpoint(ctx, opts, settings) {
 	if (settings?.isAuthorize && promptSet?.has("select_account")) return redirectWithPromptCode(ctx, opts, "select_account");
 	if (settings?.isAuthorize && opts.selectAccount) {
 		if (await opts.selectAccount.shouldRedirect({
-			headers: request.headers,
+			headers,
 			user: session.user,
 			session: session.session,
-			scopes: requestedScopes
+			scopes
 		})) {
-			if (promptNone) return redirectWithPromptNoneError(ctx, opts, query, "account_selection_required", "End-User account selection is required");
+			if (promptNone) return redirectWithAuthorizationError(ctx, opts, query, "account_selection_required", "End-User account selection is required");
 			return redirectWithPromptCode(ctx, opts, "select_account");
 		}
 	}
 	if (opts.signup?.shouldRedirect) {
 		const signupRedirect = await opts.signup.shouldRedirect({
-			headers: request.headers,
+			headers,
 			user: session.user,
 			session: session.session,
-			scopes: requestedScopes
+			scopes
 		});
 		if (signupRedirect) {
-			if (promptNone) return redirectWithPromptNoneError(ctx, opts, query, "interaction_required", "End-User interaction is required");
+			if (promptNone) return redirectWithAuthorizationError(ctx, opts, query, "interaction_required", "End-User interaction is required");
 			return redirectWithPromptCode(ctx, opts, "create", { page: typeof signupRedirect === "string" ? signupRedirect : void 0 });
 		}
 	}
 	if (!settings?.postLogin && opts.postLogin) {
 		if (await opts.postLogin.shouldRedirect({
-			headers: request.headers,
+			headers,
 			user: session.user,
 			session: session.session,
-			scopes: requestedScopes,
+			scopes,
 			isContinuation: settings?.isPostLoginContinuation ?? false
 		})) {
-			if (promptNone) return redirectWithPromptNoneError(ctx, opts, query, "interaction_required", "End-User interaction is required");
+			if (promptNone) return redirectWithAuthorizationError(ctx, opts, query, "interaction_required", "End-User interaction is required");
 			return redirectWithPromptCode(ctx, opts, "post_login");
 		}
 	}
-	if (promptSet?.has("consent")) return redirectWithPromptCode(ctx, opts, "consent", { sessionId: session.session.id });
-	const referenceId = await opts.postLogin?.consentReferenceId?.({
+	if (promptSet?.has("consent") || request.requireConsent && !settings?.consentAccepted) return redirectWithPromptCode(ctx, opts, "consent", { sessionId: session.session.id });
+	const referenceId = await getConsentReferenceId(opts, {
 		user: session.user,
 		session: session.session,
-		scopes: requestedScopes
+		scopes
 	});
-	if (client.skipConsent) return redirectWithAuthorizationCode(ctx, opts, {
-		query,
-		clientId: client.clientId,
-		userId: session.user.id,
-		sessionId: session.session.id,
-		authTime: new Date(session.session.createdAt).getTime(),
-		referenceId,
-		resource: requestedResources
-	});
-	const consent = await ctx.context.adapter.findOne({
-		model: "oauthConsent",
-		where: [
-			{
-				field: "clientId",
-				value: client.clientId
-			},
-			{
-				field: "userId",
-				value: session.user.id
-			},
-			...referenceId ? [{
-				field: "referenceId",
-				value: referenceId
-			}] : []
-		]
-	});
-	if (!consent || !requestedScopes.every((val) => consent.scopes.includes(val)) || !requestedUserInfoClaims.every((claim) => (consent.requestedUserInfoClaims ?? []).includes(claim))) {
-		if (promptNone) return redirectWithPromptNoneError(ctx, opts, query, "consent_required", "End-User consent is required");
-		return redirectWithPromptCode(ctx, opts, "consent", { sessionId: session.session.id });
-	}
-	const consentedResources = consent?.resources ?? [];
-	if (requestedResources.some((requestedResource) => !consentedResources.includes(requestedResource))) {
-		if (promptNone) return redirectWithPromptNoneError(ctx, opts, query, "consent_required", "End-User consent is required");
+	const approve = async () => {
+		let authenticationContext;
+		try {
+			authenticationContext = await resolveAuthenticationContext(opts, {
+				user: session.user,
+				session: session.session,
+				client,
+				scopes,
+				headers,
+				query
+			});
+		} catch (error) {
+			if (!(error instanceof APIError$1)) throw error;
+			if (request.errorURL) return handleRedirect(ctx, request.errorURL(error));
+			const body = error.body;
+			return redirectWithAuthorizationError(ctx, opts, query, body?.error ?? "server_error", body?.error_description ?? "authentication context unavailable");
+		}
+		if (!canSatisfyEssentialAcrRequest(query.claims, authenticationContext.acr ?? "0")) return redirectWithAuthorizationError(ctx, opts, query, "access_denied", "essential acr requirement cannot be met");
+		return handleRedirect(ctx, await request.approve({
+			query,
+			userId: session.user.id,
+			sessionId: session.session.id,
+			authTime: new Date(session.session.createdAt).getTime(),
+			...authenticationContext,
+			referenceId
+		}));
+	};
+	if (client.skipConsent) return approve();
+	const consent = await findConsent(ctx, client.clientId, session.user.id, referenceId);
+	if (!consent || !consentCovers(consent, scopes, resources) || !userInfoClaims.every((claim) => (consent.requestedUserInfoClaims ?? []).includes(claim))) {
+		if (promptNone) return redirectWithAuthorizationError(ctx, opts, query, "consent_required", "End-User consent is required");
 		return redirectWithPromptCode(ctx, opts, "consent", { sessionId: session.session.id });
 	}
-	return redirectWithAuthorizationCode(ctx, opts, {
-		query,
-		clientId: client.clientId,
-		userId: session.user.id,
-		sessionId: session.session.id,
-		authTime: new Date(session.session.createdAt).getTime(),
-		referenceId,
-		resource: requestedResources
-	});
+	return approve();
 }
 function serializeAuthorizationQuery(query) {
 	const params = new URLSearchParams();
@@ -5772,7 +6002,8 @@ function serializeAuthorizationQuery(query) {
 	}
 	return params;
 }
-async function redirectWithAuthorizationCode(ctx, opts, verificationValue) {
+/** Stores a single-use authorization code and returns the client redirect URL carrying it. */
+async function createAuthorizationCodeURL(ctx, opts, verificationValue) {
 	const code = generateRandomString(32, "a-z", "A-Z", "0-9");
 	const iat = Math.floor(Date.now() / 1e3);
 	const exp = iat + (opts.codeExpiresIn ?? 600);
@@ -5787,6 +6018,8 @@ async function redirectWithAuthorizationCode(ctx, opts, verificationValue) {
 			sessionId: verificationValue?.sessionId,
 			referenceId: verificationValue.referenceId,
 			authTime: verificationValue.authTime,
+			acr: verificationValue.acr,
+			amr: verificationValue.amr,
 			resource: verificationValue.resource
 		})
 	};
@@ -5798,7 +6031,7 @@ async function redirectWithAuthorizationCode(ctx, opts, verificationValue) {
 	redirectUriWithCode.searchParams.set("code", code);
 	if (verificationValue.query.state) redirectUriWithCode.searchParams.set("state", verificationValue.query.state);
 	redirectUriWithCode.searchParams.set("iss", getIssuer(ctx, opts));
-	return handleRedirect(ctx, redirectUriWithCode.toString());
+	return redirectUriWithCode.toString();
 }
 async function redirectWithPromptCode(ctx, opts, type, options) {
 	const queryParams = await signParams(ctx, opts, { postLoginClearedForSession: type === "consent" && opts.postLogin ? options?.sessionId : void 0 });
@@ -5826,4 +6059,4 @@ async function signParams(ctx, opts, flags) {
 	return params.toString();
 }
 //#endregion
-export { registerClientMetadataDocument as a, isForbiddenCimdClientMetadataField as c, metadataResponse as d, oauthAuthorizationServerMetadata as f, oidcServerMetadata as h, oauthProvider as i, validatePublicClientJwks as l, oauthProviderOpenIdConfigMetadata as m, DEFAULT_OAUTH_SCOPES as n, client_assertion_exports as o, oauthProviderAuthServerMetadata as p, getOAuthProviderState as r, consumeClientAssertion as s, getIssuer as t, authServerMetadata as u };
+export { assertPublicRoutableHttpsUri as a, consumeClientAssertion as c, authServerMetadata as d, metadataResponse as f, oidcServerMetadata as g, oauthProviderOpenIdConfigMetadata as h, oauthProvider as i, validatePublicClientJwks as l, oauthProviderAuthServerMetadata as m, DEFAULT_OAUTH_SCOPES as n, registerClientMetadataDocument as o, oauthAuthorizationServerMetadata as p, getOAuthProviderState as r, client_assertion_exports as s, getIssuer as t, createOAuthEndpoint as u };