@better-auth/oauth-provider 1.7.9 → 1.8.0-beta.0

package/dist/index.mjs

@@ -1,11 +1,12 @@
-import { T as oauthClientMetadataSchema, b as ResourceUriSchema, f as extractRepeatedResourceFromForm, i as getOAuthProviderApi, v as resolveResourcePolicy } from "./introspect-7WCMPe5Z.mjs";
-import { D as validateClientScopes, N as extendOAuthProvider, O as verifyOAuthQueryParams, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-DKU5wblX.mjs";
-import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-D8r6mvZx.mjs";
+import { E as oauthClientMetadataSchema, r as getOAuthProviderApi, v as resolveResourcePolicy, x as ResourceUriSchema } from "./introspect-CEo9Q06v.mjs";
+import { C as parseScopes, H as extendOAuthProvider, I as validateClientScopes, L as verifyOAuthQueryParams, N as toResourceList, P as tokenError, i as consentCovers, l as findConsent, p as getOAuthProviderPlugin, u as getClient, v as normalizeClientAuthenticationParameters, w as readFormParams, y as normalizeTimestampValue } from "./utils-BMNe8Sg2.mjs";
+import { c as consumeClientAssertion, d as authServerMetadata, f as metadataResponse, g as oidcServerMetadata, h as oauthProviderOpenIdConfigMetadata, i as oauthProvider, m as oauthProviderAuthServerMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthAuthorizationServerMetadata, r as getOAuthProviderState, t as getIssuer } from "./authorize-92EtLsBi.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
-import { APIError } from "better-auth/api";
+import { appendQueryParams } from "@better-auth/core/utils/url";
+import { isAPIError } from "better-auth/api";
 import * as z from "zod";
 import { BetterAuthError } from "@better-auth/core/error";
-import { deviceAuthorization, redeemDeviceCode } from "better-auth/plugins/device-authorization";
+import { assertDeviceCodePending, buildVerificationUris, decideDeviceCode, deviceAuthorization, findDeviceCodeByUserCode, redeemDeviceCode } from "better-auth/plugins/device-authorization";
 //#region src/device-code.ts
 /**
 * RFC 8628 device authorization grant type. A registered OAuth client polls the
@@ -29,16 +30,6 @@ const oauthDeviceRequestFields = {
 	client_assertion_type: z.string().meta({ description: "OAuth client assertion type" }).optional(),
 	resource: deviceCodeResourceSchema.meta({ description: "RFC 8707 resource indicator(s) to bind to this authorization request" }).optional()
 };
-function tokenError(status, error, errorDescription) {
-	throw new APIError(status, {
-		error,
-		error_description: errorDescription
-	});
-}
-function parseScopes(scope) {
-	const normalized = scope?.trim();
-	return normalized ? normalized.split(/\s+/) : [];
-}
 /**
 * Exchanges an approved RFC 8628 device code for an OAuth token set. Unlike the
 * device-authorization plugin's `/device/token` (which mints a first-party
@@ -52,14 +43,14 @@ async function exchangeOAuthDeviceCode(input) {
 	const body = ctx.body;
 	const deviceCode = body?.device_code;
 	if (!deviceCode) tokenError("BAD_REQUEST", "invalid_request", "device_code is required");
-	const { authorizationContext: { client, confirmation, scopes }, redemptionContext: resources, user } = await redeemDeviceCode({
+	const authentication = await provider.authenticateClient({ requireCredentials: false });
+	const { authorizationContext: { client, scopes }, claimedDeviceCode, redemptionContext: { resources, confirmation }, user } = await redeemDeviceCode({
 		ctx,
 		deviceCode,
 		authorizeRedemption: async (record) => {
 			if (!record.oauthClientId) tokenError("BAD_REQUEST", "invalid_grant", "invalid device code");
 			if (body?.client_id && record.oauthClientId !== body.client_id) tokenError("BAD_REQUEST", "invalid_grant", "Client ID mismatch");
 			const scopes = parseScopes(record.scope);
-			const authentication = await provider.authenticateClient({ requireCredentials: false });
 			if (record.oauthClientId !== authentication.client.clientId) tokenError("BAD_REQUEST", "invalid_grant", "Client ID mismatch");
 			validateClientScopes(authentication.client, scopes);
 			return {
@@ -86,7 +77,15 @@ async function exchangeOAuthDeviceCode(input) {
 				clientId: authorization.client.clientId,
 				requestedScopes: authorization.scopes
 			});
-			return resources;
+			return {
+				resources,
+				confirmation: await provider.resolveConfirmation({
+					client: authorization.client,
+					scopes: authorization.scopes,
+					resources,
+					confirmation: authorization.confirmation
+				})
+			};
 		}
 	});
 	return provider.issueTokens({
@@ -94,10 +93,77 @@ async function exchangeOAuthDeviceCode(input) {
 		scopes,
 		user,
 		resources,
+		referenceId: claimedDeviceCode.referenceId ?? void 0,
+		authTime: normalizeTimestampValue(claimedDeviceCode.authTime),
+		acr: claimedDeviceCode.acr ?? void 0,
+		amr: claimedDeviceCode.amr ?? void 0,
+		originalResources: claimedDeviceCode.resources ?? void 0,
 		confirmation
 	});
 }
-function buildOAuthDeviceGrant() {
+/**
+* Lets the user approve an OAuth device code through `/oauth2/authorize`, so
+* device approvals run the same sign-in, account selection, post-login, and
+* consent pages as authorization requests. The user is bound to the code only
+* at the final approval, after any account switch.
+*/
+function deviceApprovalRequest(verificationUri) {
+	async function findOAuthDeviceCode(ctx, userCode) {
+		const deviceCode = await findDeviceCodeByUserCode(ctx, userCode);
+		if (!deviceCode?.oauthClientId) tokenError("BAD_REQUEST", "invalid_request", "Invalid user code");
+		return {
+			...deviceCode,
+			oauthClientId: deviceCode.oauthClientId
+		};
+	}
+	const verificationPage = (ctx, userCode) => buildVerificationUris(verificationUri, ctx.context.baseURL, userCode).verificationUriComplete;
+	const completionURL = (ctx, userCode, status) => appendQueryParams(verificationPage(ctx, userCode), new URLSearchParams({ status }));
+	return {
+		load: async ({ ctx, opts, value, signedQuery }) => {
+			const deviceCode = await findOAuthDeviceCode(ctx, value);
+			assertDeviceCodePending(deviceCode);
+			const client = await getClient(ctx, opts, deviceCode.oauthClientId);
+			if (!client) tokenError("BAD_REQUEST", "invalid_client", "client_id is required");
+			const scopes = parseScopes(signedQuery?.scope ?? deviceCode.scope);
+			return {
+				query: {
+					user_code: deviceCode.userCode,
+					client_id: client.clientId,
+					scope: scopes.join(" "),
+					resource: deviceCode.resources ?? []
+				},
+				client,
+				requireConsent: true,
+				approve: async (approval) => {
+					await decideDeviceCode(ctx, {
+						deviceCode,
+						userId: approval.userId,
+						decision: "approved",
+						fields: {
+							scope: approval.query.scope,
+							referenceId: approval.referenceId ?? null,
+							authTime: new Date(approval.authTime),
+							acr: approval.acr ?? null,
+							amr: approval.amr ?? null
+						}
+					});
+					return completionURL(ctx, deviceCode.userCode, "approved");
+				}
+			};
+		},
+		deny: async ({ ctx, value, userId }) => {
+			const deviceCode = await findOAuthDeviceCode(ctx, value);
+			await decideDeviceCode(ctx, {
+				deviceCode,
+				userId,
+				decision: "denied"
+			});
+			return completionURL(ctx, deviceCode.userCode, "denied");
+		},
+		errorPage: ({ ctx, value }) => verificationPage(ctx, value)
+	};
+}
+function buildOAuthDeviceGrant(verificationUri) {
 	return {
 		requestSchemaFields: oauthDeviceRequestFields,
 		requestErrorCodes: ["invalid_target"],
@@ -133,14 +199,30 @@ function buildOAuthDeviceGrant() {
 			oauthClientId: {
 				type: "string",
 				required: false
+			},
+			referenceId: {
+				type: "string",
+				required: false
+			},
+			authTime: {
+				type: "date",
+				required: false
+			},
+			acr: {
+				type: "string",
+				required: false
+			},
+			amr: {
+				type: "string[]",
+				required: false
 			}
 		},
 		grants: { [DEVICE_CODE_GRANT_TYPE]: exchangeOAuthDeviceCode },
 		metadata: (metadataInput) => ({ device_authorization_endpoint: `${metadataInput.ctx.context.baseURL}${DEVICE_AUTHORIZATION_PATH}` }),
 		authorizeRequest: async ({ ctx, request }) => {
 			const { detected: hasClientAuthentication } = await normalizeClientAuthenticationParameters(ctx.request, ctx.body ?? {});
-			const formResources = ctx.request ? await extractRepeatedResourceFromForm(ctx.request) : void 0;
-			if (formResources) {
+			const formResources = ctx.request ? (await readFormParams(ctx.request))?.getAll("resource").filter(Boolean) : void 0;
+			if (formResources?.length) {
 				const parsedResource = deviceCodeResourceSchema.safeParse(formResources.length === 1 ? formResources[0] : formResources);
 				if (!parsedResource.success) tokenError("BAD_REQUEST", "invalid_target", "Invalid resource indicator");
 				request.resource = parsedResource.data;
@@ -172,26 +254,12 @@ function buildOAuthDeviceGrant() {
 				}
 			};
 		},
-		assertSessionRedemption: ({ deviceCode }) => {
+		assertStandaloneUse: ({ deviceCode, use }) => {
 			if (typeof deviceCode.oauthClientId !== "string") return;
-			throw new APIError("BAD_REQUEST", {
-				error: "invalid_grant",
-				error_description: "This device code must be exchanged at the OAuth token endpoint (/oauth2/token)."
-			});
+			if (use === "redeem") tokenError("BAD_REQUEST", "invalid_grant", "This device code must be exchanged at the OAuth token endpoint (/oauth2/token).");
+			tokenError("BAD_REQUEST", "invalid_request", `Approve this device code through the OAuth provider: send the user to /oauth2/authorize?user_code=${encodeURIComponent(String(deviceCode.userCode))}.`);
 		},
-		getVerificationContext: (deviceCode) => {
-			if (typeof deviceCode.oauthClientId !== "string") return;
-			const resources = deviceCode.resources;
-			if (!Array.isArray(resources) || !resources.every((resource) => typeof resource === "string")) return;
-			return { resource: toAudienceClaim(resources) };
-		},
-		verificationOpenAPIProperties: { resource: {
-			oneOf: [{ type: "string" }, {
-				type: "array",
-				items: { type: "string" }
-			}],
-			description: "The requested resource indicators, returned only to the authenticated user who owns this request"
-		} }
+		interactionRequests: { user_code: deviceApprovalRequest(verificationUri) }
 	};
 }
 /**
@@ -214,7 +282,7 @@ function buildOAuthDeviceGrant() {
 * ```
 */
 function oauthDeviceAuthorization(options = {}) {
-	const grant = buildOAuthDeviceGrant();
+	const grant = buildOAuthDeviceGrant(options.verificationUri);
 	return {
 		...deviceAuthorization({
 			...options,
@@ -228,4 +296,93 @@ function oauthDeviceAuthorization(options = {}) {
 	};
 }
 //#endregion
-export { DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, ResourceUriSchema, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata, verifyOAuthQueryParams };
+//#region src/token-exchange.ts
+/** RFC 8693 §2.1 token exchange grant type. */
+const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+/** RFC 8693 §3 token type identifier for an OAuth 2.0 access token. */
+const ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+const NON_EXCHANGEABLE_SCOPES = new Set(["openid", "offline_access"]);
+function deny(description) {
+	tokenError("BAD_REQUEST", "invalid_request", description);
+}
+async function exchangeToken({ ctx, opts, provider }, options) {
+	const body = ctx.body ?? {};
+	const subjectToken = body.subject_token;
+	if (typeof subjectToken !== "string" || !subjectToken) deny("subject_token is required");
+	if (body.subject_token_type !== "urn:ietf:params:oauth:token-type:access_token") deny(`subject_token_type must be ${ACCESS_TOKEN_TYPE}`);
+	if (body.actor_token !== void 0 || body.actor_token_type !== void 0) deny("actor_token is not supported");
+	if (body.requested_token_type !== void 0 && body.requested_token_type !== "urn:ietf:params:oauth:token-type:access_token") deny("requested_token_type is not supported");
+	const targets = [body.resource, body.audience].flat().filter((target) => target != null);
+	if (targets.length === 0) deny("resource or audience is required");
+	const { client, confirmation } = await provider.authenticateClient();
+	const userInfo = `${ctx.context.baseURL}/oauth2/userinfo`;
+	if (targets.some((target) => typeof target !== "string" || !target || target === userInfo)) tokenError("BAD_REQUEST", "invalid_target", "each resource or audience must be a registered resource");
+	const resources = [...new Set(targets)];
+	const subject = await Promise.resolve(provider.validateAccessToken(subjectToken, client.clientId)).catch((error) => {
+		if (isAPIError(error)) return;
+		throw error;
+	});
+	if (!subject?.active || !subject.sub || !subject.exp) deny("subject_token is invalid");
+	const user = await ctx.context.internalAdapter.findUserById(subject.sub);
+	if (!user) deny("subject_token does not represent a user");
+	const exchangeable = parseScopes(subject.scope).filter((scope) => !NON_EXCHANGEABLE_SCOPES.has(scope));
+	const scopes = typeof body.scope === "string" && body.scope.trim() ? [...new Set(parseScopes(body.scope))] : exchangeable.filter((scope) => !client.scopes || client.scopes.includes(scope));
+	const widened = scopes.find((scope) => !exchangeable.includes(scope));
+	if (widened) tokenError("BAD_REQUEST", "invalid_scope", `scope ${widened} is not available through token exchange`);
+	validateClientScopes(client, scopes);
+	const { effectiveScopes } = await resolveResourcePolicy(ctx, opts, {
+		resource: resources,
+		clientId: client.clientId,
+		requestedScopes: scopes
+	});
+	const referenceId = typeof subject.reference_id === "string" && subject.reference_id || void 0;
+	if (!client.skipConsent) {
+		const consent = await findConsent(ctx, client.clientId, user.id, referenceId);
+		if (!consent || !consentCovers(consent, effectiveScopes, resources)) deny("the user has not consented to this client for this exchange");
+	}
+	if (options.allowExchange && !await options.allowExchange({
+		client,
+		user,
+		subjectToken: subject,
+		resources,
+		scopes: effectiveScopes,
+		referenceId
+	})) deny("token exchange denied by policy");
+	return provider.issueTokens({
+		client,
+		user,
+		scopes: effectiveScopes,
+		resources,
+		referenceId,
+		sessionId: typeof subject.sid === "string" ? subject.sid : void 0,
+		maxExpiresAt: /* @__PURE__ */ new Date(subject.exp * 1e3),
+		confirmation,
+		tokenResponse: { issued_token_type: ACCESS_TOKEN_TYPE }
+	});
+}
+/**
+* RFC 8693 token exchange for the OAuth Provider. A confidential client
+* registered for the token-exchange grant trades a user's access token, issued
+* by this server to it or for a resource it serves, for an access token to
+* another registered resource. The issued token represents the same user
+* (impersonation), carries the requesting client as `client_id`, and expires
+* no later than the subject token.
+*
+* @example
+* ```ts
+* const auth = betterAuth({
+*   plugins: [jwt(), oauthProvider({ ... }), oauthTokenExchange()],
+* });
+* ```
+*/
+function oauthTokenExchange(options = {}) {
+	const extension = { grants: { [TOKEN_EXCHANGE_GRANT_TYPE]: (input) => exchangeToken(input, options) } };
+	return {
+		id: "oauth-token-exchange",
+		init(ctx) {
+			extendOAuthProvider(ctx, extension);
+		}
+	};
+}
+//#endregion
+export { ACCESS_TOKEN_TYPE, DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, ResourceUriSchema, TOKEN_EXCHANGE_GRANT_TYPE, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oauthTokenExchange, oidcServerMetadata, verifyOAuthQueryParams };

package/dist/internal.d.mts

@@ -1,52 +1,120 @@
-import { H as Scope, V as SchemaClient, j as OAuthOptions, o as OAuthClient } from "./oauth-DAMtT2vg.mjs";
-import { JSONWebKeySet } from "jose";
-import { GenericEndpointContext } from "@better-auth/core";
+import { J as Scope, L as OAuthOptions, at as OAuthClientRegistrationResult, ct as registerClientMetadataDocument, ot as RegisterClientMetadataDocumentInput, st as assertPublicRoutableHttpsUri } from "./oauth-BlEuA8oD.mjs";
+import { a as validatePublicClientJwks, i as PublicClientJwksValidationResult, p as createOAuthEndpoint } from "./oauth-mdkaIwmm.mjs";
+import { b as getExtensionClientMetadataFields, i as validateClientScopes, n as parseClientMetadata, r as toResourceList } from "./index-sGnh4IfY.mjs";
+import { JWSAlgorithms } from "better-auth/plugins";
+import { Session, User } from "better-auth/types";
+import { AuthContext, GenericEndpointContext } from "@better-auth/core";
 
-//#region src/client-jwks.d.ts
-type PublicClientJwksValidationResult = {
-  valid: true;
-  jwks: JSONWebKeySet;
-} | {
-  valid: false;
-  error: "jwks must be an RFC 7517 JWK Set object with a non-empty keys array" | "jwks must contain only public asymmetric keys" | "jwks keys must be supported public JWKs with required key parameters" | "jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve";
-};
-/**
- * Validates an OAuth client's public asymmetric JWK set.
- *
- * This boundary accepts only the RFC 7517 `{ keys: [...] }` representation.
- * It performs no I/O and returns the validated set for downstream JOSE
- * verification.
- *
- * @internal
- */
-declare function validatePublicClientJwks(input: unknown): PublicClientJwksValidationResult;
+//#region src/authentication-context.d.ts
+/** The ACR values the provider may assert, advertised in discovery. */
+declare function getAcrValuesSupported(opts: OAuthOptions<Scope[]>): string[];
 //#endregion
 //#region src/client-metadata.d.ts
 declare function isForbiddenCimdClientMetadataField(field: string): boolean;
 //#endregion
-//#region src/register.d.ts
-interface OAuthClientRegistrationResult {
-  client: SchemaClient<Scope[]>;
-  clientSecret?: string;
-  resources: string[];
-  created: boolean;
-}
-interface RegisterClientMetadataDocumentInput {
-  metadata: OAuthClient;
-  clientId: string;
-  clientDiscoveryId: string;
-  existingClient?: SchemaClient<Scope[]>;
+//#region src/resources.d.ts
+/**
+ * Resolved resource policy for a single `/oauth2/token` (or `/oauth2/authorize`)
+ * request. Computed by {@link resolveResourcePolicy} and consumed by the
+ * token-issuance pipeline.
+ */
+interface ResolvedResourcePolicy {
+  /**
+   * The `aud` claim value:
+   * - `undefined` when the request omitted `resource` (legacy behavior)
+   * - a single string when exactly one resource was requested
+   * - an array when multiple were requested
+   *
+   * Includes the implicit `/oauth2/userinfo` audience when `openid` is in
+   * scope — the OIDC userinfo endpoint expects to find itself in `aud`.
+   */
+  audienceClaim: string | string[] | undefined;
+  /**
+   * Effective access-token TTL in seconds. `null` means "no resource-specific
+   * override — caller should use the plugin default."
+   *
+   * When multiple resources are requested, this is the **minimum** TTL
+   * across all of them (OAuth 2.1 §1.5 bounded-blast-radius rule).
+   */
+  accessTokenTtl: number | null;
+  /**
+   * Effective refresh-token TTL in seconds. `null` means "no resource-specific
+   * override — caller should use {@link OAuthOptions.refreshTokenExpiresIn}
+   * (or its built-in default)."
+   *
+   * When multiple resources are requested, this is the **minimum** TTL
+   * across all of them (same bounded-blast-radius rule as access tokens).
+   */
+  refreshTokenTtl: number | null;
+  /**
+   * Effective signing algorithm and key id for the issued token.
+   *
+   * The JWS Protected Header (RFC 7515 §4.1) carries exactly one `alg` and
+   * at most one `kid`, so a single signed token can satisfy a multi-resource
+   * request only when every resource's pins are mutually compatible:
+   * the set of unique non-null `signingAlgorithm` values across requested
+   * resources must be ≤ 1, and the same for `signingKeyId`. When the
+   * compatibility check passes, the single unique pin (if any) is honored;
+   * `null` means "no resource pinned this, fall back to the JWT plugin
+   * default." Conflicts raise `invalid_request`.
+   */
+  signingAlgorithm: JWSAlgorithms | null;
+  signingKeyId: string | null;
+  /**
+   * Merged custom claims across requested resources, returned RAW: reserved
+   * RFC 9068 names are NOT stripped here. Feed this into
+   * `resolveAccessTokenClaims`, which owns the single strip; do not place it on
+   * a token directly or a resource could override an AS-owned claim.
+   */
+  rawCustomClaims: Record<string, unknown>;
+  /**
+   * True when at least one requested resource requires DPoP-bound access
+   * tokens.
+   */
+  dpopBoundAccessTokensRequired: boolean;
+  /**
+   * The intersection of the caller's `requestedScopes` with each requested
+   * resource's `allowedScopes`. When no requested resource defines an
+   * allowlist, equals `requestedScopes` unchanged.
+   *
+   * - A resource with `allowedScopes: null` is treated as "no restriction"
+   *   for that resource (other resources' allowlists still apply).
+   * - A resource whose allowlist excludes every requested scope causes
+   *   {@link resolveResourcePolicy} to throw `invalid_scope`.
+   * - Otherwise this is the filtered scope set the token endpoint should
+   *   mint with (RFC 6749 §3.3 narrow-but-don't-widen).
+   */
+  effectiveScopes: string[];
 }
 /**
- * First-party persistence seam for a validated Client ID Metadata Document.
+ * Resolves the resource policy for a request.
  *
- * This operation owns both initial creation and atomic replacement. It never
- * generates a client secret, preserves operator-controlled flags on
- * replacement, and ensures server-default resource links in the same
- * transaction.
+ * Validation steps (RFC 8707 §3 + per-resource policy):
+ *
+ * 1. Resolve `resource` parameter to a list of identifiers.
+ * 2. For each identifier, look up the {@link OAuthResource} row.
+ *    - Missing → `invalid_target`.
+ *    - `disabled` → `invalid_target` (no new issuance).
+ * 3. If {@link OAuthOptions.enforcePerClientResources} resolves to true,
+ *    confirm the client is linked to every requested resource via
+ *    `oauthClientResource`. Unlinked → `invalid_target`.
+ * 4. Intersect `requestedScopes` with each resource's `allowedScopes`.
+ *    Empty intersection → `invalid_scope`.
+ * 5. Pick the minimum `accessTokenTtl` across requested resources.
+ * 6. Pick signing config — only honored for single-resource requests
+ *    (a JWT can only have one signature).
+ * 7. Merge per-resource `customClaims` (returned raw; reserved-claim
+ *    stripping is owned by `resolveAccessTokenClaims`).
+ *
+ * When no `resource` param is present, returns an empty policy: no `aud`
+ * claim and no resource-specific overrides.
  *
  * @internal
  */
-declare function registerClientMetadataDocument(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>, input: RegisterClientMetadataDocumentInput): Promise<OAuthClientRegistrationResult>;
+declare function resolveResourcePolicy(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>, params: {
+  resource: unknown;
+  clientId: string;
+  requestedScopes: string[];
+}): Promise<ResolvedResourcePolicy>;
 //#endregion
-export { type OAuthClientRegistrationResult, type PublicClientJwksValidationResult, type RegisterClientMetadataDocumentInput, isForbiddenCimdClientMetadataField, registerClientMetadataDocument, validatePublicClientJwks };
+export { type OAuthClientRegistrationResult, type PublicClientJwksValidationResult, type RegisterClientMetadataDocumentInput, assertPublicRoutableHttpsUri, createOAuthEndpoint, getAcrValuesSupported, getExtensionClientMetadataFields, isForbiddenCimdClientMetadataField, parseClientMetadata, registerClientMetadataDocument, resolveResourcePolicy, toResourceList, validateClientScopes, validatePublicClientJwks };

package/dist/internal.mjs

@@ -1,2 +1,4 @@
-import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-D8r6mvZx.mjs";
-export { isForbiddenCimdClientMetadataField, registerClientMetadataDocument, validatePublicClientJwks };
+import { A as getAcrValuesSupported, v as resolveResourcePolicy } from "./introspect-CEo9Q06v.mjs";
+import { I as validateClientScopes, N as toResourceList, W as getExtensionClientMetadataFields, et as isForbiddenCimdClientMetadataField, x as parseClientMetadata } from "./utils-BMNe8Sg2.mjs";
+import { a as assertPublicRoutableHttpsUri, l as validatePublicClientJwks, o as registerClientMetadataDocument, u as createOAuthEndpoint } from "./authorize-92EtLsBi.mjs";
+export { assertPublicRoutableHttpsUri, createOAuthEndpoint, getAcrValuesSupported, getExtensionClientMetadataFields, isForbiddenCimdClientMetadataField, parseClientMetadata, registerClientMetadataDocument, resolveResourcePolicy, toResourceList, validateClientScopes, validatePublicClientJwks };