@better-auth/oauth-provider 1.7.9 → 1.8.0-beta.0

package/dist/{oauth-DAMtT2vg.d.mts → oauth-BlEuA8oD.d.mts}

@@ -1,10 +1,49 @@
 import * as z from "zod";
 import { PrivateKeyJwtSigningAlgorithm } from "@better-auth/core/oauth2";
-import { JWTPayload } from "jose";
 import { JWSAlgorithms } from "better-auth/plugins";
+import { JWTPayload } from "jose";
 import { InferOptionSchema, Session, User } from "better-auth/types";
 import { GenericEndpointContext, LiteralString } from "@better-auth/core";
 
+//#region src/register.d.ts
+type OAuthClientRegistrationMetadata = Omit<OAuthClient, "client_id" | "redirect_uris" | "client_secret_expires_at"> & {
+  client_id?: string;
+  redirect_uris?: string[];
+  client_secret_expires_at?: number | string;
+  metadata?: Record<string, unknown>;
+  resources?: string[];
+};
+/**
+ * Rejects a URI the server will POST to unless it is an absolute https URL
+ * with no fragment or credentials on a publicly routable host. Back-channel
+ * endpoints use it as an SSRF guard, since the server, not the browser, calls
+ * them.
+ */
+declare function assertPublicRoutableHttpsUri(field: string, uri: string): void;
+interface OAuthClientRegistrationResult {
+  client: SchemaClient<Scope[]>;
+  clientSecret?: string;
+  resources: string[];
+  created: boolean;
+}
+interface RegisterClientMetadataDocumentInput {
+  metadata: OAuthClient;
+  clientId: string;
+  clientDiscoveryId: string;
+  existingClient?: SchemaClient<Scope[]>;
+}
+/**
+ * First-party persistence seam for a validated Client ID Metadata Document.
+ *
+ * This operation owns both initial creation and atomic replacement. It never
+ * generates a client secret, preserves operator-controlled flags on
+ * replacement, and ensures server-default resource links in the same
+ * transaction.
+ *
+ * @internal
+ */
+declare function registerClientMetadataDocument(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>, input: RegisterClientMetadataDocumentInput): Promise<OAuthClientRegistrationResult>;
+//#endregion
 //#region src/schema.d.ts
 declare const schema: {
   oauthClient: {
@@ -40,6 +79,10 @@ declare const schema: {
         type: "string";
         required: false;
       };
+      sectorIdentifier: {
+        type: "string";
+        required: false;
+      };
       scopes: {
         type: "string[]";
         required: false;
@@ -118,6 +161,14 @@ declare const schema: {
         type: "boolean";
         required: false;
       };
+      frontchannelLogoutUri: {
+        type: "string";
+        required: false;
+      };
+      frontchannelLogoutSessionRequired: {
+        type: "boolean";
+        required: false;
+      };
       tokenEndpointAuthMethod: {
         type: "string";
         required: false;
@@ -371,6 +422,14 @@ declare const schema: {
         type: "date";
         required: false;
       };
+      acr: {
+        type: "string";
+        required: false;
+      };
+      amr: {
+        type: "string[]";
+        required: false;
+      };
       confirmation: {
         type: "json";
         required: false;
@@ -582,6 +641,8 @@ declare const clientRegistrationRequestSchema: z.ZodObject<{
   post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
   backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
   backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+  frontchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+  frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
   token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
   jwks: z.ZodOptional<z.ZodObject<{
     keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -614,26 +675,27 @@ declare const clientRegistrationRequestSchema: z.ZodObject<{
  * unknown extension without unsafe casts or ad-hoc allowlists.
  */
 declare const oauthClientMetadataSchema: z.ZodObject<{
-  contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
   jwks: z.ZodOptional<z.ZodObject<{
     keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
   }, z.core.$strip>>;
-  resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
   scope: z.ZodOptional<z.ZodString>;
-  redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
   client_name: z.ZodOptional<z.ZodString>;
   client_uri: z.ZodOptional<z.ZodString>;
   logo_uri: z.ZodOptional<z.ZodString>;
   tos_uri: z.ZodOptional<z.ZodString>;
   policy_uri: z.ZodOptional<z.ZodString>;
+  jwks_uri: z.ZodOptional<z.ZodString>;
   software_id: z.ZodOptional<z.ZodString>;
   software_version: z.ZodOptional<z.ZodString>;
   software_statement: z.ZodOptional<z.ZodString>;
+  redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
   post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
   backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
   backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+  frontchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+  frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
   token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
-  jwks_uri: z.ZodOptional<z.ZodString>;
   grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
   response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
     code: "code";
@@ -642,11 +704,12 @@ declare const oauthClientMetadataSchema: z.ZodObject<{
     web: "web";
     native: "native";
   }>>;
+  dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
   subject_type: z.ZodOptional<z.ZodEnum<{
     public: "public";
     pairwise: "pairwise";
   }>>;
-  dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+  resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
   client_id: z.ZodString;
   client_secret: z.ZodOptional<z.ZodString>;
   client_secret_expires_at: z.ZodOptional<z.ZodNumber>;
@@ -666,6 +729,55 @@ type ClientRegistrationRequest = z.infer<typeof clientRegistrationRequestSchema>
 //#endregion
 //#region src/types/index.d.ts
 type StoreTokenType = "access_token" | "refresh_token" | "authorization_code" | (string & {});
+/**
+ * The authentication context the provider asserts in ID tokens
+ * (OIDC Core 1.0 §2).
+ */
+interface OAuthAuthenticationContext {
+  /**
+   * Authentication Context Class Reference the session satisfies. Must be one
+   * of `acrValuesSupported`. Defaults to `"0"`.
+   */
+  acr?: string;
+  /**
+   * Authentication Methods References used for the session, such as
+   * `["pwd", "otp"]` (RFC 8176).
+   */
+  amr?: string[];
+}
+interface OAuthAuthenticationContextOptions<Scopes extends readonly Scope[] = InternallySupportedScopes[]> {
+  /**
+   * ACR values this provider can assert, advertised as
+   * `acr_values_supported` in discovery. Include `"0"` when `resolve` can
+   * return no `acr`.
+   */
+  acrValuesSupported: string[];
+  /**
+   * Returns the `acr` and `amr` the current session establishes. Called when
+   * the user approves an authorization request or a device code. Return only
+   * what the session actually proved; do not raise `acr` to match
+   * `requestedAcrValues`.
+   *
+   * An essential `acr` request (`claims.id_token.acr.essential`) that the
+   * returned `acr` does not satisfy fails with `access_denied`. A voluntary
+   * request (`acr_values` or a non-essential `acr` claim) never fails.
+   *
+   * Not called for requests without the `openid` scope, which issue no ID
+   * token.
+   */
+  resolve: (info: {
+    user: User & Record<string, unknown>;
+    session: Session & Record<string, unknown>;
+    client: SchemaClient<Scopes>; /** Scopes being approved */
+    scopes: string[]; /** Headers of the request approving the authorization */
+    headers: Headers;
+    /**
+     * ACR values the client requested, from `claims.id_token.acr` and
+     * `acr_values`, in order of preference.
+     */
+    requestedAcrValues: string[];
+  }) => Awaitable<OAuthAuthenticationContext | undefined>;
+}
 type InternallySupportedScopes = "openid" | "profile" | "email" | "offline_access";
 type Scope = LiteralString | InternallySupportedScopes;
 /**
@@ -779,6 +891,10 @@ interface OAuthTokenIssueParams {
     id: string;
   };
   authTime?: Date;
+  /** The `acr` ID token claim. Defaults to `"0"`. */
+  acr?: string;
+  /** The `amr` ID token claim. */
+  amr?: string[];
   verificationValue?: VerificationValue;
   resources?: string[];
   /** Full original authorized resources for the grant, used to seed refresh tokens. */
@@ -820,6 +936,14 @@ interface OAuthTokenIssueParams {
    * is stamped after, and cannot be overridden by, contributed claims.
    */
   confirmation?: Confirmation;
+  /**
+   * Latest time the access token may expire. The authorization server issues
+   * the earlier of this and its configured lifetime, so a grant derived from
+   * another token (for example RFC 8693 token exchange) cannot outlive it.
+   * If it is not in the future, issuance fails with `invalid_request`. Refresh
+   * and ID tokens are not capped, so such a grant should not issue them.
+   */
+  maxExpiresAt?: Date;
 }
 interface OAuthTokenResponse {
   access_token: string;
@@ -852,7 +976,10 @@ interface OAuthProviderApi {
    * or none). For assertion-based methods, the RFC 7523 audience is bound to the
    * endpoint serving the request, so an assertion cannot be replayed across
    * endpoints. Returns the authenticated client, plus any `confirmation` an
-   * assertion strategy proved.
+   * assertion strategy proved. A companion endpoint that accepts
+   * `application/x-www-form-urlencoded` must set `cloneRequest: true` in its
+   * endpoint options because client authentication re-reads the raw form body
+   * to enforce credential cardinality and reject mixed authentication methods.
    */
   authenticateClient: (request?: OAuthClientAuthenticationRequest) => Awaitable<OAuthAuthenticatedClient>;
   /**
@@ -869,6 +996,21 @@ interface OAuthProviderApi {
    * calling it.
    */
   issueTokens: (params: OAuthTokenIssueParams) => Awaitable<OAuthTokenResponse>;
+  /**
+   * Resolves the sender-constraint the tokens for this request will carry: the
+   * `confirmation` the client proved at authentication, or else the DPoP proof
+   * on this request, verified and required by the same rules `issueTokens`
+   * applies. A grant that consumes a one-time credential (a device code, a CIBA
+   * request) calls this before the claim and passes the result to
+   * `issueTokens` as `confirmation`, so a rejected proof leaves the credential
+   * for a retry with a valid one.
+   */
+  resolveConfirmation: (params: {
+    client: SchemaClient<Scope[]>;
+    scopes: string[];
+    resources?: string[];
+    confirmation?: Confirmation;
+  }) => Promise<Confirmation | undefined>;
   /**
    * Computes the stored lookup key for a token value (the same hash the
    * provider persists), so a caller can find or revoke a previously issued
@@ -998,7 +1140,7 @@ interface OAuthUserInfoExtensionInput {
  * `extendOAuthProvider(ctx, extension)` (or the `oauthProvider({ extensions })`
  * option).
  *
- * All five kinds live on one object so a single protocol plugin (for example
+ * All seven kinds live on one object so a single protocol plugin (for example
  * RFC 8693 token exchange, which adds a grant, advertises metadata, and emits
  * claims) registers atomically and the host validates the combined surface in
  * one place. Every field is independently optional, so a single-concern plugin
@@ -1006,10 +1148,11 @@ interface OAuthUserInfoExtensionInput {
  * just the one it needs. This is the shape every future OAuth RFC plugin copies.
  *
  * Two contribution disciplines:
- * - Dispatched kinds (`grants`, `clientAuthentication`) must be disjoint across
- *   extensions: registering a grant type, auth method, or assertion type that
- *   another extension already registered is rejected at setup, since the second
- *   would otherwise be silently unreachable.
+ * - Dispatched kinds (`grants`, `clientAuthentication`, `interactionRequests`)
+ *   must be disjoint across extensions: registering a grant type, auth method,
+ *   assertion type, or interaction parameter that another extension already
+ *   registered is rejected at setup, since the second would otherwise be
+ *   silently unreachable.
  * - Additive kinds (`metadata`, `claims`) never override authorization-server
  *   core; a key already owned by the provider is kept, and a key two extensions
  *   both contribute resolves to the first-registered extension.
@@ -1059,6 +1202,117 @@ interface OAuthProviderExtension {
    * registry, an attestation header) contributes it here.
    */
   clientDiscovery?: ClientDiscovery | ClientDiscovery[];
+  /**
+   * Client registration metadata the extension defines, such as CIBA's
+   * `backchannel_token_delivery_mode`. Extension fields live in the client's
+   * `metadata`.
+   */
+  clientMetadata?: {
+    /**
+     * Top-level registration fields the extension defines. Dynamic client
+     * registration (RFC 7591 §2) and client metadata documents (CIMD) both
+     * ignore unrecognized fields; they keep these and store them in the
+     * client's `metadata`, where admin-created clients put them too. Core
+     * and server-owned client fields cannot be claimed.
+     */
+    fields?: string[];
+    /**
+     * Validates the extension's fields when a client is registered through
+     * dynamic registration or a client metadata document, or created or
+     * updated by an admin. Throw an `APIError` with `invalid_client_metadata`
+     * to reject the client.
+     */
+    validate?: (input: OAuthClientMetadataExtensionInput) => Awaitable<void>;
+  };
+  /**
+   * Requests other than an authorization request that users approve through
+   * the `/oauth2/authorize` sign-in, account selection, post-login, and
+   * consent pages, keyed by the query parameter that identifies one, such as
+   * `user_code`. Every interaction page resumes them through
+   * `/oauth2/authorize`.
+   */
+  interactionRequests?: Record<string, OAuthInteractionRequestHandler>;
+}
+/**
+ * Parameters signed into each interaction page. An authorization request
+ * carries its `redirect_uri`; other interaction requests have none and add
+ * their own identifying parameter, such as `user_code`.
+ */
+type OAuthInteractionQuery = Omit<OAuthAuthorizationQuery, "redirect_uri"> & {
+  redirect_uri?: string | undefined;
+};
+/**
+ * A request the user reviews through the `/oauth2/authorize` sign-in,
+ * account selection, signup, post-login, and consent pages.
+ */
+interface OAuthInteractionRequest {
+  /** Signed into each interaction page; carries `prompt` and `max_age`. */
+  query: OAuthInteractionQuery;
+  /** The provider sends the user to the error page when this client is disabled. */
+  client: SchemaClient<Scope[]>;
+  /**
+   * Show the consent page even when consent is stored or the client skips
+   * it, and approve only in the request where the user accepts on that page.
+   */
+  requireConsent?: boolean | undefined;
+  /**
+   * Records the approval once every interaction is complete and returns the
+   * URL to send the user to.
+   */
+  approve: (approval: {
+    query: OAuthInteractionQuery;
+    userId: string;
+    sessionId: string;
+    authTime: number;
+    acr?: string;
+    amr?: string[];
+    referenceId?: string;
+  }) => Promise<string>;
+}
+/** Loads and denies one kind of {@link OAuthInteractionRequest}. */
+interface OAuthInteractionRequestHandler {
+  /**
+   * Loads the request identified by `value`. On a direct `/oauth2/authorize`
+   * request only `value` comes from the caller; when resuming after an
+   * interaction page, `signedQuery` is the query this server signed into it.
+   * Throw an `APIError` when the request can no longer be approved.
+   */
+  load: (input: {
+    ctx: GenericEndpointContext;
+    opts: OAuthOptions<Scope[]>;
+    value: string;
+    signedQuery?: OAuthInteractionQuery | undefined;
+  }) => Promise<OAuthInteractionRequest>;
+  /**
+   * Records a denial from the consent page and returns the URL to send the
+   * user to.
+   */
+  deny: (input: {
+    ctx: GenericEndpointContext;
+    value: string;
+    userId: string;
+  }) => Promise<string>;
+  /**
+   * Where to send the user when the request cannot be loaded, approved, or
+   * denied, such as a page where they can correct it. The provider appends
+   * `error` and `error_description`. Defaults to the provider error page.
+   */
+  errorPage?: (input: {
+    ctx: GenericEndpointContext;
+    value: string;
+  }) => string;
+}
+interface OAuthClientMetadataExtensionInput {
+  /**
+   * The client's core registration metadata after provider defaults. Read
+   * extension fields from `metadata`, not from here.
+   */
+  client: Omit<OAuthClientRegistrationMetadata, "metadata">;
+  /**
+   * The client's `metadata` as it will be stored, with reserved client field
+   * names removed. Extension fields are read from here.
+   */
+  metadata: Record<string, unknown>;
 }
 /**
  * Result of authorizing an RFC 7591 initial access token, returned by
@@ -1316,6 +1570,21 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @default 300 (5 minutes)
    */
   assertionMaxLifetime?: number;
+  /**
+   * Lets a confidential `private_key_jwt` client replace its own inline `jwks`
+   * at `POST /oauth2/client/rotate-keys`, authenticated by a client assertion
+   * signed with one of its current keys. No user session is involved.
+   *
+   * Clients that publish their keys at a `jwks_uri` rotate them there, so they
+   * cannot use this endpoint.
+   *
+   * Each rotation assertion must be single-use, so the provider refuses to
+   * start with this enabled on the memory adapter or with
+   * `advanced.database.generateId: "serial"`, neither of which enforces it.
+   *
+   * @default false
+   */
+  allowClientKeyRotation?: boolean;
   /**
    * Allows /oauth2/public-client-prelogin endpoint to be
    * requestable prior to login via a valid oauth_query.
@@ -1434,14 +1703,16 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * field.
    *
    * - `"web"`: the OIDC Registration §2 default. Omitted `application_type` is
-   *   treated as `web`, so custom-scheme redirect URIs are rejected.
+   *   treated as `web`, so custom-scheme and loopback redirect URIs are
+   *   rejected.
    * - `"native"`: omitted `application_type` is treated as `native`.
    * - `"infer"`: omitted `application_type` is treated as `native` when any
-   *   `redirect_uris` entry uses a non-http(s) scheme; otherwise `web`. Every
-   *   redirect URI is then validated against the native rules. Lets native MCP
-   *   clients that omit `application_type` (for example Cursor, which also
-   *   registers https and loopback callbacks) register without loosening
-   *   web-client redirect policy.
+   *   `redirect_uris` entry uses a non-http(s) scheme or is `http` on
+   *   `localhost`, `127.0.0.1`, or `[::1]`; otherwise `web`. Every redirect URI
+   *   of an inferred native client is then validated against the native rules.
+   *   Lets native MCP clients that omit `application_type` (for example Cursor,
+   *   or older Claude Code releases with an `http://127.0.0.1` callback)
+   *   register without loosening web-client redirect policy.
    *
    * An `application_type` the client actually sends is never overridden.
    * Applies only to dynamic client registration; managed clients and Client ID
@@ -1626,7 +1897,8 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
      */
     page: string;
     /**
-     * A value to tie to the consent reference_id.
+     * A value to tie to the consent reference_id. Consent is stored
+     * per reference; `undefined` or `""` uses consent given without one.
      *
      * Note that YOU must fail in this function if the requested
      * scope doesn't have a reference id and it should.
@@ -1752,6 +2024,14 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
      */
     requestedClaims: string[];
   }) => Awaitable<Record<string, any>>;
+  /**
+   * Asserts the `acr` and `amr` ID token claims for each approved
+   * authorization request.
+   *
+   * Without this option, ID tokens carry `acr: "0"` (OIDC level 0) and no
+   * `amr`.
+   */
+  authenticationContext?: OAuthAuthenticationContextOptions<Scopes>;
   /**
    * Custom claims attached to OIDC id tokens.
    *
@@ -1937,6 +2217,7 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    *   introspect: { window: 60, max: 100 },
    *   revoke: { window: 60, max: 30 },
    *   register: { window: 60, max: 5 },
+   *   rotateClientKeys: { window: 60, max: 5 },
    *   userinfo: { window: 60, max: 60 },
    * }
    * ```
@@ -1982,6 +2263,14 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
       window: number;
       max: number;
     } | false;
+    /**
+     * Rate limit for /oauth2/client/rotate-keys endpoint
+     * @default { window: 60, max: 5 }
+     */
+    rotateClientKeys?: {
+      window: number;
+      max: number;
+    } | false;
     /**
      * Rate limit for /oauth2/userinfo endpoint
      * @default { window: 60, max: 60 }
@@ -2282,6 +2571,8 @@ interface VerificationValue {
   resource?: string[];
   referenceId?: string;
   authTime?: number;
+  acr?: string;
+  amr?: string[];
 }
 /**
  * Client registered values as used within the plugin
@@ -2378,6 +2669,25 @@ interface SchemaClient<Scopes extends readonly Scope[] = InternallySupportedScop
    * @default false
    */
   backchannelLogoutSessionRequired?: boolean;
+  /**
+   * RP URL rendered in a hidden iframe on the OP's logout page when the
+   * end-user's session ends at `/oauth2/end-session`. Registering it is the
+   * per-client opt-in for front-channel logout. Must be absolute, without a
+   * fragment, and share the scheme, host, and port of a registered redirect
+   * URI.
+   *
+   * @see https://openid.net/specs/openid-connect-frontchannel-1_0.html#RPLogout
+   */
+  frontchannelLogoutUri?: string;
+  /**
+   * When true, the RP requires `iss` and `sid` query parameters on its
+   * front-channel logout URI. The OP includes both whenever it notifies a
+   * front-channel client, so this flag is stored but does not change
+   * delivery.
+   *
+   * @default false
+   */
+  frontchannelLogoutSessionRequired?: boolean;
   tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
   grantTypes?: GrantType[];
   responseTypes?: "code"[];
@@ -2410,6 +2720,12 @@ interface SchemaClient<Scopes extends readonly Scope[] = InternallySupportedScop
   enableEndSession?: boolean;
   /** Subject identifier type: "public" (default) or "pairwise" */
   subjectType?: "public" | "pairwise";
+  /**
+   * Pairwise sector, set by the server when the client is created. `null`
+   * for clients created before sectors were stored; those keep the sector
+   * derived from their first redirect URI host.
+   */
+  sectorIdentifier?: string | null;
   /** Reference to the owner of this client. Eg. Organization, Team, Profile */
   referenceId?: string;
   /**
@@ -2526,6 +2842,10 @@ interface OAuthRefreshToken<Scopes extends readonly Scope[] = InternallySupporte
    * Persisted so refreshed ID tokens can include a correct `auth_time` claim.
    */
   authTime?: Date;
+  /** The `acr` asserted at authorization, carried forward on rotation. */
+  acr?: string;
+  /** The `amr` asserted at authorization, carried forward on rotation. */
+  amr?: string[];
   /**
    * Scopes granted for this refresh token.
    *
@@ -2791,6 +3111,27 @@ interface AuthServerMetadata {
    * @see https://datatracker.ietf.org/doc/html/rfc9449
    */
   dpop_signing_alg_values_supported?: JWSAlgorithms[];
+  /**
+   * Boolean value specifying whether the OP supports HTTP-based (front-channel)
+   * logout, with true indicating support.
+   *
+   * Registered in the "OAuth Authorization Server Metadata" IANA registry
+   * under OpenID Connect Front-Channel Logout 1.0, so this may appear at both
+   * `.well-known/oauth-authorization-server` and `.well-known/openid-configuration`.
+   *
+   * @default false
+   * @see https://openid.net/specs/openid-connect-frontchannel-1_0.html#OPLogout
+   */
+  frontchannel_logout_supported?: boolean;
+  /**
+   * Boolean value specifying whether the OP can pass `iss` (issuer) and `sid`
+   * (session ID) query parameters to identify the RP session with the OP when
+   * the `frontchannel_logout_uri` is used.
+   *
+   * @default false
+   * @see https://openid.net/specs/openid-connect-frontchannel-1_0.html#OPLogout
+   */
+  frontchannel_logout_session_supported?: boolean;
 }
 /**
  * Metadata returned by the openid-configuration endpoint:
@@ -2930,6 +3271,25 @@ interface OAuthClient {
    * @see https://openid.net/specs/openid-connect-backchannel-1_0.html#RPMetadata
    */
   backchannel_logout_session_required?: boolean;
+  /**
+   * RP URL that the OP renders in a hidden iframe on its logout page so the
+   * RP can log itself out when the end-user's OP session ends at
+   * `/oauth2/end-session`. Must share the scheme, host, and port of one of
+   * the client's `redirect_uris`.
+   *
+   * @see https://openid.net/specs/openid-connect-frontchannel-1_0.html#RPLogout
+   */
+  frontchannel_logout_uri?: string;
+  /**
+   * When true, the RP requires `iss` and `sid` query parameters on its
+   * `frontchannel_logout_uri`. The OP includes both whenever it notifies a
+   * front-channel client, so this flag is stored but does not change
+   * delivery.
+   *
+   * @default false
+   * @see https://openid.net/specs/openid-connect-frontchannel-1_0.html#RPLogout
+   */
+  frontchannel_logout_session_required?: boolean;
   token_endpoint_auth_method?: TokenEndpointAuthMethod;
   grant_types?: GrantType[];
   response_types?: "code"[];
@@ -3007,4 +3367,4 @@ interface ResourceServerMetadata {
   dpop_bound_access_tokens_required?: boolean;
 }
 //#endregion
-export { OAuthOpaqueAccessToken as A, Prompt as B, OAuthClientAuthenticationStrategy as C, OAuthExtensionGrantHandler as D, OAuthConsent as E, OAuthResource as F, VerificationValue as G, Scope as H, OAuthResourceInput as I, ResourceUriSchema as J, ClientRegistrationRequest as K, OAuthTokenIssueParams as L, OAuthProviderApi as M, OAuthProviderExtension as N, OAuthExtensionGrantHandlerInput as O, OAuthRefreshToken as P, OAuthTokenResponse as R, OAuthClientAuthenticationResult as S, OAuthClientResource as T, StoreTokenType as U, SchemaClient as V, StoredAuthorizationQuery as W, oauthClientMetadataSchema as Y, OAuthAuthorizationQuery as _, GrantType as a, OAuthClientAuthenticationInput as b, ResourceServerMetadata as c, ActiveAccessTokenPayload as d, AuthorizePrompt as f, OAuthAuthenticatedClient as g, InitialAccessTokenAuthorization as h, Confirmation as i, OAuthOptions as j, OAuthMetadataExtensionInput as k, TokenEndpointAuthMethod as l, ClientMetadataResourceFetch as m, AuthServerMetadata as n, OAuthClient as o, ClientDiscovery as p, OAuthClientMetadata as q, BearerMethodsSupported as r, OIDCMetadata as s, AuthMethod as t, TokenType as u, OAuthClaimExtensionInput as v, OAuthClientRegistrationResponse as w, OAuthClientAuthenticationRequest as x, OAuthClientAdministrativeResponse as y, OAuthUserInfoExtensionInput as z };
+export { OAuthClientMetadata as $, OAuthExtensionGrantHandler as A, OAuthRefreshToken as B, OAuthClientAuthenticationRequest as C, OAuthClientRegistrationResponse as D, OAuthClientMetadataExtensionInput as E, OAuthMetadataExtensionInput as F, OAuthUserInfoExtensionInput as G, OAuthResourceInput as H, OAuthOpaqueAccessToken as I, Scope as J, Prompt as K, OAuthOptions as L, OAuthInteractionQuery as M, OAuthInteractionRequest as N, OAuthClientResource as O, OAuthInteractionRequestHandler as P, ClientRegistrationRequest as Q, OAuthProviderApi as R, OAuthClientAuthenticationInput as S, OAuthClientAuthenticationStrategy as T, OAuthTokenIssueParams as U, OAuthResource as V, OAuthTokenResponse as W, StoredAuthorizationQuery as X, StoreTokenType as Y, VerificationValue as Z, OAuthAuthenticationContext as _, GrantType as a, OAuthClientRegistrationResult as at, OAuthClaimExtensionInput as b, ResourceServerMetadata as c, registerClientMetadataDocument as ct, ActiveAccessTokenPayload as d, ResourceUriSchema as et, AuthorizePrompt as f, OAuthAuthenticatedClient as g, InitialAccessTokenAuthorization as h, Confirmation as i, OAuthClientRegistrationMetadata as it, OAuthExtensionGrantHandlerInput as j, OAuthConsent as k, TokenEndpointAuthMethod as l, ClientMetadataResourceFetch as m, AuthServerMetadata as n, oauthClientMetadataSchema as nt, OAuthClient as o, RegisterClientMetadataDocumentInput as ot, ClientDiscovery as p, SchemaClient as q, BearerMethodsSupported as r, Awaitable as rt, OIDCMetadata as s, assertPublicRoutableHttpsUri as st, AuthMethod as t, clientRegistrationRequestSchema as tt, TokenType as u, OAuthAuthenticationContextOptions as v, OAuthClientAuthenticationResult as w, OAuthClientAdministrativeResponse as x, OAuthAuthorizationQuery as y, OAuthProviderExtension as z };