@frontmcp/sdk 0.2.5 → 0.3.1

package/src/auth/flows/oauth.authorize.flow.d.ts

@@ -0,0 +1,231 @@
+/**
+ * Authorization Endpoint — GET /oauth/authorize
+ *
+ * Who calls: Browser via the Client (RP).
+ *
+ * When: Start of the flow.
+ *
+ * Purpose: Authenticate the user and obtain consent; returns an authorization code to the client’s redirect URI.
+ *
+ * Notes: Must support PKCE. Implicit/Hybrid are out in OAuth 2.1.
+ */
+/**
+ * Typical parameter shapes
+ *
+ * /oauth/authorize (GET)
+ *
+ * response_type=code, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method=S256, (optionally request_uri from PAR)
+ */
+import { FlowBase, FlowRunOptions } from "../../common";
+import { z } from "zod";
+/**
+ * Quick checklist (security & correctness)
+ * - PKCE (S256) required for public clients (and basically for all).
+ * - Use authorization code grant only (no implicit/hybrid).
+ * - Rotate refresh tokens and bind them to client + user + scopes.
+ * - Prefer private_key_jwt or mTLS for confidential clients.
+ * - PAR + JAR recommended for higher security.
+ * - Consider DPoP (proof-of-possession) to reduce token replay.
+ * - Keep codes very short-lived (e.g., ≤60 s) and single-use.
+ * - Publish discovery and JWKS, rotate keys safely.
+ * - Decide JWT vs opaque access tokens; provide introspection if opaque.
+ */
+declare const inputSchema: z.ZodObject<{
+    request: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    next: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    request: {} & {
+        [k: string]: unknown;
+    };
+    response: {} & {
+        [k: string]: unknown;
+    };
+    next?: ((...args: unknown[]) => unknown) | undefined;
+}, {
+    request: {} & {
+        [k: string]: unknown;
+    };
+    response: {} & {
+        [k: string]: unknown;
+    };
+    next?: ((...args: unknown[]) => unknown) | undefined;
+}>;
+declare const stateSchema: z.ZodObject<{
+    isDefaultAuthProvider: z.ZodBoolean;
+    isOrchestrated: z.ZodBoolean;
+    allowAnonymous: z.ZodBoolean;
+    redirectUri: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    allowAnonymous: boolean;
+    isOrchestrated: boolean;
+    isDefaultAuthProvider: boolean;
+    redirectUri?: string | undefined;
+}, {
+    allowAnonymous: boolean;
+    isOrchestrated: boolean;
+    isDefaultAuthProvider: boolean;
+    redirectUri?: string | undefined;
+}>;
+declare const outputSchema: z.ZodUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"redirect">;
+    status: z.ZodDefault<z.ZodType<301 | 302 | 303 | 307 | 308, z.ZodTypeDef, 301 | 302 | 303 | 307 | 308>>;
+    location: z.ZodString;
+} & {
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        path: z.ZodDefault<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        httpOnly: z.ZodDefault<z.ZodBoolean>;
+        secure: z.ZodOptional<z.ZodBoolean>;
+        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        expires: z.ZodOptional<z.ZodDate>;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        path: string;
+        name: string;
+        httpOnly: boolean;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }, {
+        value: string;
+        name: string;
+        path?: string | undefined;
+        domain?: string | undefined;
+        httpOnly?: boolean | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }>, "many">>>;
+}, "strip", z.ZodTypeAny, {
+    status: 301 | 302 | 303 | 307 | 308;
+    kind: "redirect";
+    location: string;
+    headers?: Record<string, string | string[]> | undefined;
+    cookies?: {
+        value: string;
+        path: string;
+        name: string;
+        httpOnly: boolean;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }[] | undefined;
+}, {
+    kind: "redirect";
+    location: string;
+    status?: 301 | 302 | 303 | 307 | 308 | undefined;
+    headers?: Record<string, string | string[]> | undefined;
+    cookies?: {
+        value: string;
+        name: string;
+        path?: string | undefined;
+        domain?: string | undefined;
+        httpOnly?: boolean | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }[] | undefined;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"text">;
+    status: z.ZodEffects<z.ZodNumber, number, number>;
+    body: z.ZodString;
+    contentType: z.ZodDefault<z.ZodString>;
+} & {
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        path: z.ZodDefault<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        httpOnly: z.ZodDefault<z.ZodBoolean>;
+        secure: z.ZodOptional<z.ZodBoolean>;
+        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        expires: z.ZodOptional<z.ZodDate>;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        path: string;
+        name: string;
+        httpOnly: boolean;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }, {
+        value: string;
+        name: string;
+        path?: string | undefined;
+        domain?: string | undefined;
+        httpOnly?: boolean | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }>, "many">>>;
+}, "strip", z.ZodTypeAny, {
+    status: number;
+    kind: "text";
+    body: string;
+    contentType: string;
+    headers?: Record<string, string | string[]> | undefined;
+    cookies?: {
+        value: string;
+        path: string;
+        name: string;
+        httpOnly: boolean;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }[] | undefined;
+}, {
+    status: number;
+    kind: "text";
+    body: string;
+    headers?: Record<string, string | string[]> | undefined;
+    cookies?: {
+        value: string;
+        name: string;
+        path?: string | undefined;
+        domain?: string | undefined;
+        httpOnly?: boolean | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }[] | undefined;
+    contentType?: string | undefined;
+}>]>;
+declare const plan: {
+    readonly pre: ["parseInput", "validateInput", "checkIfAuthorized"];
+    readonly execute: ["prepareAuthorizationRequest", "buildAuthorizeOutput"];
+    readonly post: ["validateOutput"];
+};
+declare global {
+    interface ExtendFlows {
+        'oauth:authorize': FlowRunOptions<OauthAuthorizeFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
+    }
+}
+declare const name: "oauth:authorize";
+export default class OauthAuthorizeFlow extends FlowBase<typeof name> {
+    parseInput(): Promise<void>;
+    validateInput(): Promise<void>;
+    checkIfAuthorized(): Promise<void>;
+    prepareAuthorizationRequest(): Promise<void>;
+    buildAuthorizeOutput(): Promise<void>;
+    validateOutput(): Promise<void>;
+}
+export {};

package/src/auth/flows/oauth.authorize.flow.js

@@ -0,0 +1,154 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+/**
+ * Authorization Endpoint — GET /oauth/authorize
+ *
+ * Who calls: Browser via the Client (RP).
+ *
+ * When: Start of the flow.
+ *
+ * Purpose: Authenticate the user and obtain consent; returns an authorization code to the client’s redirect URI.
+ *
+ * Notes: Must support PKCE. Implicit/Hybrid are out in OAuth 2.1.
+ */
+/**
+ * Typical parameter shapes
+ *
+ * /oauth/authorize (GET)
+ *
+ * response_type=code, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method=S256, (optionally request_uri from PAR)
+ */
+const common_1 = require("../../common");
+const zod_1 = require("zod");
+/**
+ * Quick checklist (security & correctness)
+ * - PKCE (S256) required for public clients (and basically for all).
+ * - Use authorization code grant only (no implicit/hybrid).
+ * - Rotate refresh tokens and bind them to client + user + scopes.
+ * - Prefer private_key_jwt or mTLS for confidential clients.
+ * - PAR + JAR recommended for higher security.
+ * - Consider DPoP (proof-of-possession) to reduce token replay.
+ * - Keep codes very short-lived (e.g., ≤60 s) and single-use.
+ * - Publish discovery and JWKS, rotate keys safely.
+ * - Decide JWT vs opaque access tokens; provide introspection if opaque.
+ */
+const inputSchema = common_1.httpInputSchema;
+const stateSchema = zod_1.z.object({
+    isDefaultAuthProvider: zod_1.z.boolean().describe("If FrontMcp initialized without auth options"),
+    isOrchestrated: zod_1.z.boolean().describe("If FrontMcp is orchestrated (local oauth proxy, remote oauth proxy)"),
+    allowAnonymous: zod_1.z.boolean().describe('Allow anonymous access, force orchestrated mode'),
+    redirectUri: zod_1.z.string().optional().describe('Oauth Redirect url')
+});
+const outputSchema = zod_1.z.union([
+    common_1.HttpRedirectSchema, // for account/login or oauth/callback
+    common_1.HttpTextSchema,
+]);
+const plan = {
+    pre: [
+        'parseInput',
+        'validateInput',
+        'checkIfAuthorized', // used for direct code generation if refresh-token is provided
+    ],
+    execute: [
+        'prepareAuthorizationRequest',
+        'buildAuthorizeOutput'
+    ],
+    post: [
+        'validateOutput',
+    ],
+};
+const name = 'oauth:authorize';
+const Stage = (0, common_1.StageHookOf)(name);
+let OauthAuthorizeFlow = class OauthAuthorizeFlow extends common_1.FlowBase {
+    async parseInput() {
+        const { metadata } = this.scope;
+        const { request } = this.rawInput;
+        const redirectUri = request.query['redirect_uri'];
+        if (!metadata.auth) {
+            this.state.set({
+                isOrchestrated: true,
+                allowAnonymous: true,
+                isDefaultAuthProvider: true,
+                redirectUri,
+            });
+        }
+        else {
+            this.next();
+        }
+    }
+    async validateInput() {
+        if (this.state.isDefaultAuthProvider) {
+            const redirectUri = `${this.state.required.redirectUri}?code=anonymous`;
+            this.respond(common_1.httpRespond.redirect(redirectUri));
+        }
+        /**
+         * check if redirect url valid
+         * check allowed origin
+         * check if valid authorize request (scope/challenge/state)
+         */
+    }
+    async checkIfAuthorized() {
+        // TBD
+    }
+    async prepareAuthorizationRequest() {
+        // TBD
+    }
+    async buildAuthorizeOutput() {
+        // TBD
+    }
+    async validateOutput() {
+        // TBD
+    }
+};
+tslib_1.__decorate([
+    Stage('parseInput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthAuthorizeFlow.prototype, "parseInput", null);
+tslib_1.__decorate([
+    Stage('validateInput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthAuthorizeFlow.prototype, "validateInput", null);
+tslib_1.__decorate([
+    Stage('checkIfAuthorized'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthAuthorizeFlow.prototype, "checkIfAuthorized", null);
+tslib_1.__decorate([
+    Stage('prepareAuthorizationRequest'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthAuthorizeFlow.prototype, "prepareAuthorizationRequest", null);
+tslib_1.__decorate([
+    Stage('buildAuthorizeOutput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthAuthorizeFlow.prototype, "buildAuthorizeOutput", null);
+tslib_1.__decorate([
+    Stage('validateOutput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthAuthorizeFlow.prototype, "validateOutput", null);
+OauthAuthorizeFlow = tslib_1.__decorate([
+    (0, common_1.Flow)({
+        name,
+        plan,
+        inputSchema,
+        outputSchema,
+        access: 'public',
+        middleware: {
+            method: 'GET',
+            path: '/oauth/authorize',
+        },
+    })
+], OauthAuthorizeFlow);
+exports.default = OauthAuthorizeFlow;
+//# sourceMappingURL=oauth.authorize.flow.js.map

package/src/auth/flows/oauth.authorize.flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.authorize.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/oauth.authorize.flow.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;GAUG;AACH;;;;;;GAMG;AACH,yCAOsB;AACtB,6BAAsB;AAEtB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,GAAG,wBAAe,CAAC;AAEpC,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,qBAAqB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IAC3F,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;IAC3G,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IACvF,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;CAClE,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,OAAC,CAAC,KAAK,CAAC;IAC3B,2BAAkB,EAAE,sCAAsC;IAC1D,uBAAc;CACf,CAAC,CAAC;AAGH,MAAM,IAAI,GAAG;IACX,GAAG,EAAE;QACH,YAAY;QACZ,eAAe;QACf,mBAAmB,EAAE,+DAA+D;KACrF;IACD,OAAO,EAAE;QACP,6BAA6B;QAC7B,sBAAsB;KACvB;IACD,IAAI,EAAE;QACJ,gBAAgB;KACjB;CACkC,CAAC;AActC,MAAM,IAAI,GAAG,iBAA0B,CAAC;AACxC,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAajB,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,iBAAqB;IAG7D,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAC,QAAQ,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAC9B,MAAM,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAEhC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAElD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBACb,cAAc,EAAE,IAAI;gBACpB,cAAc,EAAE,IAAI;gBACpB,qBAAqB,EAAE,IAAI;gBAC3B,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,EAAE,CAAA;QACb,CAAC;IACH,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;YACrC,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,iBAAiB,CAAC;YACxE,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;QACjD,CAAC;QACD;;;;WAIG;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,iBAAiB;QACrB,MAAM;IACR,CAAC;IAGK,AAAN,KAAK,CAAC,2BAA2B;QAC/B,MAAM;IACR,CAAC;IAGK,AAAN,KAAK,CAAC,oBAAoB;QACxB,MAAM;IACR,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc;QAClB,MAAM;IACR,CAAC;CACF,CAAA;AAlDO;IADL,KAAK,CAAC,YAAY,CAAC;;;;oDAiBnB;AAGK;IADL,KAAK,CAAC,eAAe,CAAC;;;;uDAWtB;AAGK;IADL,KAAK,CAAC,mBAAmB,CAAC;;;;2DAG1B;AAGK;IADL,KAAK,CAAC,6BAA6B,CAAC;;;;qEAGpC;AAGK;IADL,KAAK,CAAC,sBAAsB,CAAC;;;;8DAG7B;AAGK;IADL,KAAK,CAAC,gBAAgB,CAAC;;;;wDAGvB;AApDkB,kBAAkB;IAXtC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB;SACzB;KACF,CAAC;GACmB,kBAAkB,CAqDtC;kBArDoB,kBAAkB","sourcesContent":["/**\n * Authorization Endpoint — GET /oauth/authorize\n *\n * Who calls: Browser via the Client (RP).\n *\n * When: Start of the flow.\n *\n * Purpose: Authenticate the user and obtain consent; returns an authorization code to the client’s redirect URI.\n *\n * Notes: Must support PKCE. Implicit/Hybrid are out in OAuth 2.1.\n */\n/**\n * Typical parameter shapes\n *\n * /oauth/authorize (GET)\n *\n * response_type=code, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method=S256, (optionally request_uri from PAR)\n */\nimport {\n  Flow, FlowBase, FlowPlan,\n  FlowRunOptions,\n  httpInputSchema,\n  HttpRedirectSchema, httpRespond,\n  HttpTextSchema,\n  StageHookOf\n} from \"../../common\";\nimport {z} from \"zod\";\n\n/**\n * Quick checklist (security & correctness)\n * - PKCE (S256) required for public clients (and basically for all).\n * - Use authorization code grant only (no implicit/hybrid).\n * - Rotate refresh tokens and bind them to client + user + scopes.\n * - Prefer private_key_jwt or mTLS for confidential clients.\n * - PAR + JAR recommended for higher security.\n * - Consider DPoP (proof-of-possession) to reduce token replay.\n * - Keep codes very short-lived (e.g., ≤60 s) and single-use.\n * - Publish discovery and JWKS, rotate keys safely.\n * - Decide JWT vs opaque access tokens; provide introspection if opaque.\n */\nconst inputSchema = httpInputSchema;\n\nconst stateSchema = z.object({\n  isDefaultAuthProvider: z.boolean().describe(\"If FrontMcp initialized without auth options\"),\n  isOrchestrated: z.boolean().describe(\"If FrontMcp is orchestrated (local oauth proxy, remote oauth proxy)\"),\n  allowAnonymous: z.boolean().describe('Allow anonymous access, force orchestrated mode'),\n  redirectUri: z.string().optional().describe('Oauth Redirect url')\n});\n\nconst outputSchema = z.union([\n  HttpRedirectSchema, // for account/login or oauth/callback\n  HttpTextSchema,\n]);\n\n\nconst plan = {\n  pre: [\n    'parseInput',\n    'validateInput',\n    'checkIfAuthorized', // used for direct code generation if refresh-token is provided\n  ],\n  execute: [\n    'prepareAuthorizationRequest',\n    'buildAuthorizeOutput'\n  ],\n  post: [\n    'validateOutput',\n  ],\n} as const satisfies FlowPlan<string>;\n\ndeclare global {\n  interface ExtendFlows {\n    'oauth:authorize': FlowRunOptions<\n      OauthAuthorizeFlow,\n      typeof plan,\n      typeof inputSchema,\n      typeof outputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\nconst name = 'oauth:authorize' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'GET',\n    path: '/oauth/authorize',\n  },\n})\nexport default class OauthAuthorizeFlow extends FlowBase<typeof name> {\n\n  @Stage('parseInput')\n  async parseInput() {\n    const {metadata} = this.scope;\n    const {request} = this.rawInput;\n\n    const redirectUri = request.query['redirect_uri'];\n\n    if (!metadata.auth) {\n      this.state.set({\n        isOrchestrated: true,\n        allowAnonymous: true,\n        isDefaultAuthProvider: true,\n        redirectUri,\n      })\n    } else {\n      this.next()\n    }\n  }\n\n  @Stage('validateInput')\n  async validateInput() {\n    if (this.state.isDefaultAuthProvider) {\n      const redirectUri = `${this.state.required.redirectUri}?code=anonymous`;\n      this.respond(httpRespond.redirect(redirectUri))\n    }\n    /**\n     * check if redirect url valid\n     * check allowed origin\n     * check if valid authorize request (scope/challenge/state)\n     */\n  }\n\n  @Stage('checkIfAuthorized')\n  async checkIfAuthorized() {\n    // TBD\n  }\n\n  @Stage('prepareAuthorizationRequest')\n  async prepareAuthorizationRequest() {\n    // TBD\n  }\n\n  @Stage('buildAuthorizeOutput')\n  async buildAuthorizeOutput() {\n    // TBD\n  }\n\n  @Stage('validateOutput')\n  async validateOutput() {\n    // TBD\n  }\n}"]}

package/src/auth/flows/oauth.register.flow.d.ts

@@ -0,0 +1,202 @@
+/**
+ * Dynamic Client Registration — POST /oauth/register
+ *
+ * Who calls: Developers/automation.
+ *
+ * Purpose: Let clients register programmatically (redirect URIs, grant types, etc.).
+ */
+/**
+ * Quick checklist (security & correctness)
+ * - PKCE (S256) required for public clients (and basically for all).
+ * - Use authorization code grant only (no implicit/hybrid).
+ * - Rotate refresh tokens and bind them to client + user + scopes.
+ * - Prefer private_key_jwt or mTLS for confidential clients.
+ * - PAR + JAR recommended for higher security.
+ * - Consider DPoP (proof-of-possession) to reduce token replay.
+ * - Keep codes very short-lived (e.g., ≤60 s) and single-use.
+ * - Publish discovery and JWKS, rotate keys safely.
+ * - Decide JWT vs opaque access tokens; provide introspection if opaque.
+ */
+import { FlowBase, FlowRunOptions } from "../../common";
+import { z } from "zod";
+/** Simple in-memory registry (dev only) */
+type RegisteredClient = {
+    client_id: string;
+    client_secret?: string;
+    token_endpoint_auth_method: "none" | "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "tls_client_auth";
+    grant_types: string[];
+    response_types: string[];
+    redirect_uris: string[];
+    client_name?: string;
+    scope?: string;
+    created_at: number;
+    dev: boolean;
+};
+/** Optional: export getters so other flows can validate client_id */
+export declare const DevClientRegistry: {
+    get(client_id: string): RegisteredClient | undefined;
+    has(client_id: string): boolean;
+};
+declare const inputSchema: z.ZodObject<{
+    request: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    next: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    request: {} & {
+        [k: string]: unknown;
+    };
+    response: {} & {
+        [k: string]: unknown;
+    };
+    next?: ((...args: unknown[]) => unknown) | undefined;
+}, {
+    request: {} & {
+        [k: string]: unknown;
+    };
+    response: {} & {
+        [k: string]: unknown;
+    };
+    next?: ((...args: unknown[]) => unknown) | undefined;
+}>;
+declare const outputSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"json">;
+    status: z.ZodEffects<z.ZodNumber, number, number>;
+    body: z.ZodUnion<[z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>, z.ZodArray<z.ZodAny, "many">, z.ZodRecord<z.ZodString, z.ZodAny>]>;
+    contentType: z.ZodDefault<z.ZodString>;
+} & {
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        path: z.ZodDefault<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        httpOnly: z.ZodDefault<z.ZodBoolean>;
+        secure: z.ZodOptional<z.ZodBoolean>;
+        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        expires: z.ZodOptional<z.ZodDate>;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        path: string;
+        name: string;
+        httpOnly: boolean;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }, {
+        value: string;
+        name: string;
+        path?: string | undefined;
+        domain?: string | undefined;
+        httpOnly?: boolean | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }>, "many">>>;
+}, "strip", z.ZodTypeAny, {
+    status: number;
+    kind: "json";
+    body: any[] | z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | Record<string, any>;
+    contentType: string;
+    headers?: Record<string, string | string[]> | undefined;
+    cookies?: {
+        value: string;
+        path: string;
+        name: string;
+        httpOnly: boolean;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }[] | undefined;
+}, {
+    status: number;
+    kind: "json";
+    body: any[] | z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | Record<string, any>;
+    headers?: Record<string, string | string[]> | undefined;
+    cookies?: {
+        value: string;
+        name: string;
+        path?: string | undefined;
+        domain?: string | undefined;
+        httpOnly?: boolean | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }[] | undefined;
+    contentType?: string | undefined;
+}>;
+declare const stateSchema: z.ZodObject<{
+    body: z.ZodObject<{
+        redirect_uris: z.ZodArray<z.ZodString, "many">;
+        token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<["none", "client_secret_basic", "client_secret_post", "private_key_jwt", "tls_client_auth"]>>;
+        grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"]>, "many">>;
+        response_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["code"]>, "many">>;
+        client_name: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        redirect_uris: z.ZodArray<z.ZodString, "many">;
+        token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<["none", "client_secret_basic", "client_secret_post", "private_key_jwt", "tls_client_auth"]>>;
+        grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"]>, "many">>;
+        response_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["code"]>, "many">>;
+        client_name: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        redirect_uris: z.ZodArray<z.ZodString, "many">;
+        token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<["none", "client_secret_basic", "client_secret_post", "private_key_jwt", "tls_client_auth"]>>;
+        grant_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"]>, "many">>;
+        response_types: z.ZodDefault<z.ZodArray<z.ZodEnum<["code"]>, "many">>;
+        client_name: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>;
+    isDev: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    body: {
+        redirect_uris: string[];
+        token_endpoint_auth_method: "none" | "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "tls_client_auth";
+        grant_types: ("authorization_code" | "refresh_token" | "urn:ietf:params:oauth:grant-type:device_code")[];
+        response_types: "code"[];
+        scope?: string | undefined;
+        client_name?: string | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    isDev: boolean;
+}, {
+    body: {
+        redirect_uris: string[];
+        scope?: string | undefined;
+        token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "tls_client_auth" | undefined;
+        grant_types?: ("authorization_code" | "refresh_token" | "urn:ietf:params:oauth:grant-type:device_code")[] | undefined;
+        response_types?: "code"[] | undefined;
+        client_name?: string | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    isDev: boolean;
+}>;
+declare const plan: {
+    readonly pre: ["parseInput", "validateInput"];
+    readonly execute: ["registerClient", "respondRegistration"];
+    readonly post: ["validateOutput"];
+};
+declare global {
+    interface ExtendFlows {
+        'oauth:register': FlowRunOptions<OauthRegisterFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
+    }
+}
+declare const name: "oauth:register";
+export default class OauthRegisterFlow extends FlowBase<typeof name> {
+    private registered?;
+    parseInput(): Promise<void>;
+    validateInput(): Promise<void>;
+    registerClient(): Promise<void>;
+    respondRegistration(): Promise<void>;
+    validateOutput(): Promise<void>;
+}
+export {};