@jeffjassky/oauth-host 0.3.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeffjassky/oauth-host",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "OAuth 2.1 + OIDC authorization server for Express/Mongoose apps.",
   "license": "MIT",
   "author": "Jeff Jassky <jeff@jeffjassky.com>",
@@ -43,6 +43,9 @@
   "engines": {
     "node": ">=20"
   },
+  "dependencies": {
+    "jose": "^6.2.10"
+  },
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",

package/types/index.d.ts

@@ -422,6 +422,19 @@ export interface OAuthClientDoc {
   metadataFetchedAt?: Date;
   /** Last `ETag`, replayed as `If-None-Match` so an unchanged document is a 304. */
   metadataEtag?: string;
+  /**
+   * The usable (intersected) token endpoint auth method set for a CIMD
+   * client — what `validateMetadataDocument` computed from the document's
+   * offered methods ∩ what this server supports. Absent on a manual
+   * registration; its behavior derives from `type` exactly as before. A row
+   * with no value here supports `private_key_jwt` never — see
+   * `authenticateClient`.
+   */
+  tokenEndpointAuthMethods?: string[];
+  /** `private_key_jwt` key source: a JWKS URL. Mutually exclusive with `jwks`. */
+  jwksUri?: string;
+  /** `private_key_jwt` key source: an inline JWK Set. Mutually exclusive with `jwksUri`. */
+  jwks?: unknown;
   /** First-party marker. Reserved — v1 never skips consent. */
   trusted: boolean;
   /** Empty for a public client. There is no secret to store. */