@nocobase/plugin-idp-oauth 2.3.0-beta.12 → 2.3.0-beta.14

package/dist/node_modules/light-my-request/node_modules/cookie/dist/index.js

@@ -0,0 +1,350 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCookie = parseCookie;
+exports.parse = parseCookie;
+exports.stringifyCookie = stringifyCookie;
+exports.stringifySetCookie = stringifySetCookie;
+exports.serialize = stringifySetCookie;
+exports.parseSetCookie = parseSetCookie;
+exports.stringifySetCookie = stringifySetCookie;
+exports.serialize = stringifySetCookie;
+/**
+ * RegExp to match cookie-name in RFC 6265 sec 4.1.1
+ * This refers out to the obsoleted definition of token in RFC 2616 sec 2.2
+ * which has been replaced by the token definition in RFC 7230 appendix B.
+ *
+ * cookie-name       = token
+ * token             = 1*tchar
+ * tchar             = "!" / "#" / "$" / "%" / "&" / "'" /
+ *                     "*" / "+" / "-" / "." / "^" / "_" /
+ *                     "`" / "|" / "~" / DIGIT / ALPHA
+ *
+ * Note: Allowing more characters - https://github.com/jshttp/cookie/issues/191
+ * Allow same range as cookie value, except `=`, which delimits end of name.
+ */
+const cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
+/**
+ * RegExp to match cookie-value in RFC 6265 sec 4.1.1
+ *
+ * cookie-value      = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
+ * cookie-octet      = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+ *                     ; US-ASCII characters excluding CTLs,
+ *                     ; whitespace DQUOTE, comma, semicolon,
+ *                     ; and backslash
+ *
+ * Allowing more characters: https://github.com/jshttp/cookie/issues/191
+ * Comma, backslash, and DQUOTE are not part of the parsing algorithm.
+ */
+const cookieValueRegExp = /^[\u0021-\u003A\u003C-\u007E]*$/;
+/**
+ * RegExp to match domain-value in RFC 6265 sec 4.1.1
+ *
+ * domain-value      = <subdomain>
+ *                     ; defined in [RFC1034], Section 3.5, as
+ *                     ; enhanced by [RFC1123], Section 2.1
+ * <subdomain>       = <label> | <subdomain> "." <label>
+ * <label>           = <let-dig> [ [ <ldh-str> ] <let-dig> ]
+ *                     Labels must be 63 characters or less.
+ *                     'let-dig' not 'letter' in the first char, per RFC1123
+ * <ldh-str>         = <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+ * <let-dig-hyp>     = <let-dig> | "-"
+ * <let-dig>         = <letter> | <digit>
+ * <letter>          = any one of the 52 alphabetic characters A through Z in
+ *                     upper case and a through z in lower case
+ * <digit>           = any one of the ten digits 0 through 9
+ *
+ * Keep support for leading dot: https://github.com/jshttp/cookie/issues/173
+ *
+ * > (Note that a leading %x2E ("."), if present, is ignored even though that
+ * character is not permitted, but a trailing %x2E ("."), if present, will
+ * cause the user agent to ignore the attribute.)
+ */
+const domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+/**
+ * RegExp to match path-value in RFC 6265 sec 4.1.1
+ *
+ * path-value        = <any CHAR except CTLs or ";">
+ * CHAR              = %x01-7F
+ *                     ; defined in RFC 5234 appendix B.1
+ */
+const pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
+/**
+ * RegExp to match max-age-value in RFC 6265 sec 5.6.2
+ */
+const maxAgeRegExp = /^-?\d+$/;
+const __toString = Object.prototype.toString;
+const NullObject = /* @__PURE__ */ (() => {
+    const C = function () { };
+    C.prototype = Object.create(null);
+    return C;
+})();
+/**
+ * Parse a `Cookie` header.
+ *
+ * Parse the given cookie header string into an object
+ * The object has the various cookies as keys(names) => values
+ */
+function parseCookie(str, options) {
+    const obj = new NullObject();
+    const len = str.length;
+    // RFC 6265 sec 4.1.1, RFC 2616 2.2 defines a cookie name consists of one char minimum, plus '='.
+    if (len < 2)
+        return obj;
+    const dec = options?.decode || decode;
+    let index = 0;
+    do {
+        const eqIdx = eqIndex(str, index, len);
+        if (eqIdx === -1)
+            break; // No more cookie pairs.
+        const endIdx = endIndex(str, index, len);
+        if (eqIdx > endIdx) {
+            // backtrack on prior semicolon
+            index = str.lastIndexOf(";", eqIdx - 1) + 1;
+            continue;
+        }
+        const key = valueSlice(str, index, eqIdx);
+        // only assign once
+        if (obj[key] === undefined) {
+            obj[key] = dec(valueSlice(str, eqIdx + 1, endIdx));
+        }
+        index = endIdx + 1;
+    } while (index < len);
+    return obj;
+}
+/**
+ * Stringifies an object into an HTTP `Cookie` header.
+ */
+function stringifyCookie(cookie, options) {
+    const enc = options?.encode || encodeURIComponent;
+    const cookieStrings = [];
+    for (const name of Object.keys(cookie)) {
+        const val = cookie[name];
+        if (val === undefined)
+            continue;
+        if (!cookieNameRegExp.test(name)) {
+            throw new TypeError(`cookie name is invalid: ${name}`);
+        }
+        const value = enc(val);
+        if (!cookieValueRegExp.test(value)) {
+            throw new TypeError(`cookie val is invalid: ${val}`);
+        }
+        cookieStrings.push(`${name}=${value}`);
+    }
+    return cookieStrings.join("; ");
+}
+function stringifySetCookie(_name, _val, _opts) {
+    const cookie = typeof _name === "object"
+        ? _name
+        : { ..._opts, name: _name, value: String(_val) };
+    const options = typeof _val === "object" ? _val : _opts;
+    const enc = options?.encode || encodeURIComponent;
+    if (!cookieNameRegExp.test(cookie.name)) {
+        throw new TypeError(`argument name is invalid: ${cookie.name}`);
+    }
+    const value = cookie.value ? enc(cookie.value) : "";
+    if (!cookieValueRegExp.test(value)) {
+        throw new TypeError(`argument val is invalid: ${cookie.value}`);
+    }
+    let str = cookie.name + "=" + value;
+    if (cookie.maxAge !== undefined) {
+        if (!Number.isInteger(cookie.maxAge)) {
+            throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);
+        }
+        str += "; Max-Age=" + cookie.maxAge;
+    }
+    if (cookie.domain) {
+        if (!domainValueRegExp.test(cookie.domain)) {
+            throw new TypeError(`option domain is invalid: ${cookie.domain}`);
+        }
+        str += "; Domain=" + cookie.domain;
+    }
+    if (cookie.path) {
+        if (!pathValueRegExp.test(cookie.path)) {
+            throw new TypeError(`option path is invalid: ${cookie.path}`);
+        }
+        str += "; Path=" + cookie.path;
+    }
+    if (cookie.expires) {
+        if (!isDate(cookie.expires) || !Number.isFinite(cookie.expires.valueOf())) {
+            throw new TypeError(`option expires is invalid: ${cookie.expires}`);
+        }
+        str += "; Expires=" + cookie.expires.toUTCString();
+    }
+    if (cookie.httpOnly) {
+        str += "; HttpOnly";
+    }
+    if (cookie.secure) {
+        str += "; Secure";
+    }
+    if (cookie.partitioned) {
+        str += "; Partitioned";
+    }
+    if (cookie.priority) {
+        const priority = typeof cookie.priority === "string"
+            ? cookie.priority.toLowerCase()
+            : undefined;
+        switch (priority) {
+            case "low":
+                str += "; Priority=Low";
+                break;
+            case "medium":
+                str += "; Priority=Medium";
+                break;
+            case "high":
+                str += "; Priority=High";
+                break;
+            default:
+                throw new TypeError(`option priority is invalid: ${cookie.priority}`);
+        }
+    }
+    if (cookie.sameSite) {
+        const sameSite = typeof cookie.sameSite === "string"
+            ? cookie.sameSite.toLowerCase()
+            : cookie.sameSite;
+        switch (sameSite) {
+            case true:
+            case "strict":
+                str += "; SameSite=Strict";
+                break;
+            case "lax":
+                str += "; SameSite=Lax";
+                break;
+            case "none":
+                str += "; SameSite=None";
+                break;
+            default:
+                throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);
+        }
+    }
+    return str;
+}
+/**
+ * Deserialize a `Set-Cookie` header into an object.
+ *
+ * deserialize('foo=bar; httpOnly')
+ *   => { name: 'foo', value: 'bar', httpOnly: true }
+ */
+function parseSetCookie(str, options) {
+    const dec = options?.decode || decode;
+    const len = str.length;
+    const endIdx = endIndex(str, 0, len);
+    const eqIdx = eqIndex(str, 0, endIdx);
+    const setCookie = eqIdx === -1
+        ? { name: "", value: dec(valueSlice(str, 0, endIdx)) }
+        : {
+            name: valueSlice(str, 0, eqIdx),
+            value: dec(valueSlice(str, eqIdx + 1, endIdx)),
+        };
+    let index = endIdx + 1;
+    while (index < len) {
+        const endIdx = endIndex(str, index, len);
+        const eqIdx = eqIndex(str, index, endIdx);
+        const attr = eqIdx === -1
+            ? valueSlice(str, index, endIdx)
+            : valueSlice(str, index, eqIdx);
+        const val = eqIdx === -1 ? undefined : valueSlice(str, eqIdx + 1, endIdx);
+        switch (attr.toLowerCase()) {
+            case "httponly":
+                setCookie.httpOnly = true;
+                break;
+            case "secure":
+                setCookie.secure = true;
+                break;
+            case "partitioned":
+                setCookie.partitioned = true;
+                break;
+            case "domain":
+                setCookie.domain = val;
+                break;
+            case "path":
+                setCookie.path = val;
+                break;
+            case "max-age":
+                if (val && maxAgeRegExp.test(val))
+                    setCookie.maxAge = Number(val);
+                break;
+            case "expires":
+                if (!val)
+                    break;
+                const date = new Date(val);
+                if (Number.isFinite(date.valueOf()))
+                    setCookie.expires = date;
+                break;
+            case "priority":
+                if (!val)
+                    break;
+                const priority = val.toLowerCase();
+                if (priority === "low" ||
+                    priority === "medium" ||
+                    priority === "high") {
+                    setCookie.priority = priority;
+                }
+                break;
+            case "samesite":
+                if (!val)
+                    break;
+                const sameSite = val.toLowerCase();
+                if (sameSite === "lax" ||
+                    sameSite === "strict" ||
+                    sameSite === "none") {
+                    setCookie.sameSite = sameSite;
+                }
+                break;
+        }
+        index = endIdx + 1;
+    }
+    return setCookie;
+}
+/**
+ * Find the `;` character between `min` and `len` in str.
+ */
+function endIndex(str, min, len) {
+    const index = str.indexOf(";", min);
+    return index === -1 ? len : index;
+}
+/**
+ * Find the `=` character between `min` and `max` in str.
+ */
+function eqIndex(str, min, max) {
+    const index = str.indexOf("=", min);
+    return index < max ? index : -1;
+}
+/**
+ * Slice out a value between startPod to max.
+ */
+function valueSlice(str, min, max) {
+    let start = min;
+    let end = max;
+    do {
+        const code = str.charCodeAt(start);
+        if (code !== 0x20 /*   */ && code !== 0x09 /* \t */)
+            break;
+    } while (++start < end);
+    while (end > start) {
+        const code = str.charCodeAt(end - 1);
+        if (code !== 0x20 /*   */ && code !== 0x09 /* \t */)
+            break;
+        end--;
+    }
+    return str.slice(start, end);
+}
+/**
+ * URL-decode string value. Optimized to skip native call when no %.
+ */
+function decode(str) {
+    if (str.indexOf("%") === -1)
+        return str;
+    try {
+        return decodeURIComponent(str);
+    }
+    catch (e) {
+        return str;
+    }
+}
+/**
+ * Determine if value is a Date.
+ */
+function isDate(val) {
+    return __toString.call(val) === "[object Date]";
+}
+//# sourceMappingURL=index.js.map

package/dist/node_modules/light-my-request/node_modules/cookie/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "cookie",
+  "version": "1.1.1",
+  "description": "HTTP server cookie parsing and serialization",
+  "keywords": [
+    "cookie",
+    "cookies"
+  ],
+  "repository": "jshttp/cookie",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
+  "license": "MIT",
+  "author": "Roman Shtylman <shtylman@gmail.com>",
+  "contributors": [
+    "Douglas Christopher Wilson <doug@somethingdoug.com>"
+  ],
+  "sideEffects": false,
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist/"
+  ],
+  "scripts": {
+    "bench": "vitest bench",
+    "build": "ts-scripts build",
+    "format": "ts-scripts format",
+    "prepare": "ts-scripts install",
+    "prepublishOnly": "npm run build",
+    "specs": "ts-scripts specs",
+    "test": "ts-scripts test"
+  },
+  "devDependencies": {
+    "@borderless/ts-scripts": "^0.15.0",
+    "@vitest/coverage-v8": "^3.2.4",
+    "top-sites": "1.1.194",
+    "typescript": "^5.6.2",
+    "vitest": "^3.2.4"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "ts-scripts": {
+    "project": "tsconfig.build.json"
+  }
+}

package/dist/node_modules/light-my-request/package.json

@@ -1 +1 @@
-{"name":"light-my-request","version":"6.6.0","description":"Fake HTTP injection library","main":"index.js","type":"commonjs","types":"types/index.d.ts","dependencies":{"cookie":"^1.0.1","process-warning":"^4.0.0","set-cookie-parser":"^2.6.0"},"devDependencies":{"@fastify/ajv-compiler":"^4.0.0","@fastify/pre-commit":"^2.1.0","@types/node":"^22.7.7","c8":"^10.1.2","end-of-stream":"^1.4.4","eslint":"^9.17.0","express":"^4.19.2","form-auto-content":"^3.2.1","form-data":"^4.0.0","formdata-node":"^6.0.3","multer":"^1.4.5-lts.1","neostandard":"^0.12.0","tinybench":"^3.0.0","tsd":"^0.31.0","undici":"^7.0.0"},"scripts":{"benchmark":"node benchmark/benchmark.js","coverage":"npm run unit -- --cov --coverage-report=html","lint":"eslint","lint:fix":"eslint --fix","test":"npm run lint && npm run test:unit && npm run test:typescript","test:typescript":"tsd","test:unit":"c8 --100 node --test"},"repository":{"type":"git","url":"git+https://github.com/fastify/light-my-request.git"},"keywords":["http","inject","fake","request","server"],"author":"Tomas Della Vedova - @delvedor (http://delved.org)","contributors":[{"name":"Matteo Collina","email":"hello@matteocollina.com"},{"name":"Manuel Spigolon","email":"behemoth89@gmail.com"},{"name":"Aras Abbasi","email":"aras.abbasi@gmail.com"},{"name":"Frazer Smith","email":"frazer.dev@icloud.com","url":"https://github.com/fdawgs"}],"license":"BSD-3-Clause","bugs":{"url":"https://github.com/fastify/light-my-request/issues"},"homepage":"https://github.com/fastify/light-my-request#readme","funding":[{"type":"github","url":"https://github.com/sponsors/fastify"},{"type":"opencollective","url":"https://opencollective.com/fastify"}],"_lastModified":"2026-09-24T04:29:31.722Z"}
+{"name":"light-my-request","version":"6.6.0","description":"Fake HTTP injection library","main":"index.js","type":"commonjs","types":"types/index.d.ts","dependencies":{"cookie":"^1.0.1","process-warning":"^4.0.0","set-cookie-parser":"^2.6.0"},"devDependencies":{"@fastify/ajv-compiler":"^4.0.0","@fastify/pre-commit":"^2.1.0","@types/node":"^22.7.7","c8":"^10.1.2","end-of-stream":"^1.4.4","eslint":"^9.17.0","express":"^4.19.2","form-auto-content":"^3.2.1","form-data":"^4.0.0","formdata-node":"^6.0.3","multer":"^1.4.5-lts.1","neostandard":"^0.12.0","tinybench":"^3.0.0","tsd":"^0.31.0","undici":"^7.0.0"},"scripts":{"benchmark":"node benchmark/benchmark.js","coverage":"npm run unit -- --cov --coverage-report=html","lint":"eslint","lint:fix":"eslint --fix","test":"npm run lint && npm run test:unit && npm run test:typescript","test:typescript":"tsd","test:unit":"c8 --100 node --test"},"repository":{"type":"git","url":"git+https://github.com/fastify/light-my-request.git"},"keywords":["http","inject","fake","request","server"],"author":"Tomas Della Vedova - @delvedor (http://delved.org)","contributors":[{"name":"Matteo Collina","email":"hello@matteocollina.com"},{"name":"Manuel Spigolon","email":"behemoth89@gmail.com"},{"name":"Aras Abbasi","email":"aras.abbasi@gmail.com"},{"name":"Frazer Smith","email":"frazer.dev@icloud.com","url":"https://github.com/fdawgs"}],"license":"BSD-3-Clause","bugs":{"url":"https://github.com/fastify/light-my-request/issues"},"homepage":"https://github.com/fastify/light-my-request#readme","funding":[{"type":"github","url":"https://github.com/sponsors/fastify"},{"type":"opencollective","url":"https://opencollective.com/fastify"}],"_lastModified":"2026-10-12T01:54:33.705Z"}

package/dist/node_modules/ms/package.json

@@ -1 +1 @@
-{"name":"ms","version":"2.1.3","description":"Tiny millisecond conversion utility","repository":"vercel/ms","main":"./index","files":["index.js"],"scripts":{"precommit":"lint-staged","lint":"eslint lib/* bin/*","test":"mocha tests.js"},"eslintConfig":{"extends":"eslint:recommended","env":{"node":true,"es6":true}},"lint-staged":{"*.js":["npm run lint","prettier --single-quote --write","git add"]},"license":"MIT","devDependencies":{"eslint":"4.18.2","expect.js":"0.3.1","husky":"0.14.3","lint-staged":"5.0.0","mocha":"4.0.1","prettier":"2.0.5"},"_lastModified":"2026-09-24T04:29:31.772Z"}
+{"name":"ms","version":"2.1.3","description":"Tiny millisecond conversion utility","repository":"vercel/ms","main":"./index","files":["index.js"],"scripts":{"precommit":"lint-staged","lint":"eslint lib/* bin/*","test":"mocha tests.js"},"eslintConfig":{"extends":"eslint:recommended","env":{"node":true,"es6":true}},"lint-staged":{"*.js":["npm run lint","prettier --single-quote --write","git add"]},"license":"MIT","devDependencies":{"eslint":"4.18.2","expect.js":"0.3.1","husky":"0.14.3","lint-staged":"5.0.0","mocha":"4.0.1","prettier":"2.0.5"},"_lastModified":"2026-10-12T01:54:33.801Z"}

package/dist/node_modules/oidc-provider/README.md

@@ -35,6 +35,7 @@ _Note that not all features are enabled by default, check the configuration sect
 - [`RFC9101` - OAuth 2.0 JWT-Secured Authorization Request (`JAR`)][jar]
 - [`RFC9126` - OAuth 2.0 Pushed Authorization Requests (`PAR`)][par]
 - [`RFC9207` - OAuth 2.0 Authorization Server Issuer Identifier in Authorization Response][iss-auth-resp]
+- [`RFC9396` - OAuth 2.0 Rich Authorization Requests][rar]
 - [`RFC9449` - OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (`DPoP`)][dpop]
 - [`RFC9701` - JWT Response for OAuth Token Introspection][jwt-introspection]
 - [FAPI 1.0 Security Profile - Part 2: Advanced (`FAPI 1.0`)][fapi]
@@ -42,6 +43,7 @@ _Note that not all features are enabled by default, check the configuration sect
 - [FAPI 2.0 Message Signing (`FAPI 2.0`)][fapi2ms]
 - [JWT Secured Authorization Response Mode for OAuth 2.0 (`JARM`)][jarm]
 - [OIDC Client Initiated Backchannel Authentication Flow (`CIBA`)][ciba]
+- [OIDC Relying Party Metadata Choices 1.0][rp-metadata-choices]
 
 Supported Access Token formats:
 
@@ -51,9 +53,9 @@ Supported Access Token formats:
 The following specifications and drafts are implemented as experimental features:
 
 - [Financial-grade API: Client Initiated Backchannel Authentication Profile (`FAPI-CIBA`) - Implementers Draft 01][fapi-ciba]
-- [OIDC Relying Party Metadata Choices 1.0 - Implementers Draft 01][rp-metadata-choices]
-- [OAuth 2.0 Attestation-Based Client Authentication - Draft 06][attestation-client-auth]
-- [OAuth Client ID Metadata Document (`CIMD`) - Draft 01][cimd]
+- [OAuth 2.0 Attestation-Based Client Authentication - Draft 10][attestation-client-auth]
+- [OAuth Client ID Metadata Document (`CIMD`) - Draft 02][cimd]
+- [OpenID for Verifiable Credential Issuance 1.0][openid4vci]
 
 Updates to experimental feature specification versions are released as MINOR library versions,
 if you utilize these features consider using the tilde `~` operator in your
@@ -131,44 +133,45 @@ actions and i.e. emit metrics that react to specific triggers. See the list of a
 | Version                                                       | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
 | ------------------------------------------------------------- | ----------------- | ------------------ | --------------- |
 | [v9.x](https://github.com/panva/node-oidc-provider/tree/v9.x) | [Security Policy] | ✅                 | ✅              |
-| [v8.x](https://github.com/panva/node-oidc-provider/tree/v8.x) | [Security Policy] | ❌                 | ❌              |
 
 [npm-url]: https://www.npmjs.com/package/oidc-provider
 [openid-certified-link]: https://openid.net/certification/
 [openid-connect]: https://openid.net/connect/
 [core]: https://openid.net/specs/openid-connect-core-1_0-errata2.html
 [discovery]: https://openid.net/specs/openid-connect-discovery-1_0-errata2.html
-[oauth2-registration]: https://www.rfc-editor.org/rfc/rfc7591.html
+[oauth2-registration]: https://www.rfc-editor.org/info/rfc7591/
 [registration]: https://openid.net/specs/openid-connect-registration-1_0-errata2.html
-[oauth2]: https://www.rfc-editor.org/rfc/rfc6749.html
-[oauth2-bearer]: https://www.rfc-editor.org/rfc/rfc6750.html
-[revocation]: https://www.rfc-editor.org/rfc/rfc7009.html
-[introspection]: https://www.rfc-editor.org/rfc/rfc7662.html
-[pkce]: https://www.rfc-editor.org/rfc/rfc7636.html
+[oauth2]: https://www.rfc-editor.org/info/rfc6749/
+[oauth2-bearer]: https://www.rfc-editor.org/info/rfc6750/
+[revocation]: https://www.rfc-editor.org/info/rfc7009/
+[introspection]: https://www.rfc-editor.org/info/rfc7662/
+[pkce]: https://www.rfc-editor.org/info/rfc7636/
 [example-repo]: https://github.com/panva/node-oidc-provider-example
 [backchannel-logout]: https://openid.net/specs/openid-connect-backchannel-1_0-errata1.html
-[registration-management]: https://www.rfc-editor.org/rfc/rfc7592.html
-[oauth-native-apps]: https://www.rfc-editor.org/rfc/rfc8252.html
-[jar]: https://www.rfc-editor.org/rfc/rfc9101.html
-[device-flow]: https://www.rfc-editor.org/rfc/rfc8628.html
-[jwt-introspection]: https://www.rfc-editor.org/rfc/rfc9701.html
+[registration-management]: https://www.rfc-editor.org/info/rfc7592/
+[oauth-native-apps]: https://www.rfc-editor.org/info/rfc8252/
+[jar]: https://www.rfc-editor.org/info/rfc9101/
+[device-flow]: https://www.rfc-editor.org/info/rfc8628/
+[jwt-introspection]: https://www.rfc-editor.org/info/rfc9701/
 [sponsor-auth0]: https://a0.to/signup/panva
-[mtls]: https://www.rfc-editor.org/rfc/rfc8705.html
-[dpop]: https://www.rfc-editor.org/rfc/rfc9449.html
-[resource-indicators]: https://www.rfc-editor.org/rfc/rfc8707.html
+[mtls]: https://www.rfc-editor.org/info/rfc8705/
+[dpop]: https://www.rfc-editor.org/info/rfc9449/
+[resource-indicators]: https://www.rfc-editor.org/info/rfc8707/
 [jarm]: https://openid.net/specs/oauth-v2-jarm-errata1.html
-[jwt-at]: https://www.rfc-editor.org/rfc/rfc9068.html
+[jwt-at]: https://www.rfc-editor.org/info/rfc9068/
 [support-sponsor]: https://github.com/sponsors/panva
-[par]: https://www.rfc-editor.org/rfc/rfc9126.html
+[par]: https://www.rfc-editor.org/info/rfc9126/
 [rpinitiated-logout]: https://openid.net/specs/openid-connect-rpinitiated-1_0-final.html
-[iss-auth-resp]: https://www.rfc-editor.org/rfc/rfc9207.html
+[iss-auth-resp]: https://www.rfc-editor.org/info/rfc9207/
+[rar]: https://www.rfc-editor.org/info/rfc9396/
 [fapi]: https://openid.net/specs/openid-financial-api-part-2-1_0-final.html
 [ciba]: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html
 [fapi-ciba]: https://openid.net/specs/openid-financial-api-ciba-ID1.html
 [fapi2sp]: https://openid.net/specs/fapi-security-profile-2_0-final.html
 [fapi2ms]: https://openid.net/specs/fapi-message-signing-2_0-final.html
 [Security Policy]: https://github.com/panva/node-oidc-provider/security/policy
-[rp-metadata-choices]: https://openid.net/specs/openid-connect-rp-metadata-choices-1_0-ID1.html
-[rfc8414]: https://www.rfc-editor.org/rfc/rfc8414.html
-[attestation-client-auth]: https://www.ietf.org/archive/id/draft-ietf-oauth-attestation-based-client-auth-06.html
-[cimd]: https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-01.html
+[rp-metadata-choices]: https://openid.net/specs/openid-connect-rp-metadata-choices-1_0-final.html
+[rfc8414]: https://www.rfc-editor.org/info/rfc8414/
+[attestation-client-auth]: https://www.ietf.org/archive/id/draft-ietf-oauth-attestation-based-client-auth-10.html
+[cimd]: https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html
+[openid4vci]: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.html