@sdxc/well-known 2026.10.24 → 2026.10.26

package/dist/lib/oauth-fields.d.ts

@@ -7,7 +7,11 @@
  * @copyright Sergio Xalambrí 2026
  */
 import type { WellKnownParseError } from "../parse-error.js";
-/** Every RFC 8414 member, by camelCase field. */
+/**
+ * Every RFC 8414 registry member, by camelCase field. `request_uri_parameter_supported`
+ * reads an absent member as `true`, the OpenID Connect Discovery definition the
+ * registry points to, so a server without by-reference requests must publish `false`.
+ */
 export declare const AUTHORIZATION_SERVER_FIELDS: {
     issuer: {
         wire: string;
@@ -46,6 +50,27 @@ export declare const AUTHORIZATION_SERVER_FIELDS: {
         wire: string;
         kind: "url";
     };
+    requirePushedAuthorizationRequests: {
+        wire: string;
+        kind: "boolean";
+    };
+    requestParameterSupported: {
+        wire: string;
+        kind: "boolean";
+    };
+    requestUriParameterSupported: {
+        wire: string;
+        kind: "boolean";
+        default: true;
+    };
+    requestObjectSigningAlgValuesSupported: {
+        wire: string;
+        kind: "strings";
+    };
+    requireSignedRequestObject: {
+        wire: string;
+        kind: "boolean";
+    };
     scopesSupported: {
         wire: string;
         kind: "strings";
@@ -107,6 +132,14 @@ export declare const AUTHORIZATION_SERVER_FIELDS: {
         wire: string;
         kind: "urls";
     };
+    introspectionSigningAlgValuesSupported: {
+        wire: string;
+        kind: "strings";
+    };
+    dpopSigningAlgValuesSupported: {
+        wire: string;
+        kind: "strings";
+    };
     signedMetadata: {
         wire: string;
         kind: "text";
@@ -121,8 +154,7 @@ export declare const AUTHORIZATION_SERVER_FIELDS: {
 export declare function issuerCheck(expected: URL | string | undefined): (fields: Record<string, unknown>, issues: WellKnownParseError.Issue[]) => void;
 /**
  * OpenID Connect Discovery §3 members over the RFC 8414 ones. `authorization_endpoint`
- * and `jwks_uri` become required, and `request_uri_parameter_supported` defaults to
- * `true`, as §3 states for an absent member.
+ * and `jwks_uri` become required.
  */
 export declare const OPENID_PROVIDER_FIELDS: {
     authorizationEndpoint: {
@@ -169,15 +201,6 @@ export declare const OPENID_PROVIDER_FIELDS: {
         wire: string;
         kind: "strings";
     };
-    requestParameterSupported: {
-        wire: string;
-        kind: "boolean";
-    };
-    requestUriParameterSupported: {
-        wire: string;
-        kind: "boolean";
-        default: true;
-    };
     frontchannelLogoutSupported: {
         wire: string;
         kind: "boolean";
@@ -223,6 +246,27 @@ export declare const OPENID_PROVIDER_FIELDS: {
         wire: string;
         kind: "url";
     };
+    requirePushedAuthorizationRequests: {
+        wire: string;
+        kind: "boolean";
+    };
+    requestParameterSupported: {
+        wire: string;
+        kind: "boolean";
+    };
+    requestUriParameterSupported: {
+        wire: string;
+        kind: "boolean";
+        default: true;
+    };
+    requestObjectSigningAlgValuesSupported: {
+        wire: string;
+        kind: "strings";
+    };
+    requireSignedRequestObject: {
+        wire: string;
+        kind: "boolean";
+    };
     scopesSupported: {
         wire: string;
         kind: "strings";
@@ -284,6 +328,14 @@ export declare const OPENID_PROVIDER_FIELDS: {
         wire: string;
         kind: "urls";
     };
+    introspectionSigningAlgValuesSupported: {
+        wire: string;
+        kind: "strings";
+    };
+    dpopSigningAlgValuesSupported: {
+        wire: string;
+        kind: "strings";
+    };
     signedMetadata: {
         wire: string;
         kind: "text";

package/dist/lib/oauth-fields.js

@@ -1,5 +1,9 @@
 import { sameIdentifier } from "./identifier.js";
-/** Every RFC 8414 member, by camelCase field. */
+/**
+ * Every RFC 8414 registry member, by camelCase field. `request_uri_parameter_supported`
+ * reads an absent member as `true`, the OpenID Connect Discovery definition the
+ * registry points to, so a server without by-reference requests must publish `false`.
+ */
 export const AUTHORIZATION_SERVER_FIELDS = {
     issuer: { wire: "issuer", kind: "text", required: true },
     authorizationEndpoint: { wire: "authorization_endpoint", kind: "url" },
@@ -13,6 +17,21 @@ export const AUTHORIZATION_SERVER_FIELDS = {
         wire: "pushed_authorization_request_endpoint",
         kind: "url",
     },
+    requirePushedAuthorizationRequests: {
+        wire: "require_pushed_authorization_requests",
+        kind: "boolean",
+    },
+    requestParameterSupported: { wire: "request_parameter_supported", kind: "boolean" },
+    requestUriParameterSupported: {
+        wire: "request_uri_parameter_supported",
+        kind: "boolean",
+        default: true,
+    },
+    requestObjectSigningAlgValuesSupported: {
+        wire: "request_object_signing_alg_values_supported",
+        kind: "strings",
+    },
+    requireSignedRequestObject: { wire: "require_signed_request_object", kind: "boolean" },
     scopesSupported: { wire: "scopes_supported", kind: "strings" },
     responseTypesSupported: { wire: "response_types_supported", kind: "strings", required: true },
     responseModesSupported: { wire: "response_modes_supported", kind: "strings" },
@@ -43,6 +62,11 @@ export const AUTHORIZATION_SERVER_FIELDS = {
         kind: "boolean",
     },
     protectedResources: { wire: "protected_resources", kind: "urls" },
+    introspectionSigningAlgValuesSupported: {
+        wire: "introspection_signing_alg_values_supported",
+        kind: "strings",
+    },
+    dpopSigningAlgValuesSupported: { wire: "dpop_signing_alg_values_supported", kind: "strings" },
     signedMetadata: { wire: "signed_metadata", kind: "text" },
 };
 /**
@@ -65,8 +89,7 @@ export function issuerCheck(expected) {
 }
 /**
  * OpenID Connect Discovery §3 members over the RFC 8414 ones. `authorization_endpoint`
- * and `jwks_uri` become required, and `request_uri_parameter_supported` defaults to
- * `true`, as §3 states for an absent member.
+ * and `jwks_uri` become required.
  */
 export const OPENID_PROVIDER_FIELDS = {
     ...AUTHORIZATION_SERVER_FIELDS,
@@ -84,12 +107,6 @@ export const OPENID_PROVIDER_FIELDS = {
     claimsSupported: { wire: "claims_supported", kind: "strings" },
     promptValuesSupported: { wire: "prompt_values_supported", kind: "strings" },
     acrValuesSupported: { wire: "acr_values_supported", kind: "strings" },
-    requestParameterSupported: { wire: "request_parameter_supported", kind: "boolean" },
-    requestUriParameterSupported: {
-        wire: "request_uri_parameter_supported",
-        kind: "boolean",
-        default: true,
-    },
     frontchannelLogoutSupported: { wire: "frontchannel_logout_supported", kind: "boolean" },
     frontchannelLogoutSessionSupported: {
         wire: "frontchannel_logout_session_supported",

package/dist/oauth-authorization-server.d.ts

@@ -30,6 +30,16 @@ export interface AuthorizationServerMetadata<Extensions extends object = {}> {
     deviceAuthorizationEndpoint: URL | null;
     /** RFC 9126. */
     pushedAuthorizationRequestEndpoint: URL | null;
+    /** RFC 9126 §5: authorization request data is accepted only through the PAR endpoint. */
+    requirePushedAuthorizationRequests: boolean;
+    /** Whether the `request` parameter (RFC 9101) is accepted. */
+    requestParameterSupported: boolean;
+    /** Whether a `request_uri` the client hosts is fetched; absent in the document means `true`. */
+    requestUriParameterSupported: boolean;
+    /** The JWS algorithms a request object (RFC 9101) may be signed with. */
+    requestObjectSigningAlgValuesSupported: string[];
+    /** RFC 9101 §10.5: every authorization request must arrive as a signed request object. */
+    requireSignedRequestObject: boolean;
     scopesSupported: string[];
     responseTypesSupported: string[];
     responseModesSupported: string[];
@@ -47,6 +57,10 @@ export interface AuthorizationServerMetadata<Extensions extends object = {}> {
     authorizationResponseIssParameterSupported: boolean;
     /** RFC 9728 §4. */
     protectedResources: URL[];
+    /** RFC 9701 §7: the JWS algorithms a JWT introspection response is signed with. */
+    introspectionSigningAlgValuesSupported: string[];
+    /** RFC 9449 §5.1: the JWS algorithms a DPoP proof may be signed with. */
+    dpopSigningAlgValuesSupported: string[];
     /** A JWT carrying the metadata, kept opaque. */
     signedMetadata: string | null;
     extensions: Extensions;

package/dist/openid-configuration.d.ts

@@ -31,9 +31,6 @@ export interface OpenIdProviderMetadata<Extensions extends object = {}> extends
     claimsSupported: string[];
     promptValuesSupported: string[];
     acrValuesSupported: string[];
-    requestParameterSupported: boolean;
-    /** Absent in the document means `true` (§3). */
-    requestUriParameterSupported: boolean;
     frontchannelLogoutSupported: boolean;
     frontchannelLogoutSessionSupported: boolean;
     backchannelLogoutSupported: boolean;

package/dist/response.d.ts

@@ -16,11 +16,21 @@ export interface RespondOptions {
     cache?: PolicyOptions;
     /** Extra headers, applied last so they override the defaults. */
     headers?: HeadersInit;
+    /**
+     * Rewrites the serialized body before its `ETag` is computed, so a body wrapped in a
+     * signature (a cleartext-signed security.txt) is what the tag and a 304 describe.
+     */
+    transform?: (body: string) => string | Promise<string>;
+    /**
+     * Runs over the full 200 response before a 304 or `HEAD` drops its body, so a message
+     * signature can cover the body's digest, as a signed key directory does.
+     */
+    sign?: (response: Response, request: Request | undefined) => Promise<Response>;
 }
 /**
  * The document as a `Response`: its media type, a `Cache-Control` from `policy()`, an
- * `ETag` from `etag()` over the serialized body, CORS where the format requires it, and a
- * 304 through `conditional()` when `request` is given.
+ * `ETag` from `etag()` over the serialized body, CORS and the format's own headers, and a
+ * 304 through `conditional()` when `request` is given, after any `sign` step.
  *
  * @param format - The document's format.
  * @param document - The document to serve.

package/dist/response.js

@@ -3,8 +3,8 @@ import { conditional, etag, policy } from "@sdxc/http/cache";
 const DEFAULT_CACHE = { visibility: "public", maxAge: "1 hour" };
 /**
  * The document as a `Response`: its media type, a `Cache-Control` from `policy()`, an
- * `ETag` from `etag()` over the serialized body, CORS where the format requires it, and a
- * 304 through `conditional()` when `request` is given.
+ * `ETag` from `etag()` over the serialized body, CORS and the format's own headers, and a
+ * 304 through `conditional()` when `request` is given, after any `sign` step.
  *
  * @param format - The document's format.
  * @param document - The document to serve.
@@ -15,6 +15,8 @@ const DEFAULT_CACHE = { visibility: "public", maxAge: "1 hour" };
  */
 export async function respond(format, document, options = {}) {
     let body = format.stringify(document);
+    if (options.transform)
+        body = await options.transform(body);
     let headers = new Headers({
         "Content-Type": format.mediaType,
         "Cache-Control": policy(options.cache ?? DEFAULT_CACHE).toString(),
@@ -24,11 +26,16 @@ export async function respond(format, document, options = {}) {
         headers.set("ETag", tag.data);
     if (format.cors)
         headers.set("Access-Control-Allow-Origin", "*");
+    for (let [name, value] of Object.entries(format.headers ?? {}))
+        headers.set(name, value);
     for (let [name, value] of new Headers(options.headers))
         headers.set(name, value);
     let request = options.request;
-    let isHead = request?.method.toUpperCase() === "HEAD";
-    let response = new Response(isHead ? null : body, { status: 200, headers });
+    let response = new Response(body, { status: 200, headers });
+    if (options.sign)
+        response = await options.sign(response, request);
+    if (request?.method.toUpperCase() === "HEAD")
+        response = new Response(null, response);
     if (request === undefined)
         return response;
     return await conditional(request, response);

package/dist/security-txt.d.ts

@@ -1,11 +1,12 @@
 /**
  * security.txt (RFC 9116): a line-based reader enforcing the §2.5 cardinalities and
- * `https` rules, reading a cleartext-signed file from its signed body, and a writer,
- * so every app publishes where a researcher reports a vulnerability.
+ * `https` rules, a writer, and an OpenPGP cleartext signer, so every app publishes where
+ * a researcher reports a vulnerability in a file they can authenticate.
  *
  * @author [Sergio Xalambrí](https://sergiodxa.com)
  * @copyright Sergio Xalambrí 2026
  */
+import type { OpenPgpError } from "@sdxc/openpgp";
 import type { Result } from "@sdxc/result";
 import type { WellKnownFormat } from "./format.js";
 import { WellKnownParseError } from "./parse-error.js";
@@ -62,3 +63,28 @@ export declare function stringify(document: SecurityTxt, options?: StringifyOpti
 export declare function isExpired(document: SecurityTxt, now?: Date): boolean;
 /** security.txt as a servable format. */
 export declare const securityTxt: WellKnownFormat<SecurityTxt>;
+/** Where a cleartext signer reads its key and reports a key it cannot use. */
+export interface CleartextSignerOptions {
+    /**
+     * The armored OpenPGP private key, read on each call so it can come from a Worker
+     * secret; `undefined` or an empty string serves the file unsigned.
+     */
+    key: () => string | undefined;
+    /** The key's passphrase, when it is protected. */
+    passphrase?: () => string | undefined;
+    /** Called when the key cannot be read, unlocked or used; the file is then served unsigned. */
+    onError?: (error: OpenPgpError) => void;
+}
+/**
+ * A body transform that wraps security.txt text in an OpenPGP cleartext signature, as RFC
+ * 9116 §2.3 recommends. The key is read once per distinct armored value and each body is
+ * signed once, so repeated answers share one `ETag`. Without a usable key the text is
+ * served unsigned, after `onError` reports why.
+ *
+ * @param options - Where the key comes from and where failures go.
+ * @example
+ * serve(securityTxt, () => SECURITY_TXT, {
+ * 	transform: cleartextSigner({ key: () => env.SECURITY_TXT_SIGNING_KEY }),
+ * });
+ */
+export declare function cleartextSigner(options: CleartextSignerOptions): (body: string) => Promise<string>;

package/dist/security-txt.js

@@ -1,4 +1,5 @@
-import { failure, success } from "@sdxc/result";
+import { readPrivateKey, signCleartext } from "@sdxc/openpgp";
+import { failure, isFailure, success } from "@sdxc/result";
 import { WellKnownParseError } from "./parse-error.js";
 export const NAME = "security.txt";
 export const MEDIA_TYPE = "text/plain; charset=utf-8";
@@ -226,3 +227,43 @@ export const securityTxt = {
     stringify: (document) => stringify(document),
     parse,
 };
+/** How many distinct bodies a signer keeps signed copies of. */
+const SIGNED_CACHE_SIZE = 16;
+/**
+ * A body transform that wraps security.txt text in an OpenPGP cleartext signature, as RFC
+ * 9116 §2.3 recommends. The key is read once per distinct armored value and each body is
+ * signed once, so repeated answers share one `ETag`. Without a usable key the text is
+ * served unsigned, after `onError` reports why.
+ *
+ * @param options - Where the key comes from and where failures go.
+ * @example
+ * serve(securityTxt, () => SECURITY_TXT, {
+ * 	transform: cleartextSigner({ key: () => env.SECURITY_TXT_SIGNING_KEY }),
+ * });
+ */
+export function cleartextSigner(options) {
+    let loaded;
+    let signed = new Map();
+    return async (body) => {
+        let armored = options.key()?.trim() ?? "";
+        if (armored === "")
+            return body;
+        if (loaded?.armored !== armored) {
+            loaded = { armored, key: readPrivateKey(armored, { passphrase: options.passphrase?.() }) };
+            signed.clear();
+        }
+        let cached = signed.get(body);
+        if (cached !== undefined)
+            return cached;
+        let key = await loaded.key;
+        let result = isFailure(key) ? key : await signCleartext(body, key.data);
+        if (isFailure(result)) {
+            options.onError?.(result.error);
+            return body;
+        }
+        if (signed.size >= SIGNED_CACHE_SIZE)
+            signed.clear();
+        signed.set(body, result.data);
+        return result.data;
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sdxc/well-known",
-	"version": "2026.10.24",
+	"version": "2026.10.26",
 	"description": "Typed documents for well-known URIs: security.txt, WebFinger, NodeInfo, OAuth and OIDC metadata, JWKS and more",
 	"license": "MIT",
 	"type": "module",
@@ -12,8 +12,11 @@
 		"./openid-configuration": "./dist/openid-configuration.js",
 		"./oauth-protected-resource": "./dist/oauth-protected-resource.js",
 		"./jwks": "./dist/jwks.js",
+		"./client-id-metadata-document": "./dist/client-id-metadata-document.js",
+		"./http-message-signatures-directory": "./dist/http-message-signatures-directory.js",
 		"./change-password": "./dist/change-password.js",
 		"./passkey-endpoints": "./dist/passkey-endpoints.js",
+		"./api-catalog": "./dist/api-catalog.js",
 		"./nodeinfo": "./dist/nodeinfo.js",
 		"./response": "./dist/response.js",
 		"./middleware": "./dist/middleware.js"
@@ -21,11 +24,13 @@
 	"dependencies": {
 		"@remix-run/data-schema": "^1.0.0",
 		"@sdxc/json-pointer": "2026.10.14",
+		"@sdxc/link-header": "2026.10.25",
+		"@sdxc/openpgp": "2026.10.25",
 		"@sdxc/result": "2026.10.13",
 		"@standard-schema/spec": "^1.1.0"
 	},
 	"peerDependencies": {
-		"@sdxc/http": "2026.10.24",
+		"@sdxc/http": "2026.10.26",
 		"remix": "3.1.0"
 	},
 	"peerDependenciesMeta": {
@@ -36,7 +41,7 @@
 			"optional": true
 		}
 	},
-	"gitHead": "f9db0f8f1f51a256e74b94b0f4b1db4be9880370",
+	"gitHead": "ff18988bd00de6200766dbc77367257277979566",
 	"publishConfig": {
 		"access": "public"
 	},