[Bccorb]

What

Admin management of OpenID Provider applications (clients), per ADR 0001 D6, D10 and D12. Reads need admin:read. Every write needs admin:write plus a fresh step-up and writes an admin_oidc_application_* auth event. The routes work whether or not oidc_provider_enabled is on.

Route
GET /admin/applications	list
POST /admin/applications	create (a shared-secret client gets its secret once)
GET /admin/applications/:id	get
PATCH /admin/applications/:id	update or disabled: true
DELETE /admin/applications/:id	delete, with its resource grants and every provider grant, code and token (oidc_payloads where payload->>'clientId')
POST /admin/applications/:id/secret	issue or rotate a shared secret (HMAC stored, shown once)
PUT /admin/applications/:id/keys	JWKS or JWKS URI for private_key_jwt

Insecure settings cannot be created (#410). The rules come from @seamless-auth/types (checkOidcApplication) and run on create and again on the merged result of every update:

• Public clients use PKCE alone, with no secret, keys or client_credentials.
• Confidential clients default to private_key_jwt.
• Only one of JWKS or JWKS URI.
• The device grant is first-party only.
• Implicit, password and client_secret_jwt cannot be expressed.

The API adds the instance checks: shared secrets need allow_client_secrets, and third-party clients need third_party_clients_enabled. Moving off private_key_jwt drops the keys, and moving off a shared-secret method drops the secret.

Client model parts of #508. Redirects follow RFC 8252:

• Exact https.
• http only on 127.0.0.1 or [::1], with any port at request time.
• Private-use schemes in reverse domain form.
• Never localhost, fragments or credentials.

The registry now decides application_type: native with the same rule.

Also adds the hosted_ui system config key (OIDC_HOSTED_UI, default null) from types#97, plus a docs section with the enforcement matrix.

Contract change. These routes are access passthroughs in the adapter manifest and need seamless-auth-server#241, dashboard#296 and cli#276.

Types

Locks the published @seamless-auth/types 0.34.0-next.1 (fells-code/seamless-auth-types#125).

Closes #407
Part of #508, #410

Checks (local, against the published types 0.34.0-next.1)

• npm run typecheck, npm run lint, npm run format:check, npm run build: pass
• npm run coverage: 165 files, 2582 tests pass; 99% lines, 95.73% branches
• TEST_DB=postgres project on a scratch Postgres 16: 48 tests pass, including the JSONB delete
• /security-review: no findings