[Bccorb]

What

A new oidcEdge module with the service-token contract between the OpenID Provider service (fells-code/seamless-auth-oidc-provider) and the private API, per ADR 0001 (D4, D5, D6, D9, D13).

• OIDC_EDGE_CONTRACT_VERSION and OidcEdgeRoutes (the route paths both sides use).
• GET /oidc/config: contract version, oidc_issuer, app name, allow_client_secrets, third_party_clients_enabled. The edge checks the version at startup.
• /oidc/payloads/:model/*: upsert, find, find by user code, find by uid, consume, destroy, revoke by grant id. The model enum is the ten stored oidc-provider models. Client and the API-internal OAuth state replay model are not accepted. Upsert returns created: false for an existing ReplayDetection row.
• POST /oidc/sign: the library's external signing input plus kind, kid, clientId and sessionId (required unless client_credentials), the base64url signature back, and the refusal codes.
• GET /oidc/jwks: public keys only. The schema rejects any key carrying private members.
• GET /oidc/clients/:id (client metadata in the library's names, never a secret) and POST /oidc/clients/:id/verify-secret.
• GET /oidc/accounts/:id (claims) and GET /oidc/sessions/:id/auth-context, with OidcAccountQuerySchema (clientId, sessionId) and OidcSessionQuerySchema (clientId). The auth context carries authMethods, authTime and the derived acr/amr. The API answers only for a live session holding a grant for that client.
• POST /oidc/sessions/:id/revoke.
• POST /oidc/events: provider audit events with a correlation id.

SystemConfigSchema and the patch schema gain the provider keys the API needs for D6, D10 and D13: oidc_provider_enabled (default false), oidc_issuer (default null), allow_client_secrets and third_party_clients_enabled (both default false). The inferred SystemConfig type gains four required fields, which the changeset calls out.

Two routes go beyond the issue's list because the library needs them: client metadata (the Client model) and account claims (findAccount/userinfo).

Prereleases

This PR enters Changesets pre mode on next (.changeset/pre.json), so the release PR it produces publishes 0.34.0-next.0 to the next dist-tag and latest stays on 0.33.x. RELEASES.md documents the flow and the pre exit step for the stable 0.34.0. The changeset is minor.

The module notes that /oidc/* takes the provider service's own service token (SEAMLESS_OIDC_SERVICE_TOKEN), never the adapters' secret.

Contract-affecting. Consumers: seamless-auth-api (the /oidc/* routes) and seamless-auth-oidc-provider.

Closes #122

Checks

• npm run typecheck: pass
• npm run lint: pass
• npm run format:check: pass
• npm test: 22 files, 368 tests pass
• npm run build and npm run check-npm-build: pass, dist/schemas/oidcEdge/* included