What is not here

SAML, passwords and magic links (use better-auth or Auth.js, or build them on sessions), the implicit and hybrid flows, the form_post response mode, signed or encrypted userinfo, sender-constrained tokens (DPoP, mTLS), dynamic client registration, and front-channel or back-channel logout. They are left out on purpose: each adds an attack surface, and the code flow with PKCE covers the providers listed above. The ID token's max_age/auth_time and acr claims are available in claims for you to enforce.