@dialtribe/auth 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,90 @@
-# Temporary Holding Version
+# @dialtribe/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Relying-party SDK for **Dialtribe Identity** (OIDC SSO). One audited copy of the
+auth glue every portfolio client (80.at, Tugbeat, Bobl, ...) would otherwise
+hand-roll: sign-in, global sign-out, guest-work resume, and back-channel logout.
+
+Two entry points, so server deps (`jose`) never land in a client bundle:
+
+- `@dialtribe/auth/client` - browser helpers (zero server deps)
+- `@dialtribe/auth/server` - route handler + better-auth config (needs `jose`)
+
+```
+yarn add @dialtribe/auth
+```
+
+## Client
+
+```ts
+import {
+  startDialtribeSignIn,
+  signOutEverywhere,
+  signInWithResume,
+  consumeResumeState,
+} from "@dialtribe/auth/client";
+
+// Start sign-in (e.g. from a "Sign in" button):
+await startDialtribeSignIn({ callbackURL: "/dashboard", theme: "dark" });
+
+// Global sign-out (clears the local session + ends the Dialtribe session):
+await signOutEverywhere({ clientId: "80at", postLogout: "/signin" });
+
+// Guest fills a form, then signs in to continue, without losing input:
+await signInWithResume({ appState: formValues, returnTo: "/", theme: "dark" });
+// ...and on the return page:
+useEffect(() => {
+  const resumed = consumeResumeState<FormValues>();
+  if (resumed) setFormValues(resumed); // PREFILL only; re-validate server-side
+}, []);
+```
+
+## Server
+
+```ts
+// better-auth config
+import { genericOAuth } from "better-auth/plugins";
+import { dialtribeProvider, recommendedAccountOptions } from "@dialtribe/auth/server";
+
+betterAuth({
+  account: { ...recommendedAccountOptions }, // cookie state strategy (avoids state_mismatch)
+  plugins: [
+    genericOAuth({
+      config: [
+        dialtribeProvider({
+          clientId: process.env.DIALTRIBE_OIDC_CLIENT_ID!,
+          clientSecret: process.env.DIALTRIBE_OIDC_CLIENT_SECRET!,
+        }), // pkce: true baked in
+      ],
+    }),
+  ],
+});
+```
+
+```ts
+// app/api/auth/backchannel-logout/route.ts
+import { createBackchannelLogoutHandler } from "@dialtribe/auth/server";
+import { prisma } from "@/lib/prisma";
+
+export const POST = createBackchannelLogoutHandler({
+  clientId: process.env.DIALTRIBE_OIDC_CLIENT_ID!,
+  // The one app-specific bit: map the Dialtribe sub to local users and drop
+  // their sessions. Verification (JWKS, issuer, audience, typ, events, nonce)
+  // is handled by the SDK.
+  deleteSessionsForSub: async (sub) => {
+    const accounts = await prisma.account.findMany({
+      where: { providerId: "dialtribe", accountId: sub },
+      select: { userId: true },
+    });
+    const userIds = [...new Set(accounts.map((a) => a.userId))];
+    if (userIds.length) await prisma.session.deleteMany({ where: { userId: { in: userIds } } });
+  },
+});
+```
+
+## Configuration
+
+All helpers default to the Dialtribe prod issuer/discovery and better-auth's
+`/api/auth` base path. Override per call (`discoveryUrl`, `issuer`,
+`authBasePath`) for staging or a custom mount.
+
+Full integration guide: `docs/DIALTRIBE_IDENTITY_SSO.md` in the dialtribe repo.

package/dist/client.d.ts

@@ -0,0 +1,86 @@
+/**
+ * @dialtribe/auth/client - browser helpers for a Dialtribe Identity relying party.
+ *
+ * Zero server dependencies (no jose, no better-auth imports) so it never drags
+ * Node code into a client bundle. Everything here runs in the browser and talks
+ * to the consuming app's own better-auth routes (relative paths) plus Dialtribe's
+ * public endpoints.
+ */
+export type Theme = "light" | "dark";
+export interface StartSignInOptions {
+    /** Where to land after the whole flow completes (better-auth carries this). */
+    callbackURL: string;
+    /** OIDC provider id configured in the client's genericOAuth (default "dialtribe"). */
+    providerId?: string;
+    /** Force the Dialtribe sign-in screen theme. */
+    theme?: Theme;
+    /** Override the client's better-auth base path (default "/api/auth"). */
+    authBasePath?: string;
+}
+/**
+ * Start the Dialtribe (OIDC) sign-in: ask better-auth for the authorize URL,
+ * optionally force a theme, then navigate. The flow needs a top-level
+ * navigation (not a background fetch) so the browser gets the real redirect.
+ */
+export declare function startDialtribeSignIn(opts: StartSignInOptions): Promise<void>;
+export interface SignOutOptions {
+    /** This app's Dialtribe client_id. */
+    clientId: string;
+    /** Registered post-logout return URL (absolute, or relative to this origin). */
+    postLogout: string;
+    /** Dialtribe issuer origin (default https://id.dialtribe.com). */
+    issuer?: string;
+    /** Override the client's better-auth base path (default "/api/auth"). */
+    authBasePath?: string;
+}
+/**
+ * Sign out of this app AND Dialtribe, so there is no silent re-login. Clears the
+ * local session first (the Content-Type header is required; better-auth returns
+ * 415 and clears nothing without it), then redirects through Dialtribe's
+ * end-session endpoint back to `postLogout` (which must be a registered redirect
+ * URL for this client).
+ */
+export declare function signOutEverywhere(opts: SignOutOptions): Promise<void>;
+/**
+ * Stash `appState` under a fresh nonce and return a relative callbackURL (your
+ * return page + the nonce) to hand to the sign-in call.
+ */
+export declare function stashResumeState(appState: unknown, returnTo: string): string;
+/**
+ * On the return page, pull back the stashed appState (and clear it + strip the
+ * nonce from the URL so a refresh does not look like a resume). Returns null if
+ * there is nothing to resume.
+ */
+export declare function consumeResumeState<T = unknown>(): T | null;
+export interface SignInWithResumeOptions {
+    /** Arbitrary JSON-serializable state to restore after login. */
+    appState: unknown;
+    /** Page to land on after login (the one that calls consumeResumeState). */
+    returnTo: string;
+    providerId?: string;
+    theme?: Theme;
+    authBasePath?: string;
+}
+/** Stash the form state, then start sign-in returning to `returnTo` with the nonce. */
+export declare function signInWithResume(opts: SignInWithResumeOptions): Promise<void>;
+/**
+ * Minimal shape of a Centrifuge publication source (a Subscription, or the
+ * client itself for server-side subscriptions). Structural so we don't depend
+ * on the `centrifuge` package.
+ */
+export interface PublicationSource {
+    on(event: "publication", handler: (ctx: {
+        data?: unknown;
+    }) => void): unknown;
+}
+/**
+ * React to Dialtribe's instant "sign out everywhere" signal. Wire this to the
+ * identity channel (`dt_id:<sub>`) your connection is subscribed to (attached
+ * server-side when the product passes `dialtribeSub` to the realtime token
+ * endpoint). On `session.revoked`, run `onRevoked` (clear the local session).
+ *
+ * Reuses the app's existing Centrifuge connection; it does not open a new one.
+ *
+ *   subscribeSessionRevocation(centrifuge, () => signOutLocal());
+ */
+export declare function subscribeSessionRevocation(source: PublicationSource, onRevoked: () => void): void;

package/dist/client.js

@@ -0,0 +1,166 @@
+/**
+ * @dialtribe/auth/client - browser helpers for a Dialtribe Identity relying party.
+ *
+ * Zero server dependencies (no jose, no better-auth imports) so it never drags
+ * Node code into a client bundle. Everything here runs in the browser and talks
+ * to the consuming app's own better-auth routes (relative paths) plus Dialtribe's
+ * public endpoints.
+ */
+const DEFAULT_ISSUER = "https://id.dialtribe.com";
+const DEFAULT_AUTH_BASE = "/api/auth"; // better-auth's default mount path on the client app
+/**
+ * Start the Dialtribe (OIDC) sign-in: ask better-auth for the authorize URL,
+ * optionally force a theme, then navigate. The flow needs a top-level
+ * navigation (not a background fetch) so the browser gets the real redirect.
+ */
+export async function startDialtribeSignIn(opts) {
+    const base = opts.authBasePath ?? DEFAULT_AUTH_BASE;
+    const res = await fetch(`${base}/sign-in/oauth2`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ providerId: opts.providerId ?? "dialtribe", callbackURL: opts.callbackURL }),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok || !data.url)
+        throw new Error(data.message || "Sign-in failed");
+    const url = new URL(data.url);
+    if (opts.theme)
+        url.searchParams.set("theme", opts.theme);
+    window.location.href = url.toString();
+}
+/**
+ * Sign out of this app AND Dialtribe, so there is no silent re-login. Clears the
+ * local session first (the Content-Type header is required; better-auth returns
+ * 415 and clears nothing without it), then redirects through Dialtribe's
+ * end-session endpoint back to `postLogout` (which must be a registered redirect
+ * URL for this client).
+ */
+export async function signOutEverywhere(opts) {
+    const base = opts.authBasePath ?? DEFAULT_AUTH_BASE;
+    await fetch(`${base}/sign-out`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: "{}",
+    });
+    const issuer = opts.issuer ?? DEFAULT_ISSUER;
+    const postLogout = new URL(opts.postLogout, window.location.origin).toString();
+    window.location.href =
+        `${issuer}/api/auth/oauth2/endsession?client_id=${encodeURIComponent(opts.clientId)}` +
+            `&post_logout_redirect_uri=${encodeURIComponent(postLogout)}`;
+}
+// ----------------------------------------------------------------------------
+// Resume guest work across the sign-in round trip ("appState" pattern)
+// ----------------------------------------------------------------------------
+/**
+ * A guest fills out a form, then has to sign in to continue, and we must not
+ * lose what they typed. The flow stays in the same browser tab, and
+ * sessionStorage is per-origin AND per-tab, so the payload can sit in this
+ * origin's sessionStorage untouched while the tab is over on id.dialtribe.com
+ * and is still there on return. Only a short nonce round-trips, in the
+ * callbackURL better-auth already carries. Dialtribe never sees or stores it.
+ *
+ * SECURITY: treat anything consumeResumeState() returns as untrusted input (it
+ * is just browser state the user can edit). Use it to PREFILL only; the real
+ * action still runs your normal server-side validation under the now-signed-in
+ * session.
+ */
+const KEY_PREFIX = "dt_resume:";
+const RESUME_PARAM = "dt_resume";
+const MAX_AGE_MS = 30 * 60 * 1000; // ephemeral: a stale stash is dropped after 30 min
+/** Drop any stash older than MAX_AGE_MS (or unparseable) so they never pile up. */
+function sweepExpired() {
+    try {
+        const now = Date.now();
+        for (let i = sessionStorage.length - 1; i >= 0; i--) {
+            const key = sessionStorage.key(i);
+            if (!key || !key.startsWith(KEY_PREFIX))
+                continue;
+            try {
+                const env = JSON.parse(sessionStorage.getItem(key) || "{}");
+                if (!env.ts || now - env.ts > MAX_AGE_MS)
+                    sessionStorage.removeItem(key);
+            }
+            catch {
+                sessionStorage.removeItem(key);
+            }
+        }
+    }
+    catch {
+        // sessionStorage unavailable (SSR / privacy mode): nothing to sweep.
+    }
+}
+/**
+ * Stash `appState` under a fresh nonce and return a relative callbackURL (your
+ * return page + the nonce) to hand to the sign-in call.
+ */
+export function stashResumeState(appState, returnTo) {
+    sweepExpired();
+    const nonce = crypto.randomUUID();
+    const envelope = { appState, ts: Date.now() };
+    try {
+        sessionStorage.setItem(KEY_PREFIX + nonce, JSON.stringify(envelope));
+    }
+    catch {
+        // Storage full/blocked: fall back to a plain return (form just won't resume).
+        return returnTo;
+    }
+    const url = new URL(returnTo, window.location.origin);
+    url.searchParams.set(RESUME_PARAM, nonce);
+    return url.pathname + url.search + url.hash;
+}
+/**
+ * On the return page, pull back the stashed appState (and clear it + strip the
+ * nonce from the URL so a refresh does not look like a resume). Returns null if
+ * there is nothing to resume.
+ */
+export function consumeResumeState() {
+    if (typeof window === "undefined")
+        return null;
+    const params = new URLSearchParams(window.location.search);
+    const nonce = params.get(RESUME_PARAM);
+    if (!nonce)
+        return null;
+    const raw = sessionStorage.getItem(KEY_PREFIX + nonce);
+    sessionStorage.removeItem(KEY_PREFIX + nonce);
+    params.delete(RESUME_PARAM);
+    const qs = params.toString();
+    window.history.replaceState(null, "", window.location.pathname + (qs ? `?${qs}` : "") + window.location.hash);
+    if (!raw)
+        return null;
+    try {
+        const env = JSON.parse(raw);
+        if (!env.ts || Date.now() - env.ts > MAX_AGE_MS)
+            return null;
+        return env.appState;
+    }
+    catch {
+        return null;
+    }
+}
+/** Stash the form state, then start sign-in returning to `returnTo` with the nonce. */
+export async function signInWithResume(opts) {
+    const callbackURL = stashResumeState(opts.appState, opts.returnTo);
+    await startDialtribeSignIn({
+        callbackURL,
+        providerId: opts.providerId,
+        theme: opts.theme,
+        authBasePath: opts.authBasePath,
+    });
+}
+/**
+ * React to Dialtribe's instant "sign out everywhere" signal. Wire this to the
+ * identity channel (`dt_id:<sub>`) your connection is subscribed to (attached
+ * server-side when the product passes `dialtribeSub` to the realtime token
+ * endpoint). On `session.revoked`, run `onRevoked` (clear the local session).
+ *
+ * Reuses the app's existing Centrifuge connection; it does not open a new one.
+ *
+ *   subscribeSessionRevocation(centrifuge, () => signOutLocal());
+ */
+export function subscribeSessionRevocation(source, onRevoked) {
+    source.on("publication", (ctx) => {
+        const data = ctx?.data;
+        if (data?.type === "session.revoked")
+            onRevoked();
+    });
+}

package/dist/server.d.ts

@@ -0,0 +1,91 @@
+export interface OnlineCount {
+    /** Unique signed-in identities online. */
+    users: number;
+    /** Total connections (a user with 2 tabs counts as 2). */
+    clients: number;
+}
+/**
+ * How many of this product's users are online right now. Calls Dialtribe's
+ * realtime online endpoint with the product's secret key (dt_sk_...); the count
+ * is scoped to this product server-side, so you only ever see your own.
+ */
+export declare function getServiceOnlineCount(opts: {
+    secretKey: string;
+    apiBase?: string;
+}): Promise<OnlineCount>;
+export interface DialtribeProviderOptions {
+    clientId: string;
+    clientSecret: string;
+    /** Override the discovery URL (default Dialtribe prod). */
+    discoveryUrl?: string;
+    /** Extra scopes on top of openid/email/profile. */
+    extraScopes?: string[];
+}
+/**
+ * The better-auth `genericOAuth` provider config for Dialtribe, with PKCE baked
+ * in (the Dialtribe provider requires it). Spread into the plugin:
+ *
+ *   genericOAuth({ config: [dialtribeProvider({ clientId, clientSecret })] })
+ */
+export declare function dialtribeProvider(opts: DialtribeProviderOptions): {
+    providerId: string;
+    discoveryUrl: string;
+    clientId: string;
+    clientSecret: string;
+    scopes: string[];
+    pkce: true;
+};
+/**
+ * Recommended top-level better-auth `account` options for a Dialtribe client.
+ * The cookie state strategy (10 min) matches Dialtribe's OTP window; the default
+ * database strategy's 5-minute state cookie causes `state_mismatch` when the
+ * user takes longer than 5 min on the Dialtribe sign-in screen. Spread into the
+ * better-auth config: `account: { ...recommendedAccountOptions }`.
+ */
+export declare const recommendedAccountOptions: {
+    storeStateStrategy: "cookie";
+};
+export interface SessionStatus {
+    /** ms epoch the identity was globally signed out, or null if never. */
+    revokedAt: number | null;
+}
+/**
+ * Poll Dialtribe for an identity's global revocation watermark. Call this on a
+ * bounded cadence (e.g. every 5 min, cached) from your session-reading path and
+ * sign the user out locally if `revokedAt` is newer than the local session's
+ * creation time. Fail-open: on a network error, treat the session as valid
+ * (don't let a Dialtribe outage log everyone out).
+ *
+ * Authenticated with your OIDC client credentials (the same client_id/secret you
+ * use for sign-in).
+ */
+export declare function getSessionStatus(opts: {
+    clientId: string;
+    clientSecret: string;
+    sub: string;
+    apiBase?: string;
+}): Promise<SessionStatus>;
+export interface BackchannelLogoutConfig {
+    /** This app's Dialtribe client_id (the logout token's audience). */
+    clientId: string;
+    /** Override the discovery URL (default Dialtribe prod). */
+    discoveryUrl?: string;
+    /**
+     * Delete this app's local sessions for the given Dialtribe subject. This is
+     * the one app-specific piece (your DB / session schema). Only delete local
+     * sessions here; never call back to the OP (loop risk).
+     */
+    deleteSessionsForSub: (sub: string) => Promise<void> | void;
+}
+/**
+ * Build a Web-standard POST handler that receives Dialtribe's signed Logout
+ * Token, verifies it against Dialtribe's JWKS, and signs the subject out of this
+ * app by calling `deleteSessionsForSub`. Assign it directly in a route:
+ *
+ *   // app/api/auth/backchannel-logout/route.ts
+ *   export const POST = createBackchannelLogoutHandler({
+ *     clientId: process.env.DIALTRIBE_OIDC_CLIENT_ID!,
+ *     deleteSessionsForSub: async (sub) => { ...delete local sessions... },
+ *   });
+ */
+export declare function createBackchannelLogoutHandler(cfg: BackchannelLogoutConfig): (request: Request) => Promise<Response>;

package/dist/server.js

@@ -0,0 +1,151 @@
+/**
+ * @dialtribe/auth/server - server helpers for a Dialtribe Identity relying party.
+ *
+ * Depends on `jose` (JWT verification). Keep this out of client bundles; import
+ * from "@dialtribe/auth/client" in the browser.
+ */
+import { createRemoteJWKSet, jwtVerify } from "jose";
+const DEFAULT_DISCOVERY = "https://id.dialtribe.com/api/auth/.well-known/openid-configuration";
+const DEFAULT_API_BASE = "https://id.dialtribe.com";
+const BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+/**
+ * How many of this product's users are online right now. Calls Dialtribe's
+ * realtime online endpoint with the product's secret key (dt_sk_...); the count
+ * is scoped to this product server-side, so you only ever see your own.
+ */
+export async function getServiceOnlineCount(opts) {
+    const base = opts.apiBase ?? DEFAULT_API_BASE;
+    const res = await fetch(`${base}/api/public/v1/realtime/online`, {
+        headers: { Authorization: `Bearer ${opts.secretKey}` },
+    });
+    if (!res.ok)
+        throw new Error(`online count failed: ${res.status}`);
+    const data = (await res.json());
+    return { users: data.users ?? 0, clients: data.clients ?? 0 };
+}
+/**
+ * The better-auth `genericOAuth` provider config for Dialtribe, with PKCE baked
+ * in (the Dialtribe provider requires it). Spread into the plugin:
+ *
+ *   genericOAuth({ config: [dialtribeProvider({ clientId, clientSecret })] })
+ */
+export function dialtribeProvider(opts) {
+    return {
+        providerId: "dialtribe",
+        discoveryUrl: opts.discoveryUrl ?? DEFAULT_DISCOVERY,
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret,
+        scopes: ["openid", "email", "profile", ...(opts.extraScopes ?? [])],
+        pkce: true,
+    };
+}
+/**
+ * Recommended top-level better-auth `account` options for a Dialtribe client.
+ * The cookie state strategy (10 min) matches Dialtribe's OTP window; the default
+ * database strategy's 5-minute state cookie causes `state_mismatch` when the
+ * user takes longer than 5 min on the Dialtribe sign-in screen. Spread into the
+ * better-auth config: `account: { ...recommendedAccountOptions }`.
+ */
+export const recommendedAccountOptions = {
+    storeStateStrategy: "cookie",
+};
+/**
+ * Poll Dialtribe for an identity's global revocation watermark. Call this on a
+ * bounded cadence (e.g. every 5 min, cached) from your session-reading path and
+ * sign the user out locally if `revokedAt` is newer than the local session's
+ * creation time. Fail-open: on a network error, treat the session as valid
+ * (don't let a Dialtribe outage log everyone out).
+ *
+ * Authenticated with your OIDC client credentials (the same client_id/secret you
+ * use for sign-in).
+ */
+export async function getSessionStatus(opts) {
+    const base = opts.apiBase ?? DEFAULT_API_BASE;
+    const basic = Buffer.from(`${opts.clientId}:${opts.clientSecret}`).toString("base64");
+    const res = await fetch(`${base}/api/public/v1/identity/session-status`, {
+        method: "POST",
+        headers: { Authorization: `Basic ${basic}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ sub: opts.sub }),
+    });
+    if (!res.ok)
+        throw new Error(`session-status failed: ${res.status}`);
+    const data = (await res.json());
+    return { revokedAt: typeof data.revokedAt === "number" ? data.revokedAt : null };
+}
+function jsonError(error) {
+    // Spec: a bad logout token gets a 400 with an { error } body.
+    return new Response(JSON.stringify({ error }), {
+        status: 400,
+        headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },
+    });
+}
+/**
+ * Build a Web-standard POST handler that receives Dialtribe's signed Logout
+ * Token, verifies it against Dialtribe's JWKS, and signs the subject out of this
+ * app by calling `deleteSessionsForSub`. Assign it directly in a route:
+ *
+ *   // app/api/auth/backchannel-logout/route.ts
+ *   export const POST = createBackchannelLogoutHandler({
+ *     clientId: process.env.DIALTRIBE_OIDC_CLIENT_ID!,
+ *     deleteSessionsForSub: async (sub) => { ...delete local sessions... },
+ *   });
+ */
+export function createBackchannelLogoutHandler(cfg) {
+    const discoveryUrl = cfg.discoveryUrl ?? DEFAULT_DISCOVERY;
+    // Resolve issuer + JWKS once; createRemoteJWKSet caches keys and refetches on
+    // an unknown kid, so key rotation is handled for us.
+    let discoveryPromise = null;
+    const getDiscovery = () => {
+        if (!discoveryPromise) {
+            discoveryPromise = (async () => {
+                const res = await fetch(discoveryUrl);
+                if (!res.ok)
+                    throw new Error(`discovery fetch failed: ${res.status}`);
+                const doc = (await res.json());
+                if (!doc.issuer || !doc.jwks_uri)
+                    throw new Error("discovery missing issuer/jwks_uri");
+                return { issuer: doc.issuer, jwks: createRemoteJWKSet(new URL(doc.jwks_uri)) };
+            })().catch((err) => {
+                discoveryPromise = null; // allow retry on the next request
+                throw err;
+            });
+        }
+        return discoveryPromise;
+    };
+    return async function POST(request) {
+        if (!cfg.clientId)
+            return jsonError("client not configured");
+        const form = await request.formData().catch(() => null);
+        const token = form?.get("logout_token");
+        if (typeof token !== "string" || !token)
+            return jsonError("missing logout_token");
+        let payload;
+        try {
+            const { issuer, jwks } = await getDiscovery();
+            const verified = await jwtVerify(token, jwks, {
+                issuer,
+                audience: cfg.clientId,
+                typ: "logout+jwt",
+            });
+            payload = verified.payload;
+        }
+        catch {
+            return jsonError("invalid logout_token");
+        }
+        // MUST carry the back-channel logout event and MUST NOT carry a nonce.
+        const events = payload.events;
+        if (!events || typeof events !== "object" || !(BACKCHANNEL_LOGOUT_EVENT in events)) {
+            return jsonError("logout_token missing backchannel-logout event");
+        }
+        if ("nonce" in payload)
+            return jsonError("logout_token must not contain a nonce");
+        const sub = payload.sub;
+        if (!sub)
+            return jsonError("logout_token missing sub");
+        await cfg.deleteSessionsForSub(sub);
+        return new Response(JSON.stringify({ ok: true }), {
+            status: 200,
+            headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },
+        });
+    };
+}

package/package.json

@@ -1,6 +1,41 @@
 {
   "name": "@dialtribe/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Relying-party SDK for Dialtribe Identity (OIDC SSO): sign-in, global sign-out, guest-work resume, and back-channel logout.",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "client": ["dist/client.d.ts"],
+      "server": ["dist/server.d.ts"]
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "yarn build"
+  },
+  "dependencies": {
+    "jose": "^6"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "typescript": "^5"
+  },
+  "license": "UNLICENSED",
+  "publishConfig": {
+    "access": "public"
+  }
+}