@idp.global/sdk 18.0.1 → 18.1.0

package/changelog.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 2026-09-29 - 18.1.0
+
+### Features
+
+- add the relying-party session layer as `@idp.global/sdk/relyingparty` (relyingparty)
+  - Ported from nevermind.finance mainapp 0b693cb (`ts/identity/`, `ts/helpers.cookies.ts`, `ts/helpers.secrets.ts`, `ts/classes.actorcontext.ts`, `ts/socket/classes.socketgate.ts`) so nevermind.finance and Docbox share one implementation.
+  - `IdpOidcProvider`: discovery restricted to S256 PKCE, RS256 ID tokens and the authorization_code and refresh_token grants; code exchange with a subject-checked UserInfo read; refresh with `invalid_grant` as `OidcRefreshRefusedError`; revocation; organization introspection through `OidcIntrospectionClient`.
+  - `RelyingPartySessions` on `createRelyingPartyModels({ db, collectionNames? })`: single-use login attempts bound to the browser, return-path sanitising, HttpOnly cookie sessions with an HMAC-derived CSRF token, sessions the application opens itself, provider tokens sealed with `SecretBox` and rotated once per process under a stored cross-replica lock, conditional session ends and failed logins that hand the tokens back within a three-second budget, and application hooks for principal admission, session ends and diagnostics whose failures never skip that cleanup (`hook_failed`). A `__Host-` or `__Secure-` cookie name is refused for an http origin.
+  - `AuthorityObserver`: live organization authority projected through the application's role table. It observes freshly for every operation by default; `positiveTtlMs` and `negativeTtlMs` are explicit opt-ins, documented with their trade-off.
+  - `RelyingPartyRoutes` (login, callback, finalize, session, logout, the logout body capped while it streams) on a typedserver route context, `createActorScope()` for `TypedRouter.addRequestScope`, and `RelyingPartySocketBinding` for TypedSocket browser registration and per-request re-validation.
+  - Read-compatible with nevermind.finance's stored sessions: bound to `SessionDoc` and `LoginAttemptDoc`, the models declare the same fields and index names, `SecretBox` reads the stored `v1:` sealed format, and the application passes its own cookie names and CSRF label.
+  - Adds the dependency `openid-client` ^6.8.8 and raises `@api.global/typedrequest` to ^8.2.0 and `@api.global/typedsocket` to ^8.7.0; the `@lossless.org/client` peer range `>=1.0.0 <2.0.0` is unchanged.
+
+### Maintenance
+
+- release tooling: `@git.zone/tsbuild` 5.0.0, `@git.zone/tstest` 6.3.2, `@git.zone/tsrun` 3.0.2, `@git.zone/tsdoc` 2.2.2, `@types/node` 26.6.2 and `pnpm@12.5.1`; pnpm 12.6.0 and `@types/node` 26.6.3 wait for the seven-day release-age window.
+
 ## 2026-09-23 - 18.0.1
 
 ### Maintenance

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@idp.global/sdk',
-    version: '18.0.1',
+    version: '18.1.0',
     description: 'Reusable browser and server SDK for idp.global authentication.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxpQkFBaUI7SUFDdkIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLGdFQUFnRTtDQUM5RSxDQUFBIn0=

package/dist_ts_relyingparty/classes.actorscope.d.ts

@@ -0,0 +1,23 @@
+import * as plugins from './plugins.js';
+export interface IActorScope<TContext> {
+    /** Runs `operationArg` and everything it awaits as this actor. */
+    run<T>(contextArg: TContext, operationArg: () => T): T;
+    /** The actor of the operation in flight, or `undefined` outside one. */
+    current(): TContext | undefined;
+    /** Runs `operationArg` without any actor, for background work entered from a request. */
+    exit<T>(operationArg: () => T): T;
+    /**
+     * The request scope of a `TypedRouter` (`addRequestScope`): middleware and
+     * handler of every dispatch run as the actor the transport's trusted local
+     * data names. A dispatch without one runs without an actor.
+     */
+    readonly requestScope: plugins.typedrequest.TTypedRouterRequestScope;
+}
+/**
+ * An AsyncLocalStorage-backed actor context. The application decides what an
+ * actor is and how it is read from the trusted local data its transports set;
+ * nothing a handler can reach decides it.
+ */
+export declare const createActorScope: <TContext>(optionsArg: {
+    fromLocalData(localDataArg: Readonly<Record<string, unknown>>): TContext | undefined;
+}) => IActorScope<TContext>;

package/dist_ts_relyingparty/classes.actorscope.js

@@ -0,0 +1,22 @@
+import * as plugins from './plugins.js';
+/**
+ * An AsyncLocalStorage-backed actor context. The application decides what an
+ * actor is and how it is read from the trusted local data its transports set;
+ * nothing a handler can reach decides it.
+ */
+export const createActorScope = (optionsArg) => {
+    const storage = new plugins.asyncHooks.AsyncLocalStorage();
+    return {
+        run: (contextArg, operationArg) => storage.run(contextArg, operationArg),
+        current: () => storage.getStore(),
+        exit: (operationArg) => storage.exit(operationArg),
+        requestScope: (_typedRequestArg, nextArg, contextArg) => {
+            const actor = optionsArg.fromLocalData(contextArg.localData);
+            if (actor === undefined) {
+                return nextArg();
+            }
+            return storage.run(actor, nextArg);
+        },
+    };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hY3RvcnNjb3BlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2NsYXNzZXMuYWN0b3JzY29wZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQWlCeEM7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFHLENBQVcsVUFFMUMsRUFBeUIsRUFBRTtJQUMxQixNQUFNLE9BQU8sR0FBRyxJQUFJLE9BQU8sQ0FBQyxVQUFVLENBQUMsaUJBQWlCLEVBQVksQ0FBQztJQUNyRSxPQUFPO1FBQ0wsR0FBRyxFQUFFLENBQUMsVUFBVSxFQUFFLFlBQVksRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsWUFBWSxDQUFDO1FBQ3hFLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFO1FBQ2pDLElBQUksRUFBRSxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUM7UUFDbEQsWUFBWSxFQUFFLENBQUMsZ0JBQWdCLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxFQUFFO1lBQ3RELE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQzdELElBQUksS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUN4QixPQUFPLE9BQU8sRUFBRSxDQUFDO1lBQ25CLENBQUM7WUFDRCxPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ3JDLENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQyxDQUFDIn0=

package/dist_ts_relyingparty/classes.authorityobserver.d.ts

@@ -0,0 +1,81 @@
+import { type IOidcProvider } from './classes.idpoidcprovider.js';
+import type { IAuthorityTokenSource } from './interfaces.js';
+/** Why an observation refused: no membership at all, or roles the application maps to nothing. */
+export type TAuthorityRefusalReason = 'idp_membership_absent' | 'idp_roles_unmapped';
+/**
+ * idp.global no longer reports a usable membership of the organization.
+ * `firstRefusal` is `true` exactly once per transition from access to refusal
+ * for one login session and organization, so an audit trail records the
+ * transition and not every refused request.
+ */
+export declare class AuthorityRefusedError extends Error {
+    readonly reason: TAuthorityRefusalReason;
+    readonly firstRefusal: boolean;
+    readonly code = "organization_access_revoked";
+    readonly status = 403;
+    constructor(reason: TAuthorityRefusalReason, firstRefusal: boolean);
+}
+/** One live observation, as the caller reads it. */
+export interface IAuthorityObservation<TGrant> {
+    /** what the application's projection made of the roles */
+    grant: TGrant;
+    /** the idp role keys the provider reported, sorted */
+    roles: readonly string[];
+    /** the observation's own `exp` in epoch milliseconds */
+    tokenExpiresAt: number;
+    observedAt: number;
+}
+export interface IAuthorityObserverOptions<TGrant> {
+    provider: IOidcProvider;
+    tokens: IAuthorityTokenSource;
+    /** the application's role table: what the provider's role keys grant here, `undefined` for nothing */
+    project(rolesArg: readonly string[]): TGrant | undefined;
+    /**
+     * How long a positive observation answers later requests of the same login
+     * session and organization. `0` (the default) observes freshly for every
+     * operation, which is the provider's contract; a positive value is an
+     * explicit opt-in under which a revocation at idp.global takes effect here
+     * only once the cached answer expires.
+     */
+    positiveTtlMs?: number;
+    /** How long a refusal is reused; `0` (the default) never reuses one. */
+    negativeTtlMs?: number;
+    /** the bound of remembered observations */
+    maxEntries?: number;
+    now?: () => number;
+}
+/**
+ * Live organization authority through idp.global: one `POST /oauth/introspect`
+ * observation of a login session's subject in one organization, projected by
+ * the application's role table.
+ *
+ * Observations of one key run once however many callers ask at the same time.
+ * A failure to observe is never remembered, so the caller fails closed on
+ * every attempt while the provider is unreachable. A session that is forgotten
+ * while its observation is in flight never stores a positive answer. Nothing
+ * runs on a timer: the cache is pruned when it is written to.
+ */
+export declare class AuthorityObserver<TGrant> {
+    #private;
+    constructor(optionsArg: IAuthorityObserverOptions<TGrant>);
+    /** How many observations are remembered right now. */
+    get size(): number;
+    /**
+     * The grant of `principalId`'s login session in one organization at
+     * idp.global, or a throw: `AuthorityRefusedError` for a refusal,
+     * `AuthorityTokenError` when there is no live login to observe with or the
+     * provider could not be observed.
+     */
+    observe(optionsArg: {
+        loginSessionId: string;
+        principalId: string;
+        idpOrganizationId: string;
+    }): Promise<IAuthorityObservation<TGrant>>;
+    /** Drops every observation of a session; wire it to the session layer's `onSessionEnded`. */
+    forgetSession(sessionIdArg: string): void;
+    private liveEntry;
+    private observeOnce;
+    private makeObservation;
+    /** Expired entries go first; if that is not enough, the oldest do. */
+    private prune;
+}

package/dist_ts_relyingparty/classes.authorityobserver.js

@@ -0,0 +1,185 @@
+import { AuthorityTokenError } from './classes.errors.js';
+import { OidcAuthorityUnavailableError } from './classes.idpoidcprovider.js';
+/**
+ * idp.global no longer reports a usable membership of the organization.
+ * `firstRefusal` is `true` exactly once per transition from access to refusal
+ * for one login session and organization, so an audit trail records the
+ * transition and not every refused request.
+ */
+export class AuthorityRefusedError extends Error {
+    reason;
+    firstRefusal;
+    code = 'organization_access_revoked';
+    status = 403;
+    constructor(reason, firstRefusal) {
+        super('organization_access_revoked');
+        this.reason = reason;
+        this.firstRefusal = firstRefusal;
+        this.name = 'AuthorityRefusedError';
+    }
+}
+const DEFAULT_MAX_ENTRIES = 2_000;
+/** how much room an eviction makes, so it does not run on every insert */
+const EVICTION_HEADROOM = 0.1;
+const assertTtl = (valueArg, labelArg) => {
+    if (!Number.isSafeInteger(valueArg) || valueArg < 0) {
+        throw new Error(labelArg + ' must be a non-negative integer of milliseconds');
+    }
+    return valueArg;
+};
+/**
+ * Live organization authority through idp.global: one `POST /oauth/introspect`
+ * observation of a login session's subject in one organization, projected by
+ * the application's role table.
+ *
+ * Observations of one key run once however many callers ask at the same time.
+ * A failure to observe is never remembered, so the caller fails closed on
+ * every attempt while the provider is unreachable. A session that is forgotten
+ * while its observation is in flight never stores a positive answer. Nothing
+ * runs on a timer: the cache is pruned when it is written to.
+ */
+export class AuthorityObserver {
+    #cache = new Map();
+    #inFlight = new Map();
+    #forgotten = new Set();
+    #provider;
+    #tokens;
+    #project;
+    #positiveTtlMs;
+    #negativeTtlMs;
+    #maxEntries;
+    #now;
+    constructor(optionsArg) {
+        this.#provider = optionsArg.provider;
+        this.#tokens = optionsArg.tokens;
+        this.#project = optionsArg.project;
+        this.#positiveTtlMs = assertTtl(optionsArg.positiveTtlMs ?? 0, 'positiveTtlMs');
+        this.#negativeTtlMs = assertTtl(optionsArg.negativeTtlMs ?? 0, 'negativeTtlMs');
+        this.#maxEntries = optionsArg.maxEntries ?? DEFAULT_MAX_ENTRIES;
+        if (!Number.isSafeInteger(this.#maxEntries) || this.#maxEntries < 1) {
+            throw new Error('maxEntries must be a positive integer');
+        }
+        this.#now = optionsArg.now ?? (() => Date.now());
+    }
+    /** How many observations are remembered right now. */
+    get size() {
+        return this.#cache.size;
+    }
+    /**
+     * The grant of `principalId`'s login session in one organization at
+     * idp.global, or a throw: `AuthorityRefusedError` for a refusal,
+     * `AuthorityTokenError` when there is no live login to observe with or the
+     * provider could not be observed.
+     */
+    async observe(optionsArg) {
+        const key = `${optionsArg.loginSessionId} ${optionsArg.idpOrganizationId}`;
+        const cached = this.liveEntry(key);
+        const observation = cached ?? (await this.observeOnce(key, optionsArg));
+        if (observation.outcome !== 'active' || observation.grant === undefined) {
+            const firstRefusal = cached === undefined && !observation.reported;
+            observation.reported = true;
+            throw new AuthorityRefusedError(observation.reason ?? 'idp_membership_absent', firstRefusal);
+        }
+        return {
+            grant: observation.grant,
+            roles: observation.roles,
+            tokenExpiresAt: observation.tokenExpiresAt,
+            observedAt: observation.observedAt,
+        };
+    }
+    /** Drops every observation of a session; wire it to the session layer's `onSessionEnded`. */
+    forgetSession(sessionIdArg) {
+        const prefix = `${sessionIdArg} `;
+        for (const key of this.#cache.keys()) {
+            if (key.startsWith(prefix)) {
+                this.#cache.delete(key);
+            }
+        }
+        for (const key of this.#inFlight.keys()) {
+            if (key.startsWith(prefix)) {
+                this.#forgotten.add(key);
+            }
+        }
+    }
+    liveEntry(keyArg) {
+        const entry = this.#cache.get(keyArg);
+        return entry && entry.expiresAt > this.#now() ? entry : undefined;
+    }
+    async observeOnce(keyArg, optionsArg) {
+        const running = this.#inFlight.get(keyArg);
+        if (running) {
+            return running;
+        }
+        const pending = this.makeObservation(keyArg, optionsArg).finally(() => {
+            this.#inFlight.delete(keyArg);
+            this.#forgotten.delete(keyArg);
+        });
+        this.#inFlight.set(keyArg, pending);
+        return pending;
+    }
+    async makeObservation(keyArg, optionsArg) {
+        const token = await this.#tokens.liveProviderToken(optionsArg.loginSessionId, optionsArg.principalId);
+        let answer;
+        try {
+            answer = await this.#provider.introspectOrganization({
+                accessToken: token.accessToken,
+                subject: token.subject,
+                organizationId: optionsArg.idpOrganizationId,
+            });
+        }
+        catch (error) {
+            if (error instanceof OidcAuthorityUnavailableError) {
+                throw new AuthorityTokenError('authority_unavailable', error);
+            }
+            throw error;
+        }
+        const grant = answer.active ? this.#project(answer.roles) : undefined;
+        const active = answer.active && grant !== undefined;
+        const previous = this.#cache.get(keyArg);
+        const entry = {
+            outcome: active ? 'active' : 'inactive',
+            ...(active ? { grant } : { reason: answer.active ? 'idp_roles_unmapped' : 'idp_membership_absent' }),
+            roles: answer.roles,
+            tokenExpiresAt: answer.expiresAt,
+            observedAt: this.#now(),
+            expiresAt: this.#now() + (active ? this.#positiveTtlMs : this.#negativeTtlMs),
+            // a refusal after a reported refusal is the same transition
+            reported: !active && previous?.outcome === 'inactive' && previous.reported,
+        };
+        if (active && this.#forgotten.has(keyArg)) {
+            // the request holding this answer finishes — it was authorized before
+            // the session ended — and every later one observes again
+            entry.expiresAt = 0;
+            return entry;
+        }
+        // a refusal is kept even when it answers nothing (`negativeTtlMs` 0): it is
+        // what reports one transition instead of one per refused request
+        this.#cache.delete(keyArg);
+        this.#cache.set(keyArg, entry);
+        this.prune();
+        return entry;
+    }
+    /** Expired entries go first; if that is not enough, the oldest do. */
+    prune() {
+        if (this.#cache.size <= this.#maxEntries) {
+            return;
+        }
+        const now = this.#now();
+        for (const [key, entry] of this.#cache) {
+            if (entry.expiresAt <= now) {
+                this.#cache.delete(key);
+            }
+        }
+        if (this.#cache.size <= this.#maxEntries) {
+            return;
+        }
+        const target = Math.floor(this.#maxEntries * (1 - EVICTION_HEADROOM));
+        for (const key of this.#cache.keys()) {
+            if (this.#cache.size <= target) {
+                break;
+            }
+            this.#cache.delete(key);
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHlvYnNlcnZlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9jbGFzc2VzLmF1dGhvcml0eW9ic2VydmVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQzFELE9BQU8sRUFBRSw2QkFBNkIsRUFBc0IsTUFBTSw4QkFBOEIsQ0FBQztBQU1qRzs7Ozs7R0FLRztBQUNILE1BQU0sT0FBTyxxQkFBc0IsU0FBUSxLQUFLO0lBSzVCO0lBQ0E7SUFMRixJQUFJLEdBQUcsNkJBQTZCLENBQUM7SUFDckMsTUFBTSxHQUFHLEdBQUcsQ0FBQztJQUU3QixZQUNrQixNQUErQixFQUMvQixZQUFxQjtRQUVyQyxLQUFLLENBQUMsNkJBQTZCLENBQUMsQ0FBQztRQUhyQixXQUFNLEdBQU4sTUFBTSxDQUF5QjtRQUMvQixpQkFBWSxHQUFaLFlBQVksQ0FBUztRQUdyQyxJQUFJLENBQUMsSUFBSSxHQUFHLHVCQUF1QixDQUFDO0lBQ3RDLENBQUM7Q0FDRjtBQWlDRCxNQUFNLG1CQUFtQixHQUFHLEtBQUssQ0FBQztBQUNsQywwRUFBMEU7QUFDMUUsTUFBTSxpQkFBaUIsR0FBRyxHQUFHLENBQUM7QUFlOUIsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFnQixFQUFFLFFBQWdCLEVBQVUsRUFBRTtJQUMvRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEQsTUFBTSxJQUFJLEtBQUssQ0FBQyxRQUFRLEdBQUcsaURBQWlELENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sT0FBTyxpQkFBaUI7SUFDbkIsTUFBTSxHQUFHLElBQUksR0FBRyxFQUFzQyxDQUFDO0lBQ3ZELFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBK0MsQ0FBQztJQUNuRSxVQUFVLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUMvQixTQUFTLENBQWdCO0lBQ3pCLE9BQU8sQ0FBd0I7SUFDL0IsUUFBUSxDQUFzRDtJQUM5RCxjQUFjLENBQVM7SUFDdkIsY0FBYyxDQUFTO0lBQ3ZCLFdBQVcsQ0FBUztJQUNwQixJQUFJLENBQWU7SUFFNUIsWUFBWSxVQUE2QztRQUN2RCxJQUFJLENBQUMsU0FBUyxHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUM7UUFDckMsSUFBSSxDQUFDLE9BQU8sR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDO1FBQ2pDLElBQUksQ0FBQyxRQUFRLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQztRQUNuQyxJQUFJLENBQUMsY0FBYyxHQUFHLFNBQVMsQ0FBQyxVQUFVLENBQUMsYUFBYSxJQUFJLENBQUMsRUFBRSxlQUFlLENBQUMsQ0FBQztRQUNoRixJQUFJLENBQUMsY0FBYyxHQUFHLFNBQVMsQ0FBQyxVQUFVLENBQUMsYUFBYSxJQUFJLENBQUMsRUFBRSxlQUFlLENBQUMsQ0FBQztRQUNoRixJQUFJLENBQUMsV0FBVyxHQUFHLFVBQVUsQ0FBQyxVQUFVLElBQUksbUJBQW1CLENBQUM7UUFDaEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLElBQUksQ0FBQyxXQUFXLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDcEUsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxHQUFHLFVBQVUsQ0FBQyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRUQsc0RBQXNEO0lBQ3RELElBQVcsSUFBSTtRQUNiLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUM7SUFDMUIsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUlwQjtRQUNDLE1BQU0sR0FBRyxHQUFHLEdBQUcsVUFBVSxDQUFDLGNBQWMsSUFBSSxVQUFVLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztRQUMzRSxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ25DLE1BQU0sV0FBVyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUN4RSxJQUFJLFdBQVcsQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLFdBQVcsQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEUsTUFBTSxZQUFZLEdBQUcsTUFBTSxLQUFLLFNBQVMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUM7WUFDbkUsV0FBVyxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUM7WUFDNUIsTUFBTSxJQUFJLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxNQUFNLElBQUksdUJBQXVCLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDL0YsQ0FBQztRQUNELE9BQU87WUFDTCxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7WUFDeEIsS0FBSyxFQUFFLFdBQVcsQ0FBQyxLQUFLO1lBQ3hCLGNBQWMsRUFBRSxXQUFXLENBQUMsY0FBYztZQUMxQyxVQUFVLEVBQUUsV0FBVyxDQUFDLFVBQVU7U0FDbkMsQ0FBQztJQUNKLENBQUM7SUFFRCw2RkFBNkY7SUFDdEYsYUFBYSxDQUFDLFlBQW9CO1FBQ3ZDLE1BQU0sTUFBTSxHQUFHLEdBQUcsWUFBWSxHQUFHLENBQUM7UUFDbEMsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDckMsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7Z0JBQzNCLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQzFCLENBQUM7UUFDSCxDQUFDO1FBQ0QsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDeEMsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7Z0JBQzNCLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQzNCLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVPLFNBQVMsQ0FBQyxNQUFjO1FBQzlCLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3RDLE9BQU8sS0FBSyxJQUFJLEtBQUssQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNwRSxDQUFDO0lBRU8sS0FBSyxDQUFDLFdBQVcsQ0FDdkIsTUFBYyxFQUNkLFVBQXNGO1FBRXRGLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzNDLElBQUksT0FBTyxFQUFFLENBQUM7WUFDWixPQUFPLE9BQU8sQ0FBQztRQUNqQixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtZQUNwRSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUM5QixJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNqQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNwQyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRU8sS0FBSyxDQUFDLGVBQWUsQ0FDM0IsTUFBYyxFQUNkLFVBQXNGO1FBRXRGLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxVQUFVLENBQUMsY0FBYyxFQUFFLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUN0RyxJQUFJLE1BQW9FLENBQUM7UUFDekUsSUFBSSxDQUFDO1lBQ0gsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQztnQkFDbkQsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO2dCQUM5QixPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU87Z0JBQ3RCLGNBQWMsRUFBRSxVQUFVLENBQUMsaUJBQWlCO2FBQzdDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksNkJBQTZCLEVBQUUsQ0FBQztnQkFDbkQsTUFBTSxJQUFJLG1CQUFtQixDQUFDLHVCQUF1QixFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQ2hFLENBQUM7WUFDRCxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3RFLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLElBQUksS0FBSyxLQUFLLFNBQVMsQ0FBQztRQUNwRCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN6QyxNQUFNLEtBQUssR0FBK0I7WUFDeEMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxVQUFVO1lBQ3ZDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1lBQ3BHLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSztZQUNuQixjQUFjLEVBQUUsTUFBTSxDQUFDLFNBQVM7WUFDaEMsVUFBVSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUU7WUFDdkIsU0FBUyxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQztZQUM3RSw0REFBNEQ7WUFDNUQsUUFBUSxFQUFFLENBQUMsTUFBTSxJQUFJLFFBQVEsRUFBRSxPQUFPLEtBQUssVUFBVSxJQUFJLFFBQVEsQ0FBQyxRQUFRO1NBQzNFLENBQUM7UUFDRixJQUFJLE1BQU0sSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQzFDLHNFQUFzRTtZQUN0RSx5REFBeUQ7WUFDekQsS0FBSyxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUM7WUFDcEIsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsNEVBQTRFO1FBQzVFLGlFQUFpRTtRQUNqRSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzQixJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDL0IsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2IsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsc0VBQXNFO0lBQzlELEtBQUs7UUFDWCxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN6QyxPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN4QixLQUFLLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3ZDLElBQUksS0FBSyxDQUFDLFNBQVMsSUFBSSxHQUFHLEVBQUUsQ0FBQztnQkFDM0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDMUIsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN6QyxPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFdBQVcsR0FBRyxDQUFDLENBQUMsR0FBRyxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7UUFDdEUsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDckMsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksSUFBSSxNQUFNLEVBQUUsQ0FBQztnQkFDL0IsTUFBTTtZQUNSLENBQUM7WUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMxQixDQUFDO0lBQ0gsQ0FBQztDQUNGIn0=

package/dist_ts_relyingparty/classes.errors.d.ts

@@ -0,0 +1,33 @@
+import type { TLoginCallbackStage } from './interfaces.js';
+export type TRelyingPartyErrorCode = 'login_method_unavailable' | 'invalid_login_callback' | 'missing_login_intent' | 'invalid_or_replayed_login' | 'invalid_login_finalize';
+/** A request the login flow refuses; the code is safe to answer, the browser learns nothing more. */
+export declare class RelyingPartyError extends Error {
+    readonly code: TRelyingPartyErrorCode;
+    readonly status: number;
+    constructor(code: TRelyingPartyErrorCode);
+}
+/**
+ * The application refuses a verified provider login (a disabled account, a
+ * subject of another issuer, no organization it serves). Thrown from
+ * `IRelyingPartyPrincipals.admit`; it reaches the caller unchanged.
+ */
+export declare class RelyingPartyRefusal extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status: number);
+}
+/** A login callback that failed for a reason other than a refusal; the stage is for the log only. */
+export declare class LoginCallbackError extends Error {
+    readonly stage: TLoginCallbackStage;
+    constructor(stage: TLoginCallbackStage, causeArg: unknown);
+}
+export type TAuthorityTokenErrorCode = 
+/** there is no live provider login this credential could be observed with */
+'authority_login_required'
+/** the provider could not be reached; the caller fails closed */
+ | 'authority_unavailable';
+export declare class AuthorityTokenError extends Error {
+    readonly code: TAuthorityTokenErrorCode;
+    readonly status: number;
+    constructor(code: TAuthorityTokenErrorCode, causeArg?: unknown);
+}

package/dist_ts_relyingparty/classes.errors.js

@@ -0,0 +1,53 @@
+const RELYING_PARTY_ERROR_STATUS = {
+    login_method_unavailable: 404,
+    invalid_login_callback: 400,
+    missing_login_intent: 400,
+    invalid_or_replayed_login: 400,
+    invalid_login_finalize: 400,
+};
+/** A request the login flow refuses; the code is safe to answer, the browser learns nothing more. */
+export class RelyingPartyError extends Error {
+    code;
+    status;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'RelyingPartyError';
+        this.status = RELYING_PARTY_ERROR_STATUS[code];
+    }
+}
+/**
+ * The application refuses a verified provider login (a disabled account, a
+ * subject of another issuer, no organization it serves). Thrown from
+ * `IRelyingPartyPrincipals.admit`; it reaches the caller unchanged.
+ */
+export class RelyingPartyRefusal extends Error {
+    code;
+    status;
+    constructor(code, status) {
+        super(code);
+        this.code = code;
+        this.status = status;
+        this.name = 'RelyingPartyRefusal';
+    }
+}
+/** A login callback that failed for a reason other than a refusal; the stage is for the log only. */
+export class LoginCallbackError extends Error {
+    stage;
+    constructor(stage, causeArg) {
+        super('The login callback could not be completed', { cause: causeArg });
+        this.stage = stage;
+        this.name = 'LoginCallbackError';
+    }
+}
+export class AuthorityTokenError extends Error {
+    code;
+    status;
+    constructor(code, causeArg) {
+        super(code, { cause: causeArg });
+        this.code = code;
+        this.name = 'AuthorityTokenError';
+        this.status = code === 'authority_login_required' ? 403 : 503;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5lcnJvcnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvY2xhc3Nlcy5lcnJvcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBU0EsTUFBTSwwQkFBMEIsR0FBcUQ7SUFDbkYsd0JBQXdCLEVBQUUsR0FBRztJQUM3QixzQkFBc0IsRUFBRSxHQUFHO0lBQzNCLG9CQUFvQixFQUFFLEdBQUc7SUFDekIseUJBQXlCLEVBQUUsR0FBRztJQUM5QixzQkFBc0IsRUFBRSxHQUFHO0NBQzVCLENBQUM7QUFFRixxR0FBcUc7QUFDckcsTUFBTSxPQUFPLGlCQUFrQixTQUFRLEtBQUs7SUFHZDtJQUZaLE1BQU0sQ0FBUztJQUUvQixZQUE0QixJQUE0QjtRQUN0RCxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7UUFEYyxTQUFJLEdBQUosSUFBSSxDQUF3QjtRQUV0RCxJQUFJLENBQUMsSUFBSSxHQUFHLG1CQUFtQixDQUFDO1FBQ2hDLElBQUksQ0FBQyxNQUFNLEdBQUcsMEJBQTBCLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDakQsQ0FBQztDQUNGO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sT0FBTyxtQkFBb0IsU0FBUSxLQUFLO0lBRTFCO0lBQ0E7SUFGbEIsWUFDa0IsSUFBWSxFQUNaLE1BQWM7UUFFOUIsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBSEksU0FBSSxHQUFKLElBQUksQ0FBUTtRQUNaLFdBQU0sR0FBTixNQUFNLENBQVE7UUFHOUIsSUFBSSxDQUFDLElBQUksR0FBRyxxQkFBcUIsQ0FBQztJQUNwQyxDQUFDO0NBQ0Y7QUFFRCxxR0FBcUc7QUFDckcsTUFBTSxPQUFPLGtCQUFtQixTQUFRLEtBQUs7SUFFekI7SUFEbEIsWUFDa0IsS0FBMEIsRUFDMUMsUUFBaUI7UUFFakIsS0FBSyxDQUFDLDJDQUEyQyxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFIeEQsVUFBSyxHQUFMLEtBQUssQ0FBcUI7UUFJMUMsSUFBSSxDQUFDLElBQUksR0FBRyxvQkFBb0IsQ0FBQztJQUNuQyxDQUFDO0NBQ0Y7QUFRRCxNQUFNLE9BQU8sbUJBQW9CLFNBQVEsS0FBSztJQUdoQjtJQUZaLE1BQU0sQ0FBUztJQUUvQixZQUE0QixJQUE4QixFQUFFLFFBQWtCO1FBQzVFLEtBQUssQ0FBQyxJQUFJLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQURQLFNBQUksR0FBSixJQUFJLENBQTBCO1FBRXhELElBQUksQ0FBQyxJQUFJLEdBQUcscUJBQXFCLENBQUM7UUFDbEMsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLEtBQUssMEJBQTBCLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO0lBQ2hFLENBQUM7Q0FDRiJ9

package/dist_ts_relyingparty/classes.idpoidcprovider.d.ts

@@ -0,0 +1,142 @@
+export interface IOidcAuthorizationOptions {
+    state: string;
+    nonce: string;
+    pkceVerifier: string;
+}
+export interface IOidcCompletionOptions extends IOidcAuthorizationOptions {
+    /** the callback as the application's own public origin saw it */
+    callbackUrl: URL;
+}
+/** One organization the provider reports for the subject; display data, not an authorization grant. */
+export interface IOidcOrganizationClaim {
+    id: string;
+    name: string;
+    slug: string;
+    roles: string[];
+}
+export interface IOidcCompletion {
+    subject: string;
+    accessToken: string;
+    refreshToken?: string;
+    /** epoch milliseconds; `0` when the token response named no lifetime */
+    accessTokenExpiresAt: number;
+    email?: string;
+    emailVerified: boolean;
+    displayName?: string;
+    organizations: IOidcOrganizationClaim[];
+}
+/**
+ * One live observation of a subject's authority in one organization, as
+ * `POST /oauth/introspect` answers it. An inactive answer names no reason:
+ * revoked token, dead login session, removed membership and disconnected app
+ * are deliberately indistinguishable.
+ */
+export interface IOidcOrganizationObservation {
+    active: boolean;
+    /** the sorted membership role keys; empty when inactive */
+    roles: readonly string[];
+    /** the observation's own `exp` in epoch milliseconds; `0` when inactive */
+    expiresAt: number;
+}
+export interface IOidcRefreshedTokens {
+    accessToken: string;
+    /** the rotated refresh token; absent when the provider returned none */
+    refreshToken?: string;
+    /** epoch milliseconds; `0` when the token response named no lifetime */
+    accessTokenExpiresAt: number;
+}
+/** Why an observation or a refresh could not be made; never why access was refused. */
+export type TOidcAuthorityFailure = 'unavailable' | 'invalid_response';
+/** The provider could not be asked, or did not answer in its own contract. The caller fails closed on it. */
+export declare class OidcAuthorityUnavailableError extends Error {
+    readonly reason: TOidcAuthorityFailure;
+    constructor(reason: TOidcAuthorityFailure, causeArg?: unknown);
+}
+/** The provider refused the refresh with `invalid_grant`: the refresh family is revoked, expired or was reused. */
+export declare class OidcRefreshRefusedError extends Error {
+    constructor(causeArg?: unknown);
+}
+export type TOidcTokenHint = 'access_token' | 'refresh_token';
+export type TOidcCompletionFailureStage = 'token_exchange' | 'token_validation' | 'userinfo';
+export declare class OidcCompletionError extends Error {
+    readonly stage: TOidcCompletionFailureStage;
+    constructor(stage: TOidcCompletionFailureStage, causeArg: unknown);
+}
+/**
+ * What the session layer needs from the provider. `IdpOidcProvider` is the
+ * implementation; tests bind a double to it, so no test opens a socket.
+ */
+export interface IOidcProvider {
+    /**
+     * The deadline of every provider request, in seconds. The refresh lock that
+     * keeps two replicas from spending one refresh token outlives it.
+     */
+    readonly requestTimeoutSeconds: number;
+    init(): Promise<void>;
+    buildAuthorizationUrl(optionsArg: IOidcAuthorizationOptions): Promise<URL>;
+    completeAuthorization(optionsArg: IOidcCompletionOptions): Promise<IOidcCompletion>;
+    revokeToken(tokenArg: string, hintArg: TOidcTokenHint): Promise<void>;
+    /** Throws `OidcAuthorityUnavailableError` rather than guessing an answer. */
+    introspectOrganization(optionsArg: {
+        accessToken: string;
+        subject: string;
+        organizationId: string;
+    }): Promise<IOidcOrganizationObservation>;
+    /** Throws `OidcRefreshRefusedError` on `invalid_grant`, `OidcAuthorityUnavailableError` for everything else. */
+    refreshTokens(refreshTokenArg: string): Promise<IOidcRefreshedTokens>;
+}
+/**
+ * The scopes a relying party asks for. `organizations` and `roles` are what
+ * idp.global reports memberships under.
+ */
+export declare const IDP_OIDC_DEFAULT_SCOPES = "openid profile email organizations roles";
+export declare const IDP_OIDC_DEFAULT_REQUEST_TIMEOUT_SECONDS = 10;
+export interface IIdpOidcProviderOptions {
+    /** the issuer origin, `https://…`; the introspection client refuses anything else */
+    issuer: URL;
+    clientId: string;
+    clientSecret: string;
+    /** the registered callback, on the application's public origin */
+    redirectUri: URL;
+    scopes?: string;
+    /** deadline of discovery, token, UserInfo, refresh and revocation requests */
+    requestTimeoutSeconds?: number;
+    /** deadline of one introspection; the introspection client's default applies when absent */
+    introspectionTimeoutMs?: number;
+}
+/**
+ * Organization claims as idp.global documents them: `id`, `name`, `slug` and
+ * the member's roles. Anything that is not that exact shape is dropped rather
+ * than guessed at.
+ */
+export declare const readOrganizationClaims: (valueArg: unknown) => IOidcOrganizationClaim[];
+/**
+ * The relying-party side of the authorization code flow with S256 PKCE on
+ * `openid-client`, in the profile idp.global supports: code responses, S256
+ * challenges, RS256 ID tokens and `client_secret_basic` for a confidential
+ * client. Live organization authority is observed with the sdk's
+ * `OidcIntrospectionClient`.
+ */
+export declare class IdpOidcProvider implements IOidcProvider {
+    #private;
+    readonly requestTimeoutSeconds: number;
+    constructor(optionsArg: IIdpOidcProviderOptions);
+    private get configuration();
+    init(): Promise<void>;
+    buildAuthorizationUrl(optionsArg: IOidcAuthorizationOptions): Promise<URL>;
+    completeAuthorization(optionsArg: IOidcCompletionOptions): Promise<IOidcCompletion>;
+    revokeToken(tokenArg: string, hintArg: TOidcTokenHint): Promise<void>;
+    /**
+     * One `POST /oauth/introspect` through the confidential introspection
+     * client, which validates the whole answer before this code sees it. A
+     * refusal (`active: false`) is an answer; anything else is a failure to
+     * observe.
+     */
+    introspectOrganization(optionsArg: {
+        accessToken: string;
+        subject: string;
+        organizationId: string;
+    }): Promise<IOidcOrganizationObservation>;
+    /** The refresh grant with rotation; a superseded refresh token is never kept by the caller. */
+    refreshTokens(refreshTokenArg: string): Promise<IOidcRefreshedTokens>;
+}