@idp.global/sdk 18.0.1 → 18.1.0

package/dist_ts_relyingparty/helpers.cookies.js

@@ -0,0 +1,62 @@
+// Control characters, space, DEL and the cookie delimiters are never valid.
+const isInvalidCookieCharacter = (characterArg) => {
+    const code = characterArg.charCodeAt(0);
+    return code <= 0x20 || code === 0x7f || characterArg === ';' || characterArg === ',';
+};
+const assertCookiePart = (valueArg, labelArg) => {
+    if (!valueArg || Array.from(valueArg).some(isInvalidCookieCharacter)) {
+        throw new Error('Invalid cookie ' + labelArg);
+    }
+};
+/** The cookies of a `Cookie` header; the first value of a repeated name wins, an undecodable value is skipped. */
+export const parseCookies = (cookieHeaderArg) => {
+    const result = new Map();
+    if (!cookieHeaderArg) {
+        return result;
+    }
+    for (const part of cookieHeaderArg.split(';')) {
+        const separatorIndex = part.indexOf('=');
+        if (separatorIndex <= 0) {
+            continue;
+        }
+        const name = part.slice(0, separatorIndex).trim();
+        const encodedValue = part.slice(separatorIndex + 1).trim();
+        if (!name || result.has(name)) {
+            continue;
+        }
+        try {
+            result.set(name, decodeURIComponent(encodedValue));
+        }
+        catch {
+            continue;
+        }
+    }
+    return result;
+};
+/** One `Set-Cookie` value, always `Path=/` and never with a `Domain`, so a `__Host-` name stays valid. */
+export const serializeCookie = (nameArg, valueArg, optionsArg = {}) => {
+    assertCookiePart(nameArg, 'name');
+    assertCookiePart(valueArg, 'value');
+    const parts = [nameArg + '=' + encodeURIComponent(valueArg), 'Path=/'];
+    if (optionsArg.httpOnly) {
+        parts.push('HttpOnly');
+    }
+    if (optionsArg.secure) {
+        parts.push('Secure');
+    }
+    if (optionsArg.sameSite) {
+        parts.push('SameSite=' + optionsArg.sameSite);
+    }
+    if (optionsArg.maxAgeSeconds !== undefined) {
+        if (!Number.isSafeInteger(optionsArg.maxAgeSeconds) || optionsArg.maxAgeSeconds < 0) {
+            throw new Error('Invalid cookie max age');
+        }
+        parts.push('Max-Age=' + optionsArg.maxAgeSeconds);
+    }
+    return parts.join('; ');
+};
+export const serializeClearedCookie = (nameArg, optionsArg = {}) => serializeCookie(nameArg, 'deleted', {
+    ...optionsArg,
+    maxAgeSeconds: 0,
+}) + '; Expires=Thu, 01 Jan 1970 00:00:00 GMT';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5jb29raWVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2hlbHBlcnMuY29va2llcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFPQSw0RUFBNEU7QUFDNUUsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLFlBQW9CLEVBQVcsRUFBRTtJQUNqRSxNQUFNLElBQUksR0FBRyxZQUFZLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hDLE9BQU8sSUFBSSxJQUFJLElBQUksSUFBSSxJQUFJLEtBQUssSUFBSSxJQUFJLFlBQVksS0FBSyxHQUFHLElBQUksWUFBWSxLQUFLLEdBQUcsQ0FBQztBQUN2RixDQUFDLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBZ0IsRUFBRSxRQUFnQixFQUFRLEVBQUU7SUFDcEUsSUFBSSxDQUFDLFFBQVEsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxFQUFFLENBQUM7UUFDckUsTUFBTSxJQUFJLEtBQUssQ0FBQyxpQkFBaUIsR0FBRyxRQUFRLENBQUMsQ0FBQztJQUNoRCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsa0hBQWtIO0FBQ2xILE1BQU0sQ0FBQyxNQUFNLFlBQVksR0FBRyxDQUFDLGVBQTBDLEVBQXVCLEVBQUU7SUFDOUYsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7SUFDekMsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxLQUFLLE1BQU0sSUFBSSxJQUFJLGVBQWUsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM5QyxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3pDLElBQUksY0FBYyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3hCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsY0FBYyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDbEQsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDM0QsSUFBSSxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDOUIsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxrQkFBa0IsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO1FBQ3JELENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxTQUFTO1FBQ1gsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRiwwR0FBMEc7QUFDMUcsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQzdCLE9BQWUsRUFDZixRQUFnQixFQUNoQixhQUE2QixFQUFFLEVBQ3ZCLEVBQUU7SUFDVixnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDbEMsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sS0FBSyxHQUFHLENBQUMsT0FBTyxHQUFHLEdBQUcsR0FBRyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUN2RSxJQUFJLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUN4QixLQUFLLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3pCLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN0QixLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZCLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUN4QixLQUFLLENBQUMsSUFBSSxDQUFDLFdBQVcsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLGFBQWEsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMzQyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLElBQUksVUFBVSxDQUFDLGFBQWEsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNwRixNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFDNUMsQ0FBQztRQUNELEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQzFCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQ3BDLE9BQWUsRUFDZixhQUFvRCxFQUFFLEVBQzlDLEVBQUUsQ0FDVixlQUFlLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRTtJQUNsQyxHQUFHLFVBQVU7SUFDYixhQUFhLEVBQUUsQ0FBQztDQUNqQixDQUFDLEdBQUcseUNBQXlDLENBQUMifQ==

package/dist_ts_relyingparty/helpers.crypto.d.ts

@@ -0,0 +1,12 @@
+/** A 32-byte key given as base64 or base64url; anything else is refused by `labelArg`, never echoed. */
+export declare const decodeSecretKey: (valueArg: string, labelArg: string) => Buffer;
+export declare const randomToken: (byteLengthArg?: number) => string;
+/** base64url SHA-256 of a UTF-8 string; how tokens, states and bindings are stored. */
+export declare const sha256: (valueArg: string) => string;
+export declare const timingSafeEqualString: (leftArg: string, rightArg: string) => boolean;
+/**
+ * The CSRF token of a session: an HMAC of the session cookie token under the
+ * deployment's CSRF key, after a label that separates this use of the key from
+ * any other. It is derived again on every request and never stored.
+ */
+export declare const deriveCsrfToken: (sessionTokenArg: string, csrfKeyArg: Buffer, labelArg: string) => string;

package/dist_ts_relyingparty/helpers.crypto.js

@@ -0,0 +1,40 @@
+import * as plugins from './plugins.js';
+/** A 32-byte key given as base64 or base64url; anything else is refused by `labelArg`, never echoed. */
+export const decodeSecretKey = (valueArg, labelArg) => {
+    const normalized = typeof valueArg === 'string' ? valueArg.trim() : '';
+    if (!normalized) {
+        throw new Error(labelArg + ' must not be empty');
+    }
+    const base64Normalized = normalized
+        .replace(/-/gu, '+')
+        .replace(/_/gu, '/')
+        .replace(/=+$/u, '');
+    const decoded = Buffer.from(normalized, 'base64');
+    if (decoded.length !== 32
+        || decoded.toString('base64').replace(/=+$/u, '') !== base64Normalized) {
+        throw new Error(labelArg + ' must decode to exactly 32 bytes');
+    }
+    return decoded;
+};
+export const randomToken = (byteLengthArg = 32) => plugins.crypto.randomBytes(byteLengthArg).toString('base64url');
+/** base64url SHA-256 of a UTF-8 string; how tokens, states and bindings are stored. */
+export const sha256 = (valueArg) => plugins.crypto.createHash('sha256').update(valueArg, 'utf8').digest('base64url');
+export const timingSafeEqualString = (leftArg, rightArg) => {
+    const left = Buffer.from(leftArg, 'utf8');
+    const right = Buffer.from(rightArg, 'utf8');
+    if (left.length !== right.length) {
+        return false;
+    }
+    return plugins.crypto.timingSafeEqual(left, right);
+};
+/**
+ * The CSRF token of a session: an HMAC of the session cookie token under the
+ * deployment's CSRF key, after a label that separates this use of the key from
+ * any other. It is derived again on every request and never stored.
+ */
+export const deriveCsrfToken = (sessionTokenArg, csrfKeyArg, labelArg) => plugins.crypto
+    .createHmac('sha256', csrfKeyArg)
+    .update(labelArg, 'utf8')
+    .update(sessionTokenArg, 'utf8')
+    .digest('base64url');
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5jcnlwdG8uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvaGVscGVycy5jcnlwdG8udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFFeEMsd0dBQXdHO0FBQ3hHLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRyxDQUFDLFFBQWdCLEVBQUUsUUFBZ0IsRUFBVSxFQUFFO0lBQzVFLE1BQU0sVUFBVSxHQUFHLE9BQU8sUUFBUSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDdkUsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2hCLE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxHQUFHLG9CQUFvQixDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUNELE1BQU0sZ0JBQWdCLEdBQUcsVUFBVTtTQUNoQyxPQUFPLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQztTQUNuQixPQUFPLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQztTQUNuQixPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZCLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELElBQ0UsT0FBTyxDQUFDLE1BQU0sS0FBSyxFQUFFO1dBQ2xCLE9BQU8sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsS0FBSyxnQkFBZ0IsRUFDdEUsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxHQUFHLGtDQUFrQyxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLFdBQVcsR0FBRyxDQUFDLGdCQUF3QixFQUFFLEVBQVUsRUFBRSxDQUNoRSxPQUFPLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7QUFFbEUsdUZBQXVGO0FBQ3ZGLE1BQU0sQ0FBQyxNQUFNLE1BQU0sR0FBRyxDQUFDLFFBQWdCLEVBQVUsRUFBRSxDQUNqRCxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUVuRixNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLE9BQWUsRUFBRSxRQUFnQixFQUFXLEVBQUU7SUFDbEYsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDMUMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDNUMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNqQyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztBQUNyRCxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQUMsZUFBdUIsRUFBRSxVQUFrQixFQUFFLFFBQWdCLEVBQVUsRUFBRSxDQUN2RyxPQUFPLENBQUMsTUFBTTtLQUNYLFVBQVUsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDO0tBQ2hDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDO0tBQ3hCLE1BQU0sQ0FBQyxlQUFlLEVBQUUsTUFBTSxDQUFDO0tBQy9CLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQyJ9

package/dist_ts_relyingparty/helpers.returnpath.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The one path a login may return to, judged on the normalized result and
+ * never on the shape of the input: `/.//evil.com` parses on this origin but
+ * normalizes to `//evil.com`, which a browser reads as another host. Everything
+ * that is not a plain same-origin path outside the login routes — a scheme, a
+ * host, a backslash, a control character, an overlong value, a path under
+ * `loginPathPrefixArg` — becomes `/`.
+ */
+export declare const sanitizeReturnPath: (returnPathArg: unknown, publicOriginArg: string, loginPathPrefixArg: string) => string;

package/dist_ts_relyingparty/helpers.returnpath.js

@@ -0,0 +1,39 @@
+/** A return path is a location the application produced, not a place to park data. */
+const MAX_RETURN_PATH_LENGTH = 1_024;
+/**
+ * The one path a login may return to, judged on the normalized result and
+ * never on the shape of the input: `/.//evil.com` parses on this origin but
+ * normalizes to `//evil.com`, which a browser reads as another host. Everything
+ * that is not a plain same-origin path outside the login routes — a scheme, a
+ * host, a backslash, a control character, an overlong value, a path under
+ * `loginPathPrefixArg` — becomes `/`.
+ */
+export const sanitizeReturnPath = (returnPathArg, publicOriginArg, loginPathPrefixArg) => {
+    const candidate = typeof returnPathArg === 'string' ? returnPathArg.trim() : '';
+    if (!candidate.startsWith('/')
+        || candidate.length > MAX_RETURN_PATH_LENGTH
+        || candidate.includes('\\')
+        // the URL parser drops tabs and newlines silently; such a path is refused instead of mangled
+        || /\p{Cc}/u.test(candidate)) {
+        return '/';
+    }
+    const loginRoot = loginPathPrefixArg.endsWith('/') ? loginPathPrefixArg.slice(0, -1) : loginPathPrefixArg;
+    try {
+        const parsed = new URL(candidate, publicOriginArg);
+        if (parsed.origin !== publicOriginArg) {
+            return '/';
+        }
+        if (parsed.pathname === loginRoot || parsed.pathname.startsWith(loginRoot + '/')) {
+            return '/';
+        }
+        const normalized = parsed.pathname + parsed.search + parsed.hash;
+        if (!normalized.startsWith('/') || normalized.startsWith('//') || normalized.includes('\\')) {
+            return '/';
+        }
+        return normalized;
+    }
+    catch {
+        return '/';
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5yZXR1cm5wYXRoLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2hlbHBlcnMucmV0dXJucGF0aC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxzRkFBc0Y7QUFDdEYsTUFBTSxzQkFBc0IsR0FBRyxLQUFLLENBQUM7QUFFckM7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtCQUFrQixHQUFHLENBQ2hDLGFBQXNCLEVBQ3RCLGVBQXVCLEVBQ3ZCLGtCQUEwQixFQUNsQixFQUFFO0lBQ1YsTUFBTSxTQUFTLEdBQUcsT0FBTyxhQUFhLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNoRixJQUNFLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUM7V0FDdkIsU0FBUyxDQUFDLE1BQU0sR0FBRyxzQkFBc0I7V0FDekMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUM7UUFDM0IsNkZBQTZGO1dBQzFGLFNBQVMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQzVCLENBQUM7UUFDRCxPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsa0JBQWtCLENBQUM7SUFDMUcsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsU0FBUyxFQUFFLGVBQWUsQ0FBQyxDQUFDO1FBQ25ELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxlQUFlLEVBQUUsQ0FBQztZQUN0QyxPQUFPLEdBQUcsQ0FBQztRQUNiLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLFNBQVMsR0FBRyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ2pGLE9BQU8sR0FBRyxDQUFDO1FBQ2IsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxRQUFRLEdBQUcsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDO1FBQ2pFLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQzVGLE9BQU8sR0FBRyxDQUFDO1FBQ2IsQ0FBQztRQUNELE9BQU8sVUFBVSxDQUFDO0lBQ3BCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7QUFDSCxDQUFDLENBQUMifQ==

package/dist_ts_relyingparty/index.d.ts

@@ -0,0 +1,13 @@
+export * from './interfaces.js';
+export * from './classes.errors.js';
+export * from './helpers.cookies.js';
+export * from './helpers.crypto.js';
+export * from './helpers.returnpath.js';
+export * from './classes.secretbox.js';
+export * from './classes.idpoidcprovider.js';
+export * from './classes.rpmodels.js';
+export * from './classes.relyingpartysessions.js';
+export * from './classes.authorityobserver.js';
+export * from './classes.relyingpartyroutes.js';
+export * from './classes.actorscope.js';
+export * from './classes.socketbinding.js';

package/dist_ts_relyingparty/index.js

@@ -0,0 +1,14 @@
+export * from './interfaces.js';
+export * from './classes.errors.js';
+export * from './helpers.cookies.js';
+export * from './helpers.crypto.js';
+export * from './helpers.returnpath.js';
+export * from './classes.secretbox.js';
+export * from './classes.idpoidcprovider.js';
+export * from './classes.rpmodels.js';
+export * from './classes.relyingpartysessions.js';
+export * from './classes.authorityobserver.js';
+export * from './classes.relyingpartyroutes.js';
+export * from './classes.actorscope.js';
+export * from './classes.socketbinding.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUNBQW1DLENBQUM7QUFDbEQsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLGlDQUFpQyxDQUFDO0FBQ2hELGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyw0QkFBNEIsQ0FBQyJ9

package/dist_ts_relyingparty/interfaces.d.ts

@@ -0,0 +1,113 @@
+import type { IOidcCompletion, TOidcCompletionFailureStage, TOidcTokenHint } from './classes.idpoidcprovider.js';
+/** A session as the application reads it; no token and no sealed value is part of it. */
+export interface IRelyingPartySession {
+    id: string;
+    /** the application's principal (user) the session acts as */
+    principalId: string;
+    createdAt: number;
+    lastSeenAt: number;
+    expiresAt: number;
+    /** the provider subject; absent for a session the application opened itself */
+    idpSubject?: string;
+    loginAttemptId?: string;
+}
+/** A live session behind a cookie, with the CSRF token derived for it. */
+export interface IResolvedRelyingPartySession {
+    session: IRelyingPartySession;
+    csrfToken: string;
+}
+/** A session just opened: the answer, the CSRF token and the `Set-Cookie` value that carries it. */
+export interface IRelyingPartySessionOpening extends IResolvedRelyingPartySession {
+    sessionCookie: string;
+}
+/** The redirect that starts a provider login, and the cookie that binds it to this browser. */
+export interface IRelyingPartyLoginStart {
+    authorizationUrl: URL;
+    intentCookie: string;
+}
+/** A provider access token usable right now, with the subject it belongs to. */
+export interface IProviderToken {
+    accessToken: string;
+    subject: string;
+    /** epoch milliseconds; `0` when the provider named no lifetime */
+    expiresAt: number;
+}
+/** What an authority observer needs from the session owner. `RelyingPartySessions` implements it. */
+export interface IAuthorityTokenSource {
+    /**
+     * The access token of a login session, rotated first when it is due. The
+     * session must belong to `expectedPrincipalIdArg`. Throws `AuthorityTokenError`.
+     */
+    liveProviderToken(sessionIdArg: string, expectedPrincipalIdArg: string): Promise<IProviderToken>;
+}
+/**
+ * The application's side of a provider login: who the verified subject is
+ * here. `admit` creates or updates the local principal (and whatever the
+ * application projects from the organization claims) and answers its id, or
+ * throws `RelyingPartyRefusal` to refuse the login; the provider tokens are
+ * then handed back and the refusal reaches the caller unchanged.
+ */
+export interface IRelyingPartyPrincipals {
+    admit(completionArg: IOidcCompletion): Promise<{
+        principalId: string;
+    }>;
+    /** Whether a principal may act right now; a session of an inactive principal resolves to nothing. */
+    isActive(principalIdArg: string): Promise<boolean>;
+}
+export type TRelyingPartySessionEndReason = 
+/** the application or the user ended it */
+'logout'
+/** the provider refused to rotate its tokens: the login is over there */
+ | 'refresh_token_refused'
+/** its refresh token was sealed under a key this deployment no longer has */
+ | 'sealed_refresh_token_unreadable'
+/** its access token is dead and there is nothing to rotate it with */
+ | 'access_token_unusable'
+/** a rotation found it revoked by someone else */
+ | 'revoked_elsewhere';
+export type TRelyingPartyEventName = 'idp_token_refresh_failed' | 'idp_token_store_failed' | 'idp_session_ended' | 'oidc_sealed_token_unreadable' | 'oidc_token_revocation_failed' | 'oidc_token_revocation_timed_out' | 'login_attempt_sweep_failed'
+/** an application hook threw; the step it belonged to ran on regardless */
+ | 'hook_failed'
+/** a session whose opening failed could not be revoked; its provider tokens went back anyway */
+ | 'session_discard_failed';
+/** The application hooks whose failures `hook_failed` names. */
+export type TRelyingPartyHookName = 'onProviderSessionOpened' | 'onSessionEnded' | 'onEvent';
+/** One structured diagnostic line. It never carries a token, a cookie or a sealed value. */
+export interface IRelyingPartyEvent {
+    event: TRelyingPartyEventName;
+    sessionId?: string;
+    reason?: string;
+    hint?: TOidcTokenHint;
+    hook?: TRelyingPartyHookName;
+    message?: string;
+}
+export interface IRelyingPartyHooks {
+    /**
+     * A provider login opened a session, linked to its attempt. Runs before the
+     * login answers; a throw fails the login: the session is revoked, the
+     * provider tokens are handed back and the original error is rethrown.
+     */
+    onProviderSessionOpened?(eventArg: {
+        session: IRelyingPartySession;
+    }): Promise<void>;
+    /**
+     * A session ended, or a caller tried to end one that was already over
+     * (`revokedHere: false`). Close its live connections when `revokedHere`,
+     * drop cached authority either way. Must not wait. A throw (or a rejected
+     * promise) is reported as a `hook_failed` event and never stops the end:
+     * the provider tokens go back regardless.
+     */
+    onSessionEnded?(eventArg: {
+        sessionId: string;
+        reason: TRelyingPartySessionEndReason;
+        revokedHere: boolean;
+    }): void;
+    /**
+     * Structured diagnostics; the default writes one JSON line to
+     * `console.error`. A throwing sink never interrupts the step that reported:
+     * the event and a `hook_failed` line go to `console.error` instead.
+     */
+    onEvent?(eventArg: IRelyingPartyEvent): void;
+}
+/** Where a failed login callback stopped; for the log, never for the browser. */
+export type TLoginCallbackStage = TOidcCompletionFailureStage | 'attempt_persistence' | 'principal_admission' | 'session_persistence';

package/dist_ts_relyingparty/interfaces.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZXJmYWNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9pbnRlcmZhY2VzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist_ts_relyingparty/plugins.d.ts

@@ -0,0 +1,10 @@
+import * as asyncHooks from 'node:async_hooks';
+import * as crypto from 'node:crypto';
+export { asyncHooks, crypto };
+import * as typedrequest from '@api.global/typedrequest';
+import * as typedsocket from '@api.global/typedsocket';
+export { typedrequest, typedsocket };
+import * as nosqldb from '@lossless.org/client/nosqldb';
+export { nosqldb };
+import * as openidClient from 'openid-client';
+export { openidClient };

package/dist_ts_relyingparty/plugins.js

@@ -0,0 +1,11 @@
+import * as asyncHooks from 'node:async_hooks';
+import * as crypto from 'node:crypto';
+export { asyncHooks, crypto };
+import * as typedrequest from '@api.global/typedrequest';
+import * as typedsocket from '@api.global/typedsocket';
+export { typedrequest, typedsocket };
+import * as nosqldb from '@lossless.org/client/nosqldb';
+export { nosqldb };
+import * as openidClient from 'openid-client';
+export { openidClient };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxVQUFVLE1BQU0sa0JBQWtCLENBQUM7QUFDL0MsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFFdEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUU5QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsT0FBTyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUVyQyxPQUFPLEtBQUssT0FBTyxNQUFNLDhCQUE4QixDQUFDO0FBRXhELE9BQU8sRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUVuQixPQUFPLEtBQUssWUFBWSxNQUFNLGVBQWUsQ0FBQztBQUU5QyxPQUFPLEVBQUUsWUFBWSxFQUFFLENBQUMifQ==

package/package.json

@@ -1,22 +1,23 @@
 {
   "name": "@idp.global/sdk",
-  "version": "18.0.1",
+  "version": "18.1.0",
   "private": false,
   "description": "Reusable browser and server SDK for idp.global authentication.",
   "type": "module",
   "exports": {
     ".": "./dist_ts/index.js",
     "./browser": "./dist_ts_browser/index.js",
-    "./server": "./dist_ts_server/index.js"
+    "./server": "./dist_ts_server/index.js",
+    "./relyingparty": "./dist_ts_relyingparty/index.js"
   },
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "dependencies": {
-    "@api.global/typedrequest": "^8.0.4",
+    "@api.global/typedrequest": "^8.2.0",
     "@api.global/typedrequest-interfaces": "^7.1.0",
-    "@api.global/typedsocket": "^8.1.0",
+    "@api.global/typedsocket": "^8.7.0",
     "@idp.global/interfaces": "^29.1.0",
     "@push.rocks/smartjson": "^6.0.1",
     "@push.rocks/smartpromise": "^4.2.4",
@@ -25,25 +26,27 @@
     "@push.rocks/smarttime": "^4.2.3",
     "@push.rocks/smarturl": "^3.1.0",
     "@push.rocks/webjwt": "^1.0.10",
-    "@push.rocks/webstore": "^2.1.0"
+    "@push.rocks/webstore": "^2.1.0",
+    "openid-client": "^6.8.8"
   },
   "peerDependencies": {
     "@lossless.org/client": ">=1.0.0 <2.0.0"
   },
   "devDependencies": {
     "@api.global/typedserver": "^11.4.0",
-    "@git.zone/tsbuild": "^4.5.1",
-    "@git.zone/tsdoc": "^2.2.1",
-    "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^6.1.5",
+    "@git.zone/tsbuild": "^5.0.0",
+    "@git.zone/tsdoc": "^2.2.2",
+    "@git.zone/tsrun": "^3.0.2",
+    "@git.zone/tstest": "^6.3.2",
     "@lossless.org/client": "^1.0.0",
     "@lossless.org/nosqldb": "10.5.0",
-    "@types/node": "26.6.1"
+    "@types/node": "26.6.2"
   },
   "files": [
     "ts/**/*",
     "ts_browser/**/*",
     "ts_server/**/*",
+    "ts_relyingparty/**/*",
     "dist/**/*",
     "dist_*/**/*",
     "readme.md",

package/readme.md

@@ -2,7 +2,7 @@
 
 Reusable TypeScript SDK for building against idp.global from both sides of the wire: browser apps that need SSO, JWT housekeeping, transfer-token handoff, and typed IdP requests; and server apps that need explicit account storage, local password auth, optional idp.global password verification, and confidential OIDC membership introspection.
 
-The package is intentionally split by runtime. Use `@idp.global/sdk/browser` in browser bundles and `@idp.global/sdk/server` in Node.js services. The root `@idp.global/sdk` export does not expose application APIs.
+The package is intentionally split by runtime. Use `@idp.global/sdk/browser` in browser bundles, `@idp.global/sdk/server` in Node.js services and `@idp.global/sdk/relyingparty` for a server application that signs its users in through idp.global. The root `@idp.global/sdk` export does not expose application APIs.
 
 ## Issue Reporting and Security
 
@@ -14,6 +14,7 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 | --- | --- | --- |
 | Browser | `@idp.global/sdk/browser` | SSO client, JWT and refresh-token storage, login redirects, logout, transfer-token exchange, and typed request shortcuts for user, organization, billing, OIDC, and admin flows. |
 | Server | `@idp.global/sdk/server` | NoSQL-backed account store, scrypt password hashing, local/idp.global account authentication, a server-side typed-socket client for idp.global password login, and confidential OIDC introspection. |
+| Relying party | `@idp.global/sdk/relyingparty` | The OIDC relying-party session layer: authorization code flow with PKCE on `openid-client`, login attempts and HttpOnly cookie sessions with CSRF tokens on NoSQL, sealed provider tokens rotated under a cross-replica lock, live organization authority, HTTP login routes, a TypedRouter actor scope and TypedSocket session binding. |
 
 ## Install
 
@@ -21,8 +22,9 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 pnpm add @idp.global/sdk
 ```
 
-The server subpath additionally requires the peer dependency `@lossless.org/client`,
-which provides the `SmartdataDb` the account store persists through:
+The server and relying-party subpaths additionally require the peer dependency
+`@lossless.org/client`, which provides the `SmartdataDb` the account store and the
+session models persist through:
 
 ```bash
 pnpm add @lossless.org/client
@@ -349,6 +351,16 @@ existing login and principal binding and make a fresh observation for each
 operation requiring live authority. The response contains no identity profile
 or email-based organization inference.
 
+`AuthorityObserver` in `@idp.global/sdk/relyingparty` follows this contract by
+default: `positiveTtlMs` and `negativeTtlMs` are `0`, so every operation is
+observed freshly. An application may opt into reusing a positive observation for
+a bounded time (`positiveTtlMs`) and, separately, a refusal (`negativeTtlMs`),
+per login session and organization. The trade-off is explicit: a membership
+removed, a role lowered or an app connection revoked at idp.global takes effect
+in that application only once the reused answer expires — up to the configured
+TTL — while ending the login session in the application drops its reused answers
+at once. A failure to observe is never reused.
+
 ### Server-held OIDC UserInfo
 
 Use `OidcUserInfoClient` to obtain current profile and organization picker data
@@ -421,6 +433,148 @@ The server export includes these TypeScript types:
 | `IIdpGlobalServerClientOptions` | Server client configuration with optional `baseUrl` and `backendToken`; defaults to `https://app.idp.global`. |
 | `IIdpPasswordAuthResult` | Privacy-safe current-user DTO, JWT, and refresh-token result. |
 
+## Relying-Party Sessions
+
+`@idp.global/sdk/relyingparty` is the session layer of a server application that
+signs its users in through idp.global. The application supplies its database,
+its keys and what a verified subject means to it; the module runs everything in
+between.
+
+```ts
+import * as nosqldb from '@lossless.org/client/nosqldb';
+import {
+  AuthorityObserver,
+  createRelyingPartyModels,
+  IdpOidcProvider,
+  RelyingPartyRoutes,
+  RelyingPartySessions,
+  decodeSecretKey,
+} from '@idp.global/sdk/relyingparty';
+
+const provider = new IdpOidcProvider({
+  issuer: new URL('https://idp.global'),
+  clientId: process.env.IDP_CLIENT_ID!,
+  clientSecret: process.env.IDP_CLIENT_SECRET!,
+  redirectUri: new URL('/auth/callback', 'https://app.example'),
+});
+await provider.init();
+
+const models = createRelyingPartyModels({ db: smartdataDb });
+await models.Session.ensureInitialized();
+await models.LoginAttempt.ensureInitialized();
+
+let authority: AuthorityObserver<'manage' | 'read'>;
+const sessions = new RelyingPartySessions({
+  models,
+  provider,
+  publicOrigin: 'https://app.example',
+  sessionEncryptionKey: decodeSecretKey(process.env.SESSION_ENCRYPTION_KEY!, 'SESSION_ENCRYPTION_KEY'),
+  csrfKey: decodeSecretKey(process.env.CSRF_HMAC_KEY!, 'CSRF_HMAC_KEY'),
+  principals: {
+    // create or update the local user; throw RelyingPartyRefusal to refuse the login
+    admit: async (completion) => ({ principalId: await users.upsertFromIdp(completion) }),
+    isActive: async (principalId) => users.isActive(principalId),
+  },
+  hooks: {
+    onSessionEnded: ({ sessionId, revokedHere }) => {
+      authority.forgetSession(sessionId);
+      if (revokedHere) socketGate.closeSession(sessionId);
+    },
+  },
+});
+
+authority = new AuthorityObserver({
+  provider,
+  tokens: sessions,
+  project: (roles) => (roles.includes('owner') ? 'manage' : roles.includes('viewer') ? 'read' : undefined),
+});
+
+const routes = new RelyingPartyRoutes({ sessions, failureLocation: '/?auth=error' });
+typedServer.addRoute('/auth/*', 'ALL', routes.handle);
+```
+
+What it does:
+
+- **Login**: `GET /auth/login?return=/path` stores one login attempt (state and
+  browser binding stored as SHA-256, PKCE verifier sealed) and redirects to the
+  provider. `GET /auth/callback` consumes the attempt exactly once, exchanges
+  the code, reads UserInfo with a subject check, calls `principals.admit` and
+  opens a session; a provider `error` abandons the attempt. `GET /auth/finalize`
+  releases the return path only to the browser holding the session that attempt
+  created. Return paths stay on the public origin and outside the login routes.
+  Expired attempts are swept when the next login starts.
+- **Sessions**: an HttpOnly, `SameSite=Lax` cookie whose token is stored as a
+  hash, touched at most once a minute, with a CSRF token derived per request as
+  an HMAC of the cookie token. `GET /auth/session` answers the session and
+  `POST /auth/logout` needs the public origin and the CSRF token; its body is
+  cancelled as soon as it passes `maxBodyBytes`. Every end of a session is one
+  conditional update; its provider tokens go back to idp.global within a
+  three-second budget afterwards, and so do the tokens of a login that failed
+  after the code exchange.
+- **Provider tokens**: sealed with AES-256-GCM (`SecretBox`) and rotated shortly
+  before they expire, once per process and under a lock stored on the session,
+  so two replicas never spend one refresh token. A refused refresh ends the
+  session; an unreachable provider fails closed.
+- **Live authority**: `AuthorityObserver.observe({ loginSessionId, principalId,
+  idpOrganizationId })` introspects the organization with the session's live
+  token and projects the role keys through the application's table. It answers
+  a grant or throws `AuthorityRefusedError` (with `firstRefusal` once per
+  transition, for an audit trail) or `AuthorityTokenError`.
+- **Transports**: `createActorScope()` gives a TypedRouter request scope
+  (`addRequestScope`) that runs every dispatch as the actor its trusted local
+  data names. `RelyingPartySocketBinding` registers a TypedSocket connection
+  from its upgrade `Origin` and `Cookie` plus the page's CSRF token, pins it to
+  the session, re-validates it per request and finds a session's connections by
+  a server-owned tag. Connection limits and sweeps stay with the application.
+
+Nothing runs on a timer, and no token, cookie or sealed value ever reaches a
+log line or an error message.
+
+Application hooks never stand in the way of that cleanup. A throwing (or
+rejecting) `onSessionEnded` or `onEvent` is reported as a `hook_failed` event —
+`onEvent`'s own failure on `console.error` — and the provider tokens go back
+regardless. A throwing `onProviderSessionOpened` fails the login: the session it
+opened is revoked, its tokens are handed back and the hook's error is the
+login's cause. Custom `cookieNames` with a `__Host-` or `__Secure-` prefix need
+an https `publicOrigin`; on http the constructor refuses them, because browsers
+would silently drop those cookies.
+
+**Adopting existing session data.** The persisted fields and index declarations
+are those nevermind.finance has stored since mainapp 0b693cb. An application
+that already holds such collections binds the models to them and passes its own
+cookie names and CSRF label, so live sessions and sealed tokens keep working:
+
+```ts
+const models = createRelyingPartyModels({
+  db: smartdataDb,
+  collectionNames: { sessions: 'SessionDoc', loginAttempts: 'LoginAttemptDoc' },
+});
+const sessions = new RelyingPartySessions({
+  models,
+  cookieNames: { session: 'nm_session', intent: '__Host-nm_oidc_intent' },
+  csrfLabel: 'nevermind.finance:csrf:v1\u0000',
+  // …
+});
+```
+
+A deployment without a provider (`provider` omitted) keeps the same session
+store for sessions it opens itself with `openSession({ principalId })`, for
+example after a local password check.
+
+### Relying-Party API Surface
+
+| API | Description |
+| --- | --- |
+| `IdpOidcProvider` | Discovery, PKCE authorization URL, code exchange with UserInfo, refresh, revocation and organization introspection for idp.global. Implements `IOidcProvider`. |
+| `createRelyingPartyModels()` | Binds the session and login-attempt models to one `SmartdataDb`, optionally under existing collection names. |
+| `RelyingPartySessions` | Login start/complete/abandon/finalize, `openSession`, `resolveCookieSession`, `revalidateSession`, `isSessionLive`, `validateCsrf`, `logout`/`endSession`, `endSessionsOfPrincipal`, `liveProviderToken`. |
+| `AuthorityObserver` | Live organization authority with opt-in positive and negative reuse. |
+| `RelyingPartyRoutes` | `handle(ctx)` for `/auth/login`, `/auth/callback`, `/auth/finalize`, `/auth/session` and `/auth/logout`; `null` for anything else. Takes a typedserver route context. |
+| `createActorScope()` | AsyncLocalStorage actor context with a TypedRouter request scope. |
+| `RelyingPartySocketBinding` | TypedSocket browser registration, per-request re-validation and session tags. |
+| `SecretBox`, `deriveCsrfToken()`, `decodeSecretKey()`, `parseCookies()`, `serializeCookie()`, `sanitizeReturnPath()` | The primitives underneath. |
+| `RelyingPartyError`, `RelyingPartyRefusal`, `LoginCallbackError`, `AuthorityTokenError`, `AuthorityRefusedError` | Errors with stable codes; none carries token material. |
+
 ## Runtime Notes
 
 Use the explicit subpath imports. They keep browser bundles free of Node-only code and keep server processes free of browser storage dependencies.
@@ -438,7 +592,7 @@ The SDK uses typed sockets and typed requests from `@api.global/*`, shared idp.g
 pnpm test
 ```
 
-The test suite covers the server account store and auth service, browser transfer-token handling, typed administrative request names, and the exact backend JWT keyset and blocklist contracts.
+The test suite covers the server account store and auth service, browser transfer-token handling, typed administrative request names, the exact backend JWT keyset and blocklist contracts, and the relying-party layer: its primitives, the OIDC provider against a fetch-level issuer double, sessions and two-replica token rotation on an in-memory NoSQL engine with an injected clock, the persisted shape, the authority observer, the HTTP routes, the actor scope and the socket binding.
 
 ## License and Legal Information
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/sdk',
-  version: '18.0.1',
+  version: '18.1.0',
   description: 'Reusable browser and server SDK for idp.global authentication.'
 }