@idp.global/sdk 18.0.1 → 18.2.0

package/dist_ts_relyingparty/classes.socketbinding.js

@@ -0,0 +1,100 @@
+import * as plugins from './plugins.js';
+import { sha256, timingSafeEqualString } from './helpers.crypto.js';
+const peerOf = (targetArg) => 'peer' in targetArg ? targetArg.peer : targetArg;
+/**
+ * Binds typed socket connections to relying-party browser sessions. A
+ * connection registers once with the CSRF token of the page; the proof is the
+ * upgrade's own `Origin` and `Cookie` — which only a browser on this origin
+ * sends — plus the token, and the connection is pinned to the session. Every
+ * later request re-validates the session with the same strength as an HTTP
+ * request. Connection limits, rate limits and sweeps belong to the
+ * application's socket gate.
+ */
+export class RelyingPartySocketBinding {
+    #sessions;
+    #transport;
+    tagPrefix;
+    constructor(optionsArg) {
+        this.#sessions = optionsArg.sessions;
+        this.#transport = optionsArg.transport;
+        this.tagPrefix = optionsArg.tagPrefix ?? 'idp_rp_session:';
+    }
+    /** The upgrade headers a connection (or its peer) arrived with. */
+    upgradeOf(targetArg) {
+        const headers = peerOf(targetArg).context.headers;
+        return { origin: headers.get('origin'), cookie: headers.get('cookie') };
+    }
+    /**
+     * What a registration payload `{ csrfToken }` proves, given the upgrade it
+     * came on. No connection state is touched, so the application decides about
+     * its limits between this answer and `tagConnection`.
+     */
+    async resolveBrowserRegistration(payloadArg, upgradeArg) {
+        if (!payloadArg || typeof payloadArg !== 'object' || !Reflect.has(payloadArg, 'csrfToken')) {
+            return { registered: false, refusal: { code: 'invalid_input', status: 400 } };
+        }
+        if (upgradeArg.origin !== this.#sessions.publicOrigin) {
+            return { registered: false, refusal: { code: 'forbidden', status: 403 } };
+        }
+        const resolved = await this.#sessions.resolveCookieSession(upgradeArg.cookie);
+        if (!resolved) {
+            return { registered: false, refusal: { code: 'unauthorized', status: 401 } };
+        }
+        if (!this.#sessions.validateCsrf(resolved, Reflect.get(payloadArg, 'csrfToken'))) {
+            return { registered: false, refusal: { code: 'forbidden', status: 403 } };
+        }
+        return {
+            registered: true,
+            pinned: {
+                sessionId: resolved.session.id,
+                principalId: resolved.session.principalId,
+                csrfTokenHash: sha256(resolved.csrfToken),
+            },
+            expiresAt: resolved.session.expiresAt,
+        };
+    }
+    tagOf(sessionIdArg) {
+        return this.tagPrefix + sessionIdArg;
+    }
+    /**
+     * Tags a connection — its wrapper or its peer — with its session; throws
+     * when the transport is not running or the connection is gone.
+     */
+    tagConnection(targetArg, sessionIdArg) {
+        const transport = this.#transport();
+        if (!transport) {
+            throw new Error('The socket transport is not running');
+        }
+        transport.setServerTag(targetArg, this.tagOf(sessionIdArg));
+    }
+    /**
+     * The pinned session as it stands right now: re-read, live, its principal
+     * active and unchanged (and resolved, with `principals.resolve`), touched
+     * under the liveness it was read with. The
+     * browser keeps proving itself with its CSRF token, compared against the
+     * hash the registration kept. Nothing of this is cached.
+     */
+    async revalidate(pinnedArg) {
+        const live = await this.#sessions.revalidateLiveSession(pinnedArg.sessionId);
+        if (!live || live.session.principalId !== pinnedArg.principalId) {
+            return null;
+        }
+        const expectedHash = pinnedArg.csrfTokenHash;
+        return {
+            session: live.session,
+            principal: live.principal,
+            verifyCsrf: (candidateArg) => typeof candidateArg === 'string'
+                && expectedHash.length > 0
+                && timingSafeEqualString(expectedHash, sha256(candidateArg)),
+        };
+    }
+    /** The live connections of one session, for closing them when it ends. */
+    async connectionsOfSession(sessionIdArg) {
+        const transport = this.#transport();
+        if (!transport) {
+            return [];
+        }
+        return transport.findAllTargetConnectionsByTag(this.tagOf(sessionIdArg));
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zb2NrZXRiaW5kaW5nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2NsYXNzZXMuc29ja2V0YmluZGluZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUV4QyxPQUFPLEVBQUUsTUFBTSxFQUFFLHFCQUFxQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFpQnBFLE1BQU0sTUFBTSxHQUFHLENBQUMsU0FBb0MsRUFBMkIsRUFBRSxDQUMvRSxNQUFNLElBQUksU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUEyQm5EOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxPQUFPLHlCQUF5QjtJQUMzQixTQUFTLENBQW1DO0lBQzVDLFVBQVUsQ0FBaUQ7SUFDcEQsU0FBUyxDQUFTO0lBRWxDLFlBQVksVUFBeUQ7UUFDbkUsSUFBSSxDQUFDLFNBQVMsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQ3JDLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDLFNBQVMsQ0FBQztRQUN2QyxJQUFJLENBQUMsU0FBUyxHQUFHLFVBQVUsQ0FBQyxTQUFTLElBQUksaUJBQWlCLENBQUM7SUFDN0QsQ0FBQztJQUVELG1FQUFtRTtJQUM1RCxTQUFTLENBQUMsU0FBb0M7UUFDbkQsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7UUFDbEQsT0FBTyxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7SUFDMUUsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxLQUFLLENBQUMsMEJBQTBCLENBQ3JDLFVBQW1CLEVBQ25CLFVBQTREO1FBRTVELElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxVQUFVLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMzRixPQUFPLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQ2hGLENBQUM7UUFDRCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN0RCxPQUFPLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQzVFLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzlFLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNkLE9BQU8sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxjQUFjLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUM7UUFDL0UsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2pGLE9BQU8sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUM7UUFDNUUsQ0FBQztRQUNELE9BQU87WUFDTCxVQUFVLEVBQUUsSUFBSTtZQUNoQixNQUFNLEVBQUU7Z0JBQ04sU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRTtnQkFDOUIsV0FBVyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsV0FBVztnQkFDekMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO2FBQzFDO1lBQ0QsU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsU0FBUztTQUN0QyxDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxZQUFvQjtRQUMvQixPQUFPLElBQUksQ0FBQyxTQUFTLEdBQUcsWUFBWSxDQUFDO0lBQ3ZDLENBQUM7SUFFRDs7O09BR0c7SUFDSSxhQUFhLENBQUMsU0FBb0MsRUFBRSxZQUFvQjtRQUM3RSxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDcEMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFDRCxTQUFTLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNJLEtBQUssQ0FBQyxVQUFVLENBQ3JCLFNBQXFDO1FBRXJDLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDN0UsSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDaEUsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsTUFBTSxZQUFZLEdBQUcsU0FBUyxDQUFDLGFBQWEsQ0FBQztRQUM3QyxPQUFPO1lBQ0wsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO1lBQ3JCLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztZQUN6QixVQUFVLEVBQUUsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUMzQixPQUFPLFlBQVksS0FBSyxRQUFRO21CQUM3QixZQUFZLENBQUMsTUFBTSxHQUFHLENBQUM7bUJBQ3ZCLHFCQUFxQixDQUFDLFlBQVksRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7U0FDL0QsQ0FBQztJQUNKLENBQUM7SUFFRCwwRUFBMEU7SUFDbkUsS0FBSyxDQUFDLG9CQUFvQixDQUFDLFlBQW9CO1FBQ3BELE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNwQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDZixPQUFPLEVBQUUsQ0FBQztRQUNaLENBQUM7UUFDRCxPQUFPLFNBQVMsQ0FBQyw2QkFBNkIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDM0UsQ0FBQztDQUNGIn0=

package/dist_ts_relyingparty/helpers.cookies.d.ts

@@ -0,0 +1,11 @@
+export interface ICookieOptions {
+    httpOnly?: boolean;
+    maxAgeSeconds?: number;
+    sameSite?: 'Lax' | 'Strict' | 'None';
+    secure?: boolean;
+}
+/** The cookies of a `Cookie` header; the first value of a repeated name wins, an undecodable value is skipped. */
+export declare const parseCookies: (cookieHeaderArg: string | null | undefined) => Map<string, string>;
+/** One `Set-Cookie` value, always `Path=/` and never with a `Domain`, so a `__Host-` name stays valid. */
+export declare const serializeCookie: (nameArg: string, valueArg: string, optionsArg?: ICookieOptions) => string;
+export declare const serializeClearedCookie: (nameArg: string, optionsArg?: Omit<ICookieOptions, "maxAgeSeconds">) => string;

package/dist_ts_relyingparty/helpers.cookies.js

@@ -0,0 +1,62 @@
+// Control characters, space, DEL and the cookie delimiters are never valid.
+const isInvalidCookieCharacter = (characterArg) => {
+    const code = characterArg.charCodeAt(0);
+    return code <= 0x20 || code === 0x7f || characterArg === ';' || characterArg === ',';
+};
+const assertCookiePart = (valueArg, labelArg) => {
+    if (!valueArg || Array.from(valueArg).some(isInvalidCookieCharacter)) {
+        throw new Error('Invalid cookie ' + labelArg);
+    }
+};
+/** The cookies of a `Cookie` header; the first value of a repeated name wins, an undecodable value is skipped. */
+export const parseCookies = (cookieHeaderArg) => {
+    const result = new Map();
+    if (!cookieHeaderArg) {
+        return result;
+    }
+    for (const part of cookieHeaderArg.split(';')) {
+        const separatorIndex = part.indexOf('=');
+        if (separatorIndex <= 0) {
+            continue;
+        }
+        const name = part.slice(0, separatorIndex).trim();
+        const encodedValue = part.slice(separatorIndex + 1).trim();
+        if (!name || result.has(name)) {
+            continue;
+        }
+        try {
+            result.set(name, decodeURIComponent(encodedValue));
+        }
+        catch {
+            continue;
+        }
+    }
+    return result;
+};
+/** One `Set-Cookie` value, always `Path=/` and never with a `Domain`, so a `__Host-` name stays valid. */
+export const serializeCookie = (nameArg, valueArg, optionsArg = {}) => {
+    assertCookiePart(nameArg, 'name');
+    assertCookiePart(valueArg, 'value');
+    const parts = [nameArg + '=' + encodeURIComponent(valueArg), 'Path=/'];
+    if (optionsArg.httpOnly) {
+        parts.push('HttpOnly');
+    }
+    if (optionsArg.secure) {
+        parts.push('Secure');
+    }
+    if (optionsArg.sameSite) {
+        parts.push('SameSite=' + optionsArg.sameSite);
+    }
+    if (optionsArg.maxAgeSeconds !== undefined) {
+        if (!Number.isSafeInteger(optionsArg.maxAgeSeconds) || optionsArg.maxAgeSeconds < 0) {
+            throw new Error('Invalid cookie max age');
+        }
+        parts.push('Max-Age=' + optionsArg.maxAgeSeconds);
+    }
+    return parts.join('; ');
+};
+export const serializeClearedCookie = (nameArg, optionsArg = {}) => serializeCookie(nameArg, 'deleted', {
+    ...optionsArg,
+    maxAgeSeconds: 0,
+}) + '; Expires=Thu, 01 Jan 1970 00:00:00 GMT';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5jb29raWVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2hlbHBlcnMuY29va2llcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFPQSw0RUFBNEU7QUFDNUUsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLFlBQW9CLEVBQVcsRUFBRTtJQUNqRSxNQUFNLElBQUksR0FBRyxZQUFZLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hDLE9BQU8sSUFBSSxJQUFJLElBQUksSUFBSSxJQUFJLEtBQUssSUFBSSxJQUFJLFlBQVksS0FBSyxHQUFHLElBQUksWUFBWSxLQUFLLEdBQUcsQ0FBQztBQUN2RixDQUFDLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBZ0IsRUFBRSxRQUFnQixFQUFRLEVBQUU7SUFDcEUsSUFBSSxDQUFDLFFBQVEsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxFQUFFLENBQUM7UUFDckUsTUFBTSxJQUFJLEtBQUssQ0FBQyxpQkFBaUIsR0FBRyxRQUFRLENBQUMsQ0FBQztJQUNoRCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsa0hBQWtIO0FBQ2xILE1BQU0sQ0FBQyxNQUFNLFlBQVksR0FBRyxDQUFDLGVBQTBDLEVBQXVCLEVBQUU7SUFDOUYsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7SUFDekMsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxLQUFLLE1BQU0sSUFBSSxJQUFJLGVBQWUsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM5QyxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3pDLElBQUksY0FBYyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3hCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsY0FBYyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDbEQsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDM0QsSUFBSSxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDOUIsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxrQkFBa0IsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO1FBQ3JELENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxTQUFTO1FBQ1gsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRiwwR0FBMEc7QUFDMUcsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQzdCLE9BQWUsRUFDZixRQUFnQixFQUNoQixhQUE2QixFQUFFLEVBQ3ZCLEVBQUU7SUFDVixnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDbEMsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sS0FBSyxHQUFHLENBQUMsT0FBTyxHQUFHLEdBQUcsR0FBRyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUN2RSxJQUFJLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUN4QixLQUFLLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3pCLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUN0QixLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZCLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUN4QixLQUFLLENBQUMsSUFBSSxDQUFDLFdBQVcsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLGFBQWEsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMzQyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLElBQUksVUFBVSxDQUFDLGFBQWEsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNwRixNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFDNUMsQ0FBQztRQUNELEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQzFCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQ3BDLE9BQWUsRUFDZixhQUFvRCxFQUFFLEVBQzlDLEVBQUUsQ0FDVixlQUFlLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRTtJQUNsQyxHQUFHLFVBQVU7SUFDYixhQUFhLEVBQUUsQ0FBQztDQUNqQixDQUFDLEdBQUcseUNBQXlDLENBQUMifQ==

package/dist_ts_relyingparty/helpers.crypto.d.ts

@@ -0,0 +1,12 @@
+/** A 32-byte key given as base64 or base64url; anything else is refused by `labelArg`, never echoed. */
+export declare const decodeSecretKey: (valueArg: string, labelArg: string) => Buffer;
+export declare const randomToken: (byteLengthArg?: number) => string;
+/** base64url SHA-256 of a UTF-8 string; how tokens, states and bindings are stored. */
+export declare const sha256: (valueArg: string) => string;
+export declare const timingSafeEqualString: (leftArg: string, rightArg: string) => boolean;
+/**
+ * The CSRF token of a session: an HMAC of the session cookie token under the
+ * deployment's CSRF key, after a label that separates this use of the key from
+ * any other. It is derived again on every request and never stored.
+ */
+export declare const deriveCsrfToken: (sessionTokenArg: string, csrfKeyArg: Buffer, labelArg: string) => string;

package/dist_ts_relyingparty/helpers.crypto.js

@@ -0,0 +1,40 @@
+import * as plugins from './plugins.js';
+/** A 32-byte key given as base64 or base64url; anything else is refused by `labelArg`, never echoed. */
+export const decodeSecretKey = (valueArg, labelArg) => {
+    const normalized = typeof valueArg === 'string' ? valueArg.trim() : '';
+    if (!normalized) {
+        throw new Error(labelArg + ' must not be empty');
+    }
+    const base64Normalized = normalized
+        .replace(/-/gu, '+')
+        .replace(/_/gu, '/')
+        .replace(/=+$/u, '');
+    const decoded = Buffer.from(normalized, 'base64');
+    if (decoded.length !== 32
+        || decoded.toString('base64').replace(/=+$/u, '') !== base64Normalized) {
+        throw new Error(labelArg + ' must decode to exactly 32 bytes');
+    }
+    return decoded;
+};
+export const randomToken = (byteLengthArg = 32) => plugins.crypto.randomBytes(byteLengthArg).toString('base64url');
+/** base64url SHA-256 of a UTF-8 string; how tokens, states and bindings are stored. */
+export const sha256 = (valueArg) => plugins.crypto.createHash('sha256').update(valueArg, 'utf8').digest('base64url');
+export const timingSafeEqualString = (leftArg, rightArg) => {
+    const left = Buffer.from(leftArg, 'utf8');
+    const right = Buffer.from(rightArg, 'utf8');
+    if (left.length !== right.length) {
+        return false;
+    }
+    return plugins.crypto.timingSafeEqual(left, right);
+};
+/**
+ * The CSRF token of a session: an HMAC of the session cookie token under the
+ * deployment's CSRF key, after a label that separates this use of the key from
+ * any other. It is derived again on every request and never stored.
+ */
+export const deriveCsrfToken = (sessionTokenArg, csrfKeyArg, labelArg) => plugins.crypto
+    .createHmac('sha256', csrfKeyArg)
+    .update(labelArg, 'utf8')
+    .update(sessionTokenArg, 'utf8')
+    .digest('base64url');
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5jcnlwdG8uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvaGVscGVycy5jcnlwdG8udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFFeEMsd0dBQXdHO0FBQ3hHLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRyxDQUFDLFFBQWdCLEVBQUUsUUFBZ0IsRUFBVSxFQUFFO0lBQzVFLE1BQU0sVUFBVSxHQUFHLE9BQU8sUUFBUSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDdkUsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2hCLE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxHQUFHLG9CQUFvQixDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUNELE1BQU0sZ0JBQWdCLEdBQUcsVUFBVTtTQUNoQyxPQUFPLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQztTQUNuQixPQUFPLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQztTQUNuQixPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZCLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELElBQ0UsT0FBTyxDQUFDLE1BQU0sS0FBSyxFQUFFO1dBQ2xCLE9BQU8sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsS0FBSyxnQkFBZ0IsRUFDdEUsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxHQUFHLGtDQUFrQyxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLFdBQVcsR0FBRyxDQUFDLGdCQUF3QixFQUFFLEVBQVUsRUFBRSxDQUNoRSxPQUFPLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7QUFFbEUsdUZBQXVGO0FBQ3ZGLE1BQU0sQ0FBQyxNQUFNLE1BQU0sR0FBRyxDQUFDLFFBQWdCLEVBQVUsRUFBRSxDQUNqRCxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUVuRixNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLE9BQWUsRUFBRSxRQUFnQixFQUFXLEVBQUU7SUFDbEYsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDMUMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDNUMsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNqQyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztBQUNyRCxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQUMsZUFBdUIsRUFBRSxVQUFrQixFQUFFLFFBQWdCLEVBQVUsRUFBRSxDQUN2RyxPQUFPLENBQUMsTUFBTTtLQUNYLFVBQVUsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDO0tBQ2hDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDO0tBQ3hCLE1BQU0sQ0FBQyxlQUFlLEVBQUUsTUFBTSxDQUFDO0tBQy9CLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQyJ9

package/dist_ts_relyingparty/helpers.returnpath.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The one path a login may return to, judged on the normalized result and
+ * never on the shape of the input: `/.//evil.com` parses on this origin but
+ * normalizes to `//evil.com`, which a browser reads as another host. Everything
+ * that is not a plain same-origin path outside the login routes — a scheme, a
+ * host, a backslash, a control character, an overlong value, a path under
+ * `loginPathPrefixArg` — becomes `/`.
+ */
+export declare const sanitizeReturnPath: (returnPathArg: unknown, publicOriginArg: string, loginPathPrefixArg: string) => string;

package/dist_ts_relyingparty/helpers.returnpath.js

@@ -0,0 +1,39 @@
+/** A return path is a location the application produced, not a place to park data. */
+const MAX_RETURN_PATH_LENGTH = 1_024;
+/**
+ * The one path a login may return to, judged on the normalized result and
+ * never on the shape of the input: `/.//evil.com` parses on this origin but
+ * normalizes to `//evil.com`, which a browser reads as another host. Everything
+ * that is not a plain same-origin path outside the login routes — a scheme, a
+ * host, a backslash, a control character, an overlong value, a path under
+ * `loginPathPrefixArg` — becomes `/`.
+ */
+export const sanitizeReturnPath = (returnPathArg, publicOriginArg, loginPathPrefixArg) => {
+    const candidate = typeof returnPathArg === 'string' ? returnPathArg.trim() : '';
+    if (!candidate.startsWith('/')
+        || candidate.length > MAX_RETURN_PATH_LENGTH
+        || candidate.includes('\\')
+        // the URL parser drops tabs and newlines silently; such a path is refused instead of mangled
+        || /\p{Cc}/u.test(candidate)) {
+        return '/';
+    }
+    const loginRoot = loginPathPrefixArg.endsWith('/') ? loginPathPrefixArg.slice(0, -1) : loginPathPrefixArg;
+    try {
+        const parsed = new URL(candidate, publicOriginArg);
+        if (parsed.origin !== publicOriginArg) {
+            return '/';
+        }
+        if (parsed.pathname === loginRoot || parsed.pathname.startsWith(loginRoot + '/')) {
+            return '/';
+        }
+        const normalized = parsed.pathname + parsed.search + parsed.hash;
+        if (!normalized.startsWith('/') || normalized.startsWith('//') || normalized.includes('\\')) {
+            return '/';
+        }
+        return normalized;
+    }
+    catch {
+        return '/';
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5yZXR1cm5wYXRoLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2hlbHBlcnMucmV0dXJucGF0aC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxzRkFBc0Y7QUFDdEYsTUFBTSxzQkFBc0IsR0FBRyxLQUFLLENBQUM7QUFFckM7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtCQUFrQixHQUFHLENBQ2hDLGFBQXNCLEVBQ3RCLGVBQXVCLEVBQ3ZCLGtCQUEwQixFQUNsQixFQUFFO0lBQ1YsTUFBTSxTQUFTLEdBQUcsT0FBTyxhQUFhLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNoRixJQUNFLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUM7V0FDdkIsU0FBUyxDQUFDLE1BQU0sR0FBRyxzQkFBc0I7V0FDekMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUM7UUFDM0IsNkZBQTZGO1dBQzFGLFNBQVMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQzVCLENBQUM7UUFDRCxPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsa0JBQWtCLENBQUM7SUFDMUcsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsU0FBUyxFQUFFLGVBQWUsQ0FBQyxDQUFDO1FBQ25ELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxlQUFlLEVBQUUsQ0FBQztZQUN0QyxPQUFPLEdBQUcsQ0FBQztRQUNiLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLFNBQVMsR0FBRyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ2pGLE9BQU8sR0FBRyxDQUFDO1FBQ2IsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxRQUFRLEdBQUcsTUFBTSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDO1FBQ2pFLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQzVGLE9BQU8sR0FBRyxDQUFDO1FBQ2IsQ0FBQztRQUNELE9BQU8sVUFBVSxDQUFDO0lBQ3BCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7QUFDSCxDQUFDLENBQUMifQ==

package/dist_ts_relyingparty/index.d.ts

@@ -0,0 +1,13 @@
+export * from './interfaces.js';
+export * from './classes.errors.js';
+export * from './helpers.cookies.js';
+export * from './helpers.crypto.js';
+export * from './helpers.returnpath.js';
+export * from './classes.secretbox.js';
+export * from './classes.idpoidcprovider.js';
+export * from './classes.rpmodels.js';
+export * from './classes.relyingpartysessions.js';
+export * from './classes.authorityobserver.js';
+export * from './classes.relyingpartyroutes.js';
+export * from './classes.actorscope.js';
+export * from './classes.socketbinding.js';

package/dist_ts_relyingparty/index.js

@@ -0,0 +1,14 @@
+export * from './interfaces.js';
+export * from './classes.errors.js';
+export * from './helpers.cookies.js';
+export * from './helpers.crypto.js';
+export * from './helpers.returnpath.js';
+export * from './classes.secretbox.js';
+export * from './classes.idpoidcprovider.js';
+export * from './classes.rpmodels.js';
+export * from './classes.relyingpartysessions.js';
+export * from './classes.authorityobserver.js';
+export * from './classes.relyingpartyroutes.js';
+export * from './classes.actorscope.js';
+export * from './classes.socketbinding.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUNBQW1DLENBQUM7QUFDbEQsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLGlDQUFpQyxDQUFDO0FBQ2hELGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyw0QkFBNEIsQ0FBQyJ9

package/dist_ts_relyingparty/interfaces.d.ts

@@ -0,0 +1,142 @@
+import type { IOidcCompletion, TOidcCompletionFailureStage, TOidcTokenHint } from './classes.idpoidcprovider.js';
+/** A session as the application reads it; no token and no sealed value is part of it. */
+export interface IRelyingPartySession {
+    id: string;
+    /** the application's principal (user) the session acts as */
+    principalId: string;
+    createdAt: number;
+    lastSeenAt: number;
+    expiresAt: number;
+    /** the provider subject; absent for a session the application opened itself */
+    idpSubject?: string;
+    loginAttemptId?: string;
+}
+/**
+ * A live session with the principal it acts as. `principal` is what
+ * `principals.resolve` answered for it in the same read; with `isActive`
+ * principals it is `undefined`.
+ */
+export interface IRelyingPartyLiveSession<TPrincipal extends object | undefined = undefined> {
+    session: IRelyingPartySession;
+    principal: TPrincipal;
+}
+/** A live session behind a cookie, with its principal and the CSRF token derived for it. */
+export interface IResolvedRelyingPartySession<TPrincipal extends object | undefined = undefined> extends IRelyingPartyLiveSession<TPrincipal> {
+    csrfToken: string;
+}
+/** A session just opened: the answer, the CSRF token and the `Set-Cookie` value that carries it. */
+export interface IRelyingPartySessionOpening {
+    session: IRelyingPartySession;
+    csrfToken: string;
+    sessionCookie: string;
+}
+/** The redirect that starts a provider login, and the cookie that binds it to this browser. */
+export interface IRelyingPartyLoginStart {
+    authorizationUrl: URL;
+    intentCookie: string;
+}
+/** A provider access token usable right now, with the subject it belongs to. */
+export interface IProviderToken {
+    accessToken: string;
+    subject: string;
+    /** epoch milliseconds; `0` when the provider named no lifetime */
+    expiresAt: number;
+}
+/** What an authority observer needs from the session owner. `RelyingPartySessions` implements it. */
+export interface IAuthorityTokenSource {
+    /**
+     * The access token of a login session, rotated first when it is due. The
+     * session must belong to `expectedPrincipalIdArg`. Throws `AuthorityTokenError`.
+     */
+    liveProviderToken(sessionIdArg: string, expectedPrincipalIdArg: string): Promise<IProviderToken>;
+}
+/**
+ * The application's side of a provider login: who the verified subject is
+ * here. `admit` creates or updates the local principal (and whatever the
+ * application projects from the organization claims) and answers its id, or
+ * throws `RelyingPartyRefusal` to refuse the login; the provider tokens are
+ * then handed back and the refusal reaches the caller unchanged.
+ */
+export interface IRelyingPartyPrincipals {
+    admit(completionArg: IOidcCompletion): Promise<{
+        principalId: string;
+    }>;
+    /** Whether a principal may act right now; a session of an inactive principal resolves to nothing. */
+    isActive(principalIdArg: string): Promise<boolean>;
+}
+/**
+ * Principals that answer the principal itself instead of a yes or no, so a
+ * request reads its user once: `resolve` answers the principal when it may act
+ * right now and `null` otherwise, and every live session carries the answer as
+ * `principal`. Give either `isActive` or `resolve`, never both.
+ */
+export interface IRelyingPartyPrincipalResolver<TPrincipal extends object | undefined> {
+    admit(completionArg: IOidcCompletion): Promise<{
+        principalId: string;
+    }>;
+    /** The principal object when it may act right now, `null` otherwise; any answer that is not an object (including `false`) resolves the session to nothing. */
+    resolve(principalIdArg: string): Promise<TPrincipal | null>;
+}
+/**
+ * What `RelyingPartySessions` accepts as its principals: a resolver whose
+ * principal type every live session carries, or — only while that type is
+ * left `undefined` — the `isActive` form.
+ */
+export type TRelyingPartyPrincipals<TPrincipal extends object | undefined> = IRelyingPartyPrincipalResolver<TPrincipal> | (undefined extends TPrincipal ? IRelyingPartyPrincipals : never);
+export type TRelyingPartySessionEndReason = 
+/** the application or the user ended it */
+'logout'
+/** the provider refused to rotate its tokens: the login is over there */
+ | 'refresh_token_refused'
+/** its refresh token was sealed under a key this deployment no longer has */
+ | 'sealed_refresh_token_unreadable'
+/** its access token is dead and there is nothing to rotate it with */
+ | 'access_token_unusable'
+/** a rotation found it revoked by someone else */
+ | 'revoked_elsewhere';
+export type TRelyingPartyEventName = 'idp_token_refresh_failed' | 'idp_token_store_failed' | 'idp_session_ended' | 'oidc_sealed_token_unreadable' | 'oidc_token_revocation_failed' | 'oidc_token_revocation_timed_out' | 'login_attempt_sweep_failed'
+/** an application hook threw; the step it belonged to ran on regardless */
+ | 'hook_failed'
+/** a session whose opening failed could not be revoked; its provider tokens went back anyway */
+ | 'session_discard_failed';
+/** The application hooks whose failures `hook_failed` names. */
+export type TRelyingPartyHookName = 'onProviderSessionOpened' | 'onSessionEnded' | 'onEvent';
+/** One structured diagnostic line. It never carries a token, a cookie or a sealed value. */
+export interface IRelyingPartyEvent {
+    event: TRelyingPartyEventName;
+    sessionId?: string;
+    reason?: string;
+    hint?: TOidcTokenHint;
+    hook?: TRelyingPartyHookName;
+    message?: string;
+}
+export interface IRelyingPartyHooks {
+    /**
+     * A provider login opened a session, linked to its attempt. Runs before the
+     * login answers; a throw fails the login: the session is revoked, the
+     * provider tokens are handed back and the original error is rethrown.
+     */
+    onProviderSessionOpened?(eventArg: {
+        session: IRelyingPartySession;
+    }): Promise<void>;
+    /**
+     * A session ended, or a caller tried to end one that was already over
+     * (`revokedHere: false`). Close its live connections when `revokedHere`,
+     * drop cached authority either way. Must not wait. A throw (or a rejected
+     * promise) is reported as a `hook_failed` event and never stops the end:
+     * the provider tokens go back regardless.
+     */
+    onSessionEnded?(eventArg: {
+        sessionId: string;
+        reason: TRelyingPartySessionEndReason;
+        revokedHere: boolean;
+    }): void;
+    /**
+     * Structured diagnostics; the default writes one JSON line to
+     * `console.error`. A throwing sink never interrupts the step that reported:
+     * the event and a `hook_failed` line go to `console.error` instead.
+     */
+    onEvent?(eventArg: IRelyingPartyEvent): void;
+}
+/** Where a failed login callback stopped; for the log, never for the browser. */
+export type TLoginCallbackStage = TOidcCompletionFailureStage | 'attempt_persistence' | 'principal_admission' | 'session_persistence';

package/dist_ts_relyingparty/interfaces.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZXJmYWNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9pbnRlcmZhY2VzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist_ts_relyingparty/plugins.d.ts

@@ -0,0 +1,10 @@
+import * as asyncHooks from 'node:async_hooks';
+import * as crypto from 'node:crypto';
+export { asyncHooks, crypto };
+import * as typedrequest from '@api.global/typedrequest';
+import * as typedsocket from '@api.global/typedsocket';
+export { typedrequest, typedsocket };
+import * as nosqldb from '@lossless.org/client/nosqldb';
+export { nosqldb };
+import * as openidClient from 'openid-client';
+export { openidClient };

package/dist_ts_relyingparty/plugins.js

@@ -0,0 +1,11 @@
+import * as asyncHooks from 'node:async_hooks';
+import * as crypto from 'node:crypto';
+export { asyncHooks, crypto };
+import * as typedrequest from '@api.global/typedrequest';
+import * as typedsocket from '@api.global/typedsocket';
+export { typedrequest, typedsocket };
+import * as nosqldb from '@lossless.org/client/nosqldb';
+export { nosqldb };
+import * as openidClient from 'openid-client';
+export { openidClient };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxVQUFVLE1BQU0sa0JBQWtCLENBQUM7QUFDL0MsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFFdEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUU5QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsT0FBTyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUVyQyxPQUFPLEtBQUssT0FBTyxNQUFNLDhCQUE4QixDQUFDO0FBRXhELE9BQU8sRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUVuQixPQUFPLEtBQUssWUFBWSxNQUFNLGVBQWUsQ0FBQztBQUU5QyxPQUFPLEVBQUUsWUFBWSxFQUFFLENBQUMifQ==

package/package.json

@@ -1,22 +1,23 @@
 {
   "name": "@idp.global/sdk",
-  "version": "18.0.1",
+  "version": "18.2.0",
   "private": false,
   "description": "Reusable browser and server SDK for idp.global authentication.",
   "type": "module",
   "exports": {
     ".": "./dist_ts/index.js",
     "./browser": "./dist_ts_browser/index.js",
-    "./server": "./dist_ts_server/index.js"
+    "./server": "./dist_ts_server/index.js",
+    "./relyingparty": "./dist_ts_relyingparty/index.js"
   },
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "dependencies": {
-    "@api.global/typedrequest": "^8.0.4",
+    "@api.global/typedrequest": "^8.2.0",
     "@api.global/typedrequest-interfaces": "^7.1.0",
-    "@api.global/typedsocket": "^8.1.0",
+    "@api.global/typedsocket": "^8.7.0",
     "@idp.global/interfaces": "^29.1.0",
     "@push.rocks/smartjson": "^6.0.1",
     "@push.rocks/smartpromise": "^4.2.4",
@@ -25,25 +26,27 @@
     "@push.rocks/smarttime": "^4.2.3",
     "@push.rocks/smarturl": "^3.1.0",
     "@push.rocks/webjwt": "^1.0.10",
-    "@push.rocks/webstore": "^2.1.0"
+    "@push.rocks/webstore": "^2.1.0",
+    "openid-client": "^6.8.8"
   },
   "peerDependencies": {
     "@lossless.org/client": ">=1.0.0 <2.0.0"
   },
   "devDependencies": {
     "@api.global/typedserver": "^11.4.0",
-    "@git.zone/tsbuild": "^4.5.1",
-    "@git.zone/tsdoc": "^2.2.1",
-    "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^6.1.5",
+    "@git.zone/tsbuild": "^5.0.0",
+    "@git.zone/tsdoc": "^2.2.2",
+    "@git.zone/tsrun": "^3.0.2",
+    "@git.zone/tstest": "^6.3.2",
     "@lossless.org/client": "^1.0.0",
     "@lossless.org/nosqldb": "10.5.0",
-    "@types/node": "26.6.1"
+    "@types/node": "26.6.2"
   },
   "files": [
     "ts/**/*",
     "ts_browser/**/*",
     "ts_server/**/*",
+    "ts_relyingparty/**/*",
     "dist/**/*",
     "dist_*/**/*",
     "readme.md",