@tktchurch/auth 0.9.1 → 0.9.5

package/CHANGELOG.md

@@ -2,15 +2,62 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.9.5] - 2026-07-18
+
+### Security
+
+- PKCE `base64UrlEncode` no longer references Node `Buffer` (Deno Deploy-safe; requires `btoa`).
+- Phone OTP auth/register fallback only on client/validation HTTP failures
+  (4xx except 429); no fallback on 5xx or rate limits (Q-040).
+- Example ROPG login routes require opt-in `ALLOW_PASSWORD_GRANT=1` or
+  `ENABLE_ROPG=1` (default deny in every environment) (Q-042).
+
+## [0.9.4] - 2026-07-18
+
+### Added
+
+- `createPhoneOtpClient()` — high-level phone OTP registration / sign-in /
+  verify / profile helpers for microsites (Deno-friendly via npm or dist import).
+- `InitRegistrationRequest.flowType` (e.g. `phone_registration`).
+- Optional `debug` on in-progress flow step results (OTP debug codes).
+
+### Security (examples)
+
+- Example app cookies always `Secure` unless `ALLOW_INSECURE_COOKIES=1`.
+- Password-grant (ROPG) login routes hard-stop when `NODE_ENV` or `DEPLOYMENT`
+  is `production`.
+
+## [0.9.3] - 2026-07-10
+
+### Added
+
+- `user.verifyRecoveryEmail()` — `POST /api/v1/users/me/recovery-email/verify`
+  for completing recovery-email verification from hosted account surfaces.
+
+### Changed
+
+- Code style pass across the SDK sources, examples, and tests (formatting only;
+  no intentional API renames beyond the addition above).
+
+## [0.9.2] - 2026-06-28
+
+### Added
+
+- `authorize.evaluateConsent()` and `evaluateConsentWithCredentials()` — call
+  `POST /oauth/authorize/consent/evaluate` so hosted login surfaces can skip the
+  consent UI when stored grants already cover the requested scopes.
+- `AuthorizationConsentEvaluateBody` and `AuthorizationConsentEvaluateResponse`
+  types.
+
 ## [0.9.1] - 2026-06-25
 
 ### Changed
 
-- Dual-build pipeline: public npmjs publishes a **consumer** SDK (OAuth/OIDC client
-  namespaces only); GitHub Packages publishes the **full** internal SDK with admin
-  console modules, `request`/`fetchWithAuth`, and source maps.
-- Public consumer build is minified, ships without source maps, and does not export
-  `DEFAULT_BASE_URL` or admin TypeScript types.
+- Dual-build pipeline: public npmjs publishes a **consumer** SDK (OAuth/OIDC
+  client namespaces only); GitHub Packages publishes the **full** internal SDK
+  with admin console modules, `request`/`fetchWithAuth`, and source maps.
+- Public consumer build is minified, ships without source maps, and does not
+  export `DEFAULT_BASE_URL` or admin TypeScript types.
 - `package.json` repository metadata now points at `tktchurch/auth-sdk-js`.
 
 ### Added
@@ -22,26 +69,28 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
-- `accounts/` and `developers/` Nuxt server utilities now use `@tktchurch/auth` for
-  PKCE authorization start, token exchange/refresh/revoke, user profile fetch, and
-  `sanitizePostAuthRedirect`.
-- Privacy UI stub pages: accounts `/account/privacy`, developers `/admin/privacy`
-  (hook points for upcoming `auth.privacy.*`).
+- `accounts/` and `developers/` Nuxt server utilities now use `@tktchurch/auth`
+  for PKCE authorization start, token exchange/refresh/revoke, user profile
+  fetch, and `sanitizePostAuthRedirect`.
+- Privacy UI stub pages: accounts `/account/privacy`, developers
+  `/admin/privacy` (hook points for upcoming `auth.privacy.*`).
 
 ## [0.6.0] - 2026-06-24
 
 ### Added
 
-- Platform modules: `families.*`, `dependents.*` (guardian consent), `clients.providers.*`.
+- Platform modules: `families.*`, `dependents.*` (guardian consent),
+  `clients.providers.*`.
 - Client API keys: `clients.apiKeys.list/create/delete` backed by new OAuth
   `GET/POST/DELETE /api/v1/clients/:id/api-keys` routes.
 - OAuth backend admin reads: `GET /api/v1/users/:id/mfa/devices`,
-  `GET /api/v1/users/:id/webauthn/credentials`, and `GET /api/v1/sessions?user_id=`
-  for console user detail pages.
+  `GET /api/v1/users/:id/webauthn/credentials`, and
+  `GET /api/v1/sessions?user_id=` for console user detail pages.
 
 ### Tests
 
-- Unit coverage in `tests/phase051-platform.test.ts`; extended local-stack and Playwright suites.
+- Unit coverage in `tests/phase051-platform.test.ts`; extended local-stack and
+  Playwright suites.
 
 ## [0.5.2] - 2026-06-24
 
@@ -53,10 +102,12 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Migration parity: `oauth.discoverAuthorizationServer()`, `authorize.probeAuthorize()`,
-  `user.uploadAvatar()`, `memberDirectory.lookup()`, `federated.*` URL builders and
-  link finalize HTTP methods.
-- Admin reads: `user.admin.getMfaDevices()`, `user.admin.getWebAuthnCredentials()`.
+- Migration parity: `oauth.discoverAuthorizationServer()`,
+  `authorize.probeAuthorize()`, `user.uploadAvatar()`,
+  `memberDirectory.lookup()`, `federated.*` URL builders and link finalize HTTP
+  methods.
+- Admin reads: `user.admin.getMfaDevices()`,
+  `user.admin.getWebAuthnCredentials()`.
 - List filter wiring: `clients.list({ isActive })`, expanded `UserListQuery`,
   `RoleListQuery`, `SessionListQuery`, `AuditLogListQuery`.
 
@@ -88,16 +139,18 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
-- `token.revoke` and `token.introspect` now include `client_id` / `client_secret`
-  in the request body (required by the OAuth server for RFC 7009 / introspection).
+- `token.revoke` and `token.introspect` now include `client_id` /
+  `client_secret` in the request body (required by the OAuth server for RFC 7009
+  / introspection).
 
 ### Added (0.5.0 continued)
 
 - Expanded local-stack integration tests: PKCE full cycle, OIDC/JWKS, flow init,
   public client metadata.
-- Playwright API e2e suite (`tests/e2e/`) for live backend + security invariants.
-- `bun run test:local:env` and `bun run test:e2e:env` scripts (source `oauth/.env`).
-
+- Playwright API e2e suite (`tests/e2e/`) for live backend + security
+  invariants.
+- `bun run test:local:env` and `bun run test:e2e:env` scripts (source
+  `oauth/.env`).
 
 ### Verified
 
@@ -107,15 +160,16 @@ All notable changes to this project will be documented in this file.
 
 ### Removed (breaking)
 
-- `createLocalStorageTokenStorage` and the `@tktchurch/auth/storage/localStorage`
-  package subpath. Browser `localStorage` is an XSS sink for OAuth tokens; the
-  SDK no longer ships a persistence adapter for it.
+- `createLocalStorageTokenStorage` and the
+  `@tktchurch/auth/storage/localStorage` package subpath. Browser `localStorage`
+  is an XSS sink for OAuth tokens; the SDK no longer ships a persistence adapter
+  for it.
 
 ### Added
 
-- Token storage validation exports: `assertValidAuthTokens`, `parseStoredAuthTokens`,
-  `serializeAuthTokens`, `validateStorageKey`, `safeParseStoredJson`,
-  `DEFAULT_TOKEN_STORAGE_KEY`, `MAX_STORED_TOKEN_BYTES`.
+- Token storage validation exports: `assertValidAuthTokens`,
+  `parseStoredAuthTokens`, `serializeAuthTokens`, `validateStorageKey`,
+  `safeParseStoredJson`, `DEFAULT_TOKEN_STORAGE_KEY`, `MAX_STORED_TOKEN_BYTES`.
 - `allowInsecureTransport` config flag (default `false`) — rejects non-HTTPS
   `baseUrl` outside loopback hosts.
 - [`SECURITY.md`](./SECURITY.md) threat model and integrator checklist.
@@ -131,8 +185,8 @@ All notable changes to this project will be documented in this file.
 
 1. Remove `createLocalStorageTokenStorage()` — not replaced.
 2. Use HttpOnly cookies for refresh tokens via server routes (see examples).
-3. Implement custom `TokenStorage` with exported validators for platform-specific
-   secure backends (Keychain, Keystore).
+3. Implement custom `TokenStorage` with exported validators for
+   platform-specific secure backends (Keychain, Keystore).
 
 ### Verified
 
@@ -154,14 +208,15 @@ All notable changes to this project will be documented in this file.
   - `authorize.handleCallback()` — one call that verifies `state`
     (constant-time), surfaces server errors, and exchanges the code for tokens.
 - Standalone PKCE/CSRF primitives: `generatePkce`, `generateCodeVerifier`,
-  `deriveCodeChallenge`, `generateState`, `generateNonce`, `randomUrlSafeString`,
-  `timingSafeEqual` — all backed by the platform Web Crypto CSPRNG.
+  `deriveCodeChallenge`, `generateState`, `generateNonce`,
+  `randomUrlSafeString`, `timingSafeEqual` — all backed by the platform Web
+  Crypto CSPRNG.
 - `sanitizePostAuthRedirect()` open-redirect guard (rejects protocol-relative,
   backslash-smuggled, scheme-bearing, and CRLF targets).
 - `oidc.discover()` — fetches and maps `/.well-known/openid-configuration`.
-- Broader public type exports (`AuthorizationUrlOptions`, `AuthorizationRequest`,
-  `CallbackParams`, `HandleCallbackOptions`, `OidcDiscoveryDocument`, endpoint
-  interfaces, `AuthErrorCode`).
+- Broader public type exports (`AuthorizationUrlOptions`,
+  `AuthorizationRequest`, `CallbackParams`, `HandleCallbackOptions`,
+  `OidcDiscoveryDocument`, endpoint interfaces, `AuthErrorCode`).
 
 ### Security
 
@@ -181,15 +236,18 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Framework-agnostic `@tktchurch/auth` SDK core with typed OAuth, OIDC, AuthFlow, sessions, user, and WebAuthn endpoint wrappers.
-- Token lifecycle support with pluggable storage and `fetchWithAuth` one-retry refresh flow.
+- Framework-agnostic `@tktchurch/auth` SDK core with typed OAuth, OIDC,
+  AuthFlow, sessions, user, and WebAuthn endpoint wrappers.
+- Token lifecycle support with pluggable storage and `fetchWithAuth` one-retry
+  refresh flow.
 - Nuxt module export `@tktchurch/auth/nuxt` with:
   - `tktAuth` module configuration.
   - injected `$tktAuth` client via `useTktAuth()`.
   - server factory `createTktServerAuthClient()`.
   - cookie helper `useTktRefreshCookieName()`.
 - Next.js and Nuxt3 production examples in `examples/`.
-- Production-gated Nuxt3 integration tests (`tests/nuxt3.production.test.ts`) for login/me/logout patterns.
+- Production-gated Nuxt3 integration tests (`tests/nuxt3.production.test.ts`)
+  for login/me/logout patterns.
 - Release metadata and publish hardening:
   - GitHub Packages publish configuration.
   - npmjs public publish workflow and scripts.
@@ -200,11 +258,13 @@ All notable changes to this project will be documented in this file.
 - Default SDK endpoint remains `https://prod-auth.tktchurch.com`.
 - Package version bumped to `0.2.0`.
 - Build output now includes the Nuxt module entry (`./nuxt`).
-- Improved strict TypeScript coverage (no implicit `any` in SDK/Nuxt example handlers).
+- Improved strict TypeScript coverage (no implicit `any` in SDK/Nuxt example
+  handlers).
 
 ### Verified
 
 - `bun run typecheck`
 - `bun run test`
 - `bun run build`
-- `bun run test:nuxt3:prod` (passes when target auth server is reachable and seeded credentials are valid)
+- `bun run test:nuxt3:prod` (passes when target auth server is reachable and
+  seeded credentials are valid)

package/PUBLISHING.md

@@ -1,13 +1,16 @@
 # Publishing Guide (`@tktchurch/auth`)
 
-This package uses a **dual-build** pipeline. The artifact published to each registry differs:
+This package uses a **dual-build** pipeline. The artifact published to each
+registry differs:
 
-| Registry | Build profile | Contents |
-| --- | --- | --- |
-| **npmjs** (public) | `consumer` | OAuth/OIDC client SDK only — no admin console modules, no `request`/`fetchWithAuth`, no source maps |
-| **GitHub Packages** (private) | `full` | Complete internal SDK (admin CRUD, privacy admin, generic passthrough, source maps) |
+| Registry                      | Build profile | Contents                                                                                            |
+| ----------------------------- | ------------- | --------------------------------------------------------------------------------------------------- |
+| **npmjs** (public)            | `consumer`    | OAuth/OIDC client SDK only — no admin console modules, no `request`/`fetchWithAuth`, no source maps |
+| **GitHub Packages** (private) | `full`        | Complete internal SDK (admin CRUD, privacy admin, generic passthrough, source maps)                 |
 
-Registry selection is command/workflow specific. The repo intentionally does not pin `publishConfig.registry` or a scoped `.npmrc` to avoid cross-registry auth conflicts.
+Registry selection is command/workflow specific. The repo intentionally does not
+pin `publishConfig.registry` or a scoped `.npmrc` to avoid cross-registry auth
+conflicts.
 
 ## 1. Prerequisites
 
@@ -15,13 +18,16 @@ Registry selection is command/workflow specific. The repo intentionally does not
 - Package scope is `@tktchurch`.
 - You have permission to publish packages in the `tktchurch` organization.
 - npm scope access for `@tktchurch` (or delegated publish rights).
-- A GitHub token with `write:packages` and `repo` scope (for local GitHub publish).
+- A GitHub token with `write:packages` and `repo` scope (for local GitHub
+  publish).
 - An npm token with publish rights (for local npmjs publish).
-- npm trusted publishing configured for this package/repository (for GitHub Actions npmjs publish).
+- npm trusted publishing configured for this package/repository (for GitHub
+  Actions npmjs publish).
 
 ## 2. Local Release Validation
 
-Full internal build (used by `accounts` / `developers` via `file:../auth-sdk-js`):
+Full internal build (used by `accounts` / `developers` via
+`file:../auth-sdk-js`):
 
 ```bash
 bun run release:check
@@ -35,10 +41,10 @@ bun run release:check:consumer
 
 Both run typecheck + tests, then build with the matching profile:
 
-| Script | Build |
-| --- | --- |
-| `bun run build` / `build:full` | `BUILD_PROFILE=full` |
-| `bun run build:consumer` | `BUILD_PROFILE=consumer` |
+| Script                         | Build                    |
+| ------------------------------ | ------------------------ |
+| `bun run build` / `build:full` | `BUILD_PROFILE=full`     |
+| `bun run build:consumer`       | `BUILD_PROFILE=consumer` |
 
 ## 3. Local Publish (Manual)
 
@@ -70,13 +76,15 @@ Publish:
 bun run publish:npmjs
 ```
 
-Both publish scripts run the matching `release:check*` pipeline and pass `--ignore-scripts` so `prepublishOnly` does not rebuild with the wrong profile.
+Both publish scripts run the matching `release:check*` pipeline and pass
+`--ignore-scripts` so `prepublishOnly` does not rebuild with the wrong profile.
 
 ## 4. GitHub Actions Publish
 
 Workflow files:
 
-1. `.github/workflows/publish-github-packages.yml` — `build:full` → GitHub Packages
+1. `.github/workflows/publish-github-packages.yml` — `build:full` → GitHub
+   Packages
 2. `.github/workflows/publish-npmjs.yml` — `build:consumer` → npmjs
 
 Triggers:
@@ -84,9 +92,12 @@ Triggers:
 1. Tag push matching `v*` (for example `v0.9.1`)
 2. Manual dispatch
 
-The GitHub Packages workflow installs dependencies, typechecks, tests, builds the **full** bundle, and publishes with `GITHUB_TOKEN`.
+The GitHub Packages workflow installs dependencies, typechecks, tests, builds
+the **full** bundle, and publishes with `GITHUB_TOKEN`.
 
-The npmjs workflow installs dependencies, typechecks, tests, builds the **consumer** bundle, and publishes using trusted publishing (GitHub OIDC) when configured.
+The npmjs workflow installs dependencies, typechecks, tests, builds the
+**consumer** bundle, and publishes using trusted publishing (GitHub OIDC) when
+configured.
 
 ## 5. Tagging and Changelog
 
@@ -101,14 +112,16 @@ git push origin v0.9.1
 
 ## 6. Required Repository Secrets
 
-1. No npmjs token secret is required for npmjs workflow when OIDC trusted publishing is configured.
+1. No npmjs token secret is required for npmjs workflow when OIDC trusted
+   publishing is configured.
 2. GitHub Packages workflow uses `GITHUB_TOKEN` automatically.
 
 ## 7. Consumer vs full SDK
 
 **Public npm (`consumer`)** ships:
 
-- `authorize`, `token`, `oidc`, `flow`, `user` (self-service), `sessions`, `webauthn`, `passwordReset`, `mfa`, `maintenance.status`, `oauth` meta
+- `authorize`, `token`, `oidc`, `flow`, `user` (self-service), `sessions`,
+  `webauthn`, `passwordReset`, `mfa`, `maintenance.status`, `oauth` meta
 - PKCE, redirect sanitization, token storage helpers
 - Nuxt module entry
 
@@ -118,4 +131,5 @@ git push origin v0.9.1
 - `request()` and `fetchWithAuth()` passthrough helpers
 - `DEFAULT_BASE_URL` export and full TypeScript admin types
 
-Internal TKTChurch apps should install from GitHub Packages or use `file:../auth-sdk-js` with `bun run build:full`.
+Internal TKTChurch apps should install from GitHub Packages or use
+`file:../auth-sdk-js` with `bun run build:full`.

package/README.md

@@ -63,8 +63,8 @@ surfaces server errors, and exchanges the code for tokens:
 
 ```ts
 const tokens = await auth.authorize.handleCallback({
-  callback: requestUrl,            // full callback URL or its query string
-  expectedState: saved.state,      // the state you persisted in step 1
+  callback: requestUrl, // full callback URL or its query string
+  expectedState: saved.state, // the state you persisted in step 1
   codeVerifier: saved.codeVerifier,
   redirectUri: saved.redirectUri,
 });
@@ -93,9 +93,15 @@ return Response.redirect(sanitizePostAuthRedirect(next, "/dashboard"));
 If you need the primitives directly:
 
 ```ts
-import { generatePkce, generateState, generateNonce, deriveCodeChallenge } from "@tktchurch/auth";
-
-const { codeVerifier, codeChallenge, codeChallengeMethod } = await generatePkce();
+import {
+  deriveCodeChallenge,
+  generateNonce,
+  generatePkce,
+  generateState,
+} from "@tktchurch/auth";
+
+const { codeVerifier, codeChallenge, codeChallengeMethod } =
+  await generatePkce();
 ```
 
 ### OIDC discovery
@@ -128,7 +134,8 @@ export async function GET() {
 
 > Do **not** store OAuth tokens in `localStorage` or `sessionStorage`. The SDK
 > does not ship a browser persistence adapter — use server-side cookies or a
-> platform secure store (Keychain, Keystore). See [`SECURITY.md`](./SECURITY.md).
+> platform secure store (Keychain, Keystore). See
+> [`SECURITY.md`](./SECURITY.md).
 
 ## Framework Examples (Best Practices)
 
@@ -181,6 +188,7 @@ const init = await auth.flow.initAuthentication({
 let status = await auth.flow.executeStep({
   sessionId: init.sessionId,
   stepId: init.currentStep.stepId,
+  continuationToken: init.continuationToken,
   credential: {
     username: "user@example.com",
     password: "secret",
@@ -192,6 +200,7 @@ while (status.status === "in_progress") {
   status = await auth.flow.executeStep({
     sessionId: status.sessionId,
     stepId: status.nextStep.stepId,
+    continuationToken: init.continuationToken,
     credential: {},
   });
 }
@@ -217,8 +226,8 @@ const auth = createAuthClient({
 
 For platform-specific secure backends (Keychain, Keystore, encrypted server
 session), implement `TokenStorage` using the exported validators
-(`assertValidAuthTokens`, `parseStoredAuthTokens`, `serializeAuthTokens`).
-See [`SECURITY.md`](./SECURITY.md).
+(`assertValidAuthTokens`, `parseStoredAuthTokens`, `serializeAuthTokens`). See
+[`SECURITY.md`](./SECURITY.md).
 
 ## Error Handling
 
@@ -243,9 +252,12 @@ try {
 
 ## Authenticated Fetch
 
-`fetchWithAuth` adds the bearer token automatically and retries once on `401` using refresh token when possible.
+`fetchWithAuth` adds the bearer token automatically and retries once on `401`
+using refresh token when possible.
 
-> **Note:** `fetchWithAuth` and `request()` are available only in the **full** SDK (GitHub Packages / local `file:` build). The public npmjs consumer build omits generic passthrough helpers.
+> **Note:** `fetchWithAuth` and `request()` are available only in the **full**
+> SDK (GitHub Packages / local `file:` build). The public npmjs consumer build
+> omits generic passthrough helpers.
 
 ```ts
 const response = await auth.fetchWithAuth("/api/v1/users/me");
@@ -256,27 +268,36 @@ if (!response.ok) {
 
 ## API reference (public consumer build)
 
-The public npmjs package ships OAuth/OIDC client namespaces only. Admin console modules (`clients`, `roles`, `auditLogs`, …) and generic passthrough helpers are available in the **full** SDK from GitHub Packages — see [`CONTEXT.md`](./CONTEXT.md).
-
-| Namespace | Methods | Auth |
-| --- | --- | --- |
-| `token` | `password`, `refresh`, `clientCredentials`, `authorizationCode`, `tokenExchange`, `revoke`, `introspect` | client credentials / stored tokens |
-| `authorize` | `createRequest`, `parseCallback`, `handleCallback`, `consent`, `consentWithCredentials` | public + server session |
-| `oidc` | `userInfo`, `discover`, `jwks` | bearer / public |
-| `oauth` | `publicClient`, `discoverAuthorizationServer` | public |
-| `flow` | `initAuthentication`, `executeStep`, `initRegistration`, `executeRegistrationStep`, `initRecovery`, `executeRecoveryStep`, `getStatus` | public / step session |
-| `user` | `me`, `updateMe`, `changePassword`, `deleteAvatar`, `verifyPhone`, `securityOverview`, `recoveryContacts.*`, `identities.*`, `deleteMe` | bearer |
-| `sessions` | `list`, `current`, `get`, `update`, `revoke`, `revokeAll`, `revokeAllDevices` | bearer |
-| `webauthn` | `registerBegin/Finish`, `authenticateBegin/Finish`, `credentials`, `removeCredential`, `renameCredential`, `setPrimaryCredential` | bearer / public begin |
-| `passwordReset` | `request`, `validate`, `complete` | public |
-| `mfa` | `setup`, `verify`, `devices`, `removeDevice`, `regenerateBackupCodes`, `disable` | bearer |
-| `maintenance` | `status` | public |
-
-Integrators must pass an explicit `baseUrl` in `createAuthClient({ baseUrl, clientId, … })`. The public consumer build does not export `DEFAULT_BASE_URL`.
+The public npmjs package ships OAuth/OIDC client namespaces only. Admin console
+modules (`clients`, `roles`, `auditLogs`, …) and generic passthrough helpers are
+available in the **full** SDK from GitHub Packages — see
+[`CONTEXT.md`](./CONTEXT.md).
+
+| Namespace       | Methods                                                                                                                                 | Auth                               |
+| --------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
+| `token`         | `password`, `refresh`, `clientCredentials`, `authorizationCode`, `tokenExchange`, `revoke`, `introspect`                                | client credentials / stored tokens |
+| `authorize`     | `createRequest`, `parseCallback`, `handleCallback`, `consent`, `consentWithCredentials`                                                 | public + server session            |
+| `oidc`          | `userInfo`, `discover`, `jwks`                                                                                                          | bearer / public                    |
+| `oauth`         | `publicClient`, `discoverAuthorizationServer`                                                                                           | public                             |
+| `flow`          | `initAuthentication`, `executeStep`, `initRegistration`, `executeRegistrationStep`, `initRecovery`, `executeRecoveryStep`, `getStatus`  | public / step session              |
+| `user`          | `me`, `updateMe`, `changePassword`, `deleteAvatar`, `verifyPhone`, `securityOverview`, `recoveryContacts.*`, `identities.*`, `deleteMe` | bearer                             |
+| `sessions`      | `list`, `current`, `get`, `update`, `revoke`, `revokeAll`, `revokeAllDevices`                                                           | bearer                             |
+| `webauthn`      | `registerBegin/Finish`, `authenticateBegin/Finish`, `credentials`, `removeCredential`, `renameCredential`, `setPrimaryCredential`       | bearer / public begin              |
+| `passwordReset` | `request`, `validate`, `complete`                                                                                                       | public                             |
+| `mfa`           | `setup`, `verify`, `devices`, `removeDevice`, `regenerateBackupCodes`, `disable`                                                        | bearer                             |
+| `maintenance`   | `status`                                                                                                                                | public                             |
+
+Integrators must pass an explicit `baseUrl` in
+`createAuthClient({ baseUrl, clientId, … })`. The public consumer build does not
+export `DEFAULT_BASE_URL`.
 
 ### Internal admin SDK (GitHub Packages only)
 
-The full build adds `consents`, admin `maintenance.*`, `clients` … `comms`, `privacy`, `user.admin.*`, plus `request()` / `fetchWithAuth()`. Admin methods require a bearer access token with matching backend permissions (`client:read`, `user:write`, `*:*`, etc.). The SDK does not enforce permissions — the OAuth server does.
+The full build adds `consents`, admin `maintenance.*`, `clients` … `comms`,
+`privacy`, `user.admin.*`, plus `request()` / `fetchWithAuth()`. Admin methods
+require a bearer access token with matching backend permissions (`client:read`,
+`user:write`, `*:*`, etc.). The SDK does not enforce permissions — the OAuth
+server does.
 
 ### Migrating from hand-rolled `oauth.ts`
 
@@ -287,13 +308,18 @@ Replace direct `fetch` calls with namespaced SDK methods:
 await fetch(`${baseUrl}/oauth/token`, { method: "POST", body });
 
 // After
-const tokens = await auth.token.authorizationCode({ code, redirectUri, codeVerifier });
+const tokens = await auth.token.authorizationCode({
+  code,
+  redirectUri,
+  codeVerifier,
+});
 ```
 
-For admin console CRUD (`/api/v1/clients`, etc.), use the **full** SDK from GitHub Packages — see [`CONTEXT.md`](./CONTEXT.md).
+For admin console CRUD (`/api/v1/clients`, etc.), use the **full** SDK from
+GitHub Packages — see [`CONTEXT.md`](./CONTEXT.md).
 
-Inject internal URL rewriting via `createAuthClient({ fetch })` — same pattern as
-`accounts` / `developers` `oauth-fetch.ts`.
+Inject internal URL rewriting via `createAuthClient({ fetch })` — same pattern
+as `accounts` / `developers` `oauth-fetch.ts`.
 
 ## Release and Publish
 
@@ -303,13 +329,17 @@ Inject internal URL rewriting via `createAuthClient({ fetch })` — same pattern
 GitHub Packages (private, `tktchurch` scope) is configured via:
 
 - Script: `bun run publish:github`
-- Workflow: [`.github/workflows/publish-github-packages.yml`](./.github/workflows/publish-github-packages.yml)
+- Workflow:
+  [`.github/workflows/publish-github-packages.yml`](./.github/workflows/publish-github-packages.yml)
 - Auth token: `NODE_AUTH_TOKEN` (`GITHUB_TOKEN` in workflow)
 
 npmjs (public) publishing ships the **consumer** build only:
 
 - Script: `bun run publish:npmjs` (runs `release:check:consumer`)
-- Workflow: [`.github/workflows/publish-npmjs.yml`](./.github/workflows/publish-npmjs.yml)
-- Auth: npm trusted publishing (OIDC, no `NPM_TOKEN` secret) or local `NODE_AUTH_TOKEN`
+- Workflow:
+  [`.github/workflows/publish-npmjs.yml`](./.github/workflows/publish-npmjs.yml)
+- Auth: npm trusted publishing (OIDC, no `NPM_TOKEN` secret) or local
+  `NODE_AUTH_TOKEN`
 
-GitHub Packages ships the **full** internal SDK. See [`PUBLISHING.md`](./PUBLISHING.md) for the dual-build matrix.
+GitHub Packages ships the **full** internal SDK. See
+[`PUBLISHING.md`](./PUBLISHING.md) for the dual-build matrix.