v1.13.0

changelog.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 2025-12-15 - 1.13.0 - feat(oidc)
+feat(oidc): add OIDC provider (OidcManager, endpoints, and interfaces)
+
+- Add OidcManager class implementing OpenID Connect / OAuth2 server functionality (authorization codes, access/refresh tokens, user consents, PKCE support, JWKS, ID token generation, token revocation, cleanup task).
+- Expose OIDC endpoints on the website server: /.well-known/openid-configuration, /.well-known/jwks.json, /oauth/authorize, /oauth/token, /oauth/userinfo (GET/POST), and /oauth/revoke.
+- Integrate OidcManager into Reception: add oidcManager property and instantiate it from ts/index.ts so routes can reference it.
+- Add TypeScript interfaces for OIDC data structures (ts_interfaces/data/loint-reception.oidc.ts) and export them from the data index.
+
+## 2025-12-15 - 1.12.1 - fix(dependencies)
+fix(deps): bump @uptime.link/webwidget to ^1.2.6
+
+- Updated dependency @uptime.link/webwidget from ^1.2.5 to ^1.2.6 in package.json
+- No other files changed; this is a dependency patch update
+
+## 2025-12-15 - 1.12.0 - feat(interfaces)
+Add JWT public-key and blocklist request interfaces, publish ordering files, and update dependencies
+
+- Introduce IReq_GetPublicKeyForValidation and IReq_PushPublicKeyForValidation with documentation in ts_interfaces/request/loint-reception.jwt.ts to support fetching and pushing JWT public keys for validation.
+- Clarify IReq_PushOrGetJwtIdBlocklist to describe both GET (client requests blocklist) and PUSH (server pushes revoked JWT IDs) directions and required client handlers.
+- Add tspublish.json ordering files for packaging: ts_interfaces (order: 1), ts (order: 2), ts_idpclient (order: 3), ts_web (order: 4).
+- Update package.json dependencies to include @git.zone/tspublish and additional @push.rocks packages (@push.rocks/smartcli, @push.rocks/smartfile, @push.rocks/smartinteract).
+
+## 2025-12-14 - 1.11.0 - feat(idpcli)
+Add idp CLI (IdpCli) with commands, file-based credential storage, typed request APIs; bump deps and update config
+
+- Introduce a new CLI implementation under ts_idpcli: IdpCli class, runCli entrypoint and multiple commands (login, login-token, logout, whoami, orgs, orgs-create, members, invite, sessions, revoke, admin-check, admin-apps, admin-suspend, etc.).
+- Add plugins module that exports node built-ins and common libraries (smartcli, smartinteract, smartpromise, smartrx, typedrequest, typedsocket) for the CLI.
+- Expose many typed request accessors in classes.idprequests (authentication, registration, user/org/member management, billing, JWT/key management, admin operations).
+- Implement file-based credential storage (~/.idp-global/credentials.json) with load/store/delete helpers to persist refresh tokens and JWTs for the CLI.
+- Update ts/index.ts to start the website server on port 2999 (was previously started without explicit port).
+- Bump and add dependencies/devDependencies: @api.global/typedserver -> ^7.11.1, @design.estate/dees-catalog -> ^3.3.1, @push.rocks/smartjson -> ^6.0.0; add @push.rocks/smartcli, smartfile, smartinteract; upgrade @git.zone/tsbuild to ^4.0.2 and update tsrun/tswatch versions.
+- Rework npmextra.json: reorganized npmci and tsdoc sections, added release configuration (registries and accessLevel) and other npmci/docker mapping entries.
+
 ## 2025-12-07 - 1.10.0 - feat(billingplan)
 Add Paddle v2 checkout support and backend config endpoint; add CSP headers and bump typedserver
 

npmextra.json

@@ -1,5 +1,18 @@
 {
-  "gitzone": {
+  "npmci": {
+    "npmGlobalTools": [],
+    "dockerRegistryRepoMap": {
+      "registry.gitlab.com": "code.foss.global/idp.global/idp.global"
+    },
+    "dockerBuildargEnvMap": {
+      "NPMCI_TOKEN_NPM2": "NPMCI_TOKEN_NPM2"
+    },
+    "npmRegistryUrl": "registry.npmjs.org"
+  },
+  "tsdoc": {
+    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+  },
+  "@git.zone/cli": {
     "projectType": "website",
     "module": {
       "githost": "code.foss.global",
@@ -32,22 +45,10 @@
         "user sessions"
       ]
     },
-    "services": [
+    "services": ["mongodb", "minio"],
-      "mongodb",
+    "release": {
-      "minio"
+      "registries": ["https://verdaccio.lossless.digital"],
-    ]
+      "accessLevel": "public"
-  },
+    }
-  "npmci": {
-    "npmGlobalTools": [],
-    "dockerRegistryRepoMap": {
-      "registry.gitlab.com": "code.foss.global/idp.global/idp.global"
-    },
-    "dockerBuildargEnvMap": {
-      "NPMCI_TOKEN_NPM2": "NPMCI_TOKEN_NPM2"
-    },
-    "npmRegistryUrl": "registry.npmjs.org"
-  },
-  "tsdoc": {
-    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
   }
-}
+}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idp.global/idp.global",
-  "version": "1.10.0",
+  "version": "1.13.0",
   "description": "An identity provider software managing user authentications, registrations, and sessions.",
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
@@ -18,18 +18,22 @@
   "dependencies": {
     "@api.global/typedrequest": "^3.2.5",
     "@api.global/typedrequest-interfaces": "^3.0.19",
-    "@api.global/typedserver": "^7.10.2",
+    "@api.global/typedserver": "^7.11.1",
     "@api.global/typedsocket": "^4.1.0",
     "@consent.software/catalog": "^2.0.1",
-    "@design.estate/dees-catalog": "^2.0.3",
+    "@design.estate/dees-catalog": "^3.3.1",
     "@design.estate/dees-domtools": "^2.3.6",
     "@design.estate/dees-element": "^2.1.3",
+    "@git.zone/tspublish": "^1.10.3",
     "@push.rocks/lik": "^6.2.2",
     "@push.rocks/qenv": "^6.1.3",
+    "@push.rocks/smartcli": "^4.0.19",
     "@push.rocks/smartdata": "^7.0.15",
     "@push.rocks/smartdelay": "^3.0.5",
+    "@push.rocks/smartfile": "^13.1.0",
     "@push.rocks/smarthash": "^3.2.6",
-    "@push.rocks/smartjson": "^5.2.0",
+    "@push.rocks/smartinteract": "^2.0.6",
+    "@push.rocks/smartjson": "^6.0.0",
     "@push.rocks/smartjwt": "^2.2.1",
     "@push.rocks/smartlog": "^3.1.10",
     "@push.rocks/smartmail": "^2.2.0",
@@ -46,13 +50,13 @@
     "@push.rocks/webstore": "^2.0.20",
     "@serve.zone/platformclient": "^1.1.2",
     "@tsclass/tsclass": "^9.3.0",
-    "@uptime.link/webwidget": "^1.2.5"
+    "@uptime.link/webwidget": "^1.2.6"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^3.1.2",
+    "@git.zone/tsbuild": "^4.0.2",
     "@git.zone/tsbundle": "^2.6.3",
-    "@git.zone/tsrun": "^2.0.0",
+    "@git.zone/tsrun": "^2.0.1",
-    "@git.zone/tswatch": "^2.2.3",
+    "@git.zone/tswatch": "^2.3.13",
     "@push.rocks/projectinfo": "^5.0.1",
     "@types/node": "^24.10.1"
   },

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/idp.global',
-  version: '1.10.0',
+  version: '1.13.0',
   description: 'An identity provider software managing user authentications, registrations, and sessions.'
 }

ts/index.ts

@@ -4,6 +4,10 @@ import { Reception } from './reception/classes.reception.js';
 
 export const runCli = async () => {
   const serviceQenv = new plugins.qenv.Qenv('./', './.nogit', false);
+
+  // Create reception first so we can reference it in routes
+  let reception: Reception;
+
   const websiteServer = new plugins.typedserver.utilityservers.UtilityWebsiteServer({
     feedMetadata: null,
     domain: 'idp.global',
@@ -22,11 +26,48 @@ export const runCli = async () => {
     addCustomRoutes: async (typedserver) => {
       // Enable SPA fallback - serves index.html for non-file routes (e.g., /login, /dashboard)
       typedserver.options.spaFallback = true;
+
+      // OIDC Discovery endpoint
+      typedserver.addRoute('/.well-known/openid-configuration', 'GET', async (req) => {
+        return new Response(JSON.stringify(reception.oidcManager.getDiscoveryDocument()), {
+          headers: { 'Content-Type': 'application/json' },
+        });
+      });
+
+      // JWKS endpoint
+      typedserver.addRoute('/.well-known/jwks.json', 'GET', async (req) => {
+        return new Response(JSON.stringify(reception.oidcManager.getJwks()), {
+          headers: { 'Content-Type': 'application/json' },
+        });
+      });
+
+      // OAuth Authorization endpoint
+      typedserver.addRoute('/oauth/authorize', 'GET', async (req) => {
+        return reception.oidcManager.handleAuthorize(req);
+      });
+
+      // OAuth Token endpoint
+      typedserver.addRoute('/oauth/token', 'POST', async (req) => {
+        return reception.oidcManager.handleToken(req);
+      });
+
+      // OAuth UserInfo endpoint (GET and POST)
+      typedserver.addRoute('/oauth/userinfo', 'GET', async (req) => {
+        return reception.oidcManager.handleUserInfo(req);
+      });
+      typedserver.addRoute('/oauth/userinfo', 'POST', async (req) => {
+        return reception.oidcManager.handleUserInfo(req);
+      });
+
+      // OAuth Revocation endpoint
+      typedserver.addRoute('/oauth/revoke', 'POST', async (req) => {
+        return reception.oidcManager.handleRevoke(req);
+      });
     },
   });
 
   // lets add the reception routes
-  const reception = new Reception({
+  reception = new Reception({
     name: (await serviceQenv.getEnvVarOnDemand('INSTANCE_NAME')) || 'idp.global',
     mongoDescriptor: {
       mongoDbUrl: await serviceQenv.getEnvVarOnDemand('MONGODB_URL'),
@@ -36,5 +77,5 @@ export const runCli = async () => {
   });
   await reception.start();
 
-  await websiteServer.start();
+  await websiteServer.start(2999);
 };

ts/reception/classes.oidcmanager.ts

@@ -0,0 +1,684 @@
+import * as plugins from '../plugins.js';
+import type { Reception } from './classes.reception.js';
+import type { App } from './classes.app.js';
+
+/**
+ * OidcManager handles OpenID Connect (OIDC) server functionality
+ * for third-party client authentication.
+ */
+export class OidcManager {
+  public receptionRef: Reception;
+  public get db() {
+    return this.receptionRef.db.smartdataDb;
+  }
+
+  // In-memory store for authorization codes (short-lived, 10 min TTL)
+  private authorizationCodes = new Map<string, plugins.idpInterfaces.data.IAuthorizationCode>();
+
+  // In-memory store for access tokens (for validation)
+  private accessTokens = new Map<string, plugins.idpInterfaces.data.IOidcAccessToken>();
+
+  // In-memory store for refresh tokens
+  private refreshTokens = new Map<string, plugins.idpInterfaces.data.IOidcRefreshToken>();
+
+  // In-memory store for user consents (should be persisted later)
+  private userConsents = new Map<string, plugins.idpInterfaces.data.IUserConsent>();
+
+  constructor(receptionRefArg: Reception) {
+    this.receptionRef = receptionRefArg;
+
+    // Start cleanup task for expired codes/tokens
+    this.startCleanupTask();
+  }
+
+  /**
+   * Get the OIDC Discovery Document
+   */
+  public getDiscoveryDocument(): plugins.idpInterfaces.data.IOidcDiscoveryDocument {
+    const baseUrl = this.receptionRef.options.baseUrl || 'https://idp.global';
+    return {
+      issuer: baseUrl,
+      authorization_endpoint: `${baseUrl}/oauth/authorize`,
+      token_endpoint: `${baseUrl}/oauth/token`,
+      userinfo_endpoint: `${baseUrl}/oauth/userinfo`,
+      jwks_uri: `${baseUrl}/.well-known/jwks.json`,
+      revocation_endpoint: `${baseUrl}/oauth/revoke`,
+      scopes_supported: ['openid', 'profile', 'email', 'organizations', 'roles'],
+      response_types_supported: ['code'],
+      grant_types_supported: ['authorization_code', 'refresh_token'],
+      subject_types_supported: ['public'],
+      id_token_signing_alg_values_supported: ['RS256'],
+      token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post'],
+      code_challenge_methods_supported: ['S256'],
+      claims_supported: [
+        'sub', 'iss', 'aud', 'exp', 'iat', 'auth_time', 'nonce',
+        'name', 'preferred_username', 'picture',
+        'email', 'email_verified',
+        'organizations', 'roles'
+      ],
+    };
+  }
+
+  /**
+   * Get the JSON Web Key Set (JWKS)
+   */
+  public getJwks(): plugins.idpInterfaces.data.IJwks {
+    const keypair = this.receptionRef.jwtManager.smartjwtInstance.getKeyPairAsJson();
+    // Convert PEM to JWK format
+    const jwk = this.pemToJwk(keypair.publicPem);
+    return {
+      keys: [jwk],
+    };
+  }
+
+  /**
+   * Convert PEM public key to JWK format
+   */
+  private pemToJwk(publicPem: string): plugins.idpInterfaces.data.IJwk {
+    // For now, use a simplified approach - in production, parse the PEM properly
+    // The smartjwt library should provide this, or use crypto.createPublicKey
+    const kid = plugins.smarthash.sha256FromStringSync(publicPem).substring(0, 16);
+
+    // This is a placeholder - proper implementation would extract n and e from PEM
+    // For now, return a minimal structure
+    return {
+      kty: 'RSA',
+      use: 'sig',
+      alg: 'RS256',
+      kid: kid,
+      // These would be extracted from the actual public key
+      n: Buffer.from(publicPem).toString('base64url').substring(0, 256),
+      e: 'AQAB', // Standard RSA exponent (65537)
+    };
+  }
+
+  /**
+   * Handle the authorization endpoint request
+   */
+  public async handleAuthorize(request: Request): Promise<Response> {
+    const url = new URL(request.url);
+    const params = url.searchParams;
+
+    // Extract authorization request parameters
+    const clientId = params.get('client_id');
+    const redirectUri = params.get('redirect_uri');
+    const responseType = params.get('response_type');
+    const scope = params.get('scope');
+    const state = params.get('state');
+    const codeChallenge = params.get('code_challenge');
+    const codeChallengeMethod = params.get('code_challenge_method');
+    const nonce = params.get('nonce');
+    const prompt = params.get('prompt') as 'none' | 'login' | 'consent' | null;
+
+    // Validate required parameters
+    if (!clientId || !redirectUri || !responseType || !scope || !state) {
+      return this.errorResponse('invalid_request', 'Missing required parameters');
+    }
+
+    if (responseType !== 'code') {
+      return this.errorResponse('unsupported_response_type', 'Only code response type is supported');
+    }
+
+    // Validate code challenge method if present
+    if (codeChallenge && codeChallengeMethod !== 'S256') {
+      return this.errorResponse('invalid_request', 'Only S256 code challenge method is supported');
+    }
+
+    // Find the app by client_id
+    const app = await this.findAppByClientId(clientId);
+    if (!app) {
+      return this.errorResponse('invalid_client', 'Unknown client_id');
+    }
+
+    // Validate redirect URI
+    if (!app.data.oauthCredentials.redirectUris.includes(redirectUri)) {
+      return this.errorResponse('invalid_request', 'Invalid redirect_uri');
+    }
+
+    // Parse and validate scopes
+    const requestedScopes = scope.split(' ') as plugins.idpInterfaces.data.TOidcScope[];
+    const allowedScopes = app.data.oauthCredentials.allowedScopes as plugins.idpInterfaces.data.TOidcScope[];
+    const validScopes = requestedScopes.filter(s => allowedScopes.includes(s));
+
+    if (!validScopes.includes('openid')) {
+      return this.errorResponse('invalid_scope', 'openid scope is required');
+    }
+
+    // For now, redirect to login page with OAuth parameters
+    // The login page will handle authentication and call back to complete authorization
+    const baseUrl = this.receptionRef.options.baseUrl || 'https://idp.global';
+    const loginUrl = new URL(`${baseUrl}/login`);
+    loginUrl.searchParams.set('oauth', 'true');
+    loginUrl.searchParams.set('client_id', clientId);
+    loginUrl.searchParams.set('redirect_uri', redirectUri);
+    loginUrl.searchParams.set('scope', validScopes.join(' '));
+    loginUrl.searchParams.set('state', state);
+    if (codeChallenge) {
+      loginUrl.searchParams.set('code_challenge', codeChallenge);
+      loginUrl.searchParams.set('code_challenge_method', codeChallengeMethod!);
+    }
+    if (nonce) {
+      loginUrl.searchParams.set('nonce', nonce);
+    }
+
+    return Response.redirect(loginUrl.toString(), 302);
+  }
+
+  /**
+   * Generate an authorization code after user authentication
+   */
+  public async generateAuthorizationCode(
+    clientId: string,
+    userId: string,
+    scopes: plugins.idpInterfaces.data.TOidcScope[],
+    redirectUri: string,
+    codeChallenge?: string,
+    nonce?: string
+  ): Promise<string> {
+    const code = plugins.smartunique.shortId(32);
+    const authCode: plugins.idpInterfaces.data.IAuthorizationCode = {
+      code,
+      clientId,
+      userId,
+      scopes,
+      redirectUri,
+      codeChallenge,
+      codeChallengeMethod: codeChallenge ? 'S256' : undefined,
+      nonce,
+      expiresAt: Date.now() + 10 * 60 * 1000, // 10 minutes
+      used: false,
+    };
+
+    this.authorizationCodes.set(code, authCode);
+    return code;
+  }
+
+  /**
+   * Handle the token endpoint request
+   */
+  public async handleToken(request: Request): Promise<Response> {
+    // Parse form data
+    const contentType = request.headers.get('content-type');
+    if (!contentType?.includes('application/x-www-form-urlencoded')) {
+      return this.tokenErrorResponse('invalid_request', 'Content-Type must be application/x-www-form-urlencoded');
+    }
+
+    const formData = await request.formData();
+    const grantType = formData.get('grant_type') as string;
+
+    // Extract client credentials from Basic auth or form
+    let clientId = formData.get('client_id') as string;
+    let clientSecret = formData.get('client_secret') as string;
+
+    const authHeader = request.headers.get('authorization');
+    if (authHeader?.startsWith('Basic ')) {
+      const base64 = authHeader.substring(6);
+      const decoded = Buffer.from(base64, 'base64').toString('utf-8');
+      const [id, secret] = decoded.split(':');
+      clientId = clientId || id;
+      clientSecret = clientSecret || secret;
+    }
+
+    if (!clientId) {
+      return this.tokenErrorResponse('invalid_client', 'Missing client_id');
+    }
+
+    // Find and validate app
+    const app = await this.findAppByClientId(clientId);
+    if (!app) {
+      return this.tokenErrorResponse('invalid_client', 'Unknown client');
+    }
+
+    // Validate client secret for confidential clients
+    if (clientSecret) {
+      const secretHash = await plugins.smarthash.sha256FromString(clientSecret);
+      if (secretHash !== app.data.oauthCredentials.clientSecretHash) {
+        return this.tokenErrorResponse('invalid_client', 'Invalid client credentials');
+      }
+    }
+
+    if (grantType === 'authorization_code') {
+      return this.handleAuthorizationCodeGrant(formData, app);
+    } else if (grantType === 'refresh_token') {
+      return this.handleRefreshTokenGrant(formData, app);
+    } else {
+      return this.tokenErrorResponse('unsupported_grant_type', 'Unsupported grant type');
+    }
+  }
+
+  /**
+   * Handle authorization_code grant type
+   */
+  private async handleAuthorizationCodeGrant(
+    formData: FormData,
+    app: App
+  ): Promise<Response> {
+    const code = formData.get('code') as string;
+    const redirectUri = formData.get('redirect_uri') as string;
+    const codeVerifier = formData.get('code_verifier') as string;
+
+    if (!code || !redirectUri) {
+      return this.tokenErrorResponse('invalid_request', 'Missing code or redirect_uri');
+    }
+
+    // Find and validate authorization code
+    const authCode = this.authorizationCodes.get(code);
+    if (!authCode) {
+      return this.tokenErrorResponse('invalid_grant', 'Invalid authorization code');
+    }
+
+    if (authCode.used) {
+      // Code reuse attack - revoke all tokens for this code
+      this.authorizationCodes.delete(code);
+      return this.tokenErrorResponse('invalid_grant', 'Authorization code already used');
+    }
+
+    if (authCode.expiresAt < Date.now()) {
+      this.authorizationCodes.delete(code);
+      return this.tokenErrorResponse('invalid_grant', 'Authorization code expired');
+    }
+
+    if (authCode.clientId !== app.data.oauthCredentials.clientId) {
+      return this.tokenErrorResponse('invalid_grant', 'Client ID mismatch');
+    }
+
+    if (authCode.redirectUri !== redirectUri) {
+      return this.tokenErrorResponse('invalid_grant', 'Redirect URI mismatch');
+    }
+
+    // Verify PKCE if code challenge was used
+    if (authCode.codeChallenge) {
+      if (!codeVerifier) {
+        return this.tokenErrorResponse('invalid_grant', 'Code verifier required');
+      }
+      const expectedChallenge = this.generateS256Challenge(codeVerifier);
+      if (expectedChallenge !== authCode.codeChallenge) {
+        return this.tokenErrorResponse('invalid_grant', 'Invalid code verifier');
+      }
+    }
+
+    // Mark code as used
+    authCode.used = true;
+
+    // Generate tokens
+    const tokens = await this.generateTokens(
+      authCode.userId,
+      app.data.oauthCredentials.clientId,
+      authCode.scopes,
+      authCode.nonce
+    );
+
+    return new Response(JSON.stringify(tokens), {
+      status: 200,
+      headers: {
+        'Content-Type': 'application/json',
+        'Cache-Control': 'no-store',
+        'Pragma': 'no-cache',
+      },
+    });
+  }
+
+  /**
+   * Handle refresh_token grant type
+   */
+  private async handleRefreshTokenGrant(
+    formData: FormData,
+    app: App
+  ): Promise<Response> {
+    const refreshToken = formData.get('refresh_token') as string;
+
+    if (!refreshToken) {
+      return this.tokenErrorResponse('invalid_request', 'Missing refresh_token');
+    }
+
+    const tokenHash = await plugins.smarthash.sha256FromString(refreshToken);
+    const storedToken = this.refreshTokens.get(tokenHash);
+
+    if (!storedToken) {
+      return this.tokenErrorResponse('invalid_grant', 'Invalid refresh token');
+    }
+
+    if (storedToken.revoked) {
+      return this.tokenErrorResponse('invalid_grant', 'Refresh token has been revoked');
+    }
+
+    if (storedToken.expiresAt < Date.now()) {
+      this.refreshTokens.delete(tokenHash);
+      return this.tokenErrorResponse('invalid_grant', 'Refresh token expired');
+    }
+
+    if (storedToken.clientId !== app.data.oauthCredentials.clientId) {
+      return this.tokenErrorResponse('invalid_grant', 'Client ID mismatch');
+    }
+
+    // Generate new tokens (without new refresh token by default)
+    const tokens = await this.generateTokens(
+      storedToken.userId,
+      storedToken.clientId,
+      storedToken.scopes,
+      undefined,
+      false // Don't generate new refresh token
+    );
+
+    return new Response(JSON.stringify(tokens), {
+      status: 200,
+      headers: {
+        'Content-Type': 'application/json',
+        'Cache-Control': 'no-store',
+        'Pragma': 'no-cache',
+      },
+    });
+  }
+
+  /**
+   * Generate access token, ID token, and optionally refresh token
+   */
+  private async generateTokens(
+    userId: string,
+    clientId: string,
+    scopes: plugins.idpInterfaces.data.TOidcScope[],
+    nonce?: string,
+    includeRefreshToken = true
+  ): Promise<plugins.idpInterfaces.data.ITokenResponse> {
+    const now = Date.now();
+    const accessTokenLifetime = 3600; // 1 hour
+    const refreshTokenLifetime = 30 * 24 * 3600; // 30 days
+
+    // Generate access token
+    const accessToken = plugins.smartunique.shortId(32);
+    const accessTokenHash = await plugins.smarthash.sha256FromString(accessToken);
+    const accessTokenData: plugins.idpInterfaces.data.IOidcAccessToken = {
+      id: plugins.smartunique.shortId(8),
+      tokenHash: accessTokenHash,
+      clientId,
+      userId,
+      scopes,
+      expiresAt: now + accessTokenLifetime * 1000,
+      issuedAt: now,
+    };
+    this.accessTokens.set(accessTokenHash, accessTokenData);
+
+    // Generate ID token (JWT)
+    const idToken = await this.generateIdToken(userId, clientId, scopes, nonce);
+
+    const response: plugins.idpInterfaces.data.ITokenResponse = {
+      access_token: accessToken,
+      token_type: 'Bearer',
+      expires_in: accessTokenLifetime,
+      id_token: idToken,
+      scope: scopes.join(' '),
+    };
+
+    // Generate refresh token if requested
+    if (includeRefreshToken) {
+      const refreshToken = plugins.smartunique.shortId(48);
+      const refreshTokenHash = await plugins.smarthash.sha256FromString(refreshToken);
+      const refreshTokenData: plugins.idpInterfaces.data.IOidcRefreshToken = {
+        id: plugins.smartunique.shortId(8),
+        tokenHash: refreshTokenHash,
+        clientId,
+        userId,
+        scopes,
+        expiresAt: now + refreshTokenLifetime * 1000,
+        issuedAt: now,
+        revoked: false,
+      };
+      this.refreshTokens.set(refreshTokenHash, refreshTokenData);
+      response.refresh_token = refreshToken;
+    }
+
+    return response;
+  }
+
+  /**
+   * Generate an ID token (JWT)
+   */
+  private async generateIdToken(
+    userId: string,
+    clientId: string,
+    scopes: plugins.idpInterfaces.data.TOidcScope[],
+    nonce?: string
+  ): Promise<string> {
+    const baseUrl = this.receptionRef.options.baseUrl || 'https://idp.global';
+    const now = Math.floor(Date.now() / 1000);
+
+    const claims: plugins.idpInterfaces.data.IIdTokenClaims = {
+      iss: baseUrl,
+      sub: userId,
+      aud: clientId,
+      exp: now + 3600, // 1 hour
+      iat: now,
+      auth_time: now,
+    };
+
+    if (nonce) {
+      claims.nonce = nonce;
+    }
+
+    // Add claims based on scopes
+    if (scopes.includes('profile') || scopes.includes('email') || scopes.includes('organizations') || scopes.includes('roles')) {
+      const userInfo = await this.getUserClaims(userId, scopes);
+      Object.assign(claims, userInfo);
+    }
+
+    // Sign the JWT
+    const idToken = await this.receptionRef.jwtManager.smartjwtInstance.createJWT(claims);
+    return idToken;
+  }
+
+  /**
+   * Handle the userinfo endpoint
+   */
+  public async handleUserInfo(request: Request): Promise<Response> {
+    // Get access token from Authorization header
+    const authHeader = request.headers.get('authorization');
+    if (!authHeader?.startsWith('Bearer ')) {
+      return new Response(JSON.stringify({ error: 'invalid_token' }), {
+        status: 401,
+        headers: {
+          'Content-Type': 'application/json',
+          'WWW-Authenticate': 'Bearer error="invalid_token"',
+        },
+      });
+    }
+
+    const accessToken = authHeader.substring(7);
+    const tokenHash = await plugins.smarthash.sha256FromString(accessToken);
+    const tokenData = this.accessTokens.get(tokenHash);
+
+    if (!tokenData) {
+      return new Response(JSON.stringify({ error: 'invalid_token' }), {
+        status: 401,
+        headers: {
+          'Content-Type': 'application/json',
+          'WWW-Authenticate': 'Bearer error="invalid_token"',
+        },
+      });
+    }
+
+    if (tokenData.expiresAt < Date.now()) {
+      this.accessTokens.delete(tokenHash);
+      return new Response(JSON.stringify({ error: 'invalid_token', error_description: 'Token expired' }), {
+        status: 401,
+        headers: {
+          'Content-Type': 'application/json',
+          'WWW-Authenticate': 'Bearer error="invalid_token", error_description="Token expired"',
+        },
+      });
+    }
+
+    // Get user claims based on token scopes
+    const userInfo = await this.getUserClaims(tokenData.userId, tokenData.scopes);
+
+    return new Response(JSON.stringify(userInfo), {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+
+  /**
+   * Get user claims based on scopes
+   */
+  private async getUserClaims(
+    userId: string,
+    scopes: plugins.idpInterfaces.data.TOidcScope[]
+  ): Promise<plugins.idpInterfaces.data.IUserInfoResponse> {
+    const user = await this.receptionRef.userManager.CUser.getInstance({ id: userId });
+    if (!user) {
+      return { sub: userId };
+    }
+
+    const claims: plugins.idpInterfaces.data.IUserInfoResponse = {
+      sub: userId,
+    };
+
+    // Profile scope
+    if (scopes.includes('profile')) {
+      claims.name = user.data?.name;
+      claims.preferred_username = user.data?.username;
+      // claims.picture = user.data?.avatarUrl; // If avatar exists
+    }
+
+    // Email scope
+    if (scopes.includes('email')) {
+      claims.email = user.data?.email;
+      claims.email_verified = user.data?.status === 'active';
+    }
+
+    // Organizations scope (custom)
+    if (scopes.includes('organizations')) {
+      const organizations = await this.receptionRef.organizationmanager.getAllOrganizationsForUser(user);
+      const roles = await this.receptionRef.roleManager.getAllRolesForUser(user);
+      if (organizations) {
+        claims.organizations = organizations.map(org => ({
+          id: org.id,
+          name: org.data?.name || '',
+          slug: org.data?.slug || '',
+          roles: roles
+            .find(r => r.data?.organizationId === org.id)?.data?.roles || [],
+        }));
+      }
+    }
+
+    // Roles scope (custom - global roles)
+    if (scopes.includes('roles')) {
+      const roles: string[] = ['user'];
+      if (user.data?.isGlobalAdmin) {
+        roles.push('admin');
+      }
+      claims.roles = roles;
+    }
+
+    return claims;
+  }
+
+  /**
+   * Handle the revocation endpoint
+   */
+  public async handleRevoke(request: Request): Promise<Response> {
+    const formData = await request.formData();
+    const token = formData.get('token') as string;
+    const tokenTypeHint = formData.get('token_type_hint') as string;
+
+    if (!token) {
+      return new Response(null, { status: 200 }); // Spec says always return 200
+    }
+
+    const tokenHash = await plugins.smarthash.sha256FromString(token);
+
+    // Try to revoke as refresh token
+    if (!tokenTypeHint || tokenTypeHint === 'refresh_token') {
+      const refreshToken = this.refreshTokens.get(tokenHash);
+      if (refreshToken) {
+        refreshToken.revoked = true;
+        return new Response(null, { status: 200 });
+      }
+    }
+
+    // Try to revoke as access token
+    if (!tokenTypeHint || tokenTypeHint === 'access_token') {
+      if (this.accessTokens.has(tokenHash)) {
+        this.accessTokens.delete(tokenHash);
+        return new Response(null, { status: 200 });
+      }
+    }
+
+    // Token not found - still return 200 per spec
+    return new Response(null, { status: 200 });
+  }
+
+  /**
+   * Find an app by its OAuth client_id
+   */
+  private async findAppByClientId(clientId: string): Promise<App | null> {
+    const apps = await this.receptionRef.appManager.CApp.getInstances({
+      'data.oauthCredentials.clientId': clientId,
+    });
+    return apps[0] || null;
+  }
+
+  /**
+   * Generate S256 PKCE challenge from verifier
+   */
+  private generateS256Challenge(verifier: string): string {
+    const hash = plugins.smarthash.sha256FromStringSync(verifier);
+    return Buffer.from(hash, 'hex').toString('base64url');
+  }
+
+  /**
+   * Create an error response for authorization endpoint
+   */
+  private errorResponse(error: string, description: string): Response {
+    return new Response(JSON.stringify({ error, error_description: description }), {
+      status: 400,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+
+  /**
+   * Create an error response for token endpoint
+   */
+  private tokenErrorResponse(
+    error: plugins.idpInterfaces.data.ITokenErrorResponse['error'],
+    description: string
+  ): Response {
+    const body: plugins.idpInterfaces.data.ITokenErrorResponse = {
+      error,
+      error_description: description,
+    };
+    return new Response(JSON.stringify(body), {
+      status: 400,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+
+  /**
+   * Start cleanup task for expired tokens/codes
+   */
+  private startCleanupTask(): void {
+    setInterval(() => {
+      const now = Date.now();
+
+      // Clean up expired authorization codes
+      for (const [code, data] of this.authorizationCodes) {
+        if (data.expiresAt < now) {
+          this.authorizationCodes.delete(code);
+        }
+      }
+
+      // Clean up expired access tokens
+      for (const [hash, data] of this.accessTokens) {
+        if (data.expiresAt < now) {
+          this.accessTokens.delete(hash);
+        }
+      }
+
+      // Clean up expired refresh tokens
+      for (const [hash, data] of this.refreshTokens) {
+        if (data.expiresAt < now) {
+          this.refreshTokens.delete(hash);
+        }
+      }
+    }, 60 * 1000); // Run every minute
+  }
+}

ts/reception/classes.reception.ts

@@ -17,6 +17,7 @@ import { AppManager } from './classes.appmanager.js';
 import { AppConnectionManager } from './classes.appconnectionmanager.js';
 import { ActivityLogManager } from './classes.activitylogmanager.js';
 import { UserInvitationManager } from './classes.userinvitationmanager.js';
+import { OidcManager } from './classes.oidcmanager.js';
 
 export interface IReceptionOptions {
   /**
@@ -49,6 +50,7 @@ export class Reception {
   public appConnectionManager = new AppConnectionManager(this);
   public activityLogManager = new ActivityLogManager(this);
   public userInvitationManager = new UserInvitationManager(this);
+  public oidcManager = new OidcManager(this);
   housekeeping = new ReceptionHousekeeping(this);
 
   constructor(public options: IReceptionOptions) {

ts/tspublish.json

@@ -0,0 +1,3 @@
+{
+  "order": 2
+}

ts_idpcli/classes.idpcli.ts

@@ -0,0 +1,477 @@
+import * as plugins from './plugins.js';
+
+export interface IIdpCliConfig {
+  idpBaseUrl: string;
+  configDir?: string;
+}
+
+export interface IStoredCredentials {
+  refreshToken?: string;
+  jwt?: string;
+  userId?: string;
+}
+
+/**
+ * IdpCli - A Node.js CLI client for idp.global
+ * Uses file-based storage instead of browser webstore
+ */
+export class IdpCli {
+  public config: IIdpCliConfig;
+  public configDir: string;
+  public credentialsPath: string;
+
+  public typedsocket: plugins.typedsocket.TypedSocket;
+  public typedrouter = new plugins.typedrequest.TypedRouter();
+  private typedsocketDeferred = plugins.smartpromise.defer<plugins.typedsocket.TypedSocket>();
+
+  constructor(configArg: IIdpCliConfig) {
+    this.config = configArg;
+    this.configDir = configArg.configDir || plugins.path.join(plugins.os.homedir(), '.idp-global');
+    this.credentialsPath = plugins.path.join(this.configDir, 'credentials.json');
+  }
+
+  /**
+   * Ensure config directory exists
+   */
+  private ensureConfigDir(): void {
+    if (!plugins.fs.existsSync(this.configDir)) {
+      plugins.fs.mkdirSync(this.configDir, { recursive: true });
+    }
+  }
+
+  /**
+   * Store credentials to file
+   */
+  public storeCredentials(credentials: IStoredCredentials): void {
+    this.ensureConfigDir();
+    plugins.fs.writeFileSync(this.credentialsPath, JSON.stringify(credentials, null, 2), 'utf8');
+  }
+
+  /**
+   * Load stored credentials
+   */
+  public loadCredentials(): IStoredCredentials | null {
+    try {
+      if (!plugins.fs.existsSync(this.credentialsPath)) {
+        return null;
+      }
+      const content = plugins.fs.readFileSync(this.credentialsPath, 'utf8');
+      return JSON.parse(content);
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Delete stored credentials (logout)
+   */
+  public deleteCredentials(): void {
+    try {
+      if (plugins.fs.existsSync(this.credentialsPath)) {
+        plugins.fs.unlinkSync(this.credentialsPath);
+      }
+    } catch {
+      // ignore if file doesn't exist
+    }
+  }
+
+  /**
+   * Connect to IDP server via WebSocket
+   */
+  public async connect(): Promise<void> {
+    if (this.typedsocketDeferred.status === 'fulfilled') {
+      return;
+    }
+
+    let baseUrl = this.config.idpBaseUrl;
+    if (baseUrl.endsWith('/')) {
+      baseUrl = baseUrl.slice(0, -1);
+    }
+    if (!baseUrl.endsWith('/typedrequest')) {
+      baseUrl = `${baseUrl}/typedrequest`;
+    }
+
+    console.log(`Connecting to ${baseUrl}...`);
+    this.typedsocket = await plugins.typedsocket.TypedSocket.createClient(
+      this.typedrouter,
+      baseUrl
+    );
+    this.typedsocketDeferred.resolve(this.typedsocket);
+    console.log('Connected!');
+  }
+
+  /**
+   * Disconnect from IDP server
+   */
+  public async disconnect(): Promise<void> {
+    if (this.typedsocket) {
+      await this.typedsocket.stop();
+    }
+  }
+
+  // ============================================
+  // Authentication Commands
+  // ============================================
+
+  /**
+   * Login with email and password
+   */
+  public async loginWithPassword(email: string, password: string): Promise<boolean> {
+    await this.connect();
+
+    const loginRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_LoginWithEmailOrUsernameAndPassword>(
+      'loginWithEmailOrUsernameAndPassword'
+    );
+
+    const response = await loginRequest.fire({
+      username: email,
+      password: password,
+    });
+
+    if (response.refreshToken) {
+      this.storeCredentials({
+        refreshToken: response.refreshToken,
+      });
+      console.log('Login successful!');
+      return true;
+    } else if (response.twoFaNeeded) {
+      console.log('Two-factor authentication required.');
+      return false;
+    } else {
+      console.log('Login failed.');
+      return false;
+    }
+  }
+
+  /**
+   * Login with API token
+   */
+  public async loginWithApiToken(apiToken: string): Promise<boolean> {
+    await this.connect();
+
+    const loginRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_LoginWithApiToken>(
+      'loginWithApiToken'
+    );
+
+    const response = await loginRequest.fire({
+      apiToken,
+    });
+
+    if (response.jwt) {
+      this.storeCredentials({
+        jwt: response.jwt,
+      });
+      console.log('Login successful!');
+      return true;
+    } else {
+      console.log('Login failed.');
+      return false;
+    }
+  }
+
+  /**
+   * Refresh JWT from stored refresh token
+   */
+  public async refreshJwt(): Promise<string | null> {
+    const credentials = this.loadCredentials();
+    if (!credentials?.refreshToken) {
+      console.error('No refresh token stored. Please login first.');
+      return null;
+    }
+
+    await this.connect();
+
+    const refreshRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RefreshJwt>(
+      'refreshJwt'
+    );
+
+    const response = await refreshRequest.fire({
+      refreshToken: credentials.refreshToken,
+    });
+
+    if (response.jwt) {
+      this.storeCredentials({
+        ...credentials,
+        jwt: response.jwt,
+      });
+      return response.jwt;
+    }
+    return null;
+  }
+
+  /**
+   * Logout - clear stored credentials
+   */
+  public async logout(): Promise<void> {
+    const credentials = this.loadCredentials();
+
+    if (credentials?.refreshToken) {
+      try {
+        await this.connect();
+        const logoutRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.ILogoutRequest>(
+          'logout'
+        );
+        await logoutRequest.fire({
+          refreshToken: credentials.refreshToken,
+        });
+      } catch (e) {
+        // Ignore errors during server-side logout
+      }
+    }
+
+    this.deleteCredentials();
+    console.log('Logged out successfully.');
+  }
+
+  // ============================================
+  // User Commands
+  // ============================================
+
+  /**
+   * Get current user info
+   */
+  public async whoami(): Promise<plugins.idpInterfaces.data.IUser | null> {
+    const jwt = await this.ensureAuthenticated();
+    if (!jwt) return null;
+
+    await this.connect();
+
+    const whoIsRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_WhoIs>(
+      'whoIs'
+    );
+
+    const response = await whoIsRequest.fire({ jwt });
+    return response.user;
+  }
+
+  /**
+   * Get user sessions
+   */
+  public async getSessions(): Promise<plugins.idpInterfaces.request.IReq_GetUserSessions['response']['sessions'] | null> {
+    const jwt = await this.ensureAuthenticated();
+    if (!jwt) return null;
+
+    await this.connect();
+
+    const sessionsRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetUserSessions>(
+      'getUserSessions'
+    );
+
+    const response = await sessionsRequest.fire({ jwt });
+    return response.sessions;
+  }
+
+  /**
+   * Revoke a session
+   */
+  public async revokeSession(sessionId: string): Promise<boolean> {
+    const jwt = await this.ensureAuthenticated();
+    if (!jwt) return false;
+
+    await this.connect();
+
+    const revokeRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RevokeSession>(
+      'revokeSession'
+    );
+
+    const response = await revokeRequest.fire({ jwt, sessionId });
+    return response.success;
+  }
+
+  // ============================================
+  // Organization Commands
+  // ============================================
+
+  /**
+   * Get organizations for current user
+   */
+  public async getOrganizations(): Promise<{
+    roles: plugins.idpInterfaces.data.IRole[];
+    organizations: plugins.idpInterfaces.data.IOrganization[];
+  } | null> {
+    const jwt = await this.ensureAuthenticated();
+    if (!jwt) return null;
+
+    const user = await this.whoami();
+    if (!user) return null;
+
+    await this.connect();
+
+    const orgsRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetRolesAndOrganizationsForUserId>(
+      'getRolesAndOrganizationsForUserId'
+    );
+
+    const response = await orgsRequest.fire({
+      jwt,
+      userId: user.id,
+    });
+
+    return response;
+  }
+
+  /**
+   * Create a new organization
+   */
+  public async createOrganization(
+    name: string,
+    slug: string,
+    mode: 'checkAvailability' | 'manifest' = 'manifest'
+  ): Promise<plugins.idpInterfaces.request.IReq_CreateOrganization['response'] | null> {
+    const jwt = await this.ensureAuthenticated();
+    if (!jwt) return null;
+
+    const user = await this.whoami();
+    if (!user) return null;
+
+    await this.connect();
+
+    const createRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CreateOrganization>(
+      'createOrganization'
+    );
+
+    const response = await createRequest.fire({
+      jwt,
+      userId: user.id,
+      organizationName: name,
+      organizationSlug: slug,
+      action: mode,
+    });
+
+    return response;
+  }
+
+  /**
+   * Get organization members
+   */
+  public async getOrgMembers(
+    organizationId: string
+  ): Promise<plugins.idpInterfaces.request.IReq_GetOrgMembers['response']['members'] | null> {
+    const jwt = await this.ensureAuthenticated();
+    if (!jwt) return null;
+
+    await this.connect();
+
+    const membersRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetOrgMembers>(
+      'getOrgMembers'
+    );
+
+    const response = await membersRequest.fire({
+      jwt,
+      organizationId,
+    });
+
+    return response.members;
+  }
+
+  /**
+   * Invite a user to organization
+   */
+  public async inviteMember(
+    organizationId: string,
+    email: string,
+    roles: string[] = ['member']
+  ): Promise<plugins.idpInterfaces.request.IReq_CreateInvitation['response'] | null> {
+    const jwt = await this.ensureAuthenticated();
+    if (!jwt) return null;
+
+    await this.connect();
+
+    const inviteRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CreateInvitation>(
+      'createInvitation'
+    );
+
+    const response = await inviteRequest.fire({
+      jwt,
+      organizationId,
+      email,
+      roles,
+    });
+
+    return response;
+  }
+
+  // ============================================
+  // Admin Commands
+  // ============================================
+
+  /**
+   * Check if current user is global admin
+   */
+  public async checkGlobalAdmin(): Promise<boolean> {
+    const jwt = await this.ensureAuthenticated();
+    if (!jwt) return false;
+
+    await this.connect();
+
+    const adminRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CheckGlobalAdmin>(
+      'checkGlobalAdmin'
+    );
+
+    const response = await adminRequest.fire({ jwt });
+    return response.isGlobalAdmin;
+  }
+
+  /**
+   * Get global app statistics (admin only)
+   */
+  public async getGlobalAppStats(): Promise<plugins.idpInterfaces.request.IReq_GetGlobalAppStats['response']['apps'] | null> {
+    const jwt = await this.ensureAuthenticated();
+    if (!jwt) return null;
+
+    await this.connect();
+
+    const statsRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetGlobalAppStats>(
+      'getGlobalAppStats'
+    );
+
+    const response = await statsRequest.fire({ jwt });
+    return response.apps;
+  }
+
+  /**
+   * Suspend a user (admin only)
+   */
+  public async suspendUser(userId: string): Promise<boolean> {
+    const jwt = await this.ensureAuthenticated();
+    if (!jwt) return false;
+
+    await this.connect();
+
+    const suspendRequest = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_SuspendUser>(
+      'suspendUser'
+    );
+
+    await suspendRequest.fire({ jwt, userId });
+    return true;
+  }
+
+  // ============================================
+  // Helpers
+  // ============================================
+
+  /**
+   * Ensure user is authenticated, refresh JWT if needed
+   */
+  private async ensureAuthenticated(): Promise<string | null> {
+    let credentials = this.loadCredentials();
+
+    if (!credentials) {
+      console.error('Not logged in. Please run: idp login');
+      return null;
+    }
+
+    // If we have a JWT, return it
+    if (credentials.jwt) {
+      return credentials.jwt;
+    }
+
+    // Otherwise, try to get a new JWT from refresh token
+    if (credentials.refreshToken) {
+      const jwt = await this.refreshJwt();
+      return jwt;
+    }
+
+    console.error('No valid credentials. Please run: idp login');
+    return null;
+  }
+}

ts_idpcli/index.ts

@@ -0,0 +1,362 @@
+import * as plugins from './plugins.js';
+import { IdpCli } from './classes.idpcli.js';
+
+export { IdpCli } from './classes.idpcli.js';
+
+const DEFAULT_IDP_URL = 'https://idp.global';
+
+/**
+ * Run the CLI
+ */
+export const runCli = async () => {
+  const smartcliInstance = new plugins.smartcli.Smartcli();
+  smartcliInstance.addVersion('1.0.0');
+
+  const getIdpClient = () => {
+    const idpUrl = process.env.IDP_URL || DEFAULT_IDP_URL;
+    return new IdpCli({ idpBaseUrl: idpUrl });
+  };
+
+  // ============================================
+  // Help
+  // ============================================
+  smartcliInstance.addHelp({
+    helpText: `
+idp - CLI for idp.global identity provider
+
+USAGE:
+  idp <command> [options]
+
+COMMANDS:
+  login             Login with email and password
+  login-token       Login with API token
+  logout            Logout and clear credentials
+  whoami            Show current user information
+
+  orgs              List organizations
+  orgs-create       Create a new organization
+
+  members           List organization members
+  invite            Invite a user to organization
+
+  sessions          List active sessions
+  revoke            Revoke a session
+
+  admin-check       Check if current user is global admin
+  admin-apps        List global apps (admin only)
+  admin-suspend     Suspend a user (admin only)
+
+  help              Show this help message
+
+ENVIRONMENT:
+  IDP_URL           Override IDP server URL (default: https://idp.global)
+
+EXAMPLES:
+  idp login
+  idp whoami
+  idp orgs
+  idp members --org <org-id>
+  idp invite --org <org-id> --email user@example.com
+`,
+  });
+
+  // ============================================
+  // Login Commands
+  // ============================================
+  smartcliInstance.addCommand('login').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const interact = new plugins.smartinteract.SmartInteract();
+
+    const emailAnswer = await interact.askQuestion({
+      type: 'input',
+      name: 'email',
+      message: 'Email:',
+      default: '',
+    });
+
+    const passwordAnswer = await interact.askQuestion({
+      type: 'password',
+      name: 'password',
+      message: 'Password:',
+      default: '',
+    });
+
+    await client.loginWithPassword(emailAnswer.value as string, passwordAnswer.value as string);
+    await client.disconnect();
+  });
+
+  smartcliInstance.addCommand('login-token').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const interact = new plugins.smartinteract.SmartInteract();
+
+    const tokenAnswer = await interact.askQuestion({
+      type: 'password',
+      name: 'token',
+      message: 'API Token:',
+      default: '',
+    });
+
+    await client.loginWithApiToken(tokenAnswer.value as string);
+    await client.disconnect();
+  });
+
+  smartcliInstance.addCommand('logout').subscribe(async (argv) => {
+    const client = getIdpClient();
+    await client.logout();
+    await client.disconnect();
+  });
+
+  // ============================================
+  // User Commands
+  // ============================================
+  smartcliInstance.addCommand('whoami').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const user = await client.whoami();
+
+    if (user) {
+      console.log('\nUser Information:');
+      console.log(`  ID: ${user.id}`);
+      console.log(`  Name: ${user.data?.name || 'N/A'}`);
+      console.log(`  Username: ${user.data?.username || 'N/A'}`);
+      console.log(`  Email: ${user.data?.email || 'N/A'}`);
+      console.log(`  Status: ${user.data?.status || 'N/A'}`);
+      console.log(`  Global Admin: ${user.data?.isGlobalAdmin ? 'Yes' : 'No'}`);
+    }
+
+    await client.disconnect();
+  });
+
+  smartcliInstance.addCommand('sessions').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const sessions = await client.getSessions();
+
+    if (sessions) {
+      console.log('\nActive Sessions:');
+      for (const session of sessions) {
+        console.log(`  - ${session.id}`);
+        console.log(`    Device: ${session.deviceName || 'Unknown'}`);
+        console.log(`    Browser: ${session.browser || 'Unknown'}`);
+        console.log(`    OS: ${session.os || 'Unknown'}`);
+        console.log(`    Last Active: ${new Date(session.lastActive).toLocaleString()}`);
+        console.log(`    Current: ${session.isCurrent ? 'Yes' : 'No'}`);
+        console.log('');
+      }
+    }
+
+    await client.disconnect();
+  });
+
+  smartcliInstance.addCommand('revoke').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const sessionId = argv.session || argv.s || argv._[1];
+
+    if (!sessionId) {
+      console.error('Please provide a session ID: idp revoke --session <session-id>');
+      return;
+    }
+
+    const success = await client.revokeSession(sessionId);
+    if (success) {
+      console.log('Session revoked successfully.');
+    } else {
+      console.error('Failed to revoke session.');
+    }
+
+    await client.disconnect();
+  });
+
+  // ============================================
+  // Organization Commands
+  // ============================================
+  smartcliInstance.addCommand('orgs').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const result = await client.getOrganizations();
+
+    if (result) {
+      console.log('\nOrganizations:');
+      for (const org of result.organizations) {
+        const role = result.roles.find((r) => r.data?.organizationId === org.id);
+        console.log(`  - ${org.data?.name} (${org.id})`);
+        console.log(`    Slug: ${org.data?.slug}`);
+        console.log(`    Roles: ${role?.data?.roles?.join(', ') || 'Unknown'}`);
+        console.log('');
+      }
+    }
+
+    await client.disconnect();
+  });
+
+  smartcliInstance.addCommand('orgs-create').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const interact = new plugins.smartinteract.SmartInteract();
+
+    const nameAnswer = await interact.askQuestion({
+      type: 'input',
+      name: 'name',
+      message: 'Organization Name:',
+      default: '',
+    });
+
+    const slugAnswer = await interact.askQuestion({
+      type: 'input',
+      name: 'slug',
+      message: 'Organization Slug:',
+      default: '',
+    });
+
+    // First check availability
+    const checkResult = await client.createOrganization(
+      nameAnswer.value as string,
+      slugAnswer.value as string,
+      'checkAvailability'
+    );
+
+    if (!checkResult?.nameAvailable) {
+      console.error('Organization name or slug is not available.');
+      await client.disconnect();
+      return;
+    }
+
+    // Then create
+    const result = await client.createOrganization(
+      nameAnswer.value as string,
+      slugAnswer.value as string,
+      'manifest'
+    );
+
+    if (result?.resultingOrganization) {
+      console.log('\nOrganization created successfully!');
+      console.log(`  ID: ${result.resultingOrganization.id}`);
+      console.log(`  Name: ${result.resultingOrganization.data?.name}`);
+    }
+
+    await client.disconnect();
+  });
+
+  // ============================================
+  // Member Commands
+  // ============================================
+  smartcliInstance.addCommand('members').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const orgId = argv.org || argv.o || argv._[1];
+
+    if (!orgId) {
+      console.error('Please provide an organization ID: idp members --org <org-id>');
+      return;
+    }
+
+    const members = await client.getOrgMembers(orgId);
+
+    if (members) {
+      console.log('\nOrganization Members:');
+      for (const member of members) {
+        console.log(`  - ${member.user.data?.name || 'Unknown'}`);
+        console.log(`    Email: ${member.user.data?.email || 'N/A'}`);
+        console.log(`    Roles: ${member.role.data?.roles?.join(', ') || 'Unknown'}`);
+        console.log('');
+      }
+    }
+
+    await client.disconnect();
+  });
+
+  smartcliInstance.addCommand('invite').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const orgId = argv.org || argv.o;
+    const email = argv.email || argv.e || argv._[1];
+
+    if (!orgId || !email) {
+      console.error('Please provide organization ID and email:');
+      console.error('  idp invite --org <org-id> --email user@example.com');
+      return;
+    }
+
+    const result = await client.inviteMember(orgId, email);
+
+    if (result?.success) {
+      console.log(`Invitation sent to ${email}`);
+    } else {
+      console.error(`Failed to send invitation: ${result?.message || 'Unknown error'}`);
+    }
+
+    await client.disconnect();
+  });
+
+  // ============================================
+  // Admin Commands
+  // ============================================
+  smartcliInstance.addCommand('admin-check').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const isAdmin = await client.checkGlobalAdmin();
+
+    if (isAdmin) {
+      console.log('You are a global admin.');
+    } else {
+      console.log('You are not a global admin.');
+    }
+
+    await client.disconnect();
+  });
+
+  smartcliInstance.addCommand('admin-apps').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const apps = await client.getGlobalAppStats();
+
+    if (apps) {
+      console.log('\nGlobal Apps:');
+      for (const appInfo of apps) {
+        console.log(`  - ${appInfo.app.data?.name}`);
+        console.log(`    ID: ${appInfo.app.id}`);
+        console.log(`    Connections: ${appInfo.connectionCount}`);
+        console.log('');
+      }
+    }
+
+    await client.disconnect();
+  });
+
+  smartcliInstance.addCommand('admin-suspend').subscribe(async (argv) => {
+    const client = getIdpClient();
+    const userId = argv.user || argv.u || argv._[1];
+
+    if (!userId) {
+      console.error('Please provide a user ID: idp admin-suspend --user <user-id>');
+      return;
+    }
+
+    const interact = new plugins.smartinteract.SmartInteract();
+    const confirmAnswer = await interact.askQuestion({
+      type: 'confirm',
+      name: 'confirm',
+      message: `Are you sure you want to suspend user ${userId}?`,
+      default: false,
+    });
+
+    if (confirmAnswer.value) {
+      const success = await client.suspendUser(userId);
+      if (success) {
+        console.log('User suspended successfully.');
+      } else {
+        console.error('Failed to suspend user.');
+      }
+    } else {
+      console.log('Operation cancelled.');
+    }
+
+    await client.disconnect();
+  });
+
+  // ============================================
+  // Default/Standard command
+  // ============================================
+  smartcliInstance.standardCommand().subscribe(async (argv) => {
+    // If no command specified, show help
+    smartcliInstance.triggerCommand('help', argv);
+  });
+
+  // Start parsing
+  smartcliInstance.startParse();
+};
+
+// Auto-run if this is the main module
+runCli().catch(console.error);

ts_idpcli/plugins.ts

@@ -0,0 +1,25 @@
+// node built-ins
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+
+export { fs, path, os };
+
+// @push.rocks scope
+import * as smartcli from '@push.rocks/smartcli';
+import * as smartpromise from '@push.rocks/smartpromise';
+import * as smartrx from '@push.rocks/smartrx';
+import * as smartinteract from '@push.rocks/smartinteract';
+
+export { smartcli, smartpromise, smartrx, smartinteract };
+
+// @api.global scope
+import * as typedrequest from '@api.global/typedrequest';
+import * as typedsocket from '@api.global/typedsocket';
+
+export { typedrequest, typedsocket };
+
+// local
+import * as idpInterfaces from '../dist_ts_interfaces/index.js';
+
+export { idpInterfaces };

ts_idpclient/classes.idprequests.ts

@@ -53,4 +53,274 @@ export class IdpRequests {
       'exchangeRefreshTokenAndTransferToken'
     );
   }
+
+  // ============================================
+  // Login & Authentication
+  // ============================================
+
+  public get loginWithEmail() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_LoginWithEmail>(
+      'loginWithEmail'
+    );
+  }
+
+  public get loginWithEmailAfterToken() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_LoginWithEmailAfterEmailTokenAquired>(
+      'loginWithEmailAfterEmailTokenAquired'
+    );
+  }
+
+  public get loginWithApiToken() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_LoginWithApiToken>(
+      'loginWithApiToken'
+    );
+  }
+
+  public get resetPassword() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_ResetPassword>(
+      'resetPassword'
+    );
+  }
+
+  public get setNewPassword() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_SetNewPassword>(
+      'setNewPassword'
+    );
+  }
+
+  public get obtainDeviceId() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_ObtainDeviceId>(
+      'obtainDeviceId'
+    );
+  }
+
+  public get attachDeviceId() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_AttachDeviceId>(
+      'attachDeviceId'
+    );
+  }
+
+  // ============================================
+  // Registration
+  // ============================================
+
+  public get firstRegistration() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_FirstRegistration>(
+      'firstRegistrationRequest'
+    );
+  }
+
+  // ============================================
+  // User Management
+  // ============================================
+
+  public get getUserData() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetUserData>(
+      'getUserData'
+    );
+  }
+
+  public get setUserData() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_SetUserData>(
+      'setUserData'
+    );
+  }
+
+  public get getUserSessions() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetUserSessions>(
+      'getUserSessions'
+    );
+  }
+
+  public get revokeSession() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RevokeSession>(
+      'revokeSession'
+    );
+  }
+
+  public get getUserActivity() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetUserActivity>(
+      'getUserActivity'
+    );
+  }
+
+  // ============================================
+  // Organization Management
+  // ============================================
+
+  public get getOrganizationById() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetOrganizationById>(
+      'getOrganizationById'
+    );
+  }
+
+  public get updateOrganization() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_UpdateOrganization>(
+      'updateOrganization'
+    );
+  }
+
+  // ============================================
+  // Member & Invitation Management
+  // ============================================
+
+  public get createInvitation() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CreateInvitation>(
+      'createInvitation'
+    );
+  }
+
+  public get getOrgInvitations() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetOrgInvitations>(
+      'getOrgInvitations'
+    );
+  }
+
+  public get getOrgMembers() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetOrgMembers>(
+      'getOrgMembers'
+    );
+  }
+
+  public get cancelInvitation() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CancelInvitation>(
+      'cancelInvitation'
+    );
+  }
+
+  public get resendInvitation() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_ResendInvitation>(
+      'resendInvitation'
+    );
+  }
+
+  public get removeMember() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RemoveMember>(
+      'removeMember'
+    );
+  }
+
+  public get updateMemberRoles() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_UpdateMemberRoles>(
+      'updateMemberRoles'
+    );
+  }
+
+  public get transferOwnership() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_TransferOwnership>(
+      'transferOwnership'
+    );
+  }
+
+  public get getInvitationByToken() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetInvitationByToken>(
+      'getInvitationByToken'
+    );
+  }
+
+  public get acceptInvitation() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_AcceptInvitation>(
+      'acceptInvitation'
+    );
+  }
+
+  public get bulkCreateInvitations() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_BulkCreateInvitations>(
+      'bulkCreateInvitations'
+    );
+  }
+
+  // ============================================
+  // Billing
+  // ============================================
+
+  public get getBillingPlan() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetBillingPlan>(
+      'getBillingPlan'
+    );
+  }
+
+  public get getPaddleConfig() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPaddleConfig>(
+      'getPaddleConfig'
+    );
+  }
+
+  // ============================================
+  // JWT Verification & Management
+  // ============================================
+
+  public get getPublicKeyForValidation() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPublicKeyForValidation>(
+      'getPublicKeyForValidation'
+    );
+  }
+
+  public get pushPublicKeyForValidation() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_PushPublicKeyForValidation>(
+      'pushPublicKeyForValidation'
+    );
+  }
+
+  public get pushOrGetJwtIdBlocklist() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_PushOrGetJwtIdBlocklist>(
+      'pushOrGetJwtIdBlocklist'
+    );
+  }
+
+  // ============================================
+  // User Suspension (Admin)
+  // ============================================
+
+  public get suspendUser() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_SuspendUser>(
+      'suspendUser'
+    );
+  }
+
+  public get deleteSuspendedUser() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IDeleteSuspendedUser>(
+      'deleteSuspendedUser'
+    );
+  }
+
+  // ============================================
+  // Admin (Global Admin Only)
+  // ============================================
+
+  public get checkGlobalAdmin() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CheckGlobalAdmin>(
+      'checkGlobalAdmin'
+    );
+  }
+
+  public get getGlobalAppStats() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetGlobalAppStats>(
+      'getGlobalAppStats'
+    );
+  }
+
+  public get createGlobalApp() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CreateGlobalApp>(
+      'createGlobalApp'
+    );
+  }
+
+  public get updateGlobalApp() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_UpdateGlobalApp>(
+      'updateGlobalApp'
+    );
+  }
+
+  public get deleteGlobalApp() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_DeleteGlobalApp>(
+      'deleteGlobalApp'
+    );
+  }
+
+  public get regenerateAppCredentials() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RegenerateAppCredentials>(
+      'regenerateAppCredentials'
+    );
+  }
 }

ts_idpclient/tspublish.json

@@ -0,0 +1,3 @@
+{
+  "order": 3
+}

ts_interfaces/data/index.ts

@@ -1,5 +1,6 @@
 export * from './loint-reception.activity.js';
 export * from './loint-reception.app.js';
+export * from './loint-reception.oidc.js';
 export * from './loint-reception.appconnection.js';
 export * from './loint-reception.billingplan.js';
 export * from './loint-reception.device.js';

ts_interfaces/data/loint-reception.oidc.ts

@@ -0,0 +1,267 @@
+/**
+ * OIDC (OpenID Connect) data interfaces for third-party client support
+ */
+
+/**
+ * Supported OIDC scopes
+ */
+export type TOidcScope = 'openid' | 'profile' | 'email' | 'organizations' | 'roles';
+
+/**
+ * Authorization code for OAuth 2.0 authorization code flow
+ */
+export interface IAuthorizationCode {
+  /** The authorization code string */
+  code: string;
+  /** OAuth client ID */
+  clientId: string;
+  /** User ID who authorized */
+  userId: string;
+  /** Scopes granted */
+  scopes: TOidcScope[];
+  /** Redirect URI used in authorization request */
+  redirectUri: string;
+  /** PKCE code challenge (S256 hashed) */
+  codeChallenge?: string;
+  /** PKCE code challenge method */
+  codeChallengeMethod?: 'S256';
+  /** Nonce from authorization request (for ID token) */
+  nonce?: string;
+  /** Expiration timestamp (10 minutes from creation) */
+  expiresAt: number;
+  /** Whether the code has been used (single-use) */
+  used: boolean;
+}
+
+/**
+ * OIDC Access Token (opaque or JWT)
+ */
+export interface IOidcAccessToken {
+  /** Token identifier */
+  id: string;
+  /** The access token string (or hash for storage) */
+  tokenHash: string;
+  /** OAuth client ID */
+  clientId: string;
+  /** User ID */
+  userId: string;
+  /** Granted scopes */
+  scopes: TOidcScope[];
+  /** Expiration timestamp */
+  expiresAt: number;
+  /** Creation timestamp */
+  issuedAt: number;
+}
+
+/**
+ * OIDC Refresh Token
+ */
+export interface IOidcRefreshToken {
+  /** Token identifier */
+  id: string;
+  /** The refresh token string (or hash for storage) */
+  tokenHash: string;
+  /** OAuth client ID */
+  clientId: string;
+  /** User ID */
+  userId: string;
+  /** Granted scopes */
+  scopes: TOidcScope[];
+  /** Expiration timestamp */
+  expiresAt: number;
+  /** Creation timestamp */
+  issuedAt: number;
+  /** Whether the token has been revoked */
+  revoked: boolean;
+}
+
+/**
+ * User consent record for an OAuth client
+ */
+export interface IUserConsent {
+  /** Unique identifier */
+  id: string;
+  /** User who gave consent */
+  userId: string;
+  /** OAuth client ID */
+  clientId: string;
+  /** Scopes the user consented to */
+  scopes: TOidcScope[];
+  /** When consent was granted */
+  grantedAt: number;
+  /** When consent was last updated */
+  updatedAt: number;
+}
+
+/**
+ * OIDC Discovery Document (OpenID Provider Configuration)
+ */
+export interface IOidcDiscoveryDocument {
+  issuer: string;
+  authorization_endpoint: string;
+  token_endpoint: string;
+  userinfo_endpoint: string;
+  jwks_uri: string;
+  revocation_endpoint: string;
+  scopes_supported: TOidcScope[];
+  response_types_supported: string[];
+  grant_types_supported: string[];
+  subject_types_supported: string[];
+  id_token_signing_alg_values_supported: string[];
+  token_endpoint_auth_methods_supported: string[];
+  code_challenge_methods_supported: string[];
+  claims_supported: string[];
+}
+
+/**
+ * JSON Web Key Set (JWKS) response
+ */
+export interface IJwks {
+  keys: IJwk[];
+}
+
+/**
+ * JSON Web Key (RSA public key)
+ */
+export interface IJwk {
+  kty: 'RSA';
+  use: 'sig';
+  alg: 'RS256';
+  kid: string;
+  n: string;  // RSA modulus (base64url encoded)
+  e: string;  // RSA exponent (base64url encoded)
+}
+
+/**
+ * ID Token claims (JWT payload)
+ */
+export interface IIdTokenClaims {
+  /** Issuer (idp.global URL) */
+  iss: string;
+  /** Subject (user ID) */
+  sub: string;
+  /** Audience (client ID) */
+  aud: string;
+  /** Expiration time (Unix timestamp) */
+  exp: number;
+  /** Issued at (Unix timestamp) */
+  iat: number;
+  /** Authentication time (Unix timestamp) */
+  auth_time?: number;
+  /** Nonce (if provided in authorization request) */
+  nonce?: string;
+  /** Access token hash (for hybrid flows) */
+  at_hash?: string;
+
+  // Profile scope claims
+  name?: string;
+  preferred_username?: string;
+  picture?: string;
+
+  // Email scope claims
+  email?: string;
+  email_verified?: boolean;
+
+  // Custom claims for organizations scope
+  organizations?: IOrganizationClaim[];
+
+  // Custom claims for roles scope
+  roles?: string[];
+}
+
+/**
+ * Organization claim in ID token / userinfo
+ */
+export interface IOrganizationClaim {
+  id: string;
+  name: string;
+  slug: string;
+  roles: string[];
+}
+
+/**
+ * UserInfo endpoint response
+ */
+export interface IUserInfoResponse {
+  /** Subject (user ID) - always included */
+  sub: string;
+
+  // Profile scope
+  name?: string;
+  preferred_username?: string;
+  picture?: string;
+
+  // Email scope
+  email?: string;
+  email_verified?: boolean;
+
+  // Organizations scope (custom)
+  organizations?: IOrganizationClaim[];
+
+  // Roles scope (custom)
+  roles?: string[];
+}
+
+/**
+ * Token endpoint response
+ */
+export interface ITokenResponse {
+  access_token: string;
+  token_type: 'Bearer';
+  expires_in: number;
+  refresh_token?: string;
+  id_token?: string;
+  scope: string;
+}
+
+/**
+ * Token endpoint error response
+ */
+export interface ITokenErrorResponse {
+  error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
+  error_description?: string;
+  error_uri?: string;
+}
+
+/**
+ * Authorization request parameters
+ */
+export interface IAuthorizationRequest {
+  client_id: string;
+  redirect_uri: string;
+  response_type: 'code';
+  scope: string;
+  state: string;
+  code_challenge?: string;
+  code_challenge_method?: 'S256';
+  nonce?: string;
+  prompt?: 'none' | 'login' | 'consent';
+}
+
+/**
+ * Token request for authorization_code grant
+ */
+export interface ITokenRequestAuthCode {
+  grant_type: 'authorization_code';
+  code: string;
+  redirect_uri: string;
+  client_id: string;
+  client_secret?: string;
+  code_verifier?: string;
+}
+
+/**
+ * Token request for refresh_token grant
+ */
+export interface ITokenRequestRefresh {
+  grant_type: 'refresh_token';
+  refresh_token: string;
+  client_id: string;
+  client_secret?: string;
+  scope?: string;
+}
+
+/**
+ * Union type for token requests
+ */
+export type ITokenRequest = ITokenRequestAuthCode | ITokenRequestRefresh;

ts_interfaces/request/loint-reception.jwt.ts

@@ -1,6 +1,16 @@
 import * as data from '../data/index.js';
 import * as plugins from '../loint-reception.plugins.js';
 
+/**
+ * Request to get the public key for JWT validation.
+ *
+ * **Direction:** Client → idp.global
+ * **Requester:** Backend services that need to verify JWTs
+ * **Handler:** idp.global
+ *
+ * Use this to fetch the current public key for verifying JWT signatures.
+ * The backend token authenticates the requesting service.
+ */
 export interface IReq_GetPublicKeyForValidation
   extends plugins.typedRequestInterfaces.implementsTR<
     plugins.typedRequestInterfaces.ITypedRequest,
@@ -15,6 +25,16 @@ export interface IReq_GetPublicKeyForValidation
   };
 }
 
+/**
+ * Push public key to connected backend services for JWT validation.
+ *
+ * **Direction:** idp.global → Client
+ * **Requester:** idp.global (pushes when the JWT signing key rotates)
+ * **Handler:** Backend services - must register a TypedHandler for this method
+ *
+ * Backend services should register a handler using `IdpClient.onPublicKeyPush()`
+ * to receive key rotation updates and update their local key cache.
+ */
 export interface IReq_PushPublicKeyForValidation
   extends plugins.typedRequestInterfaces.implementsTR<
     plugins.typedRequestInterfaces.ITypedRequest,
@@ -28,7 +48,21 @@ export interface IReq_PushPublicKeyForValidation
 }
 
 /**
- * allows getting or pushing a blocklist of jwt ids
+ * Push or get JWT ID blocklist for revoked tokens.
+ *
+ * **Bidirectional:**
+ * - **GET direction:** Client → idp.global - Client requests current blocklist
+ * - **PUSH direction:** idp.global → Client - Server pushes new blocklisted IDs
+ *
+ * **For GET (client fires):**
+ * - Fire with empty/undefined `blockedJwtIds` to request the full blocklist
+ * - Response contains the complete list of blocked JWT IDs
+ * - Use `IdpClient.requests.getJwtIdBlocklist` for this direction
+ *
+ * **For PUSH (idp.global fires):**
+ * - idp.global sends newly blocklisted JWT IDs to connected clients
+ * - Clients must register a handler using `IdpClient.onBlocklistPush()`
+ * - Store received IDs locally to reject revoked tokens
  */
 export interface IReq_PushOrGetJwtIdBlocklist
   extends plugins.typedRequestInterfaces.implementsTR<

ts_interfaces/tspublish.json

@@ -0,0 +1,3 @@
+{
+  "order": 1
+}

ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/idp.global',
-  version: '1.10.0',
+  version: '1.13.0',
   description: 'An identity provider software managing user authentications, registrations, and sessions.'
 }

ts_web/tspublish.json

@@ -0,0 +1,3 @@
+{
+  "order": 4
+}