@broberg/sso 0.1.0

package/dist/index.cjs

@@ -0,0 +1,400 @@
+'use strict';
+
+var jose = require('jose');
+
+// src/config.ts
+var SsoConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SsoConfigError";
+  }
+};
+function required(env, name, hint) {
+  const raw = env[name];
+  if (typeof raw !== "string" || raw.trim() === "") {
+    throw new SsoConfigError(`${name} is not set (or is blank). ${hint}`);
+  }
+  return raw.trim();
+}
+var DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 7;
+function loadSsoConfig(env = process.env) {
+  const rawIssuer = required(
+    env,
+    "BID_ISSUER",
+    "It is Broberg ID's bare origin, e.g. https://id.broberg.ai"
+  );
+  let issuer;
+  try {
+    const url = new URL(rawIssuer);
+    if (url.protocol !== "https:" && url.hostname !== "localhost") {
+      throw new SsoConfigError(
+        `BID_ISSUER must be https (got ${url.protocol}//). Only localhost may be http.`
+      );
+    }
+    issuer = url.origin;
+  } catch (err) {
+    if (err instanceof SsoConfigError) throw err;
+    throw new SsoConfigError(`BID_ISSUER is not a valid URL: ${rawIssuer}`);
+  }
+  const cookieSecret = required(
+    env,
+    "SSO_COOKIE_SECRET",
+    "Generate one with `openssl rand -hex 32`. It signs this app's session cookie."
+  );
+  if (cookieSecret.length < 32) {
+    throw new SsoConfigError(
+      `SSO_COOKIE_SECRET is ${cookieSecret.length} characters; it must be at least 32. A short secret is a forgeable session, and a forged session is any user you like.`
+    );
+  }
+  const rawMaxAge = env.SSO_SESSION_MAX_AGE?.trim();
+  let sessionMaxAge = DEFAULT_SESSION_MAX_AGE;
+  if (rawMaxAge) {
+    const n = Number(rawMaxAge);
+    if (!Number.isFinite(n) || n <= 0) {
+      throw new SsoConfigError(
+        `SSO_SESSION_MAX_AGE must be a positive number of seconds (got ${JSON.stringify(rawMaxAge)}).`
+      );
+    }
+    sessionMaxAge = Math.floor(n);
+  }
+  return {
+    issuer,
+    clientId: required(env, "SSO_CLIENT_ID", "The id this app is registered under in Broberg ID."),
+    redirectUri: required(
+      env,
+      "SSO_REDIRECT_URI",
+      "Must match the registered redirect EXACTLY \u2014 one trailing slash is a different address."
+    ),
+    scopes: (env.SSO_SCOPES?.trim() || "openid profile email").split(/\s+/),
+    cookieSecret,
+    cookieName: env.SSO_COOKIE_NAME?.trim() || "bid_session",
+    sessionMaxAge,
+    postLogoutRedirectUri: env.SSO_POST_LOGOUT_REDIRECT_URI?.trim() || void 0
+  };
+}
+var JwksError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JwksError";
+  }
+};
+function createJwksCache(options) {
+  const {
+    jwksUri,
+    minRefetchIntervalMs = 1e4,
+    fetchImpl = fetch,
+    now = () => Date.now()
+  } = options;
+  let keys = [];
+  let lastFetchAt = -Infinity;
+  let fetchCount = 0;
+  let inFlight = null;
+  async function refresh() {
+    if (inFlight) return inFlight;
+    inFlight = (async () => {
+      const res = await fetchImpl(jwksUri);
+      if (!res.ok) {
+        throw new JwksError(`${jwksUri} answered ${res.status} \u2014 cannot verify any token`);
+      }
+      const body = await res.json();
+      if (!Array.isArray(body.keys)) {
+        throw new JwksError(`${jwksUri} returned no "keys" array`);
+      }
+      keys = body.keys;
+      lastFetchAt = now();
+      fetchCount++;
+    })().finally(() => {
+      inFlight = null;
+    });
+    return inFlight;
+  }
+  return {
+    get fetchCount() {
+      return fetchCount;
+    },
+    async getKey(kid, alg) {
+      let jwk = keys.find((k) => k.kid === kid);
+      if (!jwk) {
+        const sinceLast = now() - lastFetchAt;
+        if (sinceLast < minRefetchIntervalMs) {
+          throw new JwksError(
+            `no signing key with kid ${kid}, and the key set was refreshed ${sinceLast}ms ago (floor is ${minRefetchIntervalMs}ms). Refusing to refetch \u2014 retry shortly.`
+          );
+        }
+        await refresh();
+        jwk = keys.find((k) => k.kid === kid);
+      }
+      if (!jwk) {
+        throw new JwksError(
+          `Broberg ID does not publish a signing key with kid ${kid}. The token was not signed by this issuer.`
+        );
+      }
+      return jose.importJWK(jwk, alg);
+    }
+  };
+}
+
+// src/client.ts
+var SsoError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SsoError";
+  }
+};
+var b64url = (bytes) => {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let s = "";
+  for (const b of view) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var randomToken = (bytes = 32) => b64url(crypto.getRandomValues(new Uint8Array(bytes)));
+async function challengeFor(verifier) {
+  return b64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
+}
+function createSsoClient(config, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  let discoveryPromise = null;
+  let jwksCache = null;
+  async function discovery() {
+    discoveryPromise ??= (async () => {
+      const url = `${config.issuer}/.well-known/openid-configuration`;
+      const res = await fetchImpl(url);
+      if (!res.ok) throw new SsoError(`${url} answered ${res.status}`);
+      const doc = await res.json();
+      if (doc.issuer !== config.issuer) {
+        throw new SsoError(
+          `BID_ISSUER is ${config.issuer} but ${url} says its issuer is ${doc.issuer}. These must match exactly \u2014 tokens are validated against the issuer string.`
+        );
+      }
+      return doc;
+    })().catch((err) => {
+      discoveryPromise = null;
+      throw err;
+    });
+    return discoveryPromise;
+  }
+  async function keys() {
+    if (!jwksCache) {
+      const { jwks_uri } = await discovery();
+      jwksCache = createJwksCache({
+        jwksUri: jwks_uri,
+        fetchImpl,
+        ...options.minRefetchIntervalMs !== void 0 ? { minRefetchIntervalMs: options.minRefetchIntervalMs } : {}
+      });
+    }
+    return jwksCache;
+  }
+  async function verifyIdToken(idToken, opts = {}) {
+    const cache = await keys();
+    const header = jose.decodeProtectedHeader(idToken);
+    if (!header.kid) throw new SsoError("ID token has no kid \u2014 cannot pick a signing key");
+    const { payload } = await jose.jwtVerify(
+      idToken,
+      async () => cache.getKey(header.kid, header.alg ?? "RS256"),
+      { issuer: config.issuer, audience: config.clientId }
+    );
+    if (opts.nonce !== void 0 && payload.nonce !== opts.nonce) {
+      throw new SsoError(
+        "ID token nonce does not match this login request \u2014 refusing a token minted for another sign-in."
+      );
+    }
+    if (typeof payload.sub !== "string" || payload.sub === "") {
+      throw new SsoError("ID token has no sub \u2014 there is no user to be");
+    }
+    return payload;
+  }
+  async function withUserInfo(claims, accessToken) {
+    const doc = await discovery();
+    if (!doc.userinfo_endpoint) return claims;
+    const res = await fetchImpl(doc.userinfo_endpoint, {
+      headers: { authorization: `Bearer ${accessToken}` }
+    });
+    if (!res.ok) return claims;
+    const info = await res.json();
+    if (info.sub !== claims.sub) {
+      throw new SsoError(
+        `userinfo describes ${String(info.sub)} but the ID token is for ${claims.sub} \u2014 refusing to merge another user's profile onto this session.`
+      );
+    }
+    return { ...claims, ...info, sub: claims.sub };
+  }
+  return {
+    discovery,
+    get jwks() {
+      if (!jwksCache) throw new SsoError("the key cache is created on first verification");
+      return jwksCache;
+    },
+    verifyIdToken,
+    async beginLogin(opts = {}) {
+      const { authorization_endpoint } = await discovery();
+      const codeVerifier = randomToken();
+      const state = randomToken(16);
+      const nonce = randomToken(16);
+      const params = new URLSearchParams({
+        response_type: "code",
+        client_id: config.clientId,
+        redirect_uri: config.redirectUri,
+        scope: [.../* @__PURE__ */ new Set([...config.scopes, ...opts.scopes ?? []])].join(" "),
+        state,
+        nonce,
+        code_challenge: await challengeFor(codeVerifier),
+        code_challenge_method: "S256"
+      });
+      if (opts.prompt) params.set("prompt", opts.prompt);
+      return { url: `${authorization_endpoint}?${params}`, state, codeVerifier, nonce };
+    },
+    async completeLogin({ params, state, codeVerifier, nonce }) {
+      const error = params.get("error");
+      if (error) {
+        throw new SsoError(
+          `Broberg ID refused this login: ${error}` + (params.get("error_description") ? ` \u2014 ${params.get("error_description")}` : "")
+        );
+      }
+      const returned = params.get("state");
+      if (!returned || returned !== state) {
+        throw new SsoError(
+          "state does not match the login this browser started \u2014 refusing the callback."
+        );
+      }
+      const code = params.get("code");
+      if (!code) throw new SsoError("callback carried neither an error nor a code");
+      const { token_endpoint } = await discovery();
+      const res = await fetchImpl(token_endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: config.redirectUri,
+          client_id: config.clientId,
+          code_verifier: codeVerifier
+        })
+      });
+      const body = await res.json();
+      if (!res.ok || !body.id_token) {
+        throw new SsoError(
+          `token exchange failed (${res.status}): ${body.error ?? "no id_token in response"}` + (body.error_description ? ` \u2014 ${body.error_description}` : "")
+        );
+      }
+      const claims = await verifyIdToken(body.id_token, { nonce });
+      return {
+        claims: body.access_token ? await withUserInfo(claims, body.access_token) : claims,
+        idToken: body.id_token,
+        ...body.access_token ? { accessToken: body.access_token } : {},
+        ...body.refresh_token ? { refreshToken: body.refresh_token } : {}
+      };
+    },
+    async logoutUrl(opts = {}) {
+      const doc = await discovery();
+      if (!doc.end_session_endpoint) {
+        throw new SsoError(
+          `${config.issuer} does not advertise end_session_endpoint \u2014 central logout is unavailable.`
+        );
+      }
+      const params = new URLSearchParams();
+      if (opts.idTokenHint) params.set("id_token_hint", opts.idTokenHint);
+      const post = opts.postLogoutRedirectUri ?? config.postLogoutRedirectUri;
+      if (post) params.set("post_logout_redirect_uri", post);
+      params.set("client_id", config.clientId);
+      return `${doc.end_session_endpoint}?${params}`;
+    }
+  };
+}
+
+// src/session.ts
+var enc = new TextEncoder();
+var b64url2 = (bytes) => {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var fromB64url = (s) => {
+  const pad = s.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(pad + "=".repeat((4 - pad.length % 4) % 4));
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+};
+async function hmacKey(secret) {
+  return crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign",
+    "verify"
+  ]);
+}
+async function signValue(value, secret) {
+  const body = b64url2(enc.encode(value));
+  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", await hmacKey(secret), enc.encode(body)));
+  return `${body}.${b64url2(sig)}`;
+}
+async function verifyValue(token, secret) {
+  if (!token) return null;
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const body = token.slice(0, dot);
+  try {
+    const ok = await crypto.subtle.verify(
+      "HMAC",
+      await hmacKey(secret),
+      fromB64url(token.slice(dot + 1)),
+      enc.encode(body)
+    );
+    if (!ok) return null;
+    return new TextDecoder().decode(fromB64url(body));
+  } catch {
+    return null;
+  }
+}
+async function signSession(payload, secret) {
+  return signValue(JSON.stringify(payload), secret);
+}
+async function verifySession(token, secret, now = Date.now) {
+  const body = await verifyValue(token, secret);
+  if (body === null) return null;
+  try {
+    const payload = JSON.parse(body);
+    if (typeof payload.sub !== "string" || payload.sub === "") return null;
+    if (typeof payload.exp !== "number" || payload.exp * 1e3 <= now()) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function cookieHeader(name, value, opts) {
+  const parts = [
+    `${name}=${value}`,
+    `Path=${opts.path ?? "/"}`,
+    `Max-Age=${opts.maxAge}`,
+    "HttpOnly",
+    // Lax, NOT Strict, and this is load-bearing: the callback from Broberg ID
+    // is a top-level GET navigation from another site. Strict withholds the
+    // cookie on exactly that navigation, so the login transaction cookie would
+    // be missing when it is needed and every sign-in would fail with "state
+    // does not match" — a message that sends you looking in the wrong place.
+    `SameSite=${opts.sameSite ?? "Lax"}`
+  ];
+  if (opts.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+function readCookie(header, name) {
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
+  }
+  return void 0;
+}
+
+exports.DEFAULT_SESSION_MAX_AGE = DEFAULT_SESSION_MAX_AGE;
+exports.JwksError = JwksError;
+exports.SsoConfigError = SsoConfigError;
+exports.SsoError = SsoError;
+exports.cookieHeader = cookieHeader;
+exports.createJwksCache = createJwksCache;
+exports.createSsoClient = createSsoClient;
+exports.loadSsoConfig = loadSsoConfig;
+exports.readCookie = readCookie;
+exports.signSession = signSession;
+exports.signValue = signValue;
+exports.verifySession = verifySession;
+exports.verifyValue = verifyValue;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts","../src/jwks.ts","../src/client.ts","../src/session.ts"],"names":["importJWK","decodeProtectedHeader","jwtVerify","b64url"],"mappings":";;;;;AASO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EACxC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AAAA,EACd;AACF;AAmCA,SAAS,QAAA,CAAS,GAAA,EAAwB,IAAA,EAAc,IAAA,EAAsB;AAC5E,EAAA,MAAM,GAAA,GAAM,IAAI,IAAI,CAAA;AACpB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,IAAA,OAAW,EAAA,EAAI;AAChD,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,EAAG,IAAI,CAAA,2BAAA,EAA8B,IAAI,CAAA,CAAE,CAAA;AAAA,EACtE;AACA,EAAA,OAAO,IAAI,IAAA,EAAK;AAClB;AAGO,IAAM,uBAAA,GAA0B,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK;AAE/C,SAAS,aAAA,CAAc,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAgB;AAC7E,EAAA,MAAM,SAAA,GAAY,QAAA;AAAA,IAChB,GAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,SAAS,CAAA;AAC7B,IAAA,IAAI,GAAA,CAAI,QAAA,KAAa,QAAA,IAAY,GAAA,CAAI,aAAa,WAAA,EAAa;AAC7D,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,CAAA,8BAAA,EAAiC,IAAI,QAAQ,CAAA,gCAAA;AAAA,OAC/C;AAAA,IACF;AAIA,IAAA,MAAA,GAAS,GAAA,CAAI,MAAA;AAAA,EACf,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,gBAAgB,MAAM,GAAA;AACzC,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,+BAAA,EAAkC,SAAS,CAAA,CAAE,CAAA;AAAA,EACxE;AAEA,EAAA,MAAM,YAAA,GAAe,QAAA;AAAA,IACnB,GAAA;AAAA,IACA,mBAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,YAAA,CAAa,SAAS,EAAA,EAAI;AAC5B,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,CAAA,qBAAA,EAAwB,aAAa,MAAM,CAAA,sHAAA;AAAA,KAE7C;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,mBAAA,EAAqB,IAAA,EAAK;AAChD,EAAA,IAAI,aAAA,GAAgB,uBAAA;AACpB,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,MAAM,CAAA,GAAI,OAAO,SAAS,CAAA;AAI1B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,IAAK,KAAK,CAAA,EAAG;AACjC,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,CAAA,8DAAA,EAAiE,IAAA,CAAK,SAAA,CAAU,SAAS,CAAC,CAAA,EAAA;AAAA,OAC5F;AAAA,IACF;AACA,IAAA,aAAA,GAAgB,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,EAC9B;AAEA,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,QAAA,EAAU,QAAA,CAAS,GAAA,EAAK,eAAA,EAAiB,oDAAoD,CAAA;AAAA,IAC7F,WAAA,EAAa,QAAA;AAAA,MACX,GAAA;AAAA,MACA,kBAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,SAAS,GAAA,CAAI,UAAA,EAAY,MAAK,IAAK,sBAAA,EAAwB,MAAM,KAAK,CAAA;AAAA,IACtE,YAAA;AAAA,IACA,UAAA,EAAY,GAAA,CAAI,eAAA,EAAiB,IAAA,EAAK,IAAK,aAAA;AAAA,IAC3C,aAAA;AAAA,IACA,qBAAA,EAAuB,GAAA,CAAI,4BAAA,EAA8B,IAAA,EAAK,IAAK;AAAA,GACrE;AACF;AC3EO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACnC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AAAA,EACd;AACF;AAEO,SAAS,gBAAgB,OAAA,EAAsC;AACpE,EAAA,MAAM;AAAA,IACJ,OAAA;AAAA,IACA,oBAAA,GAAuB,GAAA;AAAA,IACvB,SAAA,GAAY,KAAA;AAAA,IACZ,GAAA,GAAM,MAAM,IAAA,CAAK,GAAA;AAAI,GACvB,GAAI,OAAA;AAEJ,EAAA,IAAI,OAAc,EAAC;AACnB,EAAA,IAAI,WAAA,GAAc,CAAA,QAAA;AAClB,EAAA,IAAI,UAAA,GAAa,CAAA;AAEjB,EAAA,IAAI,QAAA,GAAiC,IAAA;AAErC,EAAA,eAAe,OAAA,GAAyB;AACtC,IAAA,IAAI,UAAU,OAAO,QAAA;AACrB,IAAA,QAAA,GAAA,CAAY,YAAY;AACtB,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,OAAO,CAAA;AACnC,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,SAAA,CAAU,CAAA,EAAG,OAAO,CAAA,UAAA,EAAa,GAAA,CAAI,MAAM,CAAA,+BAAA,CAA4B,CAAA;AAAA,MACnF;AACA,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,QAAA,MAAM,IAAI,SAAA,CAAU,CAAA,EAAG,OAAO,CAAA,yBAAA,CAA2B,CAAA;AAAA,MAC3D;AAGA,MAAA,IAAA,GAAO,IAAA,CAAK,IAAA;AACZ,MAAA,WAAA,GAAc,GAAA,EAAI;AAClB,MAAA,UAAA,EAAA;AAAA,IACF,CAAA,GAAG,CAAE,OAAA,CAAQ,MAAM;AACjB,MAAA,QAAA,GAAW,IAAA;AAAA,IACb,CAAC,CAAA;AACD,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,IAAI,UAAA,GAAa;AACf,MAAA,OAAO,UAAA;AAAA,IACT,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,GAAA,EAAa,GAAA,EAAa;AACrC,MAAA,IAAI,MAAM,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AAExC,MAAA,IAAI,CAAC,GAAA,EAAK;AACR,QAAA,MAAM,SAAA,GAAY,KAAI,GAAI,WAAA;AAC1B,QAAA,IAAI,YAAY,oBAAA,EAAsB;AACpC,UAAA,MAAM,IAAI,SAAA;AAAA,YACR,CAAA,wBAAA,EAA2B,GAAG,CAAA,gCAAA,EAAmC,SAAS,oBAC3D,oBAAoB,CAAA,8CAAA;AAAA,WACrC;AAAA,QACF;AACA,QAAA,MAAM,OAAA,EAAQ;AACd,QAAA,GAAA,GAAM,KAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AAAA,MACtC;AAEA,MAAA,IAAI,CAAC,GAAA,EAAK;AACR,QAAA,MAAM,IAAI,SAAA;AAAA,UACR,sDAAsD,GAAG,CAAA,0CAAA;AAAA,SAE3D;AAAA,MACF;AACA,MAAA,OAAOA,cAAA,CAAU,KAAK,GAAG,CAAA;AAAA,IAC3B;AAAA,GACF;AACF;;;ACpFO,IAAM,QAAA,GAAN,cAAuB,KAAA,CAAM;AAAA,EAClC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,UAAA;AAAA,EACd;AACF;AAIA,IAAM,MAAA,GAAS,CAAC,KAAA,KAAoC;AAClD,EAAA,MAAM,OAAO,KAAA,YAAiB,UAAA,GAAa,KAAA,GAAQ,IAAI,WAAW,KAAK,CAAA;AACvE,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,MAAW,CAAA,IAAK,IAAA,EAAM,CAAA,IAAK,MAAA,CAAO,aAAa,CAAC,CAAA;AAChD,EAAA,OAAO,IAAA,CAAK,CAAC,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC1E,CAAA;AAEA,IAAM,WAAA,GAAc,CAAC,KAAA,GAAQ,EAAA,KAAO,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,KAAK,CAAC,CAAC,CAAA;AAExF,eAAe,aAAa,QAAA,EAAmC;AAC7D,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAC,CAAA;AACzF;AAuEO,SAAS,eAAA,CACd,MAAA,EACA,OAAA,GAAkC,EAAC,EACxB;AACX,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,KAAA;AACvC,EAAA,IAAI,gBAAA,GAA8C,IAAA;AAClD,EAAA,IAAI,SAAA,GAA8B,IAAA;AAElC,EAAA,eAAe,SAAA,GAAgC;AAC7C,IAAA,gBAAA,KAAA,CAAsB,YAAY;AAChC,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,iCAAA,CAAA;AAC5B,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAG,CAAA;AAC/B,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA,UAAA,EAAa,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAC/D,MAAA,MAAM,GAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAO5B,MAAA,IAAI,GAAA,CAAI,MAAA,KAAW,MAAA,CAAO,MAAA,EAAQ;AAChC,QAAA,MAAM,IAAI,QAAA;AAAA,UACR,iBAAiB,MAAA,CAAO,MAAM,QAAQ,GAAG,CAAA,oBAAA,EAAuB,IAAI,MAAM,CAAA,iFAAA;AAAA,SAE5E;AAAA,MACF;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA,GAAG,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAClB,MAAA,gBAAA,GAAmB,IAAA;AACnB,MAAA,MAAM,GAAA;AAAA,IACR,CAAC,CAAA;AACD,IAAA,OAAO,gBAAA;AAAA,EACT;AAEA,EAAA,eAAe,IAAA,GAA2B;AACxC,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,SAAA,EAAU;AACrC,MAAA,SAAA,GAAY,eAAA,CAAgB;AAAA,QAC1B,OAAA,EAAS,QAAA;AAAA,QACT,SAAA;AAAA,QACA,GAAI,QAAQ,oBAAA,KAAyB,MAAA,GACjC,EAAE,oBAAA,EAAsB,OAAA,CAAQ,oBAAA,EAAqB,GACrD;AAAC,OACN,CAAA;AAAA,IACH;AACA,IAAA,OAAO,SAAA;AAAA,EACT;AAEA,EAAA,eAAe,aAAA,CAAc,OAAA,EAAiB,IAAA,GAA2B,EAAC,EAAG;AAC3E,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,EAAK;AACzB,IAAA,MAAM,MAAA,GAASC,2BAAsB,OAAO,CAAA;AAC5C,IAAA,IAAI,CAAC,MAAA,CAAO,GAAA,EAAK,MAAM,IAAI,SAAS,sDAAiD,CAAA;AAErF,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA;AAAA,MACxB,OAAA;AAAA,MACA,YAAY,KAAA,CAAM,MAAA,CAAO,OAAO,GAAA,EAAM,MAAA,CAAO,OAAO,OAAO,CAAA;AAAA,MAC3D,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,QAAA,EAAU,OAAO,QAAA;AAAS,KACrD;AAEA,IAAA,IAAI,KAAK,KAAA,KAAU,MAAA,IAAa,OAAA,CAAQ,KAAA,KAAU,KAAK,KAAA,EAAO;AAC5D,MAAA,MAAM,IAAI,QAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IAAY,OAAA,CAAQ,QAAQ,EAAA,EAAI;AACzD,MAAA,MAAM,IAAI,SAAS,mDAA8C,CAAA;AAAA,IACnE;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAyBA,EAAA,eAAe,YAAA,CAAa,QAAmB,WAAA,EAAyC;AACtF,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,EAAU;AAC5B,IAAA,IAAI,CAAC,GAAA,CAAI,iBAAA,EAAmB,OAAO,MAAA;AAEnC,IAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,GAAA,CAAI,iBAAA,EAAmB;AAAA,MACjD,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA;AAAG,KACnD,CAAA;AAID,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,OAAO,MAAA;AAEpB,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,IAAA,IAAI,IAAA,CAAK,GAAA,KAAQ,MAAA,CAAO,GAAA,EAAK;AAC3B,MAAA,MAAM,IAAI,QAAA;AAAA,QACR,sBAAsB,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA,yBAAA,EAA4B,OAAO,GAAG,CAAA,mEAAA;AAAA,OAE9E;AAAA,IACF;AACA,IAAA,OAAO,EAAE,GAAG,MAAA,EAAQ,GAAG,IAAA,EAAM,GAAA,EAAK,OAAO,GAAA,EAAI;AAAA,EAC/C;AAEA,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,IAAI,IAAA,GAAO;AACT,MAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,SAAS,gDAAgD,CAAA;AACnF,MAAA,OAAO,SAAA;AAAA,IACT,CAAA;AAAA,IACA,aAAA;AAAA,IAEA,MAAM,UAAA,CAAW,IAAA,GAA0B,EAAC,EAAwB;AAClE,MAAA,MAAM,EAAE,sBAAA,EAAuB,GAAI,MAAM,SAAA,EAAU;AACnD,MAAA,MAAM,eAAe,WAAA,EAAY;AACjC,MAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAC5B,MAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,QACjC,aAAA,EAAe,MAAA;AAAA,QACf,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,cAAc,MAAA,CAAO,WAAA;AAAA,QACrB,OAAO,CAAC,uBAAO,GAAA,CAAI,CAAC,GAAG,MAAA,CAAO,MAAA,EAAQ,GAAI,IAAA,CAAK,UAAU,EAAG,CAAC,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AAAA,QACxE,KAAA;AAAA,QACA,KAAA;AAAA,QACA,cAAA,EAAgB,MAAM,YAAA,CAAa,YAAY,CAAA;AAAA,QAC/C,qBAAA,EAAuB;AAAA,OACxB,CAAA;AACD,MAAA,IAAI,KAAK,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,KAAK,MAAM,CAAA;AAEjD,MAAA,OAAO,EAAE,KAAK,CAAA,EAAG,sBAAsB,IAAI,MAAM,CAAA,CAAA,EAAI,KAAA,EAAO,YAAA,EAAc,KAAA,EAAM;AAAA,IAClF,CAAA;AAAA,IAEA,MAAM,aAAA,CAAc,EAAE,QAAQ,KAAA,EAAO,YAAA,EAAc,OAAM,EAAG;AAK1D,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,MAAM,IAAI,QAAA;AAAA,UACR,CAAA,+BAAA,EAAkC,KAAK,CAAA,CAAA,IACpC,MAAA,CAAO,GAAA,CAAI,mBAAmB,CAAA,GAAI,CAAA,QAAA,EAAM,MAAA,CAAO,GAAA,CAAI,mBAAmB,CAAC,CAAA,CAAA,GAAK,EAAA;AAAA,SACjF;AAAA,MACF;AAEA,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AACnC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,KAAa,KAAA,EAAO;AACnC,QAAA,MAAM,IAAI,QAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,MAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,SAAS,8CAA8C,CAAA;AAE5E,MAAA,MAAM,EAAE,cAAA,EAAe,GAAI,MAAM,SAAA,EAAU;AAC3C,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,cAAA,EAAgB;AAAA,QAC1C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,QAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,UAAA,EAAY,oBAAA;AAAA,UACZ,IAAA;AAAA,UACA,cAAc,MAAA,CAAO,WAAA;AAAA,UACrB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAA,EAAe;AAAA,SAChB;AAAA,OACF,CAAA;AAED,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAO7B,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,CAAC,KAAK,QAAA,EAAU;AAC7B,QAAA,MAAM,IAAI,QAAA;AAAA,UACR,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAM,CAAA,GAAA,EAAM,IAAA,CAAK,KAAA,IAAS,yBAAyB,CAAA,CAAA,IAC9E,IAAA,CAAK,iBAAA,GAAoB,CAAA,QAAA,EAAM,IAAA,CAAK,iBAAiB,CAAA,CAAA,GAAK,EAAA;AAAA,SAC/D;AAAA,MACF;AAEA,MAAA,MAAM,SAAS,MAAM,aAAA,CAAc,KAAK,QAAA,EAAU,EAAE,OAAO,CAAA;AAE3D,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,KAAK,YAAA,GAAe,MAAM,aAAa,MAAA,EAAQ,IAAA,CAAK,YAAY,CAAA,GAAI,MAAA;AAAA,QAC5E,SAAS,IAAA,CAAK,QAAA;AAAA,QACd,GAAI,KAAK,YAAA,GAAe,EAAE,aAAa,IAAA,CAAK,YAAA,KAAiB,EAAC;AAAA,QAC9D,GAAI,KAAK,aAAA,GAAgB,EAAE,cAAc,IAAA,CAAK,aAAA,KAAkB;AAAC,OACnE;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,SAAA,CAAU,IAAA,GAAO,EAAC,EAAG;AACzB,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,EAAU;AAC5B,MAAA,IAAI,CAAC,IAAI,oBAAA,EAAsB;AAC7B,QAAA,MAAM,IAAI,QAAA;AAAA,UACR,CAAA,EAAG,OAAO,MAAM,CAAA,8EAAA;AAAA,SAClB;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,MAAA,IAAI,KAAK,WAAA,EAAa,MAAA,CAAO,GAAA,CAAI,eAAA,EAAiB,KAAK,WAAW,CAAA;AAClE,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,qBAAA,IAAyB,MAAA,CAAO,qBAAA;AAClD,MAAA,IAAI,IAAA,EAAM,MAAA,CAAO,GAAA,CAAI,0BAAA,EAA4B,IAAI,CAAA;AACrD,MAAA,MAAA,CAAO,GAAA,CAAI,WAAA,EAAa,MAAA,CAAO,QAAQ,CAAA;AACvC,MAAA,OAAO,CAAA,EAAG,GAAA,CAAI,oBAAoB,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAAA,IAC9C;AAAA,GACF;AACF;;;ACnUA,IAAM,GAAA,GAAM,IAAI,WAAA,EAAY;AAE5B,IAAMC,OAAAA,GAAS,CAAC,KAAA,KAAsB;AACpC,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,CAAA,IAAK,MAAA,CAAO,aAAa,CAAC,CAAA;AACjD,EAAA,OAAO,IAAA,CAAK,CAAC,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC1E,CAAA;AAEA,IAAM,UAAA,GAAa,CAAC,CAAA,KAAc;AAChC,EAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,GAAM,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,GAAA,CAAI,MAAA,GAAS,CAAA,IAAM,CAAC,CAAC,CAAA;AAC7D,EAAA,OAAO,UAAA,CAAW,KAAK,GAAA,EAAK,CAAC,MAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AACpD,CAAA;AAEA,eAAe,QAAQ,MAAA,EAAgB;AACrC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,IAAI,MAAA,CAAO,MAAM,CAAA,EAAG,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,IAAa,KAAA,EAAO;AAAA,IAClG,MAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAcA,eAAsB,SAAA,CAAU,OAAe,MAAA,EAAiC;AAC9E,EAAA,MAAM,IAAA,GAAOA,OAAAA,CAAO,GAAA,CAAI,MAAA,CAAO,KAAK,CAAC,CAAA;AACrC,EAAA,MAAM,MAAM,IAAI,UAAA,CAAW,MAAM,MAAA,CAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,MAAM,OAAA,CAAQ,MAAM,CAAA,EAAG,GAAA,CAAI,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AACpG,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAIA,OAAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAC/B;AAGA,eAAsB,WAAA,CACpB,OACA,MAAA,EACwB;AACxB,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,WAAA,CAAY,GAAG,CAAA;AACjC,EAAA,IAAI,GAAA,IAAO,GAAG,OAAO,IAAA;AACrB,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA;AAC/B,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAK,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,MAC7B,MAAA;AAAA,MACA,MAAM,QAAQ,MAAM,CAAA;AAAA,MACpB,UAAA,CAAW,KAAA,CAAM,KAAA,CAAM,GAAA,GAAM,CAAC,CAAC,CAAA;AAAA,MAC/B,GAAA,CAAI,OAAO,IAAI;AAAA,KACjB;AACA,IAAA,IAAI,CAAC,IAAI,OAAO,IAAA;AAChB,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAA,CAAW,IAAI,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,eAAsB,WAAA,CAAY,SAAyB,MAAA,EAAiC;AAC1F,EAAA,OAAO,SAAA,CAAU,IAAA,CAAK,SAAA,CAAU,OAAO,GAAG,MAAM,CAAA;AAClD;AAWA,eAAsB,aAAA,CACpB,KAAA,EACA,MAAA,EACA,GAAA,GAAoB,KAAK,GAAA,EACO;AAGhC,EAAA,MAAM,IAAA,GAAO,MAAM,WAAA,CAAY,KAAA,EAAO,MAAM,CAAA;AAC5C,EAAA,IAAI,IAAA,KAAS,MAAM,OAAO,IAAA;AAE1B,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC/B,IAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,YAAY,OAAA,CAAQ,GAAA,KAAQ,IAAI,OAAO,IAAA;AAClE,IAAA,IAAI,OAAO,QAAQ,GAAA,KAAQ,QAAA,IAAY,QAAQ,GAAA,GAAM,GAAA,IAAQ,GAAA,EAAI,EAAG,OAAO,IAAA;AAC3E,IAAA,OAAO,OAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,SAAS,YAAA,CACd,IAAA,EACA,KAAA,EACA,IAAA,EACQ;AACR,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA;AAAA,IAChB,CAAA,KAAA,EAAQ,IAAA,CAAK,IAAA,IAAQ,GAAG,CAAA,CAAA;AAAA,IACxB,CAAA,QAAA,EAAW,KAAK,MAAM,CAAA,CAAA;AAAA,IACtB,UAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,CAAA,SAAA,EAAY,IAAA,CAAK,QAAA,IAAY,KAAK,CAAA;AAAA,GACpC;AACA,EAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AACpC,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEO,SAAS,UAAA,CAAW,QAAmC,IAAA,EAAkC;AAC9F,EAAA,IAAI,CAAC,QAAQ,OAAO,MAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,IAAI,OAAO,EAAA,EAAI;AACf,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,IAAA,EAAK,KAAM,IAAA,EAAM,OAAO,IAAA,CAAK,KAAA,CAAM,EAAA,GAAK,CAAC,EAAE,IAAA,EAAK;AAAA,EACxE;AACA,EAAA,OAAO,MAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * Configuration, read from the environment and nowhere else (F084.4 AC#5).\n *\n * An app mounts this package and sets env vars. It does not pass options in\n * code, because the moment configuration lives in code, two deployments of the\n * same app can disagree about who their identity provider is — and the symptom\n * is a token rejection nobody can trace back to a config line.\n */\n\nexport class SsoConfigError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"SsoConfigError\";\n  }\n}\n\nexport interface SsoConfig {\n  /** Broberg ID's origin, e.g. https://id.broberg.ai — the BARE origin. */\n  issuer: string;\n  /** The client id this app was registered under (administratively, in BID). */\n  clientId: string;\n  /** Exactly the redirect registered in BID. Exact match — one character decides. */\n  redirectUri: string;\n  /** Requested scopes. */\n  scopes: string[];\n  /** Signs the local session cookie. 32+ bytes of randomness. */\n  cookieSecret: string;\n  /** Local session cookie name. */\n  cookieName: string;\n  /**\n   * How long this app trusts its OWN session, in seconds.\n   *\n   * F084.7 decided the fleet's numbers: 7 days for a normal app, and 12 hours\n   * + 30 minutes of inactivity for anything holding personal or health data.\n   * The default here is the 7 days. An app handling patient data MUST set\n   * SSO_SESSION_MAX_AGE=43200 — the default is a normal-app default, not a\n   * safe-for-everything one.\n   */\n  sessionMaxAge: number;\n  /** Where to send the browser after a logout completes. */\n  postLogoutRedirectUri?: string;\n}\n\n/**\n * NOT `!value`. A blank string is falsy in JavaScript, so the obvious guard\n * lets `SSO_COOKIE_SECRET=\"   \"` boot an app whose sessions are signed with\n * whitespace. This fleet has measured that exact defect before (components\n * F004.7), which is why it is a trim-and-compare rather than a truthiness test.\n */\nfunction required(env: NodeJS.ProcessEnv, name: string, hint: string): string {\n  const raw = env[name];\n  if (typeof raw !== \"string\" || raw.trim() === \"\") {\n    throw new SsoConfigError(`${name} is not set (or is blank). ${hint}`);\n  }\n  return raw.trim();\n}\n\n/** Seconds in a week — the fleet default from F084.7. */\nexport const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 7;\n\nexport function loadSsoConfig(env: NodeJS.ProcessEnv = process.env): SsoConfig {\n  const rawIssuer = required(\n    env,\n    \"BID_ISSUER\",\n    \"It is Broberg ID's bare origin, e.g. https://id.broberg.ai\",\n  );\n\n  let issuer: string;\n  try {\n    const url = new URL(rawIssuer);\n    if (url.protocol !== \"https:\" && url.hostname !== \"localhost\") {\n      throw new SsoConfigError(\n        `BID_ISSUER must be https (got ${url.protocol}//). Only localhost may be http.`,\n      );\n    }\n    // Normalised to the origin: a trailing slash makes it a DIFFERENT issuer to\n    // a strict OIDC client, and the mismatch surfaces as an opaque token\n    // rejection rather than as a configuration error anyone can read.\n    issuer = url.origin;\n  } catch (err) {\n    if (err instanceof SsoConfigError) throw err;\n    throw new SsoConfigError(`BID_ISSUER is not a valid URL: ${rawIssuer}`);\n  }\n\n  const cookieSecret = required(\n    env,\n    \"SSO_COOKIE_SECRET\",\n    \"Generate one with `openssl rand -hex 32`. It signs this app's session cookie.\",\n  );\n  if (cookieSecret.length < 32) {\n    throw new SsoConfigError(\n      `SSO_COOKIE_SECRET is ${cookieSecret.length} characters; it must be at least 32. ` +\n        \"A short secret is a forgeable session, and a forged session is any user you like.\",\n    );\n  }\n\n  const rawMaxAge = env.SSO_SESSION_MAX_AGE?.trim();\n  let sessionMaxAge = DEFAULT_SESSION_MAX_AGE;\n  if (rawMaxAge) {\n    const n = Number(rawMaxAge);\n    // A non-number here would silently become NaN and then a cookie that\n    // expires immediately — an app that cannot keep anyone logged in, with no\n    // error anywhere. Refuse instead.\n    if (!Number.isFinite(n) || n <= 0) {\n      throw new SsoConfigError(\n        `SSO_SESSION_MAX_AGE must be a positive number of seconds (got ${JSON.stringify(rawMaxAge)}).`,\n      );\n    }\n    sessionMaxAge = Math.floor(n);\n  }\n\n  return {\n    issuer,\n    clientId: required(env, \"SSO_CLIENT_ID\", \"The id this app is registered under in Broberg ID.\"),\n    redirectUri: required(\n      env,\n      \"SSO_REDIRECT_URI\",\n      \"Must match the registered redirect EXACTLY — one trailing slash is a different address.\",\n    ),\n    scopes: (env.SSO_SCOPES?.trim() || \"openid profile email\").split(/\\s+/),\n    cookieSecret,\n    cookieName: env.SSO_COOKIE_NAME?.trim() || \"bid_session\",\n    sessionMaxAge,\n    postLogoutRedirectUri: env.SSO_POST_LOGOUT_REDIRECT_URI?.trim() || undefined,\n  };\n}\n","/**\n * The signing-key cache.\n *\n * ── THE ONE BEHAVIOUR THIS FILE EXISTS FOR ────────────────────────────────\n *\n * It refetches on an UNKNOWN KEY ID, not on a timer (F084.4's constraint, and\n * it is the right one). An interval is a guess about when somebody else will\n * rotate their key; an unknown kid is the event itself. With an interval, the\n * window between \"BID rotated\" and \"the interval elapsed\" is a window where\n * every login in every app fails, and the length of that window is a number\n * nobody chose on purpose.\n *\n * ── AND THE PART AN OBVIOUS IMPLEMENTATION GETS WRONG ─────────────────────\n *\n * \"Unknown kid ⇒ refetch\" turns anyone who can send this app a token into\n * someone who can make it hammer BID: a stream of tokens with random kids is a\n * stream of fetches against the one service the whole fleet logs in through.\n * So a refetch is rate-limited by time. The cost of the floor is real and worth\n * stating: a rotation landing inside the cooldown makes logins fail for up to\n * that many milliseconds. Seconds of failure for one app beats a way to aim\n * traffic at BID from outside.\n */\n// jose 6 dropped the `KeyLike` alias; importJWK now answers\n// `CryptoKey | Uint8Array` directly. Taking the type FROM the function\n// rather than naming it means a future rename cannot silently widen it.\nimport { importJWK, type JWK } from \"jose\";\n\ntype SigningKey = Awaited<ReturnType<typeof importJWK>>;\n\nexport interface JwksCacheOptions {\n  /** Absolute URL of the key set, taken from BID's discovery document. */\n  jwksUri: string;\n  /**\n   * The floor between two refetches. Below it, an unknown kid is rejected\n   * without asking BID again.\n   */\n  minRefetchIntervalMs?: number;\n  /** Injectable for tests. */\n  fetchImpl?: typeof fetch;\n  /** Injectable for tests, so the cooldown can be exercised without waiting. */\n  now?: () => number;\n}\n\nexport interface JwksCache {\n  /** Resolve a key for this kid, refetching once if it is unknown. */\n  getKey(kid: string, alg: string): Promise<SigningKey>;\n  /** How many times the remote key set has actually been fetched. */\n  readonly fetchCount: number;\n}\n\nexport class JwksError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"JwksError\";\n  }\n}\n\nexport function createJwksCache(options: JwksCacheOptions): JwksCache {\n  const {\n    jwksUri,\n    minRefetchIntervalMs = 10_000,\n    fetchImpl = fetch,\n    now = () => Date.now(),\n  } = options;\n\n  let keys: JWK[] = [];\n  let lastFetchAt = -Infinity;\n  let fetchCount = 0;\n  /** Collapses concurrent refetches into one request. */\n  let inFlight: Promise<void> | null = null;\n\n  async function refresh(): Promise<void> {\n    if (inFlight) return inFlight;\n    inFlight = (async () => {\n      const res = await fetchImpl(jwksUri);\n      if (!res.ok) {\n        throw new JwksError(`${jwksUri} answered ${res.status} — cannot verify any token`);\n      }\n      const body = (await res.json()) as { keys?: JWK[] };\n      if (!Array.isArray(body.keys)) {\n        throw new JwksError(`${jwksUri} returned no \"keys\" array`);\n      }\n      // Replace rather than merge. Merging would keep a REVOKED key usable\n      // forever, which is the one thing rotating a key is meant to stop.\n      keys = body.keys;\n      lastFetchAt = now();\n      fetchCount++;\n    })().finally(() => {\n      inFlight = null;\n    });\n    return inFlight;\n  }\n\n  return {\n    get fetchCount() {\n      return fetchCount;\n    },\n\n    async getKey(kid: string, alg: string) {\n      let jwk = keys.find((k) => k.kid === kid);\n\n      if (!jwk) {\n        const sinceLast = now() - lastFetchAt;\n        if (sinceLast < minRefetchIntervalMs) {\n          throw new JwksError(\n            `no signing key with kid ${kid}, and the key set was refreshed ${sinceLast}ms ago ` +\n              `(floor is ${minRefetchIntervalMs}ms). Refusing to refetch — retry shortly.`,\n          );\n        }\n        await refresh();\n        jwk = keys.find((k) => k.kid === kid);\n      }\n\n      if (!jwk) {\n        throw new JwksError(\n          `Broberg ID does not publish a signing key with kid ${kid}. ` +\n            `The token was not signed by this issuer.`,\n        );\n      }\n      return importJWK(jwk, alg);\n    },\n  };\n}\n","/**\n * The core: framework-free, public-client OAuth 2.1 against Broberg ID.\n *\n * ── THIS PACKAGE IS A PUBLIC CLIENT. THERE IS NO CLIENT SECRET. ───────────\n *\n * Deliberate, and F084.4 AC#4 greps the published tarball to keep it that way.\n * PKCE alone carries the exchange. That is safe here for a reason worth stating\n * rather than assuming: BID matches redirect addresses EXACTLY (measured — one\n * trailing slash is refused), so the authorization code is delivered to this\n * app's own server and nowhere else. An attacker who knows the client id can\n * start a flow; they cannot receive its result.\n *\n * What it buys is the thing the card actually asks for: a secret that does not\n * exist cannot be committed, leaked in a log, copied into a second app, or left\n * behind in a repository someone later makes public.\n *\n * ── AND WHAT THIS PACKAGE MUST NEVER LEARN TO DO ──────────────────────────\n *\n * No passwords. No passkey registration. No social-provider keys. No email\n * verification. All of it lives in BID. A client that CAN do any of it is a\n * client somebody eventually uses to do it — and then the identity rules exist\n * in two places and drift.\n */\nimport { decodeProtectedHeader, jwtVerify, type JWTPayload } from \"jose\";\nimport type { SsoConfig } from \"./config.js\";\nimport { createJwksCache, type JwksCache } from \"./jwks.js\";\n\n/* ── discovery ───────────────────────────────────────────────────────────── */\n\nexport interface Discovery {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  jwks_uri: string;\n  userinfo_endpoint?: string;\n  end_session_endpoint?: string;\n}\n\nexport class SsoError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"SsoError\";\n  }\n}\n\n/* ── PKCE ────────────────────────────────────────────────────────────────── */\n\nconst b64url = (bytes: ArrayBuffer | Uint8Array) => {\n  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);\n  let s = \"\";\n  for (const b of view) s += String.fromCharCode(b);\n  return btoa(s).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n};\n\nconst randomToken = (bytes = 32) => b64url(crypto.getRandomValues(new Uint8Array(bytes)));\n\nasync function challengeFor(verifier: string): Promise<string> {\n  return b64url(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(verifier)));\n}\n\n/* ── the shapes a caller handles ─────────────────────────────────────────── */\n\n/**\n * What `beginLogin` produces. Every field except `url` must survive the round\n * trip to BID and back — the adapter stores them in a short-lived cookie.\n *\n * They are NOT optional extras. `state` is what makes the callback provably the\n * answer to THIS request, and `nonce` is what stops a valid token minted for\n * some other login from being replayed into this one.\n */\nexport interface LoginStart {\n  url: string;\n  state: string;\n  codeVerifier: string;\n  nonce: string;\n}\n\nexport interface SsoClaims extends JWTPayload {\n  sub: string;\n  email?: string;\n  name?: string;\n  picture?: string;\n  email_verified?: boolean;\n}\n\nexport interface LoginResult {\n  claims: SsoClaims;\n  idToken: string;\n  accessToken?: string;\n  refreshToken?: string;\n}\n\n/**\n * `prompt=none` asks BID to answer WITHOUT showing anything (F084.6).\n *\n * The delivery method decides whether it works, and this package only ever\n * produces a URL for a FULL TOP-LEVEL REDIRECT. It never returns anything an\n * app could put in a hidden iframe, because an iframe against the identity\n * provider is third-party context: Safari has blocked it for years and Chrome\n * is retiring it. That path works in testing on a Mac and fails for every user\n * on an iPhone — a failure that looks like \"you are not logged in\".\n */\nexport interface BeginLoginOptions {\n  prompt?: \"none\" | \"login\" | \"consent\" | \"select_account\";\n  /** Extra scopes for this one request, on top of the configured set. */\n  scopes?: string[];\n}\n\nexport interface SsoClient {\n  discovery(): Promise<Discovery>;\n  beginLogin(options?: BeginLoginOptions): Promise<LoginStart>;\n  completeLogin(input: {\n    params: URLSearchParams;\n    state: string;\n    codeVerifier: string;\n    nonce: string;\n  }): Promise<LoginResult>;\n  verifyIdToken(idToken: string, options?: { nonce?: string }): Promise<SsoClaims>;\n  logoutUrl(options?: { idTokenHint?: string; postLogoutRedirectUri?: string }): Promise<string>;\n  /** Exposed for tests and for a health check; not needed in normal use. */\n  readonly jwks: JwksCache;\n}\n\nexport interface CreateSsoClientOptions {\n  fetchImpl?: typeof fetch;\n  /** Passed through to the key cache; see jwks.ts for why there is a floor. */\n  minRefetchIntervalMs?: number;\n}\n\nexport function createSsoClient(\n  config: SsoConfig,\n  options: CreateSsoClientOptions = {},\n): SsoClient {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  let discoveryPromise: Promise<Discovery> | null = null;\n  let jwksCache: JwksCache | null = null;\n\n  async function discovery(): Promise<Discovery> {\n    discoveryPromise ??= (async () => {\n      const url = `${config.issuer}/.well-known/openid-configuration`;\n      const res = await fetchImpl(url);\n      if (!res.ok) throw new SsoError(`${url} answered ${res.status}`);\n      const doc = (await res.json()) as Discovery;\n\n      // STRICT equality, and it is not pedantry. Better Auth's default basePath\n      // advertised `<origin>/api/auth` as the issuer — measured on a running\n      // BID during F084.1. If the document's issuer and our configured issuer\n      // disagree, every token this app later verifies will be rejected for a\n      // reason that reads as a signature problem. Refuse at boot instead.\n      if (doc.issuer !== config.issuer) {\n        throw new SsoError(\n          `BID_ISSUER is ${config.issuer} but ${url} says its issuer is ${doc.issuer}. ` +\n            `These must match exactly — tokens are validated against the issuer string.`,\n        );\n      }\n      return doc;\n    })().catch((err) => {\n      discoveryPromise = null; // let a later call retry rather than cache a failure\n      throw err;\n    });\n    return discoveryPromise;\n  }\n\n  async function keys(): Promise<JwksCache> {\n    if (!jwksCache) {\n      const { jwks_uri } = await discovery();\n      jwksCache = createJwksCache({\n        jwksUri: jwks_uri,\n        fetchImpl,\n        ...(options.minRefetchIntervalMs !== undefined\n          ? { minRefetchIntervalMs: options.minRefetchIntervalMs }\n          : {}),\n      });\n    }\n    return jwksCache;\n  }\n\n  async function verifyIdToken(idToken: string, opts: { nonce?: string } = {}) {\n    const cache = await keys();\n    const header = decodeProtectedHeader(idToken);\n    if (!header.kid) throw new SsoError(\"ID token has no kid — cannot pick a signing key\");\n\n    const { payload } = await jwtVerify(\n      idToken,\n      async () => cache.getKey(header.kid!, header.alg ?? \"RS256\"),\n      { issuer: config.issuer, audience: config.clientId },\n    );\n\n    if (opts.nonce !== undefined && payload.nonce !== opts.nonce) {\n      throw new SsoError(\n        \"ID token nonce does not match this login request — refusing a token minted for another sign-in.\",\n      );\n    }\n    if (typeof payload.sub !== \"string\" || payload.sub === \"\") {\n      throw new SsoError(\"ID token has no sub — there is no user to be\");\n    }\n    return payload as SsoClaims;\n  }\n\n  /**\n   * Fetch the profile claims and fold them in.\n   *\n   * NOT an optimisation — it is the only way to learn a user's name. MEASURED\n   * against the live Broberg ID on 16 Sep 2026:\n   *\n   *   ID token   iss · sub · aud · iat · exp · auth_time · acr · at_hash\n   *   userinfo   sub · name · given_name · family_name · email · email_verified\n   *\n   * That is correct OIDC for an authorization-code flow: profile claims belong\n   * to the userinfo endpoint, and an ID token proving WHO you are does not have\n   * to say what you are called. An app that only reads the ID token gets a\n   * signed identity and a blank name — which is exactly what the first run of\n   * the example app showed on screen.\n   *\n   * ── THE CHECK A NAIVE VERSION SKIPS ───────────────────────────────────────\n   *\n   * The `sub` from userinfo MUST equal the `sub` in the ID token (OIDC Core\n   * 5.3.2 says MUST). Without it, a userinfo response for a DIFFERENT user\n   * would be merged over a correctly verified identity — the app would show,\n   * and act as, somebody else, with a valid signature underneath. A mismatch is\n   * refused outright rather than reconciled.\n   */\n  async function withUserInfo(claims: SsoClaims, accessToken: string): Promise<SsoClaims> {\n    const doc = await discovery();\n    if (!doc.userinfo_endpoint) return claims;\n\n    const res = await fetchImpl(doc.userinfo_endpoint, {\n      headers: { authorization: `Bearer ${accessToken}` },\n    });\n    // A failure here must NOT lose the sign-in: the identity is already proven\n    // by the ID token. The user ends up with a session and no display name,\n    // which is worse than having one and far better than being logged out.\n    if (!res.ok) return claims;\n\n    const info = (await res.json()) as Record<string, unknown>;\n    if (info.sub !== claims.sub) {\n      throw new SsoError(\n        `userinfo describes ${String(info.sub)} but the ID token is for ${claims.sub} — ` +\n          `refusing to merge another user's profile onto this session.`,\n      );\n    }\n    return { ...claims, ...info, sub: claims.sub };\n  }\n\n  return {\n    discovery,\n    get jwks() {\n      if (!jwksCache) throw new SsoError(\"the key cache is created on first verification\");\n      return jwksCache;\n    },\n    verifyIdToken,\n\n    async beginLogin(opts: BeginLoginOptions = {}): Promise<LoginStart> {\n      const { authorization_endpoint } = await discovery();\n      const codeVerifier = randomToken();\n      const state = randomToken(16);\n      const nonce = randomToken(16);\n\n      const params = new URLSearchParams({\n        response_type: \"code\",\n        client_id: config.clientId,\n        redirect_uri: config.redirectUri,\n        scope: [...new Set([...config.scopes, ...(opts.scopes ?? [])])].join(\" \"),\n        state,\n        nonce,\n        code_challenge: await challengeFor(codeVerifier),\n        code_challenge_method: \"S256\",\n      });\n      if (opts.prompt) params.set(\"prompt\", opts.prompt);\n\n      return { url: `${authorization_endpoint}?${params}`, state, codeVerifier, nonce };\n    },\n\n    async completeLogin({ params, state, codeVerifier, nonce }) {\n      // An ERROR comes back on the same redirect as a success — BID answers a\n      // refused `prompt=none` by redirecting here with ?error=login_required.\n      // Reading only for `code` would make a refusal look like a malformed\n      // response instead of the expected answer it is.\n      const error = params.get(\"error\");\n      if (error) {\n        throw new SsoError(\n          `Broberg ID refused this login: ${error}` +\n            (params.get(\"error_description\") ? ` — ${params.get(\"error_description\")}` : \"\"),\n        );\n      }\n\n      const returned = params.get(\"state\");\n      if (!returned || returned !== state) {\n        throw new SsoError(\n          \"state does not match the login this browser started — refusing the callback.\",\n        );\n      }\n\n      const code = params.get(\"code\");\n      if (!code) throw new SsoError(\"callback carried neither an error nor a code\");\n\n      const { token_endpoint } = await discovery();\n      const res = await fetchImpl(token_endpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          grant_type: \"authorization_code\",\n          code,\n          redirect_uri: config.redirectUri,\n          client_id: config.clientId,\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      const body = (await res.json()) as {\n        id_token?: string;\n        access_token?: string;\n        refresh_token?: string;\n        error?: string;\n        error_description?: string;\n      };\n      if (!res.ok || !body.id_token) {\n        throw new SsoError(\n          `token exchange failed (${res.status}): ${body.error ?? \"no id_token in response\"}` +\n            (body.error_description ? ` — ${body.error_description}` : \"\"),\n        );\n      }\n\n      const claims = await verifyIdToken(body.id_token, { nonce });\n\n      return {\n        claims: body.access_token ? await withUserInfo(claims, body.access_token) : claims,\n        idToken: body.id_token,\n        ...(body.access_token ? { accessToken: body.access_token } : {}),\n        ...(body.refresh_token ? { refreshToken: body.refresh_token } : {}),\n      };\n    },\n\n    async logoutUrl(opts = {}) {\n      const doc = await discovery();\n      if (!doc.end_session_endpoint) {\n        throw new SsoError(\n          `${config.issuer} does not advertise end_session_endpoint — central logout is unavailable.`,\n        );\n      }\n      const params = new URLSearchParams();\n      if (opts.idTokenHint) params.set(\"id_token_hint\", opts.idTokenHint);\n      const post = opts.postLogoutRedirectUri ?? config.postLogoutRedirectUri;\n      if (post) params.set(\"post_logout_redirect_uri\", post);\n      params.set(\"client_id\", config.clientId);\n      return `${doc.end_session_endpoint}?${params}`;\n    },\n  };\n}\n","/**\n * The app's OWN session cookie — signed, not encrypted.\n *\n * Signed is the right choice and the distinction matters: the contents are not\n * secret (a user may read their own id and name), but they must not be\n * FORGEABLE. Encryption would hide a subject id the user already knows while\n * doing nothing extra about forgery, which is the actual risk.\n *\n * What goes in is deliberately small: who you are and when this stops being\n * true. Claims that can change — a name, a role, a picture — belong in the\n * app's own store keyed by `sub`, because a cookie is a cache nobody can\n * invalidate, and a stale role in a cookie is a permission that outlives its\n * revocation.\n */\n\nexport interface SessionPayload {\n  /** The subject from Broberg ID. The one stable identifier. */\n  sub: string;\n  /** Unix seconds. Checked on every read. */\n  exp: number;\n  /** Optional convenience copies; never authorisation data. */\n  email?: string;\n  name?: string;\n}\n\nconst enc = new TextEncoder();\n\nconst b64url = (bytes: Uint8Array) => {\n  let s = \"\";\n  for (const b of bytes) s += String.fromCharCode(b);\n  return btoa(s).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n};\n\nconst fromB64url = (s: string) => {\n  const pad = s.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const bin = atob(pad + \"=\".repeat((4 - (pad.length % 4)) % 4));\n  return Uint8Array.from(bin, (c) => c.charCodeAt(0));\n};\n\nasync function hmacKey(secret: string) {\n  return crypto.subtle.importKey(\"raw\", enc.encode(secret), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\n    \"sign\",\n    \"verify\",\n  ]);\n}\n\n/**\n * Sign an arbitrary string. The primitive underneath BOTH cookies this package\n * sets — the session and the short-lived login transaction.\n *\n * They are separate functions on purpose. The first version of this file had\n * the transaction ride inside the session envelope with `exp: 0`, and the\n * expiry check (`exp * 1000 <= now()`) then rejected it every single time: the\n * transaction cookie could never be read back, so every login would have failed\n * with \"state does not match\" — a message pointing at the wrong thing entirely.\n * Two different lifetimes wanted two different envelopes, not one envelope with\n * a sentinel in it.\n */\nexport async function signValue(value: string, secret: string): Promise<string> {\n  const body = b64url(enc.encode(value));\n  const sig = new Uint8Array(await crypto.subtle.sign(\"HMAC\", await hmacKey(secret), enc.encode(body)));\n  return `${body}.${b64url(sig)}`;\n}\n\n/** Verify the SIGNATURE only, returning the original string. No expiry notion. */\nexport async function verifyValue(\n  token: string | undefined | null,\n  secret: string,\n): Promise<string | null> {\n  if (!token) return null;\n  const dot = token.lastIndexOf(\".\");\n  if (dot <= 0) return null;\n  const body = token.slice(0, dot);\n  try {\n    const ok = await crypto.subtle.verify(\n      \"HMAC\",\n      await hmacKey(secret),\n      fromB64url(token.slice(dot + 1)),\n      enc.encode(body),\n    );\n    if (!ok) return null;\n    return new TextDecoder().decode(fromB64url(body));\n  } catch {\n    return null;\n  }\n}\n\nexport async function signSession(payload: SessionPayload, secret: string): Promise<string> {\n  return signValue(JSON.stringify(payload), secret);\n}\n\n/**\n * Returns null for ANY reason the cookie cannot be trusted — tampered,\n * truncated, wrong secret, expired, or simply not one of ours.\n *\n * Deliberately one return value rather than distinguishing them to the caller:\n * an app that can tell \"bad signature\" from \"expired\" will eventually branch on\n * it, and there is no branch where a forged cookie should do anything other\n * than what an absent one does.\n */\nexport async function verifySession(\n  token: string | undefined | null,\n  secret: string,\n  now: () => number = Date.now,\n): Promise<SessionPayload | null> {\n  // crypto.subtle.verify is constant-time; a hand-rolled string compare would\n  // leak the signature one byte at a time.\n  const body = await verifyValue(token, secret);\n  if (body === null) return null;\n\n  try {\n    const payload = JSON.parse(body) as SessionPayload;\n    if (typeof payload.sub !== \"string\" || payload.sub === \"\") return null;\n    if (typeof payload.exp !== \"number\" || payload.exp * 1000 <= now()) return null;\n    return payload;\n  } catch {\n    return null;\n  }\n}\n\n/** Serialise a Set-Cookie value. `secure` is off only for http://localhost. */\nexport function cookieHeader(\n  name: string,\n  value: string,\n  opts: { maxAge: number; secure: boolean; sameSite?: \"Lax\" | \"Strict\"; path?: string },\n): string {\n  const parts = [\n    `${name}=${value}`,\n    `Path=${opts.path ?? \"/\"}`,\n    `Max-Age=${opts.maxAge}`,\n    \"HttpOnly\",\n    // Lax, NOT Strict, and this is load-bearing: the callback from Broberg ID\n    // is a top-level GET navigation from another site. Strict withholds the\n    // cookie on exactly that navigation, so the login transaction cookie would\n    // be missing when it is needed and every sign-in would fail with \"state\n    // does not match\" — a message that sends you looking in the wrong place.\n    `SameSite=${opts.sameSite ?? \"Lax\"}`,\n  ];\n  if (opts.secure) parts.push(\"Secure\");\n  return parts.join(\"; \");\n}\n\nexport function readCookie(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined;\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();\n  }\n  return undefined;\n}\n"]}