@broberg/sso 0.13.0 → 0.14.2

package/dist/index.js

@@ -1,669 +1,145 @@
-import { importJWK, decodeProtectedHeader, jwtVerify } from 'jose';
+import { SsoError, ALLOWED_ALGS, JwksUnavailableError, createJwksCache } from './chunk-ZPRWYUFG.js';
+export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoReauthError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue } from './chunk-ZPRWYUFG.js';
+import { existsSync } from 'fs';
+import { request } from 'http';
+import { decodeProtectedHeader, jwtVerify } from 'jose';
 
-// src/config.ts
-var SsoConfigError = class extends Error {
+var DEFAULT_ISSUER = "https://id.broberg.ai";
+var FLY_SOCKET = "/.fly/api";
+var NoWorkloadIdentityError = class extends Error {
   constructor(message) {
     super(message);
-    this.name = "SsoConfigError";
+    this.name = "NoWorkloadIdentityError";
   }
 };
-function required(env, name, hint) {
-  const raw = env[name];
-  if (typeof raw !== "string" || raw.trim() === "") {
-    throw new SsoConfigError(`${name} is not set (or is blank). ${hint}`);
-  }
-  return raw.trim();
-}
-var DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 7;
-function loadSsoConfig(env = process.env) {
-  const rawIssuer = required(
-    env,
-    "BID_ISSUER",
-    "It is Broberg ID's bare origin, e.g. https://id.broberg.ai"
-  );
-  let issuer;
-  try {
-    const url = new URL(rawIssuer);
-    if (url.protocol !== "https:" && url.hostname !== "localhost") {
-      throw new SsoConfigError(
-        `BID_ISSUER must be https (got ${url.protocol}//). Only localhost may be http.`
-      );
-    }
-    issuer = url.origin;
-  } catch (err) {
-    if (err instanceof SsoConfigError) throw err;
-    throw new SsoConfigError(`BID_ISSUER is not a valid URL: ${rawIssuer}`);
-  }
-  const cookieSecret = required(
-    env,
-    "SSO_COOKIE_SECRET",
-    "Generate one with `openssl rand -hex 32`. It signs this app's session cookie."
-  );
-  if (cookieSecret.length < 32) {
-    throw new SsoConfigError(
-      `SSO_COOKIE_SECRET is ${cookieSecret.length} characters; it must be at least 32. A short secret is a forgeable session, and a forged session is any user you like.`
-    );
-  }
-  const rawMaxAge = env.SSO_SESSION_MAX_AGE?.trim();
-  let sessionMaxAge = DEFAULT_SESSION_MAX_AGE;
-  if (rawMaxAge) {
-    const n = Number(rawMaxAge);
-    if (!Number.isFinite(n) || n <= 0) {
-      throw new SsoConfigError(
-        `SSO_SESSION_MAX_AGE must be a positive number of seconds (got ${JSON.stringify(rawMaxAge)}).`
-      );
-    }
-    sessionMaxAge = Math.floor(n);
-  }
-  return {
-    issuer,
-    clientId: required(env, "SSO_CLIENT_ID", "The id this app is registered under in Broberg ID."),
-    redirectUri: required(
-      env,
-      "SSO_REDIRECT_URI",
-      "Must match the registered redirect EXACTLY \u2014 one trailing slash is a different address."
-    ),
-    scopes: (env.SSO_SCOPES?.trim() || "openid profile email").split(/\s+/),
-    cookieSecret,
-    cookieName: env.SSO_COOKIE_NAME?.trim() || "bid_session",
-    sessionMaxAge,
-    postLogoutRedirectUri: env.SSO_POST_LOGOUT_REDIRECT_URI?.trim() || void 0,
-    clientSecret: env.SSO_CLIENT_SECRET?.trim() || void 0
-  };
-}
-var JwksError = class extends Error {
-  constructor(message) {
+var TicketExchangeError = class extends Error {
+  constructor(message, code, status) {
     super(message);
-    this.name = "JwksError";
-  }
-};
-var JwksUnavailableError = class extends JwksError {
-  constructor(message) {
-    super(message);
-    this.name = "JwksUnavailableError";
+    this.code = code;
+    this.status = status;
+    this.name = "TicketExchangeError";
   }
+  code;
+  status;
 };
-var JwksUnknownKeyError = class extends JwksError {
+var TicketUnavailableError = class extends Error {
   constructor(message) {
     super(message);
-    this.name = "JwksUnknownKeyError";
+    this.name = "TicketUnavailableError";
   }
 };
-function createJwksCache(options) {
-  const {
-    jwksUri,
-    minRefetchIntervalMs = 1e4,
-    warmUp = false,
-    fetchImpl = fetch,
-    now = () => Date.now()
-  } = options;
-  let keys = [];
-  let lastFetchAt = -Infinity;
-  let fetchCount = 0;
-  let inFlight = null;
-  async function refresh() {
-    if (inFlight) return inFlight;
-    inFlight = (async () => {
-      let res;
-      try {
-        res = await fetchImpl(jwksUri);
-      } catch (cause) {
-        throw new JwksUnavailableError(
-          `${jwksUri} could not be reached: ${cause instanceof Error ? cause.message : String(cause)}`
-        );
-      }
-      if (!res.ok) {
-        throw new JwksUnavailableError(
-          `${jwksUri} answered ${res.status} \u2014 cannot verify any token right now`
-        );
-      }
-      let body;
-      try {
-        body = await res.json();
-      } catch {
-        throw new JwksUnavailableError(`${jwksUri} answered 200 with a body that is not JSON`);
-      }
-      if (!Array.isArray(body?.keys)) {
-        throw new JwksUnavailableError(`${jwksUri} returned no "keys" array`);
+function flyOidcOverSocket(aud) {
+  return new Promise((resolve, reject) => {
+    const body = JSON.stringify({ aud });
+    const req = request(
+      { socketPath: FLY_SOCKET, path: "/v1/tokens/oidc", method: "POST", headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) } },
+      (res) => {
+        let data = "";
+        res.setEncoding("utf8");
+        res.on("data", (c) => data += c);
+        res.on("end", () => {
+          if ((res.statusCode ?? 0) >= 200 && (res.statusCode ?? 0) < 300) resolve(data.trim());
+          else reject(new TicketUnavailableError(`Fly OIDC answered ${res.statusCode}`));
+        });
       }
-      keys = body.keys;
-      lastFetchAt = now();
-      fetchCount++;
-    })().finally(() => {
-      inFlight = null;
-    });
-    return inFlight;
-  }
-  if (warmUp) {
-    void refresh().catch(() => {
-    });
-  }
-  return {
-    get fetchCount() {
-      return fetchCount;
-    },
-    async getKey(kid, alg) {
-      let jwk = keys.find((k) => k.kid === kid);
-      if (!jwk) {
-        const sinceLast = now() - lastFetchAt;
-        if (sinceLast < minRefetchIntervalMs) {
-          throw new JwksUnavailableError(
-            `kid ${kid} is not in the key set we hold, fetched ${sinceLast}ms ago (we do not ask the issuer again within ${minRefetchIntervalMs}ms). A key set this fresh that lacks the kid means the token was not signed by this issuer \u2014 reject it. Only a key rotation within the last ${minRefetchIntervalMs}ms could make that wrong.`
-          );
-        }
-        await refresh();
-        jwk = keys.find((k) => k.kid === kid);
-      }
-      if (!jwk) {
-        throw new JwksUnknownKeyError(
-          `Broberg ID does not publish a signing key with kid ${kid}. The token was not signed by this issuer.`
-        );
-      }
-      return importJWK(jwk, alg);
-    }
-  };
+    );
+    req.on("error", (e) => reject(new TicketUnavailableError(`Fly OIDC socket: ${e.message}`)));
+    req.end(body);
+  });
 }
-
-// src/client.ts
-var SsoError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "SsoError";
-  }
-};
-var SsoReauthError = class extends SsoError {
-  constructor(message, reason) {
-    super(message);
-    this.reason = reason;
-    this.name = "SsoReauthError";
-  }
-  reason;
-};
-var SsoAppApiError = class extends SsoError {
-  constructor(message, status, code) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.name = "SsoAppApiError";
-  }
-  status;
-  code;
-};
-var SsoInsufficientScopeError = class extends SsoAppApiError {
-  constructor(message, scope) {
-    super(message, 403, "insufficient_scope");
-    this.scope = scope;
-    this.name = "SsoInsufficientScopeError";
-  }
-  scope;
-};
-var SsoAvatarRejectedError = class extends SsoError {
-  constructor(message, reason) {
-    super(message);
-    this.reason = reason;
-    this.name = "SsoAvatarRejectedError";
+function jwtExp(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
   }
-  reason;
-};
-var MAX_AVATAR_BYTES = 2 * 1024 * 1024;
-var AVATAR_TYPES = ["image/png", "image/jpeg", "image/webp"];
-function mediaType(contentType) {
-  return (contentType ?? "").split(";")[0].trim().toLowerCase();
-}
-var b64url = (bytes) => {
-  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
-  let s = "";
-  for (const b of view) s += String.fromCharCode(b);
-  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-};
-var randomToken = (bytes = 32) => b64url(crypto.getRandomValues(new Uint8Array(bytes)));
-async function challengeFor(verifier) {
-  return b64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
-}
-var ADDRESS_OWNERSHIP = /* @__PURE__ */ new Set(["verified", "unverified", "not_on_account"]);
-var INVITATION_OUTCOMES = /* @__PURE__ */ new Set([
-  "invited",
-  "already_invited",
-  "existing",
-  "invalid",
-  "too_soon",
-  "too_many_today",
-  "send_failed"
-]);
-var MIGRATION_STATES = /* @__PURE__ */ new Set(["ready", "invited", "expired", "not_invited"]);
-var BACKCHANNEL_EVENT = "http://schemas.openid.net/event/backchannel-logout";
-var MAX_INVITATIONS = 500;
-function excerptForLog(raw, clientSecret) {
-  let text = raw.replace(/\s+/g, " ").trim();
-  if (clientSecret) text = text.split(clientSecret).join("[redacted client_secret]");
-  if (text === "") return "(empty body)";
-  return text.length > 200 ? `${text.slice(0, 200)}\u2026` : text;
-}
-function invalidClientHint(error, weSentASecret) {
-  if (error !== "invalid_client") return "";
-  return weSentASecret ? " \u2014 we DID send a client_secret, so either it is wrong or this client is registered as PUBLIC (in which case unset SSO_CLIENT_SECRET)." : " \u2014 we sent NO client_secret, so this client is likely registered as CONFIDENTIAL (set SSO_CLIENT_SECRET to the value it was registered with).";
 }
-var ALLOWED_ALGS = [
-  // FIRST, because it is what Broberg ID actually signs with. Measured on the
-  // live issuer 2026-09-20:
-  //   /jwks      kid=Iodh… kty=OKP alg=EdDSA crv=Ed25519
-  //   discovery  id_token_signing_alg_values_supported: ["EdDSA"]
-  //
-  // 0.2.1 SHIPPED THIS LIST WITHOUT IT and rejected every real token for an
-  // hour. The list was written from what an OIDC client usually allows rather
-  // than from what our issuer uses — and the whole suite missed it because the
-  // fake issuer in the tests signs RS256. A fake agrees with whoever wrote it.
-  // There is now a test that mints EdDSA, the algorithm production uses.
-  "EdDSA",
-  "RS256",
-  "RS384",
-  "RS512",
-  "PS256",
-  "PS384",
-  "PS512",
-  "ES256",
-  "ES384",
-  "ES512"
-];
-function createSsoClient(config, options = {}) {
+function createTicketClient(options = {}) {
+  const issuer = (options.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+  const renewBeforeSec = options.renewBeforeSec ?? 30;
+  const env = options.env ?? process.env;
   const fetchImpl = options.fetchImpl ?? fetch;
-  const timeoutMs = options.timeoutMs ?? 1e4;
-  async function appPost(path, bearer, payload, what) {
-    const url = new URL(path, config.issuer).toString();
-    const ctrl = new AbortController();
-    let timer;
-    const timedOut = new Promise((_, reject) => {
-      timer = setTimeout(() => {
-        ctrl.abort();
-        reject(new SsoError(`${url} did not answer within ${timeoutMs} ms \u2014 ${what} is unknown.`));
-      }, timeoutMs);
-    });
-    try {
-      const res = await Promise.race([
-        fetchImpl(url, {
-          method: "POST",
-          headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
-          body: JSON.stringify(payload),
-          signal: ctrl.signal
-        }),
-        timedOut
-      ]);
-      if (!res.ok) {
-        const detail = await res.text().catch(() => "");
-        const hint = detail.includes("invalid_app_key") ? " (invalid_app_key: this app's bidk_ key was refused)" : "";
-        throw new SsoError(`${url} answered ${res.status}${hint} \u2014 ${what} is unknown.`);
-      }
-      return await Promise.race([res.json().catch(() => null), timedOut]);
-    } catch (e) {
-      if (e instanceof SsoError) throw e;
-      throw new SsoError(`${url} could not be reached: ${e instanceof Error ? e.message : String(e)} \u2014 ${what} is unknown.`);
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  async function appRequest(path, bearer, init, what) {
-    const url = new URL(path, config.issuer).toString();
-    const ctrl = new AbortController();
-    let timer;
-    const timedOut = new Promise((_, reject) => {
-      timer = setTimeout(() => {
-        reject(new SsoAppApiError(`${url} did not answer within ${timeoutMs} ms \u2014 ${what} is unknown.`, null, void 0));
-        ctrl.abort();
-      }, timeoutMs);
-    });
-    const headers = { authorization: `Bearer ${bearer}` };
-    let body;
-    if (init.json !== void 0) {
-      headers["content-type"] = "application/json";
-      body = JSON.stringify(init.json);
-    } else if (init.bytes !== void 0) {
-      headers["content-type"] = init.contentType ?? "application/octet-stream";
-      body = init.bytes;
-    }
-    try {
-      const res = await Promise.race([
-        fetchImpl(url, { method: init.method, headers, ...body !== void 0 ? { body } : {}, signal: ctrl.signal }),
-        timedOut
-      ]);
-      const raw = await Promise.race([res.text(), timedOut]);
-      let parsed;
+  const now = options.now ?? (() => Date.now());
+  const flyOidc = options.flyOidc ?? flyOidcOverSocket;
+  const onFly = options.onFly ?? (() => !!env.FLY_APP_NAME && existsSync(FLY_SOCKET));
+  const cache = /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
+  async function platformToken() {
+    if (onFly()) return flyOidc(issuer);
+    const url = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const bearer = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (url && bearer) {
+      let res;
       try {
-        parsed = raw.trim() === "" ? void 0 : JSON.parse(raw);
-      } catch {
-        parsed = void 0;
-      }
-      const fields = parsed && typeof parsed === "object" ? parsed : {};
-      const code = typeof fields.error === "string" ? fields.error : void 0;
-      if (!res.ok) {
-        if (res.status === 403 && code === "insufficient_scope") {
-          const scope = typeof fields.scope === "string" && fields.scope ? fields.scope : init.method === "GET" ? "profile" : "profile:write";
-          throw new SsoInsufficientScopeError(
-            `${url} answered 403 insufficient_scope \u2014 the user's token lacks scope "${scope}"; log in again with it requested.`,
-            scope
-          );
-        }
-        throw new SsoAppApiError(`${url} answered ${res.status}${code ? ` (${code})` : ""} \u2014 ${what} is unknown.`, res.status, code);
-      }
-      if (parsed === void 0) {
-        throw new SsoAppApiError(`${url} answered ${res.status} with a body that is not JSON \u2014 ${what} is unknown.`, res.status, void 0);
+        res = await fetchImpl(`${url}&audience=${encodeURIComponent(issuer)}`, { headers: { authorization: `Bearer ${bearer}` } });
+      } catch (e) {
+        throw new TicketUnavailableError(`GitHub OIDC endpoint unreachable: ${e instanceof Error ? e.message : String(e)}`);
       }
-      return parsed;
-    } catch (e) {
-      if (e instanceof SsoError) throw e;
-      throw new SsoAppApiError(`${url} could not be reached (${e instanceof Error ? e.name : "error"}) \u2014 ${what} is unknown.`, null, void 0);
-    } finally {
-      clearTimeout(timer);
+      if (!res.ok) throw new TicketUnavailableError(`GitHub OIDC endpoint answered ${res.status}`);
+      const { value } = await res.json();
+      if (!value) throw new TicketUnavailableError("GitHub OIDC endpoint returned no token");
+      return value;
     }
+    throw new NoWorkloadIdentityError(
+      "No workload identity to exchange for a ticket: not on a Fly machine (FLY_APP_NAME + /.fly/api) and not in a GitHub Actions job (ACTIONS_ID_TOKEN_REQUEST_URL/_TOKEN \u2014 add `permissions: id-token: write`). A Mac session keeps using its session key."
+    );
   }
-  function asProfile(body, path) {
-    const b = body ?? {};
-    if (typeof b.sub !== "string" || b.sub === "" || typeof b.account_url !== "string") {
-      throw new SsoAppApiError(`${path} returned no "sub" or "account_url" \u2014 the profile is unknown.`, 200, void 0);
-    }
-    const opt = (v) => typeof v === "string" ? v : null;
-    return { sub: b.sub, name: opt(b.name), picture: opt(b.picture), email: opt(b.email), account_url: b.account_url };
-  }
-  let discoveryPromise = null;
-  let jwksCache = null;
-  async function discovery() {
-    discoveryPromise ??= (async () => {
-      const url = `${config.issuer}/.well-known/openid-configuration`;
-      const res = await fetchImpl(url);
-      if (!res.ok) throw new SsoError(`${url} answered ${res.status}`);
-      const doc = await res.json();
-      const advertised = doc.id_token_signing_alg_values_supported;
-      if (Array.isArray(advertised) && advertised.length > 0) {
-        const usable = advertised.filter((a) => ALLOWED_ALGS.includes(a));
-        if (usable.length === 0) {
-          throw new SsoError(
-            `${config.issuer} signs ID tokens with ${advertised.join(", ")}, and this client accepts none of those (it allows ${ALLOWED_ALGS.join(", ")}). Every token would be rejected. This is a mismatch between the package and the issuer \u2014 report it rather than working around it.`
-          );
-        }
-      }
-      if (doc.issuer !== config.issuer) {
-        throw new SsoError(
-          `BID_ISSUER is ${config.issuer} but ${url} says its issuer is ${doc.issuer}. These must match exactly \u2014 tokens are validated against the issuer string.`
-        );
-      }
-      return doc;
-    })().catch((err) => {
-      discoveryPromise = null;
-      throw err;
+  async function exchange(audience, scope) {
+    const subject = await platformToken();
+    const form = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+      subject_token: subject,
+      subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
+      audience
     });
-    return discoveryPromise;
-  }
-  async function keys() {
-    if (!jwksCache) {
-      const { jwks_uri } = await discovery();
-      jwksCache = createJwksCache({
-        jwksUri: jwks_uri,
-        fetchImpl,
-        ...options.minRefetchIntervalMs !== void 0 ? { minRefetchIntervalMs: options.minRefetchIntervalMs } : {}
+    if (scope) form.set("scope", scope);
+    let res;
+    try {
+      res = await fetchImpl(`${issuer}/oauth2/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: form
       });
+    } catch (e) {
+      throw new TicketUnavailableError(`${issuer} unreachable: ${e instanceof Error ? e.message : String(e)}`);
     }
-    return jwksCache;
-  }
-  async function verifyLogoutToken(token) {
-    const cache = await keys();
-    let header;
+    let body = {};
     try {
-      header = decodeProtectedHeader(token);
+      body = await res.json();
     } catch {
-      throw new SsoError("logout_token is not a JWS");
-    }
-    if (!header.kid) throw new SsoError("logout_token has no kid \u2014 cannot pick a signing key");
-    let payload;
-    try {
-      ({ payload } = await jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "RS256"), {
-        issuer: config.issuer,
-        audience: config.clientId,
-        algorithms: ALLOWED_ALGS,
-        typ: "logout+jwt",
-        requiredClaims: ["iat", "exp", "jti"]
-      }));
-    } catch (e) {
-      throw new SsoError(`logout_token rejected: ${e instanceof Error ? e.message : String(e)}`);
-    }
-    const events = payload.events;
-    if (!events || typeof events !== "object" || !(BACKCHANNEL_EVENT in events)) {
-      throw new SsoError("logout_token has no back-channel logout event");
-    }
-    if ("nonce" in payload) throw new SsoError("logout_token carries a nonce \u2014 that is an ID token, not a logout token");
-    if ("sid" in payload) {
-      throw new SsoError("logout_token carries sid \u2014 only sub-wide \xABLog ud overalt\xBB is accepted (D-376ffa)");
-    }
-    if (typeof payload.sub !== "string" || payload.sub === "") throw new SsoError("logout_token has no sub");
-    return { sub: payload.sub, iat: payload.iat, jti: String(payload.jti), exp: payload.exp };
-  }
-  async function verifyIdToken(idToken, opts = {}) {
-    const cache = await keys();
-    const header = decodeProtectedHeader(idToken);
-    if (!header.kid) throw new SsoError("ID token has no kid \u2014 cannot pick a signing key");
-    const { payload } = await jwtVerify(
-      idToken,
-      async () => cache.getKey(header.kid, header.alg ?? "RS256"),
-      { issuer: config.issuer, audience: config.clientId, algorithms: ALLOWED_ALGS }
-    );
-    if (opts.nonce !== void 0 && payload.nonce !== opts.nonce) {
-      throw new SsoError(
-        "ID token nonce does not match this login request \u2014 refusing a token minted for another sign-in."
-      );
-    }
-    if (typeof payload.sub !== "string" || payload.sub === "") {
-      throw new SsoError("ID token has no sub \u2014 there is no user to be");
     }
-    return payload;
-  }
-  async function withUserInfo(claims, accessToken) {
-    const doc = await discovery();
-    if (!doc.userinfo_endpoint) return { claims, unverifiedClaims: [] };
-    const res = await fetchImpl(doc.userinfo_endpoint, {
-      headers: { authorization: `Bearer ${accessToken}` }
-    });
-    if (!res.ok) return { claims, unverifiedClaims: [] };
-    const info = await res.json();
-    if (info.sub !== claims.sub) {
-      throw new SsoError(
-        `userinfo describes ${String(info.sub)} but the ID token is for ${claims.sub} \u2014 refusing to merge another user's profile onto this session.`
-      );
+    if (res.status >= 500) throw new TicketUnavailableError(`${issuer} answered ${res.status}`);
+    if (!res.ok || !body.access_token) {
+      const desc = body.error_description ?? "";
+      const code = desc.includes(":") ? desc.slice(0, desc.indexOf(":")).trim() : body.error ?? "exchange_refused";
+      throw new TicketExchangeError(`Broberg ID refused the ticket for ${audience}: ${desc || body.error || res.status}`, code, res.status);
     }
-    const unverifiedClaims = Object.keys(info).filter((k) => k !== "sub" && info[k] !== void 0 && !(k in claims)).sort();
-    return { claims: { ...info, ...claims, sub: claims.sub }, unverifiedClaims };
+    const nowSec = Math.floor(now() / 1e3);
+    const exp = jwtExp(body.access_token) ?? nowSec + (body.expires_in ?? 300);
+    return { token: body.access_token, exp };
   }
   return {
-    discovery,
-    get jwks() {
-      if (!jwksCache) throw new SsoError("the key cache is created on first verification");
-      return jwksCache;
-    },
-    verifyIdToken,
-    async beginLogin(opts = {}) {
-      const { authorization_endpoint } = await discovery();
-      const codeVerifier = randomToken();
-      const state = randomToken(16);
-      const nonce = randomToken(16);
-      const params = new URLSearchParams({
-        response_type: "code",
-        client_id: config.clientId,
-        redirect_uri: config.redirectUri,
-        scope: [.../* @__PURE__ */ new Set([...config.scopes, ...opts.scopes ?? []])].join(" "),
-        state,
-        nonce,
-        code_challenge: await challengeFor(codeVerifier),
-        code_challenge_method: "S256"
-      });
-      if (opts.prompt) params.set("prompt", opts.prompt);
-      return { url: `${authorization_endpoint}?${params}`, state, codeVerifier, nonce };
-    },
-    async completeLogin({ params, state, codeVerifier, nonce }) {
-      const error = params.get("error");
-      if (error) {
-        throw new SsoError(
-          `Broberg ID refused this login: ${error}` + (params.get("error_description") ? ` \u2014 ${params.get("error_description")}` : "")
-        );
-      }
-      const returned = params.get("state");
-      if (!returned || returned !== state) {
-        throw new SsoError(
-          "state does not match the login this browser started \u2014 refusing the callback."
-        );
-      }
-      const code = params.get("code");
-      if (!code) throw new SsoError("callback carried neither an error nor a code");
-      const { token_endpoint } = await discovery();
-      const res = await fetchImpl(token_endpoint, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          grant_type: "authorization_code",
-          code,
-          redirect_uri: config.redirectUri,
-          client_id: config.clientId,
-          // ALWAYS sent, secret or not. See SsoConfig.clientSecret: the two
-          // prove different things, so a confidential client keeps PKCE.
-          code_verifier: codeVerifier,
-          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
-        })
-      });
-      const raw = await res.text();
-      let body;
-      try {
-        body = raw.trim() === "" ? {} : JSON.parse(raw);
-      } catch {
-        throw new SsoError(
-          `token exchange failed (${res.status}): the response body is not JSON${res.headers.get("content-type") ? ` (content-type: ${res.headers.get("content-type")})` : ""} \u2014 ${excerptForLog(raw, config.clientSecret)}`
-        );
-      }
-      if (!res.ok || !body.id_token) {
-        throw new SsoError(
-          `token exchange failed (${res.status}): ${body.error ?? "no id_token in response"}` + (body.error_description ? ` \u2014 ${body.error_description}` : "") + invalidClientHint(body.error, config.clientSecret !== void 0)
-        );
-      }
-      const claims = await verifyIdToken(body.id_token, { nonce });
-      const merged = body.access_token ? await withUserInfo(claims, body.access_token) : { claims, unverifiedClaims: [] };
-      return {
-        claims: merged.claims,
-        unverifiedClaims: merged.unverifiedClaims,
-        idToken: body.id_token,
-        ...body.access_token ? { accessToken: body.access_token } : {},
-        ...body.refresh_token ? { refreshToken: body.refresh_token } : {},
-        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
-      };
-    },
-    async refreshTokens(refreshToken) {
-      const { token_endpoint } = await discovery();
-      const res = await fetchImpl(token_endpoint, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          grant_type: "refresh_token",
-          refresh_token: refreshToken,
-          client_id: config.clientId,
-          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
-        })
-      });
-      const raw = await res.text();
-      let body;
-      try {
-        body = raw.trim() === "" ? {} : JSON.parse(raw);
-      } catch {
-        throw new SsoError(`token refresh failed (${res.status}): the response body is not JSON`);
-      }
-      if (!res.ok || typeof body.access_token !== "string" || body.access_token === "") {
-        throw new SsoError(`token refresh failed (${res.status}): ${body.error ?? "no access_token in response"}`);
-      }
-      return {
-        accessToken: body.access_token,
-        ...typeof body.refresh_token === "string" && body.refresh_token ? { refreshToken: body.refresh_token } : {},
-        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
-      };
-    },
-    async logoutUrl(opts = {}) {
-      const doc = await discovery();
-      if (!doc.end_session_endpoint) {
-        throw new SsoError(
-          `${config.issuer} does not advertise end_session_endpoint \u2014 central logout is unavailable.`
-        );
-      }
-      const params = new URLSearchParams();
-      if (opts.idTokenHint) params.set("id_token_hint", opts.idTokenHint);
-      const post = opts.postLogoutRedirectUri ?? config.postLogoutRedirectUri;
-      if (post) params.set("post_logout_redirect_uri", post);
-      params.set("client_id", config.clientId);
-      return `${doc.end_session_endpoint}?${params}`;
-    },
-    async addressOwnership(accessToken, address) {
-      const body = await appPost(
-        "/api/app/address-ownership",
-        accessToken,
-        { address },
-        'address ownership (not "unverified")'
-      );
-      const status = body?.status;
-      if (typeof status !== "string" || !ADDRESS_OWNERSHIP.has(status)) {
-        throw new SsoError(`address-ownership returned status ${JSON.stringify(status)} \u2014 expected verified, unverified or not_on_account.`);
-      }
-      return status;
-    },
-    verifyLogoutToken,
-    async getProfile(accessToken) {
-      const path = "/api/app/profile";
-      return asProfile(await appRequest(path, accessToken, { method: "GET" }, "the profile"), path);
-    },
-    async updateProfile(accessToken, name) {
-      const path = "/api/app/profile";
-      return asProfile(await appRequest(path, accessToken, { method: "POST", json: { name } }, "the new name"), path);
-    },
-    async uploadAvatar(accessToken, bytes, contentType) {
-      const type = mediaType(contentType);
-      if (!AVATAR_TYPES.includes(type)) {
-        throw new SsoAvatarRejectedError(
-          `uploadAvatar: "${type}" is not accepted \u2014 BID takes ${AVATAR_TYPES.join(", ")}.`,
-          "unsupported_type"
-        );
-      }
-      if (bytes.byteLength > MAX_AVATAR_BYTES) {
-        throw new SsoAvatarRejectedError(
-          `uploadAvatar: ${bytes.byteLength} bytes \u2014 BID takes at most ${MAX_AVATAR_BYTES}.`,
-          "too_large"
-        );
-      }
-      const path = "/api/app/profile/avatar";
-      return asProfile(await appRequest(path, accessToken, { method: "POST", bytes, contentType: type }, "the new picture"), path);
-    },
-    async removeAvatar(accessToken) {
-      const path = "/api/app/profile/avatar/remove";
-      return asProfile(await appRequest(path, accessToken, { method: "POST" }, "the removed picture"), path);
-    },
-    async inviteUsers(appKey, input) {
-      if (input.users.length > MAX_INVITATIONS) {
-        throw new SsoError(`inviteUsers: ${input.users.length} users, BID accepts at most ${MAX_INVITATIONS} per call.`);
-      }
-      const body = await appPost("/api/app/invitations", appKey, input, "the invitation outcome");
-      if (!Array.isArray(body?.results)) {
-        throw new SsoError(`invitations returned no "results" array \u2014 the invitation outcome is unknown.`);
-      }
-      for (const r of body.results) {
-        if (typeof r?.outcome !== "string" || !INVITATION_OUTCOMES.has(r.outcome)) {
-          throw new SsoError(`invitations returned outcome ${JSON.stringify(r?.outcome)} for ${String(r?.email)} \u2014 not one this client knows.`);
-        }
-      }
-      return body.results;
-    },
-    async migrationStatus(appKey, emails) {
-      const body = await appPost("/api/app/migration-status", appKey, { emails }, "the migration state");
-      if (!Array.isArray(body?.users) || typeof body.complete !== "boolean") {
-        throw new SsoError(`migration-status returned no "users" array or no "complete" flag \u2014 the migration state is unknown.`);
-      }
-      for (const u of body.users) {
-        if (typeof u?.state !== "string" || !MIGRATION_STATES.has(u.state)) {
-          throw new SsoError(`migration-status returned state ${JSON.stringify(u?.state)} for ${String(u?.email)} \u2014 never read as "ready".`);
-        }
-      }
-      return body;
+    async get({ audience, scope }) {
+      const key = `${audience} ${scope ?? ""}`;
+      const hit = cache.get(key);
+      if (hit && hit.exp - renewBeforeSec > now() / 1e3) return hit.token;
+      const pending = inFlight.get(key);
+      if (pending) return pending;
+      const p = exchange(audience, scope).then((t) => {
+        cache.set(key, t);
+        return t.token;
+      }).finally(() => inFlight.delete(key));
+      inFlight.set(key, p);
+      return p;
     }
   };
 }
+var shared = null;
+function fetchTicket(opts) {
+  shared ??= createTicketClient();
+  return shared.get(opts);
+}
 var PRINCIPAL_TYPES = ["human", "service", "agent"];
 function createTicketVerifier(options) {
   const {
@@ -743,8 +219,8 @@ function createTicketVerifier(options) {
       }
       if (typeof payload.sub !== "string" || payload.sub === "") throw new SsoError("ticket has no sub");
       const scopes = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [];
-      const required2 = opts.scope === void 0 ? [] : Array.isArray(opts.scope) ? opts.scope : [opts.scope];
-      const missing = required2.filter((s) => !scopes.includes(s));
+      const required = opts.scope === void 0 ? [] : Array.isArray(opts.scope) ? opts.scope : [opts.scope];
+      const missing = required.filter((s) => !scopes.includes(s));
       if (missing.length) throw new SsoError(`ticket lacks scope ${missing.join(", ")}`);
       const actRaw = payload.act;
       const act = actRaw && typeof actRaw.sub === "string" && actRaw.sub ? { sub: actRaw.sub } : null;
@@ -762,125 +238,6 @@ function createTicketVerifier(options) {
   };
 }
 
-// src/session.ts
-var enc = new TextEncoder();
-var b64url2 = (bytes) => {
-  let s = "";
-  for (const b of bytes) s += String.fromCharCode(b);
-  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-};
-var fromB64url = (s) => {
-  const pad = s.replace(/-/g, "+").replace(/_/g, "/");
-  const bin = atob(pad + "=".repeat((4 - pad.length % 4) % 4));
-  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
-};
-async function hmacKey(secret) {
-  return crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
-    "sign",
-    "verify"
-  ]);
-}
-async function signValue(value, secret, options = {}) {
-  const payload = b64url2(enc.encode(value));
-  const body = options.maxAgeSeconds === void 0 ? payload : `t${Math.floor((options.now ?? Date.now)() / 1e3)}~${payload}`;
-  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", await hmacKey(secret), enc.encode(body)));
-  return `${body}.${b64url2(sig)}`;
-}
-var STAMPED = /^t(\d+)~(.*)$/s;
-async function verifyValue(token, secret, options = {}) {
-  if (!token) return null;
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const body = token.slice(0, dot);
-  try {
-    const ok = await crypto.subtle.verify(
-      "HMAC",
-      await hmacKey(secret),
-      fromB64url(token.slice(dot + 1)),
-      enc.encode(body)
-    );
-    if (!ok) return null;
-    const stamped = STAMPED.exec(body);
-    if (options.maxAgeSeconds !== void 0) {
-      if (!stamped) return null;
-      const issuedAt = Number(stamped[1]);
-      if ((options.now ?? Date.now)() / 1e3 - issuedAt > options.maxAgeSeconds) return null;
-    }
-    return new TextDecoder().decode(fromB64url(stamped?.[2] ?? body));
-  } catch {
-    return null;
-  }
-}
-async function signSession(payload, secret) {
-  return signValue(JSON.stringify(payload), secret);
-}
-async function verifySession(token, secret, now = Date.now) {
-  const body = await verifyValue(token, secret);
-  if (body === null) return null;
-  try {
-    const payload = JSON.parse(body);
-    if (typeof payload.sub !== "string" || payload.sub === "") return null;
-    if (typeof payload.exp !== "number" || payload.exp * 1e3 <= now()) return null;
-    return payload;
-  } catch {
-    return null;
-  }
-}
-function cookieHeader(name, value, opts) {
-  const parts = [
-    `${name}=${value}`,
-    `Path=${opts.path ?? "/"}`,
-    `Max-Age=${opts.maxAge}`,
-    "HttpOnly",
-    // Lax, NOT Strict, and this is load-bearing: the callback from Broberg ID
-    // is a top-level GET navigation from another site. Strict withholds the
-    // cookie on exactly that navigation, so the login transaction cookie would
-    // be missing when it is needed and every sign-in would fail with "state
-    // does not match" — a message that sends you looking in the wrong place.
-    `SameSite=${opts.sameSite ?? "Lax"}`
-  ];
-  if (opts.secure) parts.push("Secure");
-  return parts.join("; ");
-}
-function readCookie(header, name) {
-  if (!header) return void 0;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq === -1) continue;
-    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
-  }
-  return void 0;
-}
-
-// src/tokens.ts
-var warned = false;
-function memoryTokenStore(options = {}) {
-  if (!options.quiet && !warned) {
-    warned = true;
-    console.warn(
-      "@broberg/sso: memoryTokenStore() keeps tokens in this process only \u2014 they are lost on restart and not shared between instances. Give ssoRoutes a TokenStore backed by your database in production."
-    );
-  }
-  const rows = /* @__PURE__ */ new Map();
-  return {
-    get size() {
-      return rows.size;
-    },
-    async get(sid) {
-      return rows.get(sid);
-    },
-    async set(sid, tokens) {
-      rows.set(sid, { ...tokens });
-    },
-    async delete(sid) {
-      rows.delete(sid);
-    },
-    async deleteSub(sub) {
-      for (const [sid, t] of rows) if (t.sub === sub) rows.delete(sid);
-    }
-  };
-}
-
-export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoReauthError, cookieHeader, createJwksCache, createSsoClient, createTicketVerifier, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue };
+export { DEFAULT_ISSUER, NoWorkloadIdentityError, TicketExchangeError, TicketUnavailableError, createTicketClient, createTicketVerifier, fetchTicket };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map