@broberg/sso 0.13.0 → 0.14.2

package/dist/session-DsjOyCJb.d.cts

@@ -0,0 +1,580 @@
+import { importJWK, JWTPayload } from 'jose';
+
+/**
+ * Configuration, read from the environment and nowhere else (F084.4 AC#5).
+ *
+ * An app mounts this package and sets env vars. It does not pass options in
+ * code, because the moment configuration lives in code, two deployments of the
+ * same app can disagree about who their identity provider is — and the symptom
+ * is a token rejection nobody can trace back to a config line.
+ */
+declare class SsoConfigError extends Error {
+    constructor(message: string);
+}
+interface SsoConfig {
+    /** Broberg ID's origin, e.g. https://id.broberg.ai — the BARE origin. */
+    issuer: string;
+    /** The client id this app was registered under (administratively, in BID). */
+    clientId: string;
+    /** Exactly the redirect registered in BID. Exact match — one character decides. */
+    redirectUri: string;
+    /** Requested scopes. */
+    scopes: string[];
+    /** Signs the local session cookie. 32+ bytes of randomness. */
+    cookieSecret: string;
+    /** Local session cookie name. */
+    cookieName: string;
+    /**
+     * How long this app trusts its OWN session, in seconds.
+     *
+     * F084.7 decided the fleet's numbers: 7 days for a normal app, and 12 hours
+     * + 30 minutes of inactivity for anything holding personal or health data.
+     * The default here is the 7 days. An app handling patient data MUST set
+     * SSO_SESSION_MAX_AGE=43200 — the default is a normal-app default, not a
+     * safe-for-everything one.
+     */
+    sessionMaxAge: number;
+    /** Where to send the browser after a logout completes. */
+    postLogoutRedirectUri?: string;
+    /**
+     * Set ONLY by an app that can actually keep a secret — one whose callback
+     * runs on a server. Leave it unset for anything shipped to a browser; a
+     * secret in a static bundle is not a secret, and PKCE alone is the correct,
+     * fully standard design there.
+     *
+     * Setting it makes this a CONFIDENTIAL client: the secret is sent as
+     * `client_secret_post` (in the body), which is the method BID registers
+     * confidential clients with.
+     *
+     * IT DOES NOT RELAX PKCE. A secret proves which APP is asking; the PKCE
+     * verifier proves the request belongs to the browser that started the login.
+     * They defend against different attacks, so one is never an excuse to drop
+     * the other — and there is a test that fails if anyone makes it one.
+     */
+    clientSecret?: string;
+}
+/** Seconds in a week — the fleet default from F084.7. */
+declare const DEFAULT_SESSION_MAX_AGE: number;
+declare function loadSsoConfig(env?: NodeJS.ProcessEnv): SsoConfig;
+
+/**
+ * The signing-key cache.
+ *
+ * ── THE ONE BEHAVIOUR THIS FILE EXISTS FOR ────────────────────────────────
+ *
+ * It refetches on an UNKNOWN KEY ID, not on a timer (F084.4's constraint, and
+ * it is the right one). An interval is a guess about when somebody else will
+ * rotate their key; an unknown kid is the event itself. With an interval, the
+ * window between "BID rotated" and "the interval elapsed" is a window where
+ * every login in every app fails, and the length of that window is a number
+ * nobody chose on purpose.
+ *
+ * ── AND THE PART AN OBVIOUS IMPLEMENTATION GETS WRONG ─────────────────────
+ *
+ * "Unknown kid ⇒ refetch" turns anyone who can send this app a token into
+ * someone who can make it hammer BID: a stream of tokens with random kids is a
+ * stream of fetches against the one service the whole fleet logs in through.
+ * So a refetch is rate-limited by time. The cost of the floor is real and worth
+ * stating: a rotation landing inside the cooldown makes logins fail for up to
+ * that many milliseconds. Seconds of failure for one app beats a way to aim
+ * traffic at BID from outside.
+ *
+ * ── TWO FAILURES, NOT ONE (components-F084.50) ───────────────────────────────────────
+ *
+ * Reported by helpdesk, measured in the published 0.1.0 dist: at process start
+ * the key set is EMPTY, so the first verification fetches. If BID is down in
+ * that second, NOTHING verifies for that app — not just new logins. A process
+ * that has been running and has seen a kid survives the same outage untouched.
+ *
+ * The recovery was never the defect: `lastFetchAt` is set only on SUCCESS, so a
+ * failed fetch does not block the next attempt and the cache self-heals the
+ * moment BID answers again. The defect was that `getKey` threw the SAME error
+ * for two states whose correct answers are opposites:
+ *
+ *   cannot reach the issuer    transient. Retry, or answer 503. The token may
+ *                              well be perfectly good — we simply did not look.
+ *   kid is not published       permanent. This token was not signed by us.
+ *                              Reject it, 401, and do not retry.
+ *
+ * One error name for both is how a caller ends up rejecting a legitimate user
+ * because a foreign service had a bad minute — or, worse, retrying a forgery.
+ * Hence two subclasses. They BOTH extend JwksError, so a 0.1.0 consumer whose
+ * catch tests `instanceof JwksError` keeps working across the upgrade.
+ *
+ * ── WHAT WE DELIBERATELY DID NOT DO ───────────────────────────────────────
+ *
+ * We do NOT persist the key set. A stored key set that survives a REVOCATION is
+ * a worse failure than a login that is down for two minutes — helpdesk's own
+ * point, and the reason `keys = body.keys` replaces rather than merges. Writing
+ * the set to disk would reintroduce exactly what that line exists to prevent.
+ */
+
+type SigningKey = Awaited<ReturnType<typeof importJWK>>;
+interface JwksCacheOptions {
+    /** Absolute URL of the key set, taken from BID's discovery document. */
+    jwksUri: string;
+    /**
+     * The floor between two refetches. Below it, an unknown kid is rejected
+     * without asking BID again.
+     */
+    minRefetchIntervalMs?: number;
+    /**
+     * Fetch the key set once at construction, so the cold window sits at BOOT
+     * rather than in front of the first user who tries to log in.
+     *
+     * It is fire-and-forget ON PURPOSE: a failed warm-up must never stop the app
+     * from starting. A package that refuses to boot because someone else's
+     * service is down has made the outage worse, not better — the first getKey
+     * will simply fetch, exactly as it does today.
+     */
+    warmUp?: boolean;
+    /** Injectable for tests. */
+    fetchImpl?: typeof fetch;
+    /** Injectable for tests, so the cooldown can be exercised without waiting. */
+    now?: () => number;
+}
+interface JwksCache {
+    /** Resolve a key for this kid, refetching once if it is unknown. */
+    getKey(kid: string, alg: string): Promise<SigningKey>;
+    /** How many times the remote key set has actually been fetched. */
+    readonly fetchCount: number;
+}
+declare class JwksError extends Error {
+    constructor(message: string);
+}
+/**
+ * The issuer could not be consulted — unreachable, a non-2xx, or a body that is
+ * not a key set. Also thrown when an unknown kid arrives inside the refetch
+ * cooldown, because there too the honest statement is "we did not look".
+ *
+ * TRANSIENT. The right response is to retry, or to answer 503 — never to
+ * conclude anything about the token, which may be perfectly valid.
+ */
+declare class JwksUnavailableError extends JwksError {
+    constructor(message: string);
+}
+/**
+ * The issuer WAS consulted and does not publish this key id.
+ *
+ * PERMANENT. The token was not signed by this issuer. Reject it; retrying only
+ * asks the same question again and BID will keep giving the same answer.
+ */
+declare class JwksUnknownKeyError extends JwksError {
+    constructor(message: string);
+}
+declare function createJwksCache(options: JwksCacheOptions): JwksCache;
+
+/**
+ * The core: framework-free, public-client OAuth 2.1 against Broberg ID.
+ *
+ * ── THIS PACKAGE IS A PUBLIC CLIENT. THERE IS NO CLIENT SECRET. ───────────
+ *
+ * Deliberate, and F084.4 AC#4 greps the published tarball to keep it that way.
+ * PKCE alone carries the exchange. That is safe here for a reason worth stating
+ * rather than assuming: BID matches redirect addresses EXACTLY (measured — one
+ * trailing slash is refused), so the authorization code is delivered to this
+ * app's own server and nowhere else. An attacker who knows the client id can
+ * start a flow; they cannot receive its result.
+ *
+ * What it buys is the thing the card actually asks for: a secret that does not
+ * exist cannot be committed, leaked in a log, copied into a second app, or left
+ * behind in a repository someone later makes public.
+ *
+ * ── AND WHAT THIS PACKAGE MUST NEVER LEARN TO DO ──────────────────────────
+ *
+ * No passwords. No passkey registration. No social-provider keys. No email
+ * verification. All of it lives in BID. A client that CAN do any of it is a
+ * client somebody eventually uses to do it — and then the identity rules exist
+ * in two places and drift.
+ */
+
+interface Discovery {
+    /** What the issuer says it signs with. Absent on some providers. */
+    id_token_signing_alg_values_supported?: string[];
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    userinfo_endpoint?: string;
+    end_session_endpoint?: string;
+}
+declare class SsoError extends Error {
+    constructor(message: string);
+}
+/**
+ * F095.2 — the user must log in again: there is no live session, no stored
+ * tokens, or the renewal was refused. `reason` says which; "no_session" means
+ * there never was a login to recover, the others mean there was one and it is
+ * spent. Thrown by getAccessToken.
+ */
+declare class SsoReauthError extends SsoError {
+    readonly reason: "no_session" | "no_tokens" | "expired" | "refresh_failed";
+    constructor(message: string, reason: "no_session" | "no_tokens" | "expired" | "refresh_failed");
+}
+/**
+ * F095.2 — BID's app API answered with an error, or did not answer at all.
+ * `status` is BID's HTTP status (null when nothing came back: timeout, network);
+ * `code` is BID's own `error` field when it sent one. The message carries the
+ * URL, the status and the code — never the body, never a token.
+ */
+declare class SsoAppApiError extends SsoError {
+    readonly status: number | null;
+    readonly code: string | undefined;
+    constructor(message: string, status: number | null, code: string | undefined);
+}
+/**
+ * F095.2 — BID refused because the user's token lacks a scope (403
+ * insufficient_scope). For the profile writes that is `profile:write`: the app
+ * must request it at login, and a user who logged in before it did must log in
+ * again. That is the one actionable fact, so it gets its own class.
+ */
+declare class SsoInsufficientScopeError extends SsoAppApiError {
+    readonly scope: string;
+    constructor(message: string, scope: string);
+}
+/** F095.2 — an avatar refused BEFORE it was sent: too big, or not PNG/JPEG/WebP. */
+declare class SsoAvatarRejectedError extends SsoError {
+    readonly reason: "too_large" | "unsupported_type";
+    constructor(message: string, reason: "too_large" | "unsupported_type");
+}
+/** BID's limit for a profile picture (llms.txt step 7a: "max 2 MB", read as 2 MiB). */
+declare const MAX_AVATAR_BYTES: number;
+/** The picture types BID accepts. */
+declare const AVATAR_TYPES: readonly string[];
+/** The signed-in user's own profile, as BID's GET /api/app/profile returns it. */
+interface BidProfile {
+    sub: string;
+    name: string | null;
+    picture: string | null;
+    email: string | null;
+    /** BID's own account page — mail, password, passkeys, 2FA and sessions live there. */
+    account_url: string;
+}
+/**
+ * What `beginLogin` produces. Every field except `url` must survive the round
+ * trip to BID and back — the adapter stores them in a short-lived cookie.
+ *
+ * They are NOT optional extras. `state` is what makes the callback provably the
+ * answer to THIS request, and `nonce` is what stops a valid token minted for
+ * some other login from being replayed into this one.
+ */
+interface LoginStart {
+    url: string;
+    state: string;
+    codeVerifier: string;
+    nonce: string;
+}
+interface SsoClaims extends JWTPayload {
+    sub: string;
+    email?: string;
+    name?: string;
+    picture?: string;
+    email_verified?: boolean;
+}
+interface LoginResult {
+    claims: SsoClaims;
+    /**
+     * The claims in `claims` that came from the UNSIGNED userinfo response and
+     * not from the signed ID token (components-F084.51, since 0.8.0). Sorted; an
+     * empty list means everything in `claims` was signed (or userinfo was not
+     * reached). When both sources carry a claim, the signed token's value wins
+     * and the claim is not listed.
+     *
+     * On BID today this always contains "email" and "email_verified": the ID
+     * token does not carry them (measured by broberg-id, 20 Sep 2026). A decision
+     * that must rest on a signed identity binds on `claims.sub`, never on email.
+     */
+    unverifiedClaims: string[];
+    idToken: string;
+    accessToken?: string;
+    refreshToken?: string;
+    /** Seconds the access token lives, when BID said so (`expires_in`). */
+    expiresIn?: number;
+}
+/**
+ * `prompt=none` asks BID to answer WITHOUT showing anything (components-F084.6).
+ *
+ * The delivery method decides whether it works, and this package only ever
+ * produces a URL for a FULL TOP-LEVEL REDIRECT. It never returns anything an
+ * app could put in a hidden iframe, because an iframe against the identity
+ * provider is third-party context: Safari has blocked it for years and Chrome
+ * is retiring it. That path works in testing on a Mac and fails for every user
+ * on an iPhone — a failure that looks like "you are not logged in".
+ */
+interface BeginLoginOptions {
+    prompt?: "none" | "login" | "consent" | "select_account";
+    /** Extra scopes for this one request, on top of the configured set. */
+    scopes?: string[];
+}
+interface SsoClient {
+    discovery(): Promise<Discovery>;
+    beginLogin(options?: BeginLoginOptions): Promise<LoginStart>;
+    completeLogin(input: {
+        params: URLSearchParams;
+        state: string;
+        codeVerifier: string;
+        nonce: string;
+    }): Promise<LoginResult>;
+    verifyIdToken(idToken: string, options?: {
+        nonce?: string;
+    }): Promise<SsoClaims>;
+    logoutUrl(options?: {
+        idTokenHint?: string;
+        postLogoutRedirectUri?: string;
+    }): Promise<string>;
+    /**
+     * Does this address belong to the signed-in user's BID account, and is it
+     * verified there? Asks BID's POST /api/app/address-ownership with the user's
+     * access token. Throws SsoError on anything that is not one of the three
+     * answers — see the implementation for why that must never become "unverified".
+     */
+    addressOwnership(accessToken: string, address: string): Promise<AddressOwnership>;
+    /**
+     * F095.1 — trade a refresh token for a new access token (`grant_type=refresh_token`).
+     * Throws SsoError on refusal; the message carries the status and BID's error
+     * code, never a token.
+     */
+    refreshTokens(refreshToken: string): Promise<{
+        accessToken: string;
+        refreshToken?: string;
+        expiresIn?: number;
+    }>;
+    /**
+     * Invite users to BID on behalf of this app (the app's OWN key, `bidk_…`).
+     * One result per email. Throws SsoError on anything BID did not clearly say.
+     */
+    inviteUsers(appKey: string, input: InviteUsersInput): Promise<InvitationResult[]>;
+    /**
+     * Where each user is in the move to BID. Throws SsoError on any state it does
+     * not know — never a silent "ready", which would switch off a user's old login
+     * while they cannot get in.
+     */
+    migrationStatus(appKey: string, emails: string[]): Promise<MigrationStatus>;
+    /**
+     * Verify an OIDC Back-Channel Logout token from BID («Log ud overalt»).
+     * Throws SsoError on anything that is not a valid, sub-only logout token.
+     */
+    verifyLogoutToken(token: string): Promise<LogoutToken>;
+    /**
+     * F095.2 — the signed-in user's own profile (scope `profile`), with the user's
+     * access token. Throws SsoAppApiError on any refusal.
+     */
+    getProfile(accessToken: string): Promise<BidProfile>;
+    /** F095.2 — change the user's own name (scope `profile:write`). Returns the new profile. */
+    updateProfile(accessToken: string, name: string): Promise<BidProfile>;
+    /**
+     * F095.2 — replace the user's picture (scope `profile:write`). Refuses more than
+     * MAX_AVATAR_BYTES or a type outside AVATAR_TYPES with SsoAvatarRejectedError
+     * BEFORE anything is sent.
+     */
+    uploadAvatar(accessToken: string, bytes: Uint8Array | ArrayBuffer, contentType: string): Promise<BidProfile>;
+    /** F095.2 — remove the user's picture (scope `profile:write`). */
+    removeAvatar(accessToken: string): Promise<BidProfile>;
+    /** Exposed for tests and for a health check; not needed in normal use. */
+    readonly jwks: JwksCache;
+}
+type AddressOwnership = "verified" | "unverified" | "not_on_account";
+type InvitationOutcome = "invited" | "already_invited" | "existing" | "invalid" | "too_soon" | "too_many_today" | "send_failed";
+interface InviteUsersInput {
+    customerName: string;
+    appUrl: string;
+    appName?: string;
+    switchDate?: string;
+    users: Array<{
+        email: string;
+        name: string;
+    }>;
+}
+interface InvitationResult {
+    email: string;
+    outcome: InvitationOutcome;
+    mailId?: string;
+    problem?: string;
+}
+type MigrationState = "ready" | "invited" | "expired" | "not_invited";
+interface MigrationStatus {
+    users: Array<{
+        email: string;
+        state: MigrationState;
+        expiresAt?: string;
+    }>;
+    counts: Record<string, number>;
+    complete: boolean;
+}
+/** A verified back-channel logout: every session for `sub` issued at or before `iat` is over. */
+interface LogoutToken {
+    sub: string;
+    iat: number;
+    jti: string;
+    exp: number;
+}
+/** BID's own limit per invitation call. */
+declare const MAX_INVITATIONS = 500;
+interface CreateSsoClientOptions {
+    fetchImpl?: typeof fetch;
+    /**
+     * Ceiling for the app-API calls (addressOwnership, inviteUsers,
+     * migrationStatus). A hanging BID must not hang the app. Default 10 000 ms.
+     */
+    timeoutMs?: number;
+    /** Passed through to the key cache; see jwks.ts for why there is a floor. */
+    minRefetchIntervalMs?: number;
+}
+declare function createSsoClient(config: SsoConfig, options?: CreateSsoClientOptions): SsoClient;
+
+/**
+ * Server-side tokens for calling Broberg ID on the user's behalf (F095.1).
+ *
+ * The login already RECEIVES an access token and a refresh token; before 0.9.0
+ * ssoRoutes dropped both, so an app could not call BID's app API (the account
+ * page: read and change your own name and picture) as the user.
+ *
+ * ── WHY NOT IN THE COOKIE ────────────────────────────────────────────────
+ * The session cookie is SIGNED, not encrypted, and the browser can read it. A
+ * refresh token is the longest-lived, highest-value credential in the whole
+ * flow: whoever holds it can mint access tokens until it is revoked. So the
+ * tokens live server-side, keyed by a random `sid` that is the only thing the
+ * cookie carries. A stolen cookie still needs the server to be useful.
+ */
+interface TokenSet {
+    /** The BID subject the tokens belong to — lets «Log ud overalt» find them. */
+    sub: string;
+    accessToken: string;
+    refreshToken?: string;
+    /** Unix seconds. */
+    expiresAt: number;
+}
+/**
+ * Where the tokens live. The APP provides it in production, backed by
+ * something every instance shares (SQLite on one machine, a database or Redis
+ * on several) — the same reason BackchannelStore has no in-memory default.
+ */
+interface TokenStore {
+    get(sid: string): Promise<TokenSet | undefined>;
+    set(sid: string, tokens: TokenSet): Promise<void>;
+    delete(sid: string): Promise<void>;
+    /** Drop every token set for `sub` — what «Log ud overalt» calls. */
+    deleteSub(sub: string): Promise<void>;
+}
+/**
+ * An in-process TokenStore. Fine for tests and a single dev process. In
+ * production it LOSES every user's tokens on a restart (they must log in again
+ * before the account page works) and is not shared between machines — so it
+ * says so, once, when created.
+ */
+declare function memoryTokenStore(options?: {
+    quiet?: boolean;
+}): TokenStore & {
+    readonly size: number;
+};
+
+/**
+ * The app's OWN session cookie — signed, not encrypted.
+ *
+ * Signed is the right choice and the distinction matters: the contents are not
+ * secret (a user may read their own id and name), but they must not be
+ * FORGEABLE. Encryption would hide a subject id the user already knows while
+ * doing nothing extra about forgery, which is the actual risk.
+ *
+ * What goes in is deliberately small: who you are and when this stops being
+ * true. Claims that can change — a name, a role, a picture — belong in the
+ * app's own store keyed by `sub`, because a cookie is a cache nobody can
+ * invalidate, and a stale role in a cookie is a permission that outlives its
+ * revocation.
+ */
+interface SessionPayload {
+    /** The subject from Broberg ID. The one stable identifier. */
+    sub: string;
+    /** Unix seconds. Checked on every read. */
+    exp: number;
+    /**
+     * Unix seconds, when this session was minted. What «Log ud overalt» compares
+     * against (F084.151). Absent on sessions minted before 0.6.0 — those count as
+     * older than any logout.
+     */
+    iat?: number;
+    /**
+     * F095.1 — the key to this session's server-side tokens (ssoRoutes'
+     * `tokenStore`). Random, 128 bits. The tokens themselves are NEVER in the
+     * cookie: it is signed, not encrypted, and the browser can read it.
+     */
+    sid?: string;
+    /** Optional convenience copies; never authorisation data. */
+    email?: string;
+    name?: string;
+    /** A URL, never bytes. The picture lives wherever BID put it; this is a
+     *  reference, so a changed picture propagates without every app storing a
+     *  copy that then goes stale. */
+    picture?: string;
+    /**
+     * Whether BID has verified `email` (F084.152). Absent when BID did not say.
+     * Bind access to an address only when this is `true`.
+     */
+    email_verified?: boolean;
+}
+/**
+ * Sign an arbitrary string. The primitive underneath BOTH cookies this package
+ * sets — the session and the short-lived login transaction.
+ *
+ * They are separate functions on purpose. The first version of this file had
+ * the transaction ride inside the session envelope with `exp: 0`, and the
+ * expiry check (`exp * 1000 <= now()`) then rejected it every single time: the
+ * transaction cookie could never be read back, so every login would have failed
+ * with "state does not match" — a message pointing at the wrong thing entirely.
+ * Two different lifetimes wanted two different envelopes, not one envelope with
+ * a sentinel in it.
+ */
+declare function signValue(value: string, secret: string, options?: {
+    maxAgeSeconds?: number;
+    now?: () => number;
+}): Promise<string>;
+/**
+ * Verify the signature, and — only if you ask — the age (components-F084.53).
+ *
+ * THE PREFIX ON THAT NUMBER IS NOT DECORATION. F-numbers are per-project, and
+ * this comment ships in the .d.ts — so a consumer reading it in their editor
+ * resolves the number against whatever board THEY know. broberg-id found this
+ * by reading their own F084.53, which is "no limit on password guesses": a
+ * different feature, in a different repo, behind the same string.
+ *
+ * WITHOUT `maxAgeSeconds` this is signature-only, exactly as before. That is
+ * not laziness: the login-transaction cookie has lived on its browser `Max-Age`
+ * since the package shipped, and making the check mandatory would invalidate
+ * every cookie already in a user's browser — an instant logout for everyone.
+ *
+ * WITH `maxAgeSeconds`, a value the SERVER can date is refused once it is too
+ * old. Reported by broberg-id: `Max-Age` is the client's claim about when a
+ * cookie stopped being valid, and a client may simply not make that claim, so
+ * the server used to accept a correctly-signed transaction value forever.
+ *
+ * THE MIXED CASE IS THE ONE THAT DECIDES WHETHER THIS IS WORTH ANYTHING: a
+ * value signed by the OLD code (no timestamp) verified by the NEW code (with a
+ * limit). That happens during every rollout, and it FAILS CLOSED — otherwise an
+ * undated value would be the way around the very limit being added, and the
+ * limit would only apply to those not trying to avoid it.
+ */
+declare function verifyValue(token: string | undefined | null, secret: string, options?: {
+    maxAgeSeconds?: number;
+    now?: () => number;
+}): Promise<string | null>;
+declare function signSession(payload: SessionPayload, secret: string): Promise<string>;
+/**
+ * Returns null for ANY reason the cookie cannot be trusted — tampered,
+ * truncated, wrong secret, expired, or simply not one of ours.
+ *
+ * Deliberately one return value rather than distinguishing them to the caller:
+ * an app that can tell "bad signature" from "expired" will eventually branch on
+ * it, and there is no branch where a forged cookie should do anything other
+ * than what an absent one does.
+ */
+declare function verifySession(token: string | undefined | null, secret: string, now?: () => number): Promise<SessionPayload | null>;
+/** Serialise a Set-Cookie value. `secure` is off only for http://localhost. */
+declare function cookieHeader(name: string, value: string, opts: {
+    maxAge: number;
+    secure: boolean;
+    sameSite?: "Lax" | "Strict";
+    path?: string;
+}): string;
+declare function readCookie(header: string | null | undefined, name: string): string | undefined;
+
+export { AVATAR_TYPES as A, type BeginLoginOptions as B, type CreateSsoClientOptions as C, DEFAULT_SESSION_MAX_AGE as D, createSsoClient as E, loadSsoConfig as F, memoryTokenStore as G, readCookie as H, type InvitationOutcome as I, type JwksCache as J, signSession as K, type LoginResult as L, MAX_AVATAR_BYTES as M, signValue as N, verifySession as O, verifyValue as P, type SsoClient as S, type TokenStore as T, type SsoConfig as a, type SessionPayload as b, type AddressOwnership as c, type BidProfile as d, type Discovery as e, type InvitationResult as f, type InviteUsersInput as g, type JwksCacheOptions as h, JwksError as i, JwksUnavailableError as j, JwksUnknownKeyError as k, type LoginStart as l, type LogoutToken as m, MAX_INVITATIONS as n, type MigrationState as o, type MigrationStatus as p, SsoAppApiError as q, SsoAvatarRejectedError as r, type SsoClaims as s, SsoConfigError as t, SsoError as u, SsoInsufficientScopeError as v, SsoReauthError as w, type TokenSet as x, cookieHeader as y, createJwksCache as z };