@broberg/sso 0.14.1 → 0.14.2

package/dist/chunk-JGIO7XPR.cjs

@@ -0,0 +1,833 @@
+'use strict';
+
+var jose = require('jose');
+
+// src/config.ts
+var SsoConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SsoConfigError";
+  }
+};
+function required(env, name, hint) {
+  const raw = env[name];
+  if (typeof raw !== "string" || raw.trim() === "") {
+    throw new SsoConfigError(`${name} is not set (or is blank). ${hint}`);
+  }
+  return raw.trim();
+}
+var DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 7;
+function loadSsoConfig(env = process.env) {
+  const rawIssuer = required(
+    env,
+    "BID_ISSUER",
+    "It is Broberg ID's bare origin, e.g. https://id.broberg.ai"
+  );
+  let issuer;
+  try {
+    const url = new URL(rawIssuer);
+    if (url.protocol !== "https:" && url.hostname !== "localhost") {
+      throw new SsoConfigError(
+        `BID_ISSUER must be https (got ${url.protocol}//). Only localhost may be http.`
+      );
+    }
+    issuer = url.origin;
+  } catch (err) {
+    if (err instanceof SsoConfigError) throw err;
+    throw new SsoConfigError(`BID_ISSUER is not a valid URL: ${rawIssuer}`);
+  }
+  const cookieSecret = required(
+    env,
+    "SSO_COOKIE_SECRET",
+    "Generate one with `openssl rand -hex 32`. It signs this app's session cookie."
+  );
+  if (cookieSecret.length < 32) {
+    throw new SsoConfigError(
+      `SSO_COOKIE_SECRET is ${cookieSecret.length} characters; it must be at least 32. A short secret is a forgeable session, and a forged session is any user you like.`
+    );
+  }
+  const rawMaxAge = env.SSO_SESSION_MAX_AGE?.trim();
+  let sessionMaxAge = DEFAULT_SESSION_MAX_AGE;
+  if (rawMaxAge) {
+    const n = Number(rawMaxAge);
+    if (!Number.isFinite(n) || n <= 0) {
+      throw new SsoConfigError(
+        `SSO_SESSION_MAX_AGE must be a positive number of seconds (got ${JSON.stringify(rawMaxAge)}).`
+      );
+    }
+    sessionMaxAge = Math.floor(n);
+  }
+  return {
+    issuer,
+    clientId: required(env, "SSO_CLIENT_ID", "The id this app is registered under in Broberg ID."),
+    redirectUri: required(
+      env,
+      "SSO_REDIRECT_URI",
+      "Must match the registered redirect EXACTLY \u2014 one trailing slash is a different address."
+    ),
+    scopes: (env.SSO_SCOPES?.trim() || "openid profile email").split(/\s+/),
+    cookieSecret,
+    cookieName: env.SSO_COOKIE_NAME?.trim() || "bid_session",
+    sessionMaxAge,
+    postLogoutRedirectUri: env.SSO_POST_LOGOUT_REDIRECT_URI?.trim() || void 0,
+    clientSecret: env.SSO_CLIENT_SECRET?.trim() || void 0
+  };
+}
+var JwksError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JwksError";
+  }
+};
+var JwksUnavailableError = class extends JwksError {
+  constructor(message) {
+    super(message);
+    this.name = "JwksUnavailableError";
+  }
+};
+var JwksUnknownKeyError = class extends JwksError {
+  constructor(message) {
+    super(message);
+    this.name = "JwksUnknownKeyError";
+  }
+};
+function createJwksCache(options) {
+  const {
+    jwksUri,
+    minRefetchIntervalMs = 1e4,
+    warmUp = false,
+    fetchImpl = fetch,
+    now = () => Date.now()
+  } = options;
+  let keys = [];
+  let lastFetchAt = -Infinity;
+  let fetchCount = 0;
+  let inFlight = null;
+  async function refresh() {
+    if (inFlight) return inFlight;
+    inFlight = (async () => {
+      let res;
+      try {
+        res = await fetchImpl(jwksUri);
+      } catch (cause) {
+        throw new JwksUnavailableError(
+          `${jwksUri} could not be reached: ${cause instanceof Error ? cause.message : String(cause)}`
+        );
+      }
+      if (!res.ok) {
+        throw new JwksUnavailableError(
+          `${jwksUri} answered ${res.status} \u2014 cannot verify any token right now`
+        );
+      }
+      let body;
+      try {
+        body = await res.json();
+      } catch {
+        throw new JwksUnavailableError(`${jwksUri} answered 200 with a body that is not JSON`);
+      }
+      if (!Array.isArray(body?.keys)) {
+        throw new JwksUnavailableError(`${jwksUri} returned no "keys" array`);
+      }
+      keys = body.keys;
+      lastFetchAt = now();
+      fetchCount++;
+    })().finally(() => {
+      inFlight = null;
+    });
+    return inFlight;
+  }
+  if (warmUp) {
+    void refresh().catch(() => {
+    });
+  }
+  return {
+    get fetchCount() {
+      return fetchCount;
+    },
+    async getKey(kid, alg) {
+      let jwk = keys.find((k) => k.kid === kid);
+      if (!jwk) {
+        const sinceLast = now() - lastFetchAt;
+        if (sinceLast < minRefetchIntervalMs) {
+          throw new JwksUnavailableError(
+            `kid ${kid} is not in the key set we hold, fetched ${sinceLast}ms ago (we do not ask the issuer again within ${minRefetchIntervalMs}ms). A key set this fresh that lacks the kid means the token was not signed by this issuer \u2014 reject it. Only a key rotation within the last ${minRefetchIntervalMs}ms could make that wrong.`
+          );
+        }
+        await refresh();
+        jwk = keys.find((k) => k.kid === kid);
+      }
+      if (!jwk) {
+        throw new JwksUnknownKeyError(
+          `Broberg ID does not publish a signing key with kid ${kid}. The token was not signed by this issuer.`
+        );
+      }
+      return jose.importJWK(jwk, alg);
+    }
+  };
+}
+var SsoError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SsoError";
+  }
+};
+var SsoReauthError = class extends SsoError {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "SsoReauthError";
+  }
+  reason;
+};
+var SsoAppApiError = class extends SsoError {
+  constructor(message, status, code) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "SsoAppApiError";
+  }
+  status;
+  code;
+};
+var SsoInsufficientScopeError = class extends SsoAppApiError {
+  constructor(message, scope) {
+    super(message, 403, "insufficient_scope");
+    this.scope = scope;
+    this.name = "SsoInsufficientScopeError";
+  }
+  scope;
+};
+var SsoAvatarRejectedError = class extends SsoError {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "SsoAvatarRejectedError";
+  }
+  reason;
+};
+var MAX_AVATAR_BYTES = 2 * 1024 * 1024;
+var AVATAR_TYPES = ["image/png", "image/jpeg", "image/webp"];
+function mediaType(contentType) {
+  return (contentType ?? "").split(";")[0].trim().toLowerCase();
+}
+var b64url = (bytes) => {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let s = "";
+  for (const b of view) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var randomToken = (bytes = 32) => b64url(crypto.getRandomValues(new Uint8Array(bytes)));
+async function challengeFor(verifier) {
+  return b64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
+}
+var ADDRESS_OWNERSHIP = /* @__PURE__ */ new Set(["verified", "unverified", "not_on_account"]);
+var INVITATION_OUTCOMES = /* @__PURE__ */ new Set([
+  "invited",
+  "already_invited",
+  "existing",
+  "invalid",
+  "too_soon",
+  "too_many_today",
+  "send_failed"
+]);
+var MIGRATION_STATES = /* @__PURE__ */ new Set(["ready", "invited", "expired", "not_invited"]);
+var BACKCHANNEL_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+var MAX_INVITATIONS = 500;
+function excerptForLog(raw, clientSecret) {
+  let text = raw.replace(/\s+/g, " ").trim();
+  if (clientSecret) text = text.split(clientSecret).join("[redacted client_secret]");
+  if (text === "") return "(empty body)";
+  return text.length > 200 ? `${text.slice(0, 200)}\u2026` : text;
+}
+function invalidClientHint(error, weSentASecret) {
+  if (error !== "invalid_client") return "";
+  return weSentASecret ? " \u2014 we DID send a client_secret, so either it is wrong or this client is registered as PUBLIC (in which case unset SSO_CLIENT_SECRET)." : " \u2014 we sent NO client_secret, so this client is likely registered as CONFIDENTIAL (set SSO_CLIENT_SECRET to the value it was registered with).";
+}
+var ALLOWED_ALGS = [
+  // FIRST, because it is what Broberg ID actually signs with. Measured on the
+  // live issuer 2026-09-20:
+  //   /jwks      kid=Iodh… kty=OKP alg=EdDSA crv=Ed25519
+  //   discovery  id_token_signing_alg_values_supported: ["EdDSA"]
+  //
+  // 0.2.1 SHIPPED THIS LIST WITHOUT IT and rejected every real token for an
+  // hour. The list was written from what an OIDC client usually allows rather
+  // than from what our issuer uses — and the whole suite missed it because the
+  // fake issuer in the tests signs RS256. A fake agrees with whoever wrote it.
+  // There is now a test that mints EdDSA, the algorithm production uses.
+  "EdDSA",
+  "RS256",
+  "RS384",
+  "RS512",
+  "PS256",
+  "PS384",
+  "PS512",
+  "ES256",
+  "ES384",
+  "ES512"
+];
+function createSsoClient(config, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 1e4;
+  async function appPost(path, bearer, payload, what) {
+    const url = new URL(path, config.issuer).toString();
+    const ctrl = new AbortController();
+    let timer;
+    const timedOut = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        ctrl.abort();
+        reject(new SsoError(`${url} did not answer within ${timeoutMs} ms \u2014 ${what} is unknown.`));
+      }, timeoutMs);
+    });
+    try {
+      const res = await Promise.race([
+        fetchImpl(url, {
+          method: "POST",
+          headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+          body: JSON.stringify(payload),
+          signal: ctrl.signal
+        }),
+        timedOut
+      ]);
+      if (!res.ok) {
+        const detail = await res.text().catch(() => "");
+        const hint = detail.includes("invalid_app_key") ? " (invalid_app_key: this app's bidk_ key was refused)" : "";
+        throw new SsoError(`${url} answered ${res.status}${hint} \u2014 ${what} is unknown.`);
+      }
+      return await Promise.race([res.json().catch(() => null), timedOut]);
+    } catch (e) {
+      if (e instanceof SsoError) throw e;
+      throw new SsoError(`${url} could not be reached: ${e instanceof Error ? e.message : String(e)} \u2014 ${what} is unknown.`);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async function appRequest(path, bearer, init, what) {
+    const url = new URL(path, config.issuer).toString();
+    const ctrl = new AbortController();
+    let timer;
+    const timedOut = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        reject(new SsoAppApiError(`${url} did not answer within ${timeoutMs} ms \u2014 ${what} is unknown.`, null, void 0));
+        ctrl.abort();
+      }, timeoutMs);
+    });
+    const headers = { authorization: `Bearer ${bearer}` };
+    let body;
+    if (init.json !== void 0) {
+      headers["content-type"] = "application/json";
+      body = JSON.stringify(init.json);
+    } else if (init.bytes !== void 0) {
+      headers["content-type"] = init.contentType ?? "application/octet-stream";
+      body = init.bytes;
+    }
+    try {
+      const res = await Promise.race([
+        fetchImpl(url, { method: init.method, headers, ...body !== void 0 ? { body } : {}, signal: ctrl.signal }),
+        timedOut
+      ]);
+      const raw = await Promise.race([res.text(), timedOut]);
+      let parsed;
+      try {
+        parsed = raw.trim() === "" ? void 0 : JSON.parse(raw);
+      } catch {
+        parsed = void 0;
+      }
+      const fields = parsed && typeof parsed === "object" ? parsed : {};
+      const code = typeof fields.error === "string" ? fields.error : void 0;
+      if (!res.ok) {
+        if (res.status === 403 && code === "insufficient_scope") {
+          const scope = typeof fields.scope === "string" && fields.scope ? fields.scope : init.method === "GET" ? "profile" : "profile:write";
+          throw new SsoInsufficientScopeError(
+            `${url} answered 403 insufficient_scope \u2014 the user's token lacks scope "${scope}"; log in again with it requested.`,
+            scope
+          );
+        }
+        throw new SsoAppApiError(`${url} answered ${res.status}${code ? ` (${code})` : ""} \u2014 ${what} is unknown.`, res.status, code);
+      }
+      if (parsed === void 0) {
+        throw new SsoAppApiError(`${url} answered ${res.status} with a body that is not JSON \u2014 ${what} is unknown.`, res.status, void 0);
+      }
+      return parsed;
+    } catch (e) {
+      if (e instanceof SsoError) throw e;
+      throw new SsoAppApiError(`${url} could not be reached (${e instanceof Error ? e.name : "error"}) \u2014 ${what} is unknown.`, null, void 0);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  function asProfile(body, path) {
+    const b = body ?? {};
+    if (typeof b.sub !== "string" || b.sub === "" || typeof b.account_url !== "string") {
+      throw new SsoAppApiError(`${path} returned no "sub" or "account_url" \u2014 the profile is unknown.`, 200, void 0);
+    }
+    const opt = (v) => typeof v === "string" ? v : null;
+    return { sub: b.sub, name: opt(b.name), picture: opt(b.picture), email: opt(b.email), account_url: b.account_url };
+  }
+  let discoveryPromise = null;
+  let jwksCache = null;
+  async function discovery() {
+    discoveryPromise ??= (async () => {
+      const url = `${config.issuer}/.well-known/openid-configuration`;
+      const res = await fetchImpl(url);
+      if (!res.ok) throw new SsoError(`${url} answered ${res.status}`);
+      const doc = await res.json();
+      const advertised = doc.id_token_signing_alg_values_supported;
+      if (Array.isArray(advertised) && advertised.length > 0) {
+        const usable = advertised.filter((a) => ALLOWED_ALGS.includes(a));
+        if (usable.length === 0) {
+          throw new SsoError(
+            `${config.issuer} signs ID tokens with ${advertised.join(", ")}, and this client accepts none of those (it allows ${ALLOWED_ALGS.join(", ")}). Every token would be rejected. This is a mismatch between the package and the issuer \u2014 report it rather than working around it.`
+          );
+        }
+      }
+      if (doc.issuer !== config.issuer) {
+        throw new SsoError(
+          `BID_ISSUER is ${config.issuer} but ${url} says its issuer is ${doc.issuer}. These must match exactly \u2014 tokens are validated against the issuer string.`
+        );
+      }
+      return doc;
+    })().catch((err) => {
+      discoveryPromise = null;
+      throw err;
+    });
+    return discoveryPromise;
+  }
+  async function keys() {
+    if (!jwksCache) {
+      const { jwks_uri } = await discovery();
+      jwksCache = createJwksCache({
+        jwksUri: jwks_uri,
+        fetchImpl,
+        ...options.minRefetchIntervalMs !== void 0 ? { minRefetchIntervalMs: options.minRefetchIntervalMs } : {}
+      });
+    }
+    return jwksCache;
+  }
+  async function verifyLogoutToken(token) {
+    const cache = await keys();
+    let header;
+    try {
+      header = jose.decodeProtectedHeader(token);
+    } catch {
+      throw new SsoError("logout_token is not a JWS");
+    }
+    if (!header.kid) throw new SsoError("logout_token has no kid \u2014 cannot pick a signing key");
+    let payload;
+    try {
+      ({ payload } = await jose.jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "RS256"), {
+        issuer: config.issuer,
+        audience: config.clientId,
+        algorithms: ALLOWED_ALGS,
+        typ: "logout+jwt",
+        requiredClaims: ["iat", "exp", "jti"]
+      }));
+    } catch (e) {
+      throw new SsoError(`logout_token rejected: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    const events = payload.events;
+    if (!events || typeof events !== "object" || !(BACKCHANNEL_EVENT in events)) {
+      throw new SsoError("logout_token has no back-channel logout event");
+    }
+    if ("nonce" in payload) throw new SsoError("logout_token carries a nonce \u2014 that is an ID token, not a logout token");
+    if ("sid" in payload) {
+      throw new SsoError("logout_token carries sid \u2014 only sub-wide \xABLog ud overalt\xBB is accepted (D-376ffa)");
+    }
+    if (typeof payload.sub !== "string" || payload.sub === "") throw new SsoError("logout_token has no sub");
+    return { sub: payload.sub, iat: payload.iat, jti: String(payload.jti), exp: payload.exp };
+  }
+  async function verifyIdToken(idToken, opts = {}) {
+    const cache = await keys();
+    const header = jose.decodeProtectedHeader(idToken);
+    if (!header.kid) throw new SsoError("ID token has no kid \u2014 cannot pick a signing key");
+    const { payload } = await jose.jwtVerify(
+      idToken,
+      async () => cache.getKey(header.kid, header.alg ?? "RS256"),
+      { issuer: config.issuer, audience: config.clientId, algorithms: ALLOWED_ALGS }
+    );
+    if (opts.nonce !== void 0 && payload.nonce !== opts.nonce) {
+      throw new SsoError(
+        "ID token nonce does not match this login request \u2014 refusing a token minted for another sign-in."
+      );
+    }
+    if (typeof payload.sub !== "string" || payload.sub === "") {
+      throw new SsoError("ID token has no sub \u2014 there is no user to be");
+    }
+    return payload;
+  }
+  async function withUserInfo(claims, accessToken) {
+    const doc = await discovery();
+    if (!doc.userinfo_endpoint) return { claims, unverifiedClaims: [] };
+    const res = await fetchImpl(doc.userinfo_endpoint, {
+      headers: { authorization: `Bearer ${accessToken}` }
+    });
+    if (!res.ok) return { claims, unverifiedClaims: [] };
+    const info = await res.json();
+    if (info.sub !== claims.sub) {
+      throw new SsoError(
+        `userinfo describes ${String(info.sub)} but the ID token is for ${claims.sub} \u2014 refusing to merge another user's profile onto this session.`
+      );
+    }
+    const unverifiedClaims = Object.keys(info).filter((k) => k !== "sub" && info[k] !== void 0 && !(k in claims)).sort();
+    return { claims: { ...info, ...claims, sub: claims.sub }, unverifiedClaims };
+  }
+  return {
+    discovery,
+    get jwks() {
+      if (!jwksCache) throw new SsoError("the key cache is created on first verification");
+      return jwksCache;
+    },
+    verifyIdToken,
+    async beginLogin(opts = {}) {
+      const { authorization_endpoint } = await discovery();
+      const codeVerifier = randomToken();
+      const state = randomToken(16);
+      const nonce = randomToken(16);
+      const params = new URLSearchParams({
+        response_type: "code",
+        client_id: config.clientId,
+        redirect_uri: config.redirectUri,
+        scope: [.../* @__PURE__ */ new Set([...config.scopes, ...opts.scopes ?? []])].join(" "),
+        state,
+        nonce,
+        code_challenge: await challengeFor(codeVerifier),
+        code_challenge_method: "S256"
+      });
+      if (opts.prompt) params.set("prompt", opts.prompt);
+      return { url: `${authorization_endpoint}?${params}`, state, codeVerifier, nonce };
+    },
+    async completeLogin({ params, state, codeVerifier, nonce }) {
+      const error = params.get("error");
+      if (error) {
+        throw new SsoError(
+          `Broberg ID refused this login: ${error}` + (params.get("error_description") ? ` \u2014 ${params.get("error_description")}` : "")
+        );
+      }
+      const returned = params.get("state");
+      if (!returned || returned !== state) {
+        throw new SsoError(
+          "state does not match the login this browser started \u2014 refusing the callback."
+        );
+      }
+      const code = params.get("code");
+      if (!code) throw new SsoError("callback carried neither an error nor a code");
+      const { token_endpoint } = await discovery();
+      const res = await fetchImpl(token_endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: config.redirectUri,
+          client_id: config.clientId,
+          // ALWAYS sent, secret or not. See SsoConfig.clientSecret: the two
+          // prove different things, so a confidential client keeps PKCE.
+          code_verifier: codeVerifier,
+          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
+        })
+      });
+      const raw = await res.text();
+      let body;
+      try {
+        body = raw.trim() === "" ? {} : JSON.parse(raw);
+      } catch {
+        throw new SsoError(
+          `token exchange failed (${res.status}): the response body is not JSON${res.headers.get("content-type") ? ` (content-type: ${res.headers.get("content-type")})` : ""} \u2014 ${excerptForLog(raw, config.clientSecret)}`
+        );
+      }
+      if (!res.ok || !body.id_token) {
+        throw new SsoError(
+          `token exchange failed (${res.status}): ${body.error ?? "no id_token in response"}` + (body.error_description ? ` \u2014 ${body.error_description}` : "") + invalidClientHint(body.error, config.clientSecret !== void 0)
+        );
+      }
+      const claims = await verifyIdToken(body.id_token, { nonce });
+      const merged = body.access_token ? await withUserInfo(claims, body.access_token) : { claims, unverifiedClaims: [] };
+      return {
+        claims: merged.claims,
+        unverifiedClaims: merged.unverifiedClaims,
+        idToken: body.id_token,
+        ...body.access_token ? { accessToken: body.access_token } : {},
+        ...body.refresh_token ? { refreshToken: body.refresh_token } : {},
+        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
+      };
+    },
+    async refreshTokens(refreshToken) {
+      const { token_endpoint } = await discovery();
+      const res = await fetchImpl(token_endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: config.clientId,
+          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
+        })
+      });
+      const raw = await res.text();
+      let body;
+      try {
+        body = raw.trim() === "" ? {} : JSON.parse(raw);
+      } catch {
+        throw new SsoError(`token refresh failed (${res.status}): the response body is not JSON`);
+      }
+      if (!res.ok || typeof body.access_token !== "string" || body.access_token === "") {
+        throw new SsoError(`token refresh failed (${res.status}): ${body.error ?? "no access_token in response"}`);
+      }
+      return {
+        accessToken: body.access_token,
+        ...typeof body.refresh_token === "string" && body.refresh_token ? { refreshToken: body.refresh_token } : {},
+        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
+      };
+    },
+    async logoutUrl(opts = {}) {
+      const doc = await discovery();
+      if (!doc.end_session_endpoint) {
+        throw new SsoError(
+          `${config.issuer} does not advertise end_session_endpoint \u2014 central logout is unavailable.`
+        );
+      }
+      const params = new URLSearchParams();
+      if (opts.idTokenHint) params.set("id_token_hint", opts.idTokenHint);
+      const post = opts.postLogoutRedirectUri ?? config.postLogoutRedirectUri;
+      if (post) params.set("post_logout_redirect_uri", post);
+      params.set("client_id", config.clientId);
+      return `${doc.end_session_endpoint}?${params}`;
+    },
+    async addressOwnership(accessToken, address) {
+      const body = await appPost(
+        "/api/app/address-ownership",
+        accessToken,
+        { address },
+        'address ownership (not "unverified")'
+      );
+      const status = body?.status;
+      if (typeof status !== "string" || !ADDRESS_OWNERSHIP.has(status)) {
+        throw new SsoError(`address-ownership returned status ${JSON.stringify(status)} \u2014 expected verified, unverified or not_on_account.`);
+      }
+      return status;
+    },
+    verifyLogoutToken,
+    async getProfile(accessToken) {
+      const path = "/api/app/profile";
+      return asProfile(await appRequest(path, accessToken, { method: "GET" }, "the profile"), path);
+    },
+    async updateProfile(accessToken, name) {
+      const path = "/api/app/profile";
+      return asProfile(await appRequest(path, accessToken, { method: "POST", json: { name } }, "the new name"), path);
+    },
+    async uploadAvatar(accessToken, bytes, contentType) {
+      const type = mediaType(contentType);
+      if (!AVATAR_TYPES.includes(type)) {
+        throw new SsoAvatarRejectedError(
+          `uploadAvatar: "${type}" is not accepted \u2014 BID takes ${AVATAR_TYPES.join(", ")}.`,
+          "unsupported_type"
+        );
+      }
+      if (bytes.byteLength > MAX_AVATAR_BYTES) {
+        throw new SsoAvatarRejectedError(
+          `uploadAvatar: ${bytes.byteLength} bytes \u2014 BID takes at most ${MAX_AVATAR_BYTES}.`,
+          "too_large"
+        );
+      }
+      const path = "/api/app/profile/avatar";
+      return asProfile(await appRequest(path, accessToken, { method: "POST", bytes, contentType: type }, "the new picture"), path);
+    },
+    async removeAvatar(accessToken) {
+      const path = "/api/app/profile/avatar/remove";
+      return asProfile(await appRequest(path, accessToken, { method: "POST" }, "the removed picture"), path);
+    },
+    async inviteUsers(appKey, input) {
+      if (input.users.length > MAX_INVITATIONS) {
+        throw new SsoError(`inviteUsers: ${input.users.length} users, BID accepts at most ${MAX_INVITATIONS} per call.`);
+      }
+      const body = await appPost("/api/app/invitations", appKey, input, "the invitation outcome");
+      if (!Array.isArray(body?.results)) {
+        throw new SsoError(`invitations returned no "results" array \u2014 the invitation outcome is unknown.`);
+      }
+      for (const r of body.results) {
+        if (typeof r?.outcome !== "string" || !INVITATION_OUTCOMES.has(r.outcome)) {
+          throw new SsoError(`invitations returned outcome ${JSON.stringify(r?.outcome)} for ${String(r?.email)} \u2014 not one this client knows.`);
+        }
+      }
+      return body.results;
+    },
+    async migrationStatus(appKey, emails) {
+      const body = await appPost("/api/app/migration-status", appKey, { emails }, "the migration state");
+      if (!Array.isArray(body?.users) || typeof body.complete !== "boolean") {
+        throw new SsoError(`migration-status returned no "users" array or no "complete" flag \u2014 the migration state is unknown.`);
+      }
+      for (const u of body.users) {
+        if (typeof u?.state !== "string" || !MIGRATION_STATES.has(u.state)) {
+          throw new SsoError(`migration-status returned state ${JSON.stringify(u?.state)} for ${String(u?.email)} \u2014 never read as "ready".`);
+        }
+      }
+      return body;
+    }
+  };
+}
+
+// src/session.ts
+var enc = new TextEncoder();
+var b64url2 = (bytes) => {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var fromB64url = (s) => {
+  const pad = s.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(pad + "=".repeat((4 - pad.length % 4) % 4));
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+};
+async function hmacKey(secret) {
+  return crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign",
+    "verify"
+  ]);
+}
+async function signValue(value, secret, options = {}) {
+  const payload = b64url2(enc.encode(value));
+  const body = options.maxAgeSeconds === void 0 ? payload : `t${Math.floor((options.now ?? Date.now)() / 1e3)}~${payload}`;
+  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", await hmacKey(secret), enc.encode(body)));
+  return `${body}.${b64url2(sig)}`;
+}
+var STAMPED = /^t(\d+)~(.*)$/s;
+async function verifyValue(token, secret, options = {}) {
+  if (!token) return null;
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const body = token.slice(0, dot);
+  try {
+    const ok = await crypto.subtle.verify(
+      "HMAC",
+      await hmacKey(secret),
+      fromB64url(token.slice(dot + 1)),
+      enc.encode(body)
+    );
+    if (!ok) return null;
+    const stamped = STAMPED.exec(body);
+    if (options.maxAgeSeconds !== void 0) {
+      if (!stamped) return null;
+      const issuedAt = Number(stamped[1]);
+      if ((options.now ?? Date.now)() / 1e3 - issuedAt > options.maxAgeSeconds) return null;
+    }
+    return new TextDecoder().decode(fromB64url(stamped?.[2] ?? body));
+  } catch {
+    return null;
+  }
+}
+async function signSession(payload, secret) {
+  return signValue(JSON.stringify(payload), secret);
+}
+async function verifySession(token, secret, now = Date.now) {
+  const body = await verifyValue(token, secret);
+  if (body === null) return null;
+  try {
+    const payload = JSON.parse(body);
+    if (typeof payload.sub !== "string" || payload.sub === "") return null;
+    if (typeof payload.exp !== "number" || payload.exp * 1e3 <= now()) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function cookieHeader(name, value, opts) {
+  const parts = [
+    `${name}=${value}`,
+    `Path=${opts.path ?? "/"}`,
+    `Max-Age=${opts.maxAge}`,
+    "HttpOnly",
+    // Lax, NOT Strict, and this is load-bearing: the callback from Broberg ID
+    // is a top-level GET navigation from another site. Strict withholds the
+    // cookie on exactly that navigation, so the login transaction cookie would
+    // be missing when it is needed and every sign-in would fail with "state
+    // does not match" — a message that sends you looking in the wrong place.
+    `SameSite=${opts.sameSite ?? "Lax"}`
+  ];
+  if (opts.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+function readCookie(header, name) {
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
+  }
+  return void 0;
+}
+
+// src/tokens.ts
+var warned = false;
+function memoryTokenStore(options = {}) {
+  if (!options.quiet && !warned) {
+    warned = true;
+    console.warn(
+      "@broberg/sso: memoryTokenStore() keeps tokens in this process only \u2014 they are lost on restart and not shared between instances. Give ssoRoutes a TokenStore backed by your database in production."
+    );
+  }
+  const rows = /* @__PURE__ */ new Map();
+  return {
+    get size() {
+      return rows.size;
+    },
+    async get(sid) {
+      return rows.get(sid);
+    },
+    async set(sid, tokens) {
+      rows.set(sid, { ...tokens });
+    },
+    async delete(sid) {
+      rows.delete(sid);
+    },
+    async deleteSub(sub) {
+      for (const [sid, t] of rows) if (t.sub === sub) rows.delete(sid);
+    }
+  };
+}
+function expiresAtFrom(expiresIn, accessToken, now) {
+  if (typeof expiresIn === "number" && expiresIn > 0) return now + Math.floor(expiresIn);
+  const parts = accessToken.split(".");
+  if (parts.length === 3) {
+    try {
+      const json = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
+      if (typeof json.exp === "number" && json.exp > now) return json.exp;
+    } catch {
+    }
+  }
+  return now + 300;
+}
+function newSid() {
+  const b = crypto.getRandomValues(new Uint8Array(16));
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+exports.ALLOWED_ALGS = ALLOWED_ALGS;
+exports.AVATAR_TYPES = AVATAR_TYPES;
+exports.DEFAULT_SESSION_MAX_AGE = DEFAULT_SESSION_MAX_AGE;
+exports.JwksError = JwksError;
+exports.JwksUnavailableError = JwksUnavailableError;
+exports.JwksUnknownKeyError = JwksUnknownKeyError;
+exports.MAX_AVATAR_BYTES = MAX_AVATAR_BYTES;
+exports.MAX_INVITATIONS = MAX_INVITATIONS;
+exports.SsoAppApiError = SsoAppApiError;
+exports.SsoAvatarRejectedError = SsoAvatarRejectedError;
+exports.SsoConfigError = SsoConfigError;
+exports.SsoError = SsoError;
+exports.SsoInsufficientScopeError = SsoInsufficientScopeError;
+exports.SsoReauthError = SsoReauthError;
+exports.cookieHeader = cookieHeader;
+exports.createJwksCache = createJwksCache;
+exports.createSsoClient = createSsoClient;
+exports.expiresAtFrom = expiresAtFrom;
+exports.loadSsoConfig = loadSsoConfig;
+exports.mediaType = mediaType;
+exports.memoryTokenStore = memoryTokenStore;
+exports.newSid = newSid;
+exports.readCookie = readCookie;
+exports.signSession = signSession;
+exports.signValue = signValue;
+exports.verifySession = verifySession;
+exports.verifyValue = verifyValue;
+//# sourceMappingURL=chunk-JGIO7XPR.cjs.map
+//# sourceMappingURL=chunk-JGIO7XPR.cjs.map