@broberg/sso 0.15.0 → 0.17.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, I as InvitationOutcome, f as InvitationResult, g as InviteUsersInput, J as JwksCache, h as JwksCacheOptions, i as JwksError, j as JwksUnavailableError, k as JwksUnknownKeyError, L as LoginResult, l as LoginStart, m as LogoutToken, M as MAX_AVATAR_BYTES, n as MAX_INVITATIONS, o as MigrationState, p as MigrationStatus, b as SessionPayload, q as SsoAppApiError, r as SsoAvatarRejectedError, s as SsoClaims, S as SsoClient, a as SsoConfig, t as SsoConfigError, u as SsoError, v as SsoInsufficientScopeError, w as SsoReauthError, x as TokenSet, T as TokenStore, y as cookieHeader, z as createJwksCache, E as createSsoClient, F as loadSsoConfig, G as memoryTokenStore, H as readCookie, K as signSession, N as signValue, O as verifySession, P as verifyValue } from './session-DsjOyCJb.cjs';
-import 'jose';
+export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, I as IntrospectOptions, f as IntrospectedToken, g as InvitationOutcome, h as InvitationResult, i as InviteUsersInput, J as JwksCache, j as JwksCacheOptions, k as JwksError, l as JwksUnavailableError, m as JwksUnknownKeyError, L as LoginResult, n as LoginStart, o as LogoutToken, M as MAX_AVATAR_BYTES, p as MAX_INVITATIONS, q as MigrationState, r as MigrationStatus, b as SessionPayload, s as SsoAppApiError, t as SsoAvatarRejectedError, u as SsoClaims, S as SsoClient, a as SsoConfig, v as SsoConfigError, w as SsoError, x as SsoInsufficientScopeError, y as SsoIntrospectionUnavailableError, z as SsoReauthError, E as SsoTokenInactiveError, F as TokenSet, T as TokenStore, G as cookieHeader, H as createJwksCache, K as createSsoClient, N as loadSsoConfig, O as memoryTokenStore, P as readCookie, Q as signSession, R as signValue, U as verifySession, V as verifyValue } from './session-CIm4_raQ.cjs';
+import { JWK } from 'jose';
 
 declare const DEFAULT_ISSUER = "https://id.broberg.ai";
 /** No platform identity to exchange: not on Fly, not in a GitHub Actions job with id-token: write. */
@@ -32,6 +32,17 @@ interface TicketClientOptions {
     flyOidc?: (aud: string) => Promise<string>;
     /** Whether the Fly socket is present. Default: checks /.fly/api. */
     onFly?: () => boolean;
+    /**
+     * F084.157 — ask BID for DPoP-BOUND tickets. One ES256 key per client
+     * (non-extractable, never stored); every call then needs a proof, which
+     * `authHeaders` makes. Default false: bearer tickets, exactly as before.
+     */
+    dpop?: boolean;
+}
+/** Headers for one call to a receiver. With `dpop`, `authorization` is `DPoP <ticket>` and `dpop` is the proof. */
+interface TicketAuthHeaders {
+    authorization: string;
+    dpop?: string;
 }
 interface TicketClient {
     /** A ticket for `audience` (BID's short name, e.g. "discovery"), from cache while it is fresh. */
@@ -39,6 +50,17 @@ interface TicketClient {
         audience: string;
         scope?: string;
     }): Promise<string>;
+    /**
+     * F084.157 — the headers for ONE request to a receiver: a ticket plus, with
+     * `dpop`, a fresh proof bound to this method and URL (use it once). Without
+     * `dpop`: `{ authorization: "Bearer <ticket>" }`.
+     */
+    authHeaders(opts: {
+        audience: string;
+        scope?: string;
+        method: string;
+        url: string;
+    }): Promise<TicketAuthHeaders>;
 }
 declare function createTicketClient(options?: TicketClientOptions): TicketClient;
 /** A ticket from the process-wide client (one cache per process). */
@@ -47,6 +69,68 @@ declare function fetchTicket(opts: {
     scope?: string;
 }): Promise<string>;
 
+/**
+ * F084.157 — DPoP (RFC 9449): a bound ticket works only for whoever holds the key
+ * (broberg-id-F087.16, joint design #2572/#2574).
+ *
+ * A DPoP-bound ticket carries `cnf.jkt`, the thumbprint of the caller's public
+ * key. With every request the caller signs a short PROOF (method, URL, time, a
+ * hash of the ticket) with the matching private key. A ticket copied out of a log
+ * is useless on another machine: it has the ticket, not the key.
+ *
+ * THE RULE THAT MAKES IT PROTECTION (agreed with broberg-id, (A) in #2574): once a
+ * receiver verifies with this version, a ticket WITH cnf.jkt needs a valid proof —
+ * also while DPoP is otherwise optional. `requireDpop` only decides whether
+ * UNBOUND tickets are still accepted. Were bound tickets accepted without a proof
+ * during the rollout, a stolen bound ticket would work as bearer the whole time.
+ *
+ * Not here yet: server nonces (RFC 9449 §8). The jti replay store covers replay
+ * inside the iat window.
+ */
+
+/** One process's DPoP key. The private half cannot be exported. */
+interface DpopKey {
+    privateKey: CryptoKey;
+    publicJwk: JWK;
+    /** RFC 7638 thumbprint — what BID puts in the ticket's cnf.jkt. */
+    jkt: string;
+}
+/** A fresh ES256 key pair, private key non-extractable, never written anywhere. */
+declare function createDpopKey(): Promise<DpopKey>;
+/** `ath`: base64url(SHA-256(ticket)) — ties a proof to one ticket. */
+declare function accessTokenHash(ticket: string): Promise<string>;
+/** RFC 9449 §4.3: htu is compared without query and fragment. */
+declare function normalizeHtu(url: string): string;
+/** Sign one proof. Pass `ticket` when calling a resource server (adds ath); omit it for BID's token endpoint. */
+declare function createDpopProof(key: DpopKey, opts: {
+    method: string;
+    url: string;
+    ticket?: string;
+    now?: () => number;
+}): Promise<string>;
+/**
+ * Remembers which proofs were already used. The default is in-memory, which
+ * holds on ONE machine: a receiver running on two machines must pass a shared
+ * store, or a proof replayed against the other machine inside the window passes.
+ */
+interface ReplayStore {
+    /** Record `key`; resolve true if it was already recorded within `ttlMs`. */
+    seen(key: string, ttlMs: number): Promise<boolean>;
+}
+declare function createMemoryReplayStore(now?: () => number): ReplayStore;
+interface VerifyProofOptions {
+    method: string;
+    /** The receiver's PUBLIC URL for this request (behind a proxy the process sees an internal one). */
+    url: string;
+    ticket: string;
+    jkt: string;
+    replay: ReplayStore;
+    iatWindowSec: number;
+    now: () => number;
+}
+/** Throws SsoError naming the first thing that is wrong. */
+declare function verifyDpopProof(proof: string, o: VerifyProofOptions): Promise<void>;
+
 type PrincipalType = "human" | "service" | "agent";
 /**
  * F084.156 — one link of an RFC 8693 delegation chain. `act` is the next link
@@ -76,8 +160,8 @@ interface TicketPrincipal {
     version: number;
     /**
      * F084.156 — the DPoP key thumbprint when the ticket is sender-constrained.
-     * NOT checked here: until the receiver verifies a DPoP proof against it
-     * (F087.16), a bound ticket is accepted exactly like a bearer ticket.
+     * Since 0.16.0 (F084.157) a ticket with cnf.jkt is only accepted together with
+     * a valid DPoP proof for that key — see `verify(token, { dpop })`.
      */
     cnf: {
         jkt: string;
@@ -106,13 +190,35 @@ interface TicketVerifierOptions {
     warmUp?: boolean;
     fetchImpl?: typeof fetch;
     minRefetchIntervalMs?: number;
+    /**
+     * F084.157 — refuse UNBOUND tickets (bearer). Off by default during the
+     * rollout. A BOUND ticket (cnf.jkt) needs a valid proof either way.
+     */
+    requireDpop?: boolean;
+    /** Where used proof ids are remembered. Default in-memory — ONE machine only; share one across machines. */
+    replayStore?: ReplayStore;
+    /** How far a proof's iat may be from now. Default 60 s. */
+    dpopIatWindowSec?: number;
+    /** Injectable clock for the DPoP checks (ms). */
+    now?: () => number;
+}
+/** The DPoP half of a request: the `DPoP` header, and the method + PUBLIC URL the receiver was called on. */
+interface DpopRequest {
+    proof: string | null | undefined;
+    method: string;
+    url: string;
 }
 interface TicketVerifier {
-    /** Verify a ticket; with `scope`, also require that scope to be granted. */
+    /**
+     * Verify a ticket; with `scope`, also require that scope to be granted. Pass
+     * `dpop` with the request's DPoP header, method and public URL — a bound ticket
+     * is refused without it.
+     */
     verify(token: string, options?: {
         scope?: string | string[];
+        dpop?: DpopRequest;
     }): Promise<TicketPrincipal>;
 }
 declare function createTicketVerifier(options: TicketVerifierOptions): TicketVerifier;
 
-export { DEFAULT_ISSUER, MAX_ACT_DEPTH, NoWorkloadIdentityError, type PrincipalType, TICKET_FORMAT_VERSION, type TicketActor, type TicketClient, type TicketClientOptions, TicketExchangeError, type TicketPrincipal, TicketUnavailableError, type TicketVerifier, type TicketVerifierOptions, createTicketClient, createTicketVerifier, fetchTicket };
+export { DEFAULT_ISSUER, type DpopKey, type DpopRequest, MAX_ACT_DEPTH, NoWorkloadIdentityError, type PrincipalType, type ReplayStore, TICKET_FORMAT_VERSION, type TicketActor, type TicketAuthHeaders, type TicketClient, type TicketClientOptions, TicketExchangeError, type TicketPrincipal, TicketUnavailableError, type TicketVerifier, type TicketVerifierOptions, accessTokenHash, createDpopKey, createDpopProof, createMemoryReplayStore, createTicketClient, createTicketVerifier, fetchTicket, normalizeHtu, verifyDpopProof };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, I as InvitationOutcome, f as InvitationResult, g as InviteUsersInput, J as JwksCache, h as JwksCacheOptions, i as JwksError, j as JwksUnavailableError, k as JwksUnknownKeyError, L as LoginResult, l as LoginStart, m as LogoutToken, M as MAX_AVATAR_BYTES, n as MAX_INVITATIONS, o as MigrationState, p as MigrationStatus, b as SessionPayload, q as SsoAppApiError, r as SsoAvatarRejectedError, s as SsoClaims, S as SsoClient, a as SsoConfig, t as SsoConfigError, u as SsoError, v as SsoInsufficientScopeError, w as SsoReauthError, x as TokenSet, T as TokenStore, y as cookieHeader, z as createJwksCache, E as createSsoClient, F as loadSsoConfig, G as memoryTokenStore, H as readCookie, K as signSession, N as signValue, O as verifySession, P as verifyValue } from './session-DsjOyCJb.js';
-import 'jose';
+export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, I as IntrospectOptions, f as IntrospectedToken, g as InvitationOutcome, h as InvitationResult, i as InviteUsersInput, J as JwksCache, j as JwksCacheOptions, k as JwksError, l as JwksUnavailableError, m as JwksUnknownKeyError, L as LoginResult, n as LoginStart, o as LogoutToken, M as MAX_AVATAR_BYTES, p as MAX_INVITATIONS, q as MigrationState, r as MigrationStatus, b as SessionPayload, s as SsoAppApiError, t as SsoAvatarRejectedError, u as SsoClaims, S as SsoClient, a as SsoConfig, v as SsoConfigError, w as SsoError, x as SsoInsufficientScopeError, y as SsoIntrospectionUnavailableError, z as SsoReauthError, E as SsoTokenInactiveError, F as TokenSet, T as TokenStore, G as cookieHeader, H as createJwksCache, K as createSsoClient, N as loadSsoConfig, O as memoryTokenStore, P as readCookie, Q as signSession, R as signValue, U as verifySession, V as verifyValue } from './session-CIm4_raQ.js';
+import { JWK } from 'jose';
 
 declare const DEFAULT_ISSUER = "https://id.broberg.ai";
 /** No platform identity to exchange: not on Fly, not in a GitHub Actions job with id-token: write. */
@@ -32,6 +32,17 @@ interface TicketClientOptions {
     flyOidc?: (aud: string) => Promise<string>;
     /** Whether the Fly socket is present. Default: checks /.fly/api. */
     onFly?: () => boolean;
+    /**
+     * F084.157 — ask BID for DPoP-BOUND tickets. One ES256 key per client
+     * (non-extractable, never stored); every call then needs a proof, which
+     * `authHeaders` makes. Default false: bearer tickets, exactly as before.
+     */
+    dpop?: boolean;
+}
+/** Headers for one call to a receiver. With `dpop`, `authorization` is `DPoP <ticket>` and `dpop` is the proof. */
+interface TicketAuthHeaders {
+    authorization: string;
+    dpop?: string;
 }
 interface TicketClient {
     /** A ticket for `audience` (BID's short name, e.g. "discovery"), from cache while it is fresh. */
@@ -39,6 +50,17 @@ interface TicketClient {
         audience: string;
         scope?: string;
     }): Promise<string>;
+    /**
+     * F084.157 — the headers for ONE request to a receiver: a ticket plus, with
+     * `dpop`, a fresh proof bound to this method and URL (use it once). Without
+     * `dpop`: `{ authorization: "Bearer <ticket>" }`.
+     */
+    authHeaders(opts: {
+        audience: string;
+        scope?: string;
+        method: string;
+        url: string;
+    }): Promise<TicketAuthHeaders>;
 }
 declare function createTicketClient(options?: TicketClientOptions): TicketClient;
 /** A ticket from the process-wide client (one cache per process). */
@@ -47,6 +69,68 @@ declare function fetchTicket(opts: {
     scope?: string;
 }): Promise<string>;
 
+/**
+ * F084.157 — DPoP (RFC 9449): a bound ticket works only for whoever holds the key
+ * (broberg-id-F087.16, joint design #2572/#2574).
+ *
+ * A DPoP-bound ticket carries `cnf.jkt`, the thumbprint of the caller's public
+ * key. With every request the caller signs a short PROOF (method, URL, time, a
+ * hash of the ticket) with the matching private key. A ticket copied out of a log
+ * is useless on another machine: it has the ticket, not the key.
+ *
+ * THE RULE THAT MAKES IT PROTECTION (agreed with broberg-id, (A) in #2574): once a
+ * receiver verifies with this version, a ticket WITH cnf.jkt needs a valid proof —
+ * also while DPoP is otherwise optional. `requireDpop` only decides whether
+ * UNBOUND tickets are still accepted. Were bound tickets accepted without a proof
+ * during the rollout, a stolen bound ticket would work as bearer the whole time.
+ *
+ * Not here yet: server nonces (RFC 9449 §8). The jti replay store covers replay
+ * inside the iat window.
+ */
+
+/** One process's DPoP key. The private half cannot be exported. */
+interface DpopKey {
+    privateKey: CryptoKey;
+    publicJwk: JWK;
+    /** RFC 7638 thumbprint — what BID puts in the ticket's cnf.jkt. */
+    jkt: string;
+}
+/** A fresh ES256 key pair, private key non-extractable, never written anywhere. */
+declare function createDpopKey(): Promise<DpopKey>;
+/** `ath`: base64url(SHA-256(ticket)) — ties a proof to one ticket. */
+declare function accessTokenHash(ticket: string): Promise<string>;
+/** RFC 9449 §4.3: htu is compared without query and fragment. */
+declare function normalizeHtu(url: string): string;
+/** Sign one proof. Pass `ticket` when calling a resource server (adds ath); omit it for BID's token endpoint. */
+declare function createDpopProof(key: DpopKey, opts: {
+    method: string;
+    url: string;
+    ticket?: string;
+    now?: () => number;
+}): Promise<string>;
+/**
+ * Remembers which proofs were already used. The default is in-memory, which
+ * holds on ONE machine: a receiver running on two machines must pass a shared
+ * store, or a proof replayed against the other machine inside the window passes.
+ */
+interface ReplayStore {
+    /** Record `key`; resolve true if it was already recorded within `ttlMs`. */
+    seen(key: string, ttlMs: number): Promise<boolean>;
+}
+declare function createMemoryReplayStore(now?: () => number): ReplayStore;
+interface VerifyProofOptions {
+    method: string;
+    /** The receiver's PUBLIC URL for this request (behind a proxy the process sees an internal one). */
+    url: string;
+    ticket: string;
+    jkt: string;
+    replay: ReplayStore;
+    iatWindowSec: number;
+    now: () => number;
+}
+/** Throws SsoError naming the first thing that is wrong. */
+declare function verifyDpopProof(proof: string, o: VerifyProofOptions): Promise<void>;
+
 type PrincipalType = "human" | "service" | "agent";
 /**
  * F084.156 — one link of an RFC 8693 delegation chain. `act` is the next link
@@ -76,8 +160,8 @@ interface TicketPrincipal {
     version: number;
     /**
      * F084.156 — the DPoP key thumbprint when the ticket is sender-constrained.
-     * NOT checked here: until the receiver verifies a DPoP proof against it
-     * (F087.16), a bound ticket is accepted exactly like a bearer ticket.
+     * Since 0.16.0 (F084.157) a ticket with cnf.jkt is only accepted together with
+     * a valid DPoP proof for that key — see `verify(token, { dpop })`.
      */
     cnf: {
         jkt: string;
@@ -106,13 +190,35 @@ interface TicketVerifierOptions {
     warmUp?: boolean;
     fetchImpl?: typeof fetch;
     minRefetchIntervalMs?: number;
+    /**
+     * F084.157 — refuse UNBOUND tickets (bearer). Off by default during the
+     * rollout. A BOUND ticket (cnf.jkt) needs a valid proof either way.
+     */
+    requireDpop?: boolean;
+    /** Where used proof ids are remembered. Default in-memory — ONE machine only; share one across machines. */
+    replayStore?: ReplayStore;
+    /** How far a proof's iat may be from now. Default 60 s. */
+    dpopIatWindowSec?: number;
+    /** Injectable clock for the DPoP checks (ms). */
+    now?: () => number;
+}
+/** The DPoP half of a request: the `DPoP` header, and the method + PUBLIC URL the receiver was called on. */
+interface DpopRequest {
+    proof: string | null | undefined;
+    method: string;
+    url: string;
 }
 interface TicketVerifier {
-    /** Verify a ticket; with `scope`, also require that scope to be granted. */
+    /**
+     * Verify a ticket; with `scope`, also require that scope to be granted. Pass
+     * `dpop` with the request's DPoP header, method and public URL — a bound ticket
+     * is refused without it.
+     */
     verify(token: string, options?: {
         scope?: string | string[];
+        dpop?: DpopRequest;
     }): Promise<TicketPrincipal>;
 }
 declare function createTicketVerifier(options: TicketVerifierOptions): TicketVerifier;
 
-export { DEFAULT_ISSUER, MAX_ACT_DEPTH, NoWorkloadIdentityError, type PrincipalType, TICKET_FORMAT_VERSION, type TicketActor, type TicketClient, type TicketClientOptions, TicketExchangeError, type TicketPrincipal, TicketUnavailableError, type TicketVerifier, type TicketVerifierOptions, createTicketClient, createTicketVerifier, fetchTicket };
+export { DEFAULT_ISSUER, type DpopKey, type DpopRequest, MAX_ACT_DEPTH, NoWorkloadIdentityError, type PrincipalType, type ReplayStore, TICKET_FORMAT_VERSION, type TicketActor, type TicketAuthHeaders, type TicketClient, type TicketClientOptions, TicketExchangeError, type TicketPrincipal, TicketUnavailableError, type TicketVerifier, type TicketVerifierOptions, accessTokenHash, createDpopKey, createDpopProof, createMemoryReplayStore, createTicketClient, createTicketVerifier, fetchTicket, normalizeHtu, verifyDpopProof };

package/dist/index.js

@@ -1,9 +1,87 @@
-import { SsoError, ALLOWED_ALGS, JwksUnavailableError, createJwksCache } from './chunk-ZPRWYUFG.js';
-export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoReauthError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue } from './chunk-ZPRWYUFG.js';
+import { SsoError, ALLOWED_ALGS, JwksUnavailableError, createJwksCache } from './chunk-AVXQLEYK.js';
+export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoIntrospectionUnavailableError, SsoReauthError, SsoTokenInactiveError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue } from './chunk-AVXQLEYK.js';
 import { existsSync } from 'fs';
 import { request } from 'http';
-import { decodeProtectedHeader, jwtVerify } from 'jose';
+import { generateKeyPair, exportJWK, calculateJwkThumbprint, SignJWT, decodeProtectedHeader, importJWK, jwtVerify } from 'jose';
 
+async function createDpopKey() {
+  const { privateKey, publicKey } = await generateKeyPair("ES256", { extractable: false });
+  const jwk = await exportJWK(publicKey);
+  const publicJwk = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+  return { privateKey, publicJwk, jkt: await calculateJwkThumbprint(publicJwk) };
+}
+var enc = new TextEncoder();
+var b64url = (bytes) => btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function accessTokenHash(ticket) {
+  return b64url(await crypto.subtle.digest("SHA-256", enc.encode(ticket)));
+}
+function normalizeHtu(url) {
+  const u = new URL(url);
+  return `${u.protocol}//${u.host}${u.pathname}`;
+}
+async function createDpopProof(key, opts) {
+  const payload = {
+    jti: crypto.randomUUID(),
+    htm: opts.method.toUpperCase(),
+    htu: normalizeHtu(opts.url),
+    iat: Math.floor((opts.now?.() ?? Date.now()) / 1e3)
+  };
+  if (opts.ticket !== void 0) payload.ath = await accessTokenHash(opts.ticket);
+  return new SignJWT(payload).setProtectedHeader({ typ: "dpop+jwt", alg: "ES256", jwk: key.publicJwk }).sign(key.privateKey);
+}
+function createMemoryReplayStore(now = () => Date.now()) {
+  const entries = /* @__PURE__ */ new Map();
+  return {
+    async seen(key, ttlMs) {
+      const t = now();
+      for (const [k, until] of entries) if (until <= t) entries.delete(k);
+      if (entries.has(key)) return true;
+      entries.set(key, t + ttlMs);
+      return false;
+    }
+  };
+}
+var ASYMMETRIC = /* @__PURE__ */ new Set(["ES256", "ES384", "ES512", "EdDSA", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512"]);
+async function verifyDpopProof(proof, o) {
+  let header;
+  try {
+    header = decodeProtectedHeader(proof);
+  } catch {
+    throw new SsoError("DPoP proof is not a JWS");
+  }
+  if (header.typ !== "dpop+jwt") throw new SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
+  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
+  const jwk = header.jwk;
+  if (!jwk || typeof jwk !== "object") throw new SsoError("DPoP proof carries no jwk");
+  if ("d" in jwk) throw new SsoError("DPoP proof jwk contains a private key");
+  let payload;
+  try {
+    const key = await importJWK(jwk, header.alg);
+    ({ payload } = await jwtVerify(proof, key, { typ: "dpop+jwt", algorithms: [header.alg] }));
+  } catch (e) {
+    throw new SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  if (await calculateJwkThumbprint(jwk) !== o.jkt) throw new SsoError("DPoP proof key does not match the ticket's cnf.jkt");
+  if (payload.htm !== o.method.toUpperCase()) throw new SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
+  let htu;
+  try {
+    htu = normalizeHtu(String(payload.htu));
+  } catch {
+    throw new SsoError("DPoP proof htu is not a URL");
+  }
+  if (htu !== normalizeHtu(o.url)) throw new SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
+  const nowSec = Math.floor(o.now() / 1e3);
+  if (typeof payload.iat !== "number" || Math.abs(nowSec - payload.iat) > o.iatWindowSec) {
+    throw new SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
+  }
+  if (payload.ath !== await accessTokenHash(o.ticket)) throw new SsoError("DPoP proof ath does not match this ticket");
+  if (typeof payload.jti !== "string" || payload.jti === "") throw new SsoError("DPoP proof has no jti");
+  if (await o.replay.seen(`${o.jkt}:${payload.jti}`, o.iatWindowSec * 2 * 1e3)) {
+    throw new SsoError("DPoP proof was already used (jti replay)");
+  }
+}
+
+// src/fetch-ticket.ts
 var DEFAULT_ISSUER = "https://id.broberg.ai";
 var FLY_SOCKET = "/.fly/api";
 var NoWorkloadIdentityError = class extends Error {
@@ -65,6 +143,8 @@ function createTicketClient(options = {}) {
   const onFly = options.onFly ?? (() => !!env.FLY_APP_NAME && existsSync(FLY_SOCKET));
   const cache = /* @__PURE__ */ new Map();
   const inFlight = /* @__PURE__ */ new Map();
+  let dpopKey = null;
+  const ownKey = () => dpopKey ??= createDpopKey();
   async function platformToken() {
     if (onFly()) return flyOidc(issuer);
     const url = env.ACTIONS_ID_TOKEN_REQUEST_URL;
@@ -96,11 +176,10 @@ function createTicketClient(options = {}) {
     if (scope) form.set("scope", scope);
     let res;
     try {
-      res = await fetchImpl(`${issuer}/oauth2/token`, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: form
-      });
+      const tokenUrl = `${issuer}/oauth2/token`;
+      const headers = { "content-type": "application/x-www-form-urlencoded" };
+      if (options.dpop) headers.dpop = await createDpopProof(await ownKey(), { method: "POST", url: tokenUrl, now });
+      res = await fetchImpl(tokenUrl, { method: "POST", headers, body: form });
     } catch (e) {
       throw new TicketUnavailableError(`${issuer} unreachable: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -119,7 +198,12 @@ function createTicketClient(options = {}) {
     const exp = jwtExp(body.access_token) ?? nowSec + (body.expires_in ?? 300);
     return { token: body.access_token, exp };
   }
-  return {
+  const client = {
+    async authHeaders({ audience, scope, method, url }) {
+      const ticket = await client.get({ audience, scope });
+      if (!options.dpop) return { authorization: `Bearer ${ticket}` };
+      return { authorization: `DPoP ${ticket}`, dpop: await createDpopProof(await ownKey(), { method, url, ticket, now }) };
+    },
     async get({ audience, scope }) {
       const key = `${audience} ${scope ?? ""}`;
       const hit = cache.get(key);
@@ -134,6 +218,7 @@ function createTicketClient(options = {}) {
       return p;
     }
   };
+  return client;
 }
 var shared = null;
 function fetchTicket(opts) {
@@ -149,8 +234,12 @@ function createTicketVerifier(options) {
     audience,
     maxLifetimeSec = 15 * 60,
     clockToleranceSec = 30,
-    fetchImpl = fetch
+    fetchImpl = fetch,
+    requireDpop = false,
+    dpopIatWindowSec = 60,
+    now = () => Date.now()
   } = options;
+  const replayStore = options.replayStore ?? createMemoryReplayStore(now);
   if (!issuer) throw new SsoError("createTicketVerifier needs an issuer");
   if (!audience) throw new SsoError("createTicketVerifier needs this receiver's audience");
   let cachePromise = null;
@@ -234,6 +323,20 @@ function createTicketVerifier(options) {
       const act = payload.act === void 0 ? null : readActor(payload.act, 1);
       const cnfRaw = payload.cnf;
       const cnf = cnfRaw && typeof cnfRaw.jkt === "string" && cnfRaw.jkt ? { jkt: cnfRaw.jkt } : null;
+      if (cnf) {
+        if (!opts.dpop?.proof) throw new SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
+        await verifyDpopProof(opts.dpop.proof, {
+          method: opts.dpop.method,
+          url: opts.dpop.url,
+          ticket: token,
+          jkt: cnf.jkt,
+          replay: replayStore,
+          iatWindowSec: dpopIatWindowSec,
+          now
+        });
+      } else if (requireDpop) {
+        throw new SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
+      }
       return {
         principal: payload.sub,
         type,
@@ -258,6 +361,6 @@ function readActor(raw, depth) {
   return link.act === void 0 ? { sub: link.sub } : { sub: link.sub, act: readActor(link.act, depth + 1) };
 }
 
-export { DEFAULT_ISSUER, MAX_ACT_DEPTH, NoWorkloadIdentityError, TICKET_FORMAT_VERSION, TicketExchangeError, TicketUnavailableError, createTicketClient, createTicketVerifier, fetchTicket };
+export { DEFAULT_ISSUER, MAX_ACT_DEPTH, NoWorkloadIdentityError, TICKET_FORMAT_VERSION, TicketExchangeError, TicketUnavailableError, accessTokenHash, createDpopKey, createDpopProof, createMemoryReplayStore, createTicketClient, createTicketVerifier, fetchTicket, normalizeHtu, verifyDpopProof };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map