@broberg/sso 0.16.0 → 0.17.0

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkJGIO7XPR_cjs = require('./chunk-JGIO7XPR.cjs');
+var chunkQYMEISTU_cjs = require('./chunk-QYMEISTU.cjs');
 var fs = require('fs');
 var http = require('http');
 var jose = require('jose');
@@ -48,37 +48,37 @@ async function verifyDpopProof(proof, o) {
   try {
     header = jose.decodeProtectedHeader(proof);
   } catch {
-    throw new chunkJGIO7XPR_cjs.SsoError("DPoP proof is not a JWS");
+    throw new chunkQYMEISTU_cjs.SsoError("DPoP proof is not a JWS");
   }
-  if (header.typ !== "dpop+jwt") throw new chunkJGIO7XPR_cjs.SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
-  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new chunkJGIO7XPR_cjs.SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
+  if (header.typ !== "dpop+jwt") throw new chunkQYMEISTU_cjs.SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
+  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new chunkQYMEISTU_cjs.SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
   const jwk = header.jwk;
-  if (!jwk || typeof jwk !== "object") throw new chunkJGIO7XPR_cjs.SsoError("DPoP proof carries no jwk");
-  if ("d" in jwk) throw new chunkJGIO7XPR_cjs.SsoError("DPoP proof jwk contains a private key");
+  if (!jwk || typeof jwk !== "object") throw new chunkQYMEISTU_cjs.SsoError("DPoP proof carries no jwk");
+  if ("d" in jwk) throw new chunkQYMEISTU_cjs.SsoError("DPoP proof jwk contains a private key");
   let payload;
   try {
     const key = await jose.importJWK(jwk, header.alg);
     ({ payload } = await jose.jwtVerify(proof, key, { typ: "dpop+jwt", algorithms: [header.alg] }));
   } catch (e) {
-    throw new chunkJGIO7XPR_cjs.SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
+    throw new chunkQYMEISTU_cjs.SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
   }
-  if (await jose.calculateJwkThumbprint(jwk) !== o.jkt) throw new chunkJGIO7XPR_cjs.SsoError("DPoP proof key does not match the ticket's cnf.jkt");
-  if (payload.htm !== o.method.toUpperCase()) throw new chunkJGIO7XPR_cjs.SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
+  if (await jose.calculateJwkThumbprint(jwk) !== o.jkt) throw new chunkQYMEISTU_cjs.SsoError("DPoP proof key does not match the ticket's cnf.jkt");
+  if (payload.htm !== o.method.toUpperCase()) throw new chunkQYMEISTU_cjs.SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
   let htu;
   try {
     htu = normalizeHtu(String(payload.htu));
   } catch {
-    throw new chunkJGIO7XPR_cjs.SsoError("DPoP proof htu is not a URL");
+    throw new chunkQYMEISTU_cjs.SsoError("DPoP proof htu is not a URL");
   }
-  if (htu !== normalizeHtu(o.url)) throw new chunkJGIO7XPR_cjs.SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
+  if (htu !== normalizeHtu(o.url)) throw new chunkQYMEISTU_cjs.SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
   const nowSec = Math.floor(o.now() / 1e3);
   if (typeof payload.iat !== "number" || Math.abs(nowSec - payload.iat) > o.iatWindowSec) {
-    throw new chunkJGIO7XPR_cjs.SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
+    throw new chunkQYMEISTU_cjs.SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
   }
-  if (payload.ath !== await accessTokenHash(o.ticket)) throw new chunkJGIO7XPR_cjs.SsoError("DPoP proof ath does not match this ticket");
-  if (typeof payload.jti !== "string" || payload.jti === "") throw new chunkJGIO7XPR_cjs.SsoError("DPoP proof has no jti");
+  if (payload.ath !== await accessTokenHash(o.ticket)) throw new chunkQYMEISTU_cjs.SsoError("DPoP proof ath does not match this ticket");
+  if (typeof payload.jti !== "string" || payload.jti === "") throw new chunkQYMEISTU_cjs.SsoError("DPoP proof has no jti");
   if (await o.replay.seen(`${o.jkt}:${payload.jti}`, o.iatWindowSec * 2 * 1e3)) {
-    throw new chunkJGIO7XPR_cjs.SsoError("DPoP proof was already used (jti replay)");
+    throw new chunkQYMEISTU_cjs.SsoError("DPoP proof was already used (jti replay)");
   }
 }
 
@@ -241,10 +241,10 @@ function createTicketVerifier(options) {
     now = () => Date.now()
   } = options;
   const replayStore = options.replayStore ?? createMemoryReplayStore(now);
-  if (!issuer) throw new chunkJGIO7XPR_cjs.SsoError("createTicketVerifier needs an issuer");
-  if (!audience) throw new chunkJGIO7XPR_cjs.SsoError("createTicketVerifier needs this receiver's audience");
+  if (!issuer) throw new chunkQYMEISTU_cjs.SsoError("createTicketVerifier needs an issuer");
+  if (!audience) throw new chunkQYMEISTU_cjs.SsoError("createTicketVerifier needs this receiver's audience");
   let cachePromise = null;
-  const cacheFor = (jwksUri) => chunkJGIO7XPR_cjs.createJwksCache({
+  const cacheFor = (jwksUri) => chunkQYMEISTU_cjs.createJwksCache({
     jwksUri,
     fetchImpl,
     ...options.warmUp ? { warmUp: true } : {},
@@ -260,12 +260,12 @@ function createTicketVerifier(options) {
         if (!res.ok) throw new Error(`answered ${res.status}`);
         doc = await res.json();
       } catch (cause) {
-        throw new chunkJGIO7XPR_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
+        throw new chunkQYMEISTU_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
       }
       if (doc.issuer !== issuer) {
-        throw new chunkJGIO7XPR_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
+        throw new chunkQYMEISTU_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
       }
-      if (!doc.jwks_uri) throw new chunkJGIO7XPR_cjs.SsoError(`${url} names no jwks_uri`);
+      if (!doc.jwks_uri) throw new chunkQYMEISTU_cjs.SsoError(`${url} names no jwks_uri`);
       return cacheFor(doc.jwks_uri);
     })().catch((err) => {
       cachePromise = null;
@@ -281,51 +281,51 @@ function createTicketVerifier(options) {
       try {
         header = jose.decodeProtectedHeader(token);
       } catch {
-        throw new chunkJGIO7XPR_cjs.SsoError("ticket is not a JWS");
+        throw new chunkQYMEISTU_cjs.SsoError("ticket is not a JWS");
       }
-      if (!header.kid) throw new chunkJGIO7XPR_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
-      if (header.typ === "logout+jwt") throw new chunkJGIO7XPR_cjs.SsoError("a logout token is not a ticket");
+      if (!header.kid) throw new chunkQYMEISTU_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
+      if (header.typ === "logout+jwt") throw new chunkQYMEISTU_cjs.SsoError("a logout token is not a ticket");
       const cache = await keys();
       let payload;
       try {
         ({ payload } = await jose.jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "EdDSA"), {
           issuer,
           audience,
-          algorithms: chunkJGIO7XPR_cjs.ALLOWED_ALGS,
+          algorithms: chunkQYMEISTU_cjs.ALLOWED_ALGS,
           clockTolerance: clockToleranceSec,
           requiredClaims: ["exp", "iat", "jti", "sub"]
         }));
       } catch (e) {
-        if (e instanceof chunkJGIO7XPR_cjs.JwksUnavailableError) throw e;
-        throw new chunkJGIO7XPR_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
+        if (e instanceof chunkQYMEISTU_cjs.JwksUnavailableError) throw e;
+        throw new chunkQYMEISTU_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
       }
-      if ("events" in payload) throw new chunkJGIO7XPR_cjs.SsoError("a logout token is not a ticket");
-      if ("nonce" in payload) throw new chunkJGIO7XPR_cjs.SsoError("an ID token is not a ticket");
+      if ("events" in payload) throw new chunkQYMEISTU_cjs.SsoError("a logout token is not a ticket");
+      if ("nonce" in payload) throw new chunkQYMEISTU_cjs.SsoError("an ID token is not a ticket");
       const type = payload.principal_type;
       if (typeof type !== "string" || !PRINCIPAL_TYPES.includes(type)) {
-        throw new chunkJGIO7XPR_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
+        throw new chunkQYMEISTU_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
       }
       const lifetime = payload.exp - payload.iat;
       if (lifetime > maxLifetimeSec) {
-        throw new chunkJGIO7XPR_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
+        throw new chunkQYMEISTU_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
       }
-      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunkJGIO7XPR_cjs.SsoError("ticket has no sub");
+      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunkQYMEISTU_cjs.SsoError("ticket has no sub");
       const scopes = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [];
       const required = opts.scope === void 0 ? [] : Array.isArray(opts.scope) ? opts.scope : [opts.scope];
       const missing = required.filter((s) => !scopes.includes(s));
-      if (missing.length) throw new chunkJGIO7XPR_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
+      if (missing.length) throw new chunkQYMEISTU_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
       const ver = payload.ver === void 0 ? 0 : payload.ver;
       if (typeof ver !== "number" || !Number.isInteger(ver) || ver < 0) {
-        throw new chunkJGIO7XPR_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
+        throw new chunkQYMEISTU_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
       }
       if (ver > TICKET_FORMAT_VERSION) {
-        throw new chunkJGIO7XPR_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
+        throw new chunkQYMEISTU_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
       }
       const act = payload.act === void 0 ? null : readActor(payload.act, 1);
       const cnfRaw = payload.cnf;
       const cnf = cnfRaw && typeof cnfRaw.jkt === "string" && cnfRaw.jkt ? { jkt: cnfRaw.jkt } : null;
       if (cnf) {
-        if (!opts.dpop?.proof) throw new chunkJGIO7XPR_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
+        if (!opts.dpop?.proof) throw new chunkQYMEISTU_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
         await verifyDpopProof(opts.dpop.proof, {
           method: opts.dpop.method,
           url: opts.dpop.url,
@@ -336,7 +336,7 @@ function createTicketVerifier(options) {
           now
         });
       } else if (requireDpop) {
-        throw new chunkJGIO7XPR_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
+        throw new chunkQYMEISTU_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
       }
       return {
         principal: payload.sub,
@@ -354,105 +354,113 @@ function createTicketVerifier(options) {
   };
 }
 function readActor(raw, depth) {
-  if (depth > MAX_ACT_DEPTH) throw new chunkJGIO7XPR_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
+  if (depth > MAX_ACT_DEPTH) throw new chunkQYMEISTU_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
   const link = raw;
   if (!link || typeof link !== "object" || typeof link.sub !== "string" || link.sub === "") {
-    throw new chunkJGIO7XPR_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
+    throw new chunkQYMEISTU_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
   }
   return link.act === void 0 ? { sub: link.sub } : { sub: link.sub, act: readActor(link.act, depth + 1) };
 }
 
 Object.defineProperty(exports, "AVATAR_TYPES", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.AVATAR_TYPES; }
+  get: function () { return chunkQYMEISTU_cjs.AVATAR_TYPES; }
 });
 Object.defineProperty(exports, "DEFAULT_SESSION_MAX_AGE", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.DEFAULT_SESSION_MAX_AGE; }
+  get: function () { return chunkQYMEISTU_cjs.DEFAULT_SESSION_MAX_AGE; }
 });
 Object.defineProperty(exports, "JwksError", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.JwksError; }
+  get: function () { return chunkQYMEISTU_cjs.JwksError; }
 });
 Object.defineProperty(exports, "JwksUnavailableError", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.JwksUnavailableError; }
+  get: function () { return chunkQYMEISTU_cjs.JwksUnavailableError; }
 });
 Object.defineProperty(exports, "JwksUnknownKeyError", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.JwksUnknownKeyError; }
+  get: function () { return chunkQYMEISTU_cjs.JwksUnknownKeyError; }
 });
 Object.defineProperty(exports, "MAX_AVATAR_BYTES", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.MAX_AVATAR_BYTES; }
+  get: function () { return chunkQYMEISTU_cjs.MAX_AVATAR_BYTES; }
 });
 Object.defineProperty(exports, "MAX_INVITATIONS", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.MAX_INVITATIONS; }
+  get: function () { return chunkQYMEISTU_cjs.MAX_INVITATIONS; }
 });
 Object.defineProperty(exports, "SsoAppApiError", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.SsoAppApiError; }
+  get: function () { return chunkQYMEISTU_cjs.SsoAppApiError; }
 });
 Object.defineProperty(exports, "SsoAvatarRejectedError", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.SsoAvatarRejectedError; }
+  get: function () { return chunkQYMEISTU_cjs.SsoAvatarRejectedError; }
 });
 Object.defineProperty(exports, "SsoConfigError", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.SsoConfigError; }
+  get: function () { return chunkQYMEISTU_cjs.SsoConfigError; }
 });
 Object.defineProperty(exports, "SsoError", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.SsoError; }
+  get: function () { return chunkQYMEISTU_cjs.SsoError; }
 });
 Object.defineProperty(exports, "SsoInsufficientScopeError", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.SsoInsufficientScopeError; }
+  get: function () { return chunkQYMEISTU_cjs.SsoInsufficientScopeError; }
+});
+Object.defineProperty(exports, "SsoIntrospectionUnavailableError", {
+  enumerable: true,
+  get: function () { return chunkQYMEISTU_cjs.SsoIntrospectionUnavailableError; }
 });
 Object.defineProperty(exports, "SsoReauthError", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.SsoReauthError; }
+  get: function () { return chunkQYMEISTU_cjs.SsoReauthError; }
+});
+Object.defineProperty(exports, "SsoTokenInactiveError", {
+  enumerable: true,
+  get: function () { return chunkQYMEISTU_cjs.SsoTokenInactiveError; }
 });
 Object.defineProperty(exports, "cookieHeader", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.cookieHeader; }
+  get: function () { return chunkQYMEISTU_cjs.cookieHeader; }
 });
 Object.defineProperty(exports, "createJwksCache", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.createJwksCache; }
+  get: function () { return chunkQYMEISTU_cjs.createJwksCache; }
 });
 Object.defineProperty(exports, "createSsoClient", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.createSsoClient; }
+  get: function () { return chunkQYMEISTU_cjs.createSsoClient; }
 });
 Object.defineProperty(exports, "loadSsoConfig", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.loadSsoConfig; }
+  get: function () { return chunkQYMEISTU_cjs.loadSsoConfig; }
 });
 Object.defineProperty(exports, "memoryTokenStore", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.memoryTokenStore; }
+  get: function () { return chunkQYMEISTU_cjs.memoryTokenStore; }
 });
 Object.defineProperty(exports, "readCookie", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.readCookie; }
+  get: function () { return chunkQYMEISTU_cjs.readCookie; }
 });
 Object.defineProperty(exports, "signSession", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.signSession; }
+  get: function () { return chunkQYMEISTU_cjs.signSession; }
 });
 Object.defineProperty(exports, "signValue", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.signValue; }
+  get: function () { return chunkQYMEISTU_cjs.signValue; }
 });
 Object.defineProperty(exports, "verifySession", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.verifySession; }
+  get: function () { return chunkQYMEISTU_cjs.verifySession; }
 });
 Object.defineProperty(exports, "verifyValue", {
   enumerable: true,
-  get: function () { return chunkJGIO7XPR_cjs.verifyValue; }
+  get: function () { return chunkQYMEISTU_cjs.verifyValue; }
 });
 exports.DEFAULT_ISSUER = DEFAULT_ISSUER;
 exports.MAX_ACT_DEPTH = MAX_ACT_DEPTH;

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, I as InvitationOutcome, f as InvitationResult, g as InviteUsersInput, J as JwksCache, h as JwksCacheOptions, i as JwksError, j as JwksUnavailableError, k as JwksUnknownKeyError, L as LoginResult, l as LoginStart, m as LogoutToken, M as MAX_AVATAR_BYTES, n as MAX_INVITATIONS, o as MigrationState, p as MigrationStatus, b as SessionPayload, q as SsoAppApiError, r as SsoAvatarRejectedError, s as SsoClaims, S as SsoClient, a as SsoConfig, t as SsoConfigError, u as SsoError, v as SsoInsufficientScopeError, w as SsoReauthError, x as TokenSet, T as TokenStore, y as cookieHeader, z as createJwksCache, E as createSsoClient, F as loadSsoConfig, G as memoryTokenStore, H as readCookie, K as signSession, N as signValue, O as verifySession, P as verifyValue } from './session-DsjOyCJb.cjs';
+export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, I as IntrospectOptions, f as IntrospectedToken, g as InvitationOutcome, h as InvitationResult, i as InviteUsersInput, J as JwksCache, j as JwksCacheOptions, k as JwksError, l as JwksUnavailableError, m as JwksUnknownKeyError, L as LoginResult, n as LoginStart, o as LogoutToken, M as MAX_AVATAR_BYTES, p as MAX_INVITATIONS, q as MigrationState, r as MigrationStatus, b as SessionPayload, s as SsoAppApiError, t as SsoAvatarRejectedError, u as SsoClaims, S as SsoClient, a as SsoConfig, v as SsoConfigError, w as SsoError, x as SsoInsufficientScopeError, y as SsoIntrospectionUnavailableError, z as SsoReauthError, E as SsoTokenInactiveError, F as TokenSet, T as TokenStore, G as cookieHeader, H as createJwksCache, K as createSsoClient, N as loadSsoConfig, O as memoryTokenStore, P as readCookie, Q as signSession, R as signValue, U as verifySession, V as verifyValue } from './session-CIm4_raQ.cjs';
 import { JWK } from 'jose';
 
 declare const DEFAULT_ISSUER = "https://id.broberg.ai";

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, I as InvitationOutcome, f as InvitationResult, g as InviteUsersInput, J as JwksCache, h as JwksCacheOptions, i as JwksError, j as JwksUnavailableError, k as JwksUnknownKeyError, L as LoginResult, l as LoginStart, m as LogoutToken, M as MAX_AVATAR_BYTES, n as MAX_INVITATIONS, o as MigrationState, p as MigrationStatus, b as SessionPayload, q as SsoAppApiError, r as SsoAvatarRejectedError, s as SsoClaims, S as SsoClient, a as SsoConfig, t as SsoConfigError, u as SsoError, v as SsoInsufficientScopeError, w as SsoReauthError, x as TokenSet, T as TokenStore, y as cookieHeader, z as createJwksCache, E as createSsoClient, F as loadSsoConfig, G as memoryTokenStore, H as readCookie, K as signSession, N as signValue, O as verifySession, P as verifyValue } from './session-DsjOyCJb.js';
+export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, I as IntrospectOptions, f as IntrospectedToken, g as InvitationOutcome, h as InvitationResult, i as InviteUsersInput, J as JwksCache, j as JwksCacheOptions, k as JwksError, l as JwksUnavailableError, m as JwksUnknownKeyError, L as LoginResult, n as LoginStart, o as LogoutToken, M as MAX_AVATAR_BYTES, p as MAX_INVITATIONS, q as MigrationState, r as MigrationStatus, b as SessionPayload, s as SsoAppApiError, t as SsoAvatarRejectedError, u as SsoClaims, S as SsoClient, a as SsoConfig, v as SsoConfigError, w as SsoError, x as SsoInsufficientScopeError, y as SsoIntrospectionUnavailableError, z as SsoReauthError, E as SsoTokenInactiveError, F as TokenSet, T as TokenStore, G as cookieHeader, H as createJwksCache, K as createSsoClient, N as loadSsoConfig, O as memoryTokenStore, P as readCookie, Q as signSession, R as signValue, U as verifySession, V as verifyValue } from './session-CIm4_raQ.js';
 import { JWK } from 'jose';
 
 declare const DEFAULT_ISSUER = "https://id.broberg.ai";

package/dist/index.js

@@ -1,5 +1,5 @@
-import { SsoError, ALLOWED_ALGS, JwksUnavailableError, createJwksCache } from './chunk-ZPRWYUFG.js';
-export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoReauthError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue } from './chunk-ZPRWYUFG.js';
+import { SsoError, ALLOWED_ALGS, JwksUnavailableError, createJwksCache } from './chunk-AVXQLEYK.js';
+export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoIntrospectionUnavailableError, SsoReauthError, SsoTokenInactiveError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue } from './chunk-AVXQLEYK.js';
 import { existsSync } from 'fs';
 import { request } from 'http';
 import { generateKeyPair, exportJWK, calculateJwkThumbprint, SignJWT, decodeProtectedHeader, importJWK, jwtVerify } from 'jose';

package/dist/{session-DsjOyCJb.d.cts → session-CIm4_raQ.d.cts}

@@ -197,6 +197,8 @@ interface Discovery {
     jwks_uri: string;
     userinfo_endpoint?: string;
     end_session_endpoint?: string;
+    /** RFC 7662 — where a resource server checks an access token (F084.158). */
+    introspection_endpoint?: string;
 }
 declare class SsoError extends Error {
     constructor(message: string);
@@ -233,6 +235,43 @@ declare class SsoInsufficientScopeError extends SsoAppApiError {
     constructor(message: string, scope: string);
 }
 /** F095.2 — an avatar refused BEFORE it was sent: too big, or not PNG/JPEG/WebP. */
+/**
+ * F084.158 — the token is not usable HERE: inactive, expired, or issued to a
+ * different client than the one required. Answer 401 — the user has to log in
+ * again. Never thrown because BID could not be asked.
+ */
+declare class SsoTokenInactiveError extends SsoError {
+    /** "inactive" | "wrong_client" | "expired" */
+    readonly reason: "inactive" | "wrong_client" | "expired";
+    constructor(message: string, 
+    /** "inactive" | "wrong_client" | "expired" */
+    reason: "inactive" | "wrong_client" | "expired");
+}
+/**
+ * F084.158 — BID could not answer whether the token is active (network, timeout,
+ * 5xx, an unreadable body, or our own client credentials refused). Answer 503 —
+ * a BID hiccup must never look like an expired login.
+ */
+declare class SsoIntrospectionUnavailableError extends SsoError {
+    readonly status: number | null;
+    constructor(message: string, status: number | null);
+}
+interface IntrospectOptions {
+    /** The client the token must have been issued to (e.g. "trail-clipper"). */
+    requireClientId: string;
+    /** Reuse an ACTIVE answer for up to this long, never past the token's exp. Off by default. */
+    cacheMs?: number;
+    /** For tests. */
+    now?: () => number;
+}
+interface IntrospectedToken {
+    active: true;
+    sub: string;
+    clientId: string;
+    scope: string;
+    /** Seconds since epoch. */
+    exp: number;
+}
 declare class SsoAvatarRejectedError extends SsoError {
     readonly reason: "too_large" | "unsupported_type";
     constructor(message: string, reason: "too_large" | "unsupported_type");
@@ -370,6 +409,13 @@ interface SsoClient {
     uploadAvatar(accessToken: string, bytes: Uint8Array | ArrayBuffer, contentType: string): Promise<BidProfile>;
     /** F095.2 — remove the user's picture (scope `profile:write`). */
     removeAvatar(accessToken: string): Promise<BidProfile>;
+    /**
+     * F084.158 — ask BID (RFC 7662) whether an access token is active, with THIS
+     * app's client credentials, and require it was issued to `requireClientId`.
+     * Throws SsoTokenInactiveError (→ 401) or SsoIntrospectionUnavailableError
+     * (→ 503). The token never appears in an error message.
+     */
+    introspectToken(token: string, options: IntrospectOptions): Promise<IntrospectedToken>;
     /** Exposed for tests and for a health check; not needed in normal use. */
     readonly jwks: JwksCache;
 }
@@ -577,4 +623,4 @@ declare function cookieHeader(name: string, value: string, opts: {
 }): string;
 declare function readCookie(header: string | null | undefined, name: string): string | undefined;
 
-export { AVATAR_TYPES as A, type BeginLoginOptions as B, type CreateSsoClientOptions as C, DEFAULT_SESSION_MAX_AGE as D, createSsoClient as E, loadSsoConfig as F, memoryTokenStore as G, readCookie as H, type InvitationOutcome as I, type JwksCache as J, signSession as K, type LoginResult as L, MAX_AVATAR_BYTES as M, signValue as N, verifySession as O, verifyValue as P, type SsoClient as S, type TokenStore as T, type SsoConfig as a, type SessionPayload as b, type AddressOwnership as c, type BidProfile as d, type Discovery as e, type InvitationResult as f, type InviteUsersInput as g, type JwksCacheOptions as h, JwksError as i, JwksUnavailableError as j, JwksUnknownKeyError as k, type LoginStart as l, type LogoutToken as m, MAX_INVITATIONS as n, type MigrationState as o, type MigrationStatus as p, SsoAppApiError as q, SsoAvatarRejectedError as r, type SsoClaims as s, SsoConfigError as t, SsoError as u, SsoInsufficientScopeError as v, SsoReauthError as w, type TokenSet as x, cookieHeader as y, createJwksCache as z };
+export { AVATAR_TYPES as A, type BeginLoginOptions as B, type CreateSsoClientOptions as C, DEFAULT_SESSION_MAX_AGE as D, SsoTokenInactiveError as E, type TokenSet as F, cookieHeader as G, createJwksCache as H, type IntrospectOptions as I, type JwksCache as J, createSsoClient as K, type LoginResult as L, MAX_AVATAR_BYTES as M, loadSsoConfig as N, memoryTokenStore as O, readCookie as P, signSession as Q, signValue as R, type SsoClient as S, type TokenStore as T, verifySession as U, verifyValue as V, type SsoConfig as a, type SessionPayload as b, type AddressOwnership as c, type BidProfile as d, type Discovery as e, type IntrospectedToken as f, type InvitationOutcome as g, type InvitationResult as h, type InviteUsersInput as i, type JwksCacheOptions as j, JwksError as k, JwksUnavailableError as l, JwksUnknownKeyError as m, type LoginStart as n, type LogoutToken as o, MAX_INVITATIONS as p, type MigrationState as q, type MigrationStatus as r, SsoAppApiError as s, SsoAvatarRejectedError as t, type SsoClaims as u, SsoConfigError as v, SsoError as w, SsoInsufficientScopeError as x, SsoIntrospectionUnavailableError as y, SsoReauthError as z };

package/dist/{session-DsjOyCJb.d.ts → session-CIm4_raQ.d.ts}

@@ -197,6 +197,8 @@ interface Discovery {
     jwks_uri: string;
     userinfo_endpoint?: string;
     end_session_endpoint?: string;
+    /** RFC 7662 — where a resource server checks an access token (F084.158). */
+    introspection_endpoint?: string;
 }
 declare class SsoError extends Error {
     constructor(message: string);
@@ -233,6 +235,43 @@ declare class SsoInsufficientScopeError extends SsoAppApiError {
     constructor(message: string, scope: string);
 }
 /** F095.2 — an avatar refused BEFORE it was sent: too big, or not PNG/JPEG/WebP. */
+/**
+ * F084.158 — the token is not usable HERE: inactive, expired, or issued to a
+ * different client than the one required. Answer 401 — the user has to log in
+ * again. Never thrown because BID could not be asked.
+ */
+declare class SsoTokenInactiveError extends SsoError {
+    /** "inactive" | "wrong_client" | "expired" */
+    readonly reason: "inactive" | "wrong_client" | "expired";
+    constructor(message: string, 
+    /** "inactive" | "wrong_client" | "expired" */
+    reason: "inactive" | "wrong_client" | "expired");
+}
+/**
+ * F084.158 — BID could not answer whether the token is active (network, timeout,
+ * 5xx, an unreadable body, or our own client credentials refused). Answer 503 —
+ * a BID hiccup must never look like an expired login.
+ */
+declare class SsoIntrospectionUnavailableError extends SsoError {
+    readonly status: number | null;
+    constructor(message: string, status: number | null);
+}
+interface IntrospectOptions {
+    /** The client the token must have been issued to (e.g. "trail-clipper"). */
+    requireClientId: string;
+    /** Reuse an ACTIVE answer for up to this long, never past the token's exp. Off by default. */
+    cacheMs?: number;
+    /** For tests. */
+    now?: () => number;
+}
+interface IntrospectedToken {
+    active: true;
+    sub: string;
+    clientId: string;
+    scope: string;
+    /** Seconds since epoch. */
+    exp: number;
+}
 declare class SsoAvatarRejectedError extends SsoError {
     readonly reason: "too_large" | "unsupported_type";
     constructor(message: string, reason: "too_large" | "unsupported_type");
@@ -370,6 +409,13 @@ interface SsoClient {
     uploadAvatar(accessToken: string, bytes: Uint8Array | ArrayBuffer, contentType: string): Promise<BidProfile>;
     /** F095.2 — remove the user's picture (scope `profile:write`). */
     removeAvatar(accessToken: string): Promise<BidProfile>;
+    /**
+     * F084.158 — ask BID (RFC 7662) whether an access token is active, with THIS
+     * app's client credentials, and require it was issued to `requireClientId`.
+     * Throws SsoTokenInactiveError (→ 401) or SsoIntrospectionUnavailableError
+     * (→ 503). The token never appears in an error message.
+     */
+    introspectToken(token: string, options: IntrospectOptions): Promise<IntrospectedToken>;
     /** Exposed for tests and for a health check; not needed in normal use. */
     readonly jwks: JwksCache;
 }
@@ -577,4 +623,4 @@ declare function cookieHeader(name: string, value: string, opts: {
 }): string;
 declare function readCookie(header: string | null | undefined, name: string): string | undefined;
 
-export { AVATAR_TYPES as A, type BeginLoginOptions as B, type CreateSsoClientOptions as C, DEFAULT_SESSION_MAX_AGE as D, createSsoClient as E, loadSsoConfig as F, memoryTokenStore as G, readCookie as H, type InvitationOutcome as I, type JwksCache as J, signSession as K, type LoginResult as L, MAX_AVATAR_BYTES as M, signValue as N, verifySession as O, verifyValue as P, type SsoClient as S, type TokenStore as T, type SsoConfig as a, type SessionPayload as b, type AddressOwnership as c, type BidProfile as d, type Discovery as e, type InvitationResult as f, type InviteUsersInput as g, type JwksCacheOptions as h, JwksError as i, JwksUnavailableError as j, JwksUnknownKeyError as k, type LoginStart as l, type LogoutToken as m, MAX_INVITATIONS as n, type MigrationState as o, type MigrationStatus as p, SsoAppApiError as q, SsoAvatarRejectedError as r, type SsoClaims as s, SsoConfigError as t, SsoError as u, SsoInsufficientScopeError as v, SsoReauthError as w, type TokenSet as x, cookieHeader as y, createJwksCache as z };
+export { AVATAR_TYPES as A, type BeginLoginOptions as B, type CreateSsoClientOptions as C, DEFAULT_SESSION_MAX_AGE as D, SsoTokenInactiveError as E, type TokenSet as F, cookieHeader as G, createJwksCache as H, type IntrospectOptions as I, type JwksCache as J, createSsoClient as K, type LoginResult as L, MAX_AVATAR_BYTES as M, loadSsoConfig as N, memoryTokenStore as O, readCookie as P, signSession as Q, signValue as R, type SsoClient as S, type TokenStore as T, verifySession as U, verifyValue as V, type SsoConfig as a, type SessionPayload as b, type AddressOwnership as c, type BidProfile as d, type Discovery as e, type IntrospectedToken as f, type InvitationOutcome as g, type InvitationResult as h, type InviteUsersInput as i, type JwksCacheOptions as j, JwksError as k, JwksUnavailableError as l, JwksUnknownKeyError as m, type LoginStart as n, type LogoutToken as o, MAX_INVITATIONS as p, type MigrationState as q, type MigrationStatus as r, SsoAppApiError as s, SsoAvatarRejectedError as t, type SsoClaims as u, SsoConfigError as v, SsoError as w, SsoInsufficientScopeError as x, SsoIntrospectionUnavailableError as y, SsoReauthError as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@broberg/sso",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "The thin client for Broberg ID — send a user to central login, verify the ID token against JWKS, keep a local session. Public client + PKCE only: no passwords, no passkeys, no client secret can live in an app.",
   "type": "module",
   "license": "MIT",