@broberg/sso 0.18.3 → 0.19.0

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkCHRCHUZ3_cjs = require('./chunk-CHRCHUZ3.cjs');
+var chunkMZE4TPFU_cjs = require('./chunk-MZE4TPFU.cjs');
 var fs = require('fs');
 var http = require('http');
 var jose = require('jose');
@@ -48,37 +48,37 @@ async function verifyDpopProof(proof, o) {
   try {
     header = jose.decodeProtectedHeader(proof);
   } catch {
-    throw new chunkCHRCHUZ3_cjs.SsoError("DPoP proof is not a JWS");
+    throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof is not a JWS");
   }
-  if (header.typ !== "dpop+jwt") throw new chunkCHRCHUZ3_cjs.SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
-  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new chunkCHRCHUZ3_cjs.SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
+  if (header.typ !== "dpop+jwt") throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
+  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
   const jwk = header.jwk;
-  if (!jwk || typeof jwk !== "object") throw new chunkCHRCHUZ3_cjs.SsoError("DPoP proof carries no jwk");
-  if ("d" in jwk) throw new chunkCHRCHUZ3_cjs.SsoError("DPoP proof jwk contains a private key");
+  if (!jwk || typeof jwk !== "object") throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof carries no jwk");
+  if ("d" in jwk) throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof jwk contains a private key");
   let payload;
   try {
     const key = await jose.importJWK(jwk, header.alg);
     ({ payload } = await jose.jwtVerify(proof, key, { typ: "dpop+jwt", algorithms: [header.alg] }));
   } catch (e) {
-    throw new chunkCHRCHUZ3_cjs.SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
+    throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
   }
-  if (await jose.calculateJwkThumbprint(jwk) !== o.jkt) throw new chunkCHRCHUZ3_cjs.SsoError("DPoP proof key does not match the ticket's cnf.jkt");
-  if (payload.htm !== o.method.toUpperCase()) throw new chunkCHRCHUZ3_cjs.SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
+  if (await jose.calculateJwkThumbprint(jwk) !== o.jkt) throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof key does not match the ticket's cnf.jkt");
+  if (payload.htm !== o.method.toUpperCase()) throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
   let htu;
   try {
     htu = normalizeHtu(String(payload.htu));
   } catch {
-    throw new chunkCHRCHUZ3_cjs.SsoError("DPoP proof htu is not a URL");
+    throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof htu is not a URL");
   }
-  if (htu !== normalizeHtu(o.url)) throw new chunkCHRCHUZ3_cjs.SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
+  if (htu !== normalizeHtu(o.url)) throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
   const nowSec = Math.floor(o.now() / 1e3);
   if (typeof payload.iat !== "number" || Math.abs(nowSec - payload.iat) > o.iatWindowSec) {
-    throw new chunkCHRCHUZ3_cjs.SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
+    throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
   }
-  if (payload.ath !== await accessTokenHash(o.ticket)) throw new chunkCHRCHUZ3_cjs.SsoError("DPoP proof ath does not match this ticket");
-  if (typeof payload.jti !== "string" || payload.jti === "") throw new chunkCHRCHUZ3_cjs.SsoError("DPoP proof has no jti");
+  if (payload.ath !== await accessTokenHash(o.ticket)) throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof ath does not match this ticket");
+  if (typeof payload.jti !== "string" || payload.jti === "") throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof has no jti");
   if (await o.replay.seen(`${o.jkt}:${payload.jti}`, o.iatWindowSec * 2 * 1e3)) {
-    throw new chunkCHRCHUZ3_cjs.SsoError("DPoP proof was already used (jti replay)");
+    throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof was already used (jti replay)");
   }
 }
 
@@ -241,10 +241,10 @@ function createTicketVerifier(options) {
     now = () => Date.now()
   } = options;
   const replayStore = options.replayStore ?? createMemoryReplayStore(now);
-  if (!issuer) throw new chunkCHRCHUZ3_cjs.SsoError("createTicketVerifier needs an issuer");
-  if (!audience) throw new chunkCHRCHUZ3_cjs.SsoError("createTicketVerifier needs this receiver's audience");
+  if (!issuer) throw new chunkMZE4TPFU_cjs.SsoError("createTicketVerifier needs an issuer");
+  if (!audience) throw new chunkMZE4TPFU_cjs.SsoError("createTicketVerifier needs this receiver's audience");
   let cachePromise = null;
-  const cacheFor = (jwksUri) => chunkCHRCHUZ3_cjs.createJwksCache({
+  const cacheFor = (jwksUri) => chunkMZE4TPFU_cjs.createJwksCache({
     jwksUri,
     fetchImpl,
     ...options.warmUp ? { warmUp: true } : {},
@@ -260,12 +260,12 @@ function createTicketVerifier(options) {
         if (!res.ok) throw new Error(`answered ${res.status}`);
         doc = await res.json();
       } catch (cause) {
-        throw new chunkCHRCHUZ3_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
+        throw new chunkMZE4TPFU_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
       }
       if (doc.issuer !== issuer) {
-        throw new chunkCHRCHUZ3_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
+        throw new chunkMZE4TPFU_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
       }
-      if (!doc.jwks_uri) throw new chunkCHRCHUZ3_cjs.SsoError(`${url} names no jwks_uri`);
+      if (!doc.jwks_uri) throw new chunkMZE4TPFU_cjs.SsoError(`${url} names no jwks_uri`);
       return cacheFor(doc.jwks_uri);
     })().catch((err) => {
       cachePromise = null;
@@ -281,51 +281,51 @@ function createTicketVerifier(options) {
       try {
         header = jose.decodeProtectedHeader(token);
       } catch {
-        throw new chunkCHRCHUZ3_cjs.SsoError("ticket is not a JWS");
+        throw new chunkMZE4TPFU_cjs.SsoError("ticket is not a JWS");
       }
-      if (!header.kid) throw new chunkCHRCHUZ3_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
-      if (header.typ === "logout+jwt") throw new chunkCHRCHUZ3_cjs.SsoError("a logout token is not a ticket");
+      if (!header.kid) throw new chunkMZE4TPFU_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
+      if (header.typ === "logout+jwt") throw new chunkMZE4TPFU_cjs.SsoError("a logout token is not a ticket");
       const cache = await keys();
       let payload;
       try {
         ({ payload } = await jose.jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "EdDSA"), {
           issuer,
           audience,
-          algorithms: chunkCHRCHUZ3_cjs.ALLOWED_ALGS,
+          algorithms: chunkMZE4TPFU_cjs.ALLOWED_ALGS,
           clockTolerance: clockToleranceSec,
           requiredClaims: ["exp", "iat", "jti", "sub"]
         }));
       } catch (e) {
-        if (e instanceof chunkCHRCHUZ3_cjs.JwksUnavailableError) throw e;
-        throw new chunkCHRCHUZ3_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
+        if (e instanceof chunkMZE4TPFU_cjs.JwksUnavailableError) throw e;
+        throw new chunkMZE4TPFU_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
       }
-      if ("events" in payload) throw new chunkCHRCHUZ3_cjs.SsoError("a logout token is not a ticket");
-      if ("nonce" in payload) throw new chunkCHRCHUZ3_cjs.SsoError("an ID token is not a ticket");
+      if ("events" in payload) throw new chunkMZE4TPFU_cjs.SsoError("a logout token is not a ticket");
+      if ("nonce" in payload) throw new chunkMZE4TPFU_cjs.SsoError("an ID token is not a ticket");
       const type = payload.principal_type;
       if (typeof type !== "string" || !PRINCIPAL_TYPES.includes(type)) {
-        throw new chunkCHRCHUZ3_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
+        throw new chunkMZE4TPFU_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
       }
       const lifetime = payload.exp - payload.iat;
       if (lifetime > maxLifetimeSec) {
-        throw new chunkCHRCHUZ3_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
+        throw new chunkMZE4TPFU_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
       }
-      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunkCHRCHUZ3_cjs.SsoError("ticket has no sub");
+      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunkMZE4TPFU_cjs.SsoError("ticket has no sub");
       const scopes = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [];
       const required = opts.scope === void 0 ? [] : Array.isArray(opts.scope) ? opts.scope : [opts.scope];
       const missing = required.filter((s) => !scopes.includes(s));
-      if (missing.length) throw new chunkCHRCHUZ3_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
+      if (missing.length) throw new chunkMZE4TPFU_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
       const ver = payload.ver === void 0 ? 0 : payload.ver;
       if (typeof ver !== "number" || !Number.isInteger(ver) || ver < 0) {
-        throw new chunkCHRCHUZ3_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
+        throw new chunkMZE4TPFU_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
       }
       if (ver > TICKET_FORMAT_VERSION) {
-        throw new chunkCHRCHUZ3_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
+        throw new chunkMZE4TPFU_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
       }
       const act = payload.act === void 0 ? null : readActor(payload.act, 1);
       const cnfRaw = payload.cnf;
       const cnf = cnfRaw && typeof cnfRaw.jkt === "string" && cnfRaw.jkt ? { jkt: cnfRaw.jkt } : null;
       if (cnf) {
-        if (!opts.dpop?.proof) throw new chunkCHRCHUZ3_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
+        if (!opts.dpop?.proof) throw new chunkMZE4TPFU_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
         await verifyDpopProof(opts.dpop.proof, {
           method: opts.dpop.method,
           url: opts.dpop.url,
@@ -336,11 +336,11 @@ function createTicketVerifier(options) {
           now
         });
       } else if (requireDpop) {
-        throw new chunkCHRCHUZ3_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
+        throw new chunkMZE4TPFU_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
       }
       const named = (v) => typeof v === "string" && v ? v : null;
       const clientId = type === "user" ? named(payload.client_id) ?? named(payload.azp) : named(payload.client_id) ?? payload.sub;
-      if (clientId === null) throw new chunkCHRCHUZ3_cjs.SsoError("a user ticket names no app (no client_id or azp)");
+      if (clientId === null) throw new chunkMZE4TPFU_cjs.SsoError("a user ticket names no app (no client_id or azp)");
       return {
         principal: payload.sub,
         type,
@@ -357,113 +357,125 @@ function createTicketVerifier(options) {
   };
 }
 function readActor(raw, depth) {
-  if (depth > MAX_ACT_DEPTH) throw new chunkCHRCHUZ3_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
+  if (depth > MAX_ACT_DEPTH) throw new chunkMZE4TPFU_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
   const link = raw;
   if (!link || typeof link !== "object" || typeof link.sub !== "string" || link.sub === "") {
-    throw new chunkCHRCHUZ3_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
+    throw new chunkMZE4TPFU_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
   }
   return link.act === void 0 ? { sub: link.sub } : { sub: link.sub, act: readActor(link.act, depth + 1) };
 }
 
 Object.defineProperty(exports, "AVATAR_TYPES", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.AVATAR_TYPES; }
+  get: function () { return chunkMZE4TPFU_cjs.AVATAR_TYPES; }
 });
 Object.defineProperty(exports, "DEFAULT_SESSION_MAX_AGE", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.DEFAULT_SESSION_MAX_AGE; }
+  get: function () { return chunkMZE4TPFU_cjs.DEFAULT_SESSION_MAX_AGE; }
+});
+Object.defineProperty(exports, "EMBEDDED_FLOW_MAX_AGE", {
+  enumerable: true,
+  get: function () { return chunkMZE4TPFU_cjs.EMBEDDED_FLOW_MAX_AGE; }
 });
 Object.defineProperty(exports, "JwksError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.JwksError; }
+  get: function () { return chunkMZE4TPFU_cjs.JwksError; }
 });
 Object.defineProperty(exports, "JwksUnavailableError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.JwksUnavailableError; }
+  get: function () { return chunkMZE4TPFU_cjs.JwksUnavailableError; }
 });
 Object.defineProperty(exports, "JwksUnknownKeyError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.JwksUnknownKeyError; }
+  get: function () { return chunkMZE4TPFU_cjs.JwksUnknownKeyError; }
 });
 Object.defineProperty(exports, "MAX_AVATAR_BYTES", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.MAX_AVATAR_BYTES; }
+  get: function () { return chunkMZE4TPFU_cjs.MAX_AVATAR_BYTES; }
 });
 Object.defineProperty(exports, "MAX_INVITATIONS", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.MAX_INVITATIONS; }
+  get: function () { return chunkMZE4TPFU_cjs.MAX_INVITATIONS; }
 });
 Object.defineProperty(exports, "SsoAppApiError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.SsoAppApiError; }
+  get: function () { return chunkMZE4TPFU_cjs.SsoAppApiError; }
 });
 Object.defineProperty(exports, "SsoAvatarRejectedError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.SsoAvatarRejectedError; }
+  get: function () { return chunkMZE4TPFU_cjs.SsoAvatarRejectedError; }
 });
 Object.defineProperty(exports, "SsoConfigError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.SsoConfigError; }
+  get: function () { return chunkMZE4TPFU_cjs.SsoConfigError; }
 });
 Object.defineProperty(exports, "SsoError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.SsoError; }
+  get: function () { return chunkMZE4TPFU_cjs.SsoError; }
 });
 Object.defineProperty(exports, "SsoInsufficientScopeError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.SsoInsufficientScopeError; }
+  get: function () { return chunkMZE4TPFU_cjs.SsoInsufficientScopeError; }
 });
 Object.defineProperty(exports, "SsoIntrospectionUnavailableError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.SsoIntrospectionUnavailableError; }
+  get: function () { return chunkMZE4TPFU_cjs.SsoIntrospectionUnavailableError; }
 });
 Object.defineProperty(exports, "SsoReauthError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.SsoReauthError; }
+  get: function () { return chunkMZE4TPFU_cjs.SsoReauthError; }
 });
 Object.defineProperty(exports, "SsoTokenInactiveError", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.SsoTokenInactiveError; }
+  get: function () { return chunkMZE4TPFU_cjs.SsoTokenInactiveError; }
 });
 Object.defineProperty(exports, "cookieHeader", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.cookieHeader; }
+  get: function () { return chunkMZE4TPFU_cjs.cookieHeader; }
 });
 Object.defineProperty(exports, "createJwksCache", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.createJwksCache; }
+  get: function () { return chunkMZE4TPFU_cjs.createJwksCache; }
 });
 Object.defineProperty(exports, "createSsoClient", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.createSsoClient; }
+  get: function () { return chunkMZE4TPFU_cjs.createSsoClient; }
 });
 Object.defineProperty(exports, "loadSsoConfig", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.loadSsoConfig; }
+  get: function () { return chunkMZE4TPFU_cjs.loadSsoConfig; }
 });
 Object.defineProperty(exports, "memoryTokenStore", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.memoryTokenStore; }
+  get: function () { return chunkMZE4TPFU_cjs.memoryTokenStore; }
+});
+Object.defineProperty(exports, "openEmbeddedFlow", {
+  enumerable: true,
+  get: function () { return chunkMZE4TPFU_cjs.openEmbeddedFlow; }
 });
 Object.defineProperty(exports, "readCookie", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.readCookie; }
+  get: function () { return chunkMZE4TPFU_cjs.readCookie; }
+});
+Object.defineProperty(exports, "sealEmbeddedFlow", {
+  enumerable: true,
+  get: function () { return chunkMZE4TPFU_cjs.sealEmbeddedFlow; }
 });
 Object.defineProperty(exports, "signSession", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.signSession; }
+  get: function () { return chunkMZE4TPFU_cjs.signSession; }
 });
 Object.defineProperty(exports, "signValue", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.signValue; }
+  get: function () { return chunkMZE4TPFU_cjs.signValue; }
 });
 Object.defineProperty(exports, "verifySession", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.verifySession; }
+  get: function () { return chunkMZE4TPFU_cjs.verifySession; }
 });
 Object.defineProperty(exports, "verifyValue", {
   enumerable: true,
-  get: function () { return chunkCHRCHUZ3_cjs.verifyValue; }
+  get: function () { return chunkMZE4TPFU_cjs.verifyValue; }
 });
 exports.DEFAULT_ISSUER = DEFAULT_ISSUER;
 exports.MAX_ACT_DEPTH = MAX_ACT_DEPTH;

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, I as IntrospectOptions, f as IntrospectedToken, g as InvitationOutcome, h as InvitationResult, i as InviteUsersInput, J as JwksCache, j as JwksCacheOptions, k as JwksError, l as JwksUnavailableError, m as JwksUnknownKeyError, L as LoginResult, n as LoginStart, o as LogoutToken, M as MAX_AVATAR_BYTES, p as MAX_INVITATIONS, q as MigrationState, r as MigrationStatus, b as SessionPayload, s as SsoAppApiError, t as SsoAvatarRejectedError, u as SsoClaims, S as SsoClient, a as SsoConfig, v as SsoConfigError, w as SsoError, x as SsoInsufficientScopeError, y as SsoIntrospectionUnavailableError, z as SsoReauthError, E as SsoTokenInactiveError, F as TokenSet, T as TokenStore, G as cookieHeader, H as createJwksCache, K as createSsoClient, N as loadSsoConfig, O as memoryTokenStore, P as readCookie, Q as signSession, R as signValue, U as verifySession, V as verifyValue } from './session-eya6Bon5.cjs';
+export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, E as EMBEDDED_FLOW_MAX_AGE, f as EmbeddedClient, g as EmbeddedError, h as EmbeddedFlow, i as EmbeddedStart, j as EmbeddedStartInput, k as EmbeddedStep, l as EmbeddedTerms, I as IntrospectOptions, m as IntrospectedToken, n as InvitationOutcome, o as InvitationResult, p as InviteUsersInput, J as JwksCache, q as JwksCacheOptions, r as JwksError, s as JwksUnavailableError, t as JwksUnknownKeyError, L as LoginResult, u as LoginStart, v as LogoutToken, M as MAX_AVATAR_BYTES, w as MAX_INVITATIONS, x as MigrationState, y as MigrationStatus, b as SessionPayload, z as SsoAppApiError, F as SsoAvatarRejectedError, G as SsoClaims, S as SsoClient, a as SsoConfig, H as SsoConfigError, K as SsoError, N as SsoInsufficientScopeError, O as SsoIntrospectionUnavailableError, P as SsoReauthError, Q as SsoTokenInactiveError, R as TokenSet, T as TokenStore, U as cookieHeader, V as createJwksCache, W as createSsoClient, X as loadSsoConfig, Y as memoryTokenStore, Z as openEmbeddedFlow, _ as readCookie, $ as sealEmbeddedFlow, a0 as signSession, a1 as signValue, a2 as verifySession, a3 as verifyValue } from './session-qvhMg3ID.cjs';
 import { JWK } from 'jose';
 
 declare const DEFAULT_ISSUER = "https://id.broberg.ai";

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, I as IntrospectOptions, f as IntrospectedToken, g as InvitationOutcome, h as InvitationResult, i as InviteUsersInput, J as JwksCache, j as JwksCacheOptions, k as JwksError, l as JwksUnavailableError, m as JwksUnknownKeyError, L as LoginResult, n as LoginStart, o as LogoutToken, M as MAX_AVATAR_BYTES, p as MAX_INVITATIONS, q as MigrationState, r as MigrationStatus, b as SessionPayload, s as SsoAppApiError, t as SsoAvatarRejectedError, u as SsoClaims, S as SsoClient, a as SsoConfig, v as SsoConfigError, w as SsoError, x as SsoInsufficientScopeError, y as SsoIntrospectionUnavailableError, z as SsoReauthError, E as SsoTokenInactiveError, F as TokenSet, T as TokenStore, G as cookieHeader, H as createJwksCache, K as createSsoClient, N as loadSsoConfig, O as memoryTokenStore, P as readCookie, Q as signSession, R as signValue, U as verifySession, V as verifyValue } from './session-eya6Bon5.js';
+export { A as AVATAR_TYPES, c as AddressOwnership, B as BeginLoginOptions, d as BidProfile, C as CreateSsoClientOptions, D as DEFAULT_SESSION_MAX_AGE, e as Discovery, E as EMBEDDED_FLOW_MAX_AGE, f as EmbeddedClient, g as EmbeddedError, h as EmbeddedFlow, i as EmbeddedStart, j as EmbeddedStartInput, k as EmbeddedStep, l as EmbeddedTerms, I as IntrospectOptions, m as IntrospectedToken, n as InvitationOutcome, o as InvitationResult, p as InviteUsersInput, J as JwksCache, q as JwksCacheOptions, r as JwksError, s as JwksUnavailableError, t as JwksUnknownKeyError, L as LoginResult, u as LoginStart, v as LogoutToken, M as MAX_AVATAR_BYTES, w as MAX_INVITATIONS, x as MigrationState, y as MigrationStatus, b as SessionPayload, z as SsoAppApiError, F as SsoAvatarRejectedError, G as SsoClaims, S as SsoClient, a as SsoConfig, H as SsoConfigError, K as SsoError, N as SsoInsufficientScopeError, O as SsoIntrospectionUnavailableError, P as SsoReauthError, Q as SsoTokenInactiveError, R as TokenSet, T as TokenStore, U as cookieHeader, V as createJwksCache, W as createSsoClient, X as loadSsoConfig, Y as memoryTokenStore, Z as openEmbeddedFlow, _ as readCookie, $ as sealEmbeddedFlow, a0 as signSession, a1 as signValue, a2 as verifySession, a3 as verifyValue } from './session-qvhMg3ID.js';
 import { JWK } from 'jose';
 
 declare const DEFAULT_ISSUER = "https://id.broberg.ai";

package/dist/index.js

@@ -1,5 +1,5 @@
-import { SsoError, ALLOWED_ALGS, JwksUnavailableError, createJwksCache } from './chunk-XKKKS2RO.js';
-export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoIntrospectionUnavailableError, SsoReauthError, SsoTokenInactiveError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue } from './chunk-XKKKS2RO.js';
+import { SsoError, ALLOWED_ALGS, JwksUnavailableError, createJwksCache } from './chunk-PQTT74BA.js';
+export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, EMBEDDED_FLOW_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoIntrospectionUnavailableError, SsoReauthError, SsoTokenInactiveError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, openEmbeddedFlow, readCookie, sealEmbeddedFlow, signSession, signValue, verifySession, verifyValue } from './chunk-PQTT74BA.js';
 import { existsSync } from 'fs';
 import { request } from 'http';
 import { generateKeyPair, exportJWK, calculateJwkThumbprint, SignJWT, decodeProtectedHeader, importJWK, jwtVerify } from 'jose';

package/dist/{session-eya6Bon5.d.cts → session-qvhMg3ID.d.cts}

@@ -57,6 +57,105 @@ interface SsoConfig {
 declare const DEFAULT_SESSION_MAX_AGE: number;
 declare function loadSsoConfig(env?: NodeJS.ProcessEnv): SsoConfig;
 
+/** What a step can answer, as data the app can word itself (the contract's error table). */
+type EmbeddedError = {
+    kind: "invalid_code";
+    attemptsLeft?: number;
+} | {
+    kind: "expired";
+} | {
+    kind: "locked";
+    retryAfter?: number;
+} | {
+    kind: "too_many_requests";
+    retryAfter?: number;
+} | {
+    kind: "not_embedded";
+} | {
+    kind: "signup_not_enabled";
+} | {
+    kind: "terms_outdated";
+    version?: string;
+} | {
+    kind: "invalid_request";
+} | {
+    kind: "unavailable";
+    message: string;
+};
+/** The server-side state of one embedded login: keep it in a signed cookie (sealEmbeddedFlow). */
+interface EmbeddedFlow {
+    flowId: string;
+    codeVerifier: string;
+    nonce: string;
+    email: string;
+}
+interface EmbeddedStartInput {
+    email: string;
+    /** "signup" creates the account at verify (BID F084.167); needs `name` and the current `termsVersion`. */
+    intent?: "login" | "signup";
+    name?: string;
+    termsVersion?: string;
+    /** The user's IP, for BID's per-IP limit. Without it, BID counts your server's IP. */
+    endUserIp?: string;
+}
+type EmbeddedStart = {
+    ok: true;
+    flow: EmbeddedFlow;
+    expiresIn: number;
+} | {
+    ok: false;
+    error: EmbeddedError;
+};
+/** After a code: signed in (the same result as completeLogin), a second factor, or an error. */
+type EmbeddedStep = {
+    kind: "done";
+    result: LoginResult;
+} | {
+    kind: "second_factor";
+    methods: ("totp" | "sms")[];
+} | {
+    kind: "error";
+    error: EmbeddedError;
+};
+interface EmbeddedTerms {
+    version: string;
+    /** Show it VERBATIM at the button — BID owns the text. */
+    text: string;
+    links: {
+        label: string;
+        url: string;
+    }[];
+}
+interface EmbeddedClient {
+    start(input: EmbeddedStartInput): Promise<EmbeddedStart>;
+    verify(flow: EmbeddedFlow, code: string): Promise<EmbeddedStep>;
+    sendSms(flow: EmbeddedFlow): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        error: EmbeddedError;
+    }>;
+    verifySecondFactor(flow: EmbeddedFlow, method: "totp" | "sms", code: string): Promise<EmbeddedStep>;
+    /** BID's consent text for signup, current version. Throws SsoError if BID does not answer it. */
+    terms(lang: "da" | "en"): Promise<EmbeddedTerms>;
+}
+/** A flow lives as long as BID's code does (10 min). */
+declare const EMBEDDED_FLOW_MAX_AGE = 600;
+/** Seal the flow for a signed, httpOnly cookie (same signing as the login transaction). */
+declare function sealEmbeddedFlow(flow: EmbeddedFlow, secret: string, options?: {
+    now?: () => number;
+}): Promise<string>;
+/** Read it back: the flow, or why not — "absent" (no cookie), "expired" (too old), "unreadable" (not ours / tampered). */
+declare function openEmbeddedFlow(raw: string | undefined | null, secret: string, options?: {
+    now?: () => number;
+}): Promise<{
+    ok: true;
+    flow: EmbeddedFlow;
+} | {
+    ok: false;
+    reason: "absent" | "expired" | "unreadable";
+}>;
+
 /**
  * The signing-key cache.
  *
@@ -357,6 +456,12 @@ interface SsoClient {
     verifyIdToken(idToken: string, options?: {
         nonce?: string;
     }): Promise<SsoClaims>;
+    /**
+     * components-F084.165 — the embedded login and signup (BID F084.166 v1.1 + F084.167), called
+     * from YOUR SERVER as a confidential client (needs `clientSecret`). Ends in the same
+     * LoginResult as completeLogin. Keep the returned flow in a cookie with sealEmbeddedFlow.
+     */
+    embedded: EmbeddedClient;
     logoutUrl(options?: {
         idTokenHint?: string;
         postLogoutRedirectUri?: string;
@@ -623,4 +728,4 @@ declare function cookieHeader(name: string, value: string, opts: {
 }): string;
 declare function readCookie(header: string | null | undefined, name: string): string | undefined;
 
-export { AVATAR_TYPES as A, type BeginLoginOptions as B, type CreateSsoClientOptions as C, DEFAULT_SESSION_MAX_AGE as D, SsoTokenInactiveError as E, type TokenSet as F, cookieHeader as G, createJwksCache as H, type IntrospectOptions as I, type JwksCache as J, createSsoClient as K, type LoginResult as L, MAX_AVATAR_BYTES as M, loadSsoConfig as N, memoryTokenStore as O, readCookie as P, signSession as Q, signValue as R, type SsoClient as S, type TokenStore as T, verifySession as U, verifyValue as V, type SsoConfig as a, type SessionPayload as b, type AddressOwnership as c, type BidProfile as d, type Discovery as e, type IntrospectedToken as f, type InvitationOutcome as g, type InvitationResult as h, type InviteUsersInput as i, type JwksCacheOptions as j, JwksError as k, JwksUnavailableError as l, JwksUnknownKeyError as m, type LoginStart as n, type LogoutToken as o, MAX_INVITATIONS as p, type MigrationState as q, type MigrationStatus as r, SsoAppApiError as s, SsoAvatarRejectedError as t, type SsoClaims as u, SsoConfigError as v, SsoError as w, SsoInsufficientScopeError as x, SsoIntrospectionUnavailableError as y, SsoReauthError as z };
+export { sealEmbeddedFlow as $, AVATAR_TYPES as A, type BeginLoginOptions as B, type CreateSsoClientOptions as C, DEFAULT_SESSION_MAX_AGE as D, EMBEDDED_FLOW_MAX_AGE as E, SsoAvatarRejectedError as F, type SsoClaims as G, SsoConfigError as H, type IntrospectOptions as I, type JwksCache as J, SsoError as K, type LoginResult as L, MAX_AVATAR_BYTES as M, SsoInsufficientScopeError as N, SsoIntrospectionUnavailableError as O, SsoReauthError as P, SsoTokenInactiveError as Q, type TokenSet as R, type SsoClient as S, type TokenStore as T, cookieHeader as U, createJwksCache as V, createSsoClient as W, loadSsoConfig as X, memoryTokenStore as Y, openEmbeddedFlow as Z, readCookie as _, type SsoConfig as a, signSession as a0, signValue as a1, verifySession as a2, verifyValue as a3, type SessionPayload as b, type AddressOwnership as c, type BidProfile as d, type Discovery as e, type EmbeddedClient as f, type EmbeddedError as g, type EmbeddedFlow as h, type EmbeddedStart as i, type EmbeddedStartInput as j, type EmbeddedStep as k, type EmbeddedTerms as l, type IntrospectedToken as m, type InvitationOutcome as n, type InvitationResult as o, type InviteUsersInput as p, type JwksCacheOptions as q, JwksError as r, JwksUnavailableError as s, JwksUnknownKeyError as t, type LoginStart as u, type LogoutToken as v, MAX_INVITATIONS as w, type MigrationState as x, type MigrationStatus as y, SsoAppApiError as z };

package/dist/{session-eya6Bon5.d.ts → session-qvhMg3ID.d.ts}

@@ -57,6 +57,105 @@ interface SsoConfig {
 declare const DEFAULT_SESSION_MAX_AGE: number;
 declare function loadSsoConfig(env?: NodeJS.ProcessEnv): SsoConfig;
 
+/** What a step can answer, as data the app can word itself (the contract's error table). */
+type EmbeddedError = {
+    kind: "invalid_code";
+    attemptsLeft?: number;
+} | {
+    kind: "expired";
+} | {
+    kind: "locked";
+    retryAfter?: number;
+} | {
+    kind: "too_many_requests";
+    retryAfter?: number;
+} | {
+    kind: "not_embedded";
+} | {
+    kind: "signup_not_enabled";
+} | {
+    kind: "terms_outdated";
+    version?: string;
+} | {
+    kind: "invalid_request";
+} | {
+    kind: "unavailable";
+    message: string;
+};
+/** The server-side state of one embedded login: keep it in a signed cookie (sealEmbeddedFlow). */
+interface EmbeddedFlow {
+    flowId: string;
+    codeVerifier: string;
+    nonce: string;
+    email: string;
+}
+interface EmbeddedStartInput {
+    email: string;
+    /** "signup" creates the account at verify (BID F084.167); needs `name` and the current `termsVersion`. */
+    intent?: "login" | "signup";
+    name?: string;
+    termsVersion?: string;
+    /** The user's IP, for BID's per-IP limit. Without it, BID counts your server's IP. */
+    endUserIp?: string;
+}
+type EmbeddedStart = {
+    ok: true;
+    flow: EmbeddedFlow;
+    expiresIn: number;
+} | {
+    ok: false;
+    error: EmbeddedError;
+};
+/** After a code: signed in (the same result as completeLogin), a second factor, or an error. */
+type EmbeddedStep = {
+    kind: "done";
+    result: LoginResult;
+} | {
+    kind: "second_factor";
+    methods: ("totp" | "sms")[];
+} | {
+    kind: "error";
+    error: EmbeddedError;
+};
+interface EmbeddedTerms {
+    version: string;
+    /** Show it VERBATIM at the button — BID owns the text. */
+    text: string;
+    links: {
+        label: string;
+        url: string;
+    }[];
+}
+interface EmbeddedClient {
+    start(input: EmbeddedStartInput): Promise<EmbeddedStart>;
+    verify(flow: EmbeddedFlow, code: string): Promise<EmbeddedStep>;
+    sendSms(flow: EmbeddedFlow): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        error: EmbeddedError;
+    }>;
+    verifySecondFactor(flow: EmbeddedFlow, method: "totp" | "sms", code: string): Promise<EmbeddedStep>;
+    /** BID's consent text for signup, current version. Throws SsoError if BID does not answer it. */
+    terms(lang: "da" | "en"): Promise<EmbeddedTerms>;
+}
+/** A flow lives as long as BID's code does (10 min). */
+declare const EMBEDDED_FLOW_MAX_AGE = 600;
+/** Seal the flow for a signed, httpOnly cookie (same signing as the login transaction). */
+declare function sealEmbeddedFlow(flow: EmbeddedFlow, secret: string, options?: {
+    now?: () => number;
+}): Promise<string>;
+/** Read it back: the flow, or why not — "absent" (no cookie), "expired" (too old), "unreadable" (not ours / tampered). */
+declare function openEmbeddedFlow(raw: string | undefined | null, secret: string, options?: {
+    now?: () => number;
+}): Promise<{
+    ok: true;
+    flow: EmbeddedFlow;
+} | {
+    ok: false;
+    reason: "absent" | "expired" | "unreadable";
+}>;
+
 /**
  * The signing-key cache.
  *
@@ -357,6 +456,12 @@ interface SsoClient {
     verifyIdToken(idToken: string, options?: {
         nonce?: string;
     }): Promise<SsoClaims>;
+    /**
+     * components-F084.165 — the embedded login and signup (BID F084.166 v1.1 + F084.167), called
+     * from YOUR SERVER as a confidential client (needs `clientSecret`). Ends in the same
+     * LoginResult as completeLogin. Keep the returned flow in a cookie with sealEmbeddedFlow.
+     */
+    embedded: EmbeddedClient;
     logoutUrl(options?: {
         idTokenHint?: string;
         postLogoutRedirectUri?: string;
@@ -623,4 +728,4 @@ declare function cookieHeader(name: string, value: string, opts: {
 }): string;
 declare function readCookie(header: string | null | undefined, name: string): string | undefined;
 
-export { AVATAR_TYPES as A, type BeginLoginOptions as B, type CreateSsoClientOptions as C, DEFAULT_SESSION_MAX_AGE as D, SsoTokenInactiveError as E, type TokenSet as F, cookieHeader as G, createJwksCache as H, type IntrospectOptions as I, type JwksCache as J, createSsoClient as K, type LoginResult as L, MAX_AVATAR_BYTES as M, loadSsoConfig as N, memoryTokenStore as O, readCookie as P, signSession as Q, signValue as R, type SsoClient as S, type TokenStore as T, verifySession as U, verifyValue as V, type SsoConfig as a, type SessionPayload as b, type AddressOwnership as c, type BidProfile as d, type Discovery as e, type IntrospectedToken as f, type InvitationOutcome as g, type InvitationResult as h, type InviteUsersInput as i, type JwksCacheOptions as j, JwksError as k, JwksUnavailableError as l, JwksUnknownKeyError as m, type LoginStart as n, type LogoutToken as o, MAX_INVITATIONS as p, type MigrationState as q, type MigrationStatus as r, SsoAppApiError as s, SsoAvatarRejectedError as t, type SsoClaims as u, SsoConfigError as v, SsoError as w, SsoInsufficientScopeError as x, SsoIntrospectionUnavailableError as y, SsoReauthError as z };
+export { sealEmbeddedFlow as $, AVATAR_TYPES as A, type BeginLoginOptions as B, type CreateSsoClientOptions as C, DEFAULT_SESSION_MAX_AGE as D, EMBEDDED_FLOW_MAX_AGE as E, SsoAvatarRejectedError as F, type SsoClaims as G, SsoConfigError as H, type IntrospectOptions as I, type JwksCache as J, SsoError as K, type LoginResult as L, MAX_AVATAR_BYTES as M, SsoInsufficientScopeError as N, SsoIntrospectionUnavailableError as O, SsoReauthError as P, SsoTokenInactiveError as Q, type TokenSet as R, type SsoClient as S, type TokenStore as T, cookieHeader as U, createJwksCache as V, createSsoClient as W, loadSsoConfig as X, memoryTokenStore as Y, openEmbeddedFlow as Z, readCookie as _, type SsoConfig as a, signSession as a0, signValue as a1, verifySession as a2, verifyValue as a3, type SessionPayload as b, type AddressOwnership as c, type BidProfile as d, type Discovery as e, type EmbeddedClient as f, type EmbeddedError as g, type EmbeddedFlow as h, type EmbeddedStart as i, type EmbeddedStartInput as j, type EmbeddedStep as k, type EmbeddedTerms as l, type IntrospectedToken as m, type InvitationOutcome as n, type InvitationResult as o, type InviteUsersInput as p, type JwksCacheOptions as q, JwksError as r, JwksUnavailableError as s, JwksUnknownKeyError as t, type LoginStart as u, type LogoutToken as v, MAX_INVITATIONS as w, type MigrationState as x, type MigrationStatus as y, SsoAppApiError as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@broberg/sso",
-  "version": "0.18.3",
+  "version": "0.19.0",
   "description": "The thin client for BrobergID — send a user to central login, verify the ID token against JWKS, keep a local session. Public client + PKCE only: no passwords, no passkeys, no client secret can live in an app.",
   "type": "module",
   "license": "MIT",