@broberg/sso 0.19.0 → 0.19.1

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkMZE4TPFU_cjs = require('./chunk-MZE4TPFU.cjs');
+var chunk2F3RPYJV_cjs = require('./chunk-2F3RPYJV.cjs');
 var fs = require('fs');
 var http = require('http');
 var jose = require('jose');
@@ -48,37 +48,37 @@ async function verifyDpopProof(proof, o) {
   try {
     header = jose.decodeProtectedHeader(proof);
   } catch {
-    throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof is not a JWS");
+    throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof is not a JWS");
   }
-  if (header.typ !== "dpop+jwt") throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
-  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
+  if (header.typ !== "dpop+jwt") throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
+  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
   const jwk = header.jwk;
-  if (!jwk || typeof jwk !== "object") throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof carries no jwk");
-  if ("d" in jwk) throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof jwk contains a private key");
+  if (!jwk || typeof jwk !== "object") throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof carries no jwk");
+  if ("d" in jwk) throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof jwk contains a private key");
   let payload;
   try {
     const key = await jose.importJWK(jwk, header.alg);
     ({ payload } = await jose.jwtVerify(proof, key, { typ: "dpop+jwt", algorithms: [header.alg] }));
   } catch (e) {
-    throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
+    throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
   }
-  if (await jose.calculateJwkThumbprint(jwk) !== o.jkt) throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof key does not match the ticket's cnf.jkt");
-  if (payload.htm !== o.method.toUpperCase()) throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
+  if (await jose.calculateJwkThumbprint(jwk) !== o.jkt) throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof key does not match the ticket's cnf.jkt");
+  if (payload.htm !== o.method.toUpperCase()) throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
   let htu;
   try {
     htu = normalizeHtu(String(payload.htu));
   } catch {
-    throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof htu is not a URL");
+    throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof htu is not a URL");
   }
-  if (htu !== normalizeHtu(o.url)) throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
+  if (htu !== normalizeHtu(o.url)) throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
   const nowSec = Math.floor(o.now() / 1e3);
   if (typeof payload.iat !== "number" || Math.abs(nowSec - payload.iat) > o.iatWindowSec) {
-    throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
+    throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
   }
-  if (payload.ath !== await accessTokenHash(o.ticket)) throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof ath does not match this ticket");
-  if (typeof payload.jti !== "string" || payload.jti === "") throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof has no jti");
+  if (payload.ath !== await accessTokenHash(o.ticket)) throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof ath does not match this ticket");
+  if (typeof payload.jti !== "string" || payload.jti === "") throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof has no jti");
   if (await o.replay.seen(`${o.jkt}:${payload.jti}`, o.iatWindowSec * 2 * 1e3)) {
-    throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof was already used (jti replay)");
+    throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof was already used (jti replay)");
   }
 }
 
@@ -241,10 +241,10 @@ function createTicketVerifier(options) {
     now = () => Date.now()
   } = options;
   const replayStore = options.replayStore ?? createMemoryReplayStore(now);
-  if (!issuer) throw new chunkMZE4TPFU_cjs.SsoError("createTicketVerifier needs an issuer");
-  if (!audience) throw new chunkMZE4TPFU_cjs.SsoError("createTicketVerifier needs this receiver's audience");
+  if (!issuer) throw new chunk2F3RPYJV_cjs.SsoError("createTicketVerifier needs an issuer");
+  if (!audience) throw new chunk2F3RPYJV_cjs.SsoError("createTicketVerifier needs this receiver's audience");
   let cachePromise = null;
-  const cacheFor = (jwksUri) => chunkMZE4TPFU_cjs.createJwksCache({
+  const cacheFor = (jwksUri) => chunk2F3RPYJV_cjs.createJwksCache({
     jwksUri,
     fetchImpl,
     ...options.warmUp ? { warmUp: true } : {},
@@ -260,12 +260,12 @@ function createTicketVerifier(options) {
         if (!res.ok) throw new Error(`answered ${res.status}`);
         doc = await res.json();
       } catch (cause) {
-        throw new chunkMZE4TPFU_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
+        throw new chunk2F3RPYJV_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
       }
       if (doc.issuer !== issuer) {
-        throw new chunkMZE4TPFU_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
+        throw new chunk2F3RPYJV_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
       }
-      if (!doc.jwks_uri) throw new chunkMZE4TPFU_cjs.SsoError(`${url} names no jwks_uri`);
+      if (!doc.jwks_uri) throw new chunk2F3RPYJV_cjs.SsoError(`${url} names no jwks_uri`);
       return cacheFor(doc.jwks_uri);
     })().catch((err) => {
       cachePromise = null;
@@ -281,51 +281,51 @@ function createTicketVerifier(options) {
       try {
         header = jose.decodeProtectedHeader(token);
       } catch {
-        throw new chunkMZE4TPFU_cjs.SsoError("ticket is not a JWS");
+        throw new chunk2F3RPYJV_cjs.SsoError("ticket is not a JWS");
       }
-      if (!header.kid) throw new chunkMZE4TPFU_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
-      if (header.typ === "logout+jwt") throw new chunkMZE4TPFU_cjs.SsoError("a logout token is not a ticket");
+      if (!header.kid) throw new chunk2F3RPYJV_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
+      if (header.typ === "logout+jwt") throw new chunk2F3RPYJV_cjs.SsoError("a logout token is not a ticket");
       const cache = await keys();
       let payload;
       try {
         ({ payload } = await jose.jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "EdDSA"), {
           issuer,
           audience,
-          algorithms: chunkMZE4TPFU_cjs.ALLOWED_ALGS,
+          algorithms: chunk2F3RPYJV_cjs.ALLOWED_ALGS,
           clockTolerance: clockToleranceSec,
           requiredClaims: ["exp", "iat", "jti", "sub"]
         }));
       } catch (e) {
-        if (e instanceof chunkMZE4TPFU_cjs.JwksUnavailableError) throw e;
-        throw new chunkMZE4TPFU_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
+        if (e instanceof chunk2F3RPYJV_cjs.JwksUnavailableError) throw e;
+        throw new chunk2F3RPYJV_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
       }
-      if ("events" in payload) throw new chunkMZE4TPFU_cjs.SsoError("a logout token is not a ticket");
-      if ("nonce" in payload) throw new chunkMZE4TPFU_cjs.SsoError("an ID token is not a ticket");
+      if ("events" in payload) throw new chunk2F3RPYJV_cjs.SsoError("a logout token is not a ticket");
+      if ("nonce" in payload) throw new chunk2F3RPYJV_cjs.SsoError("an ID token is not a ticket");
       const type = payload.principal_type;
       if (typeof type !== "string" || !PRINCIPAL_TYPES.includes(type)) {
-        throw new chunkMZE4TPFU_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
+        throw new chunk2F3RPYJV_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
       }
       const lifetime = payload.exp - payload.iat;
       if (lifetime > maxLifetimeSec) {
-        throw new chunkMZE4TPFU_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
+        throw new chunk2F3RPYJV_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
       }
-      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunkMZE4TPFU_cjs.SsoError("ticket has no sub");
+      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunk2F3RPYJV_cjs.SsoError("ticket has no sub");
       const scopes = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [];
       const required = opts.scope === void 0 ? [] : Array.isArray(opts.scope) ? opts.scope : [opts.scope];
       const missing = required.filter((s) => !scopes.includes(s));
-      if (missing.length) throw new chunkMZE4TPFU_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
+      if (missing.length) throw new chunk2F3RPYJV_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
       const ver = payload.ver === void 0 ? 0 : payload.ver;
       if (typeof ver !== "number" || !Number.isInteger(ver) || ver < 0) {
-        throw new chunkMZE4TPFU_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
+        throw new chunk2F3RPYJV_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
       }
       if (ver > TICKET_FORMAT_VERSION) {
-        throw new chunkMZE4TPFU_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
+        throw new chunk2F3RPYJV_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
       }
       const act = payload.act === void 0 ? null : readActor(payload.act, 1);
       const cnfRaw = payload.cnf;
       const cnf = cnfRaw && typeof cnfRaw.jkt === "string" && cnfRaw.jkt ? { jkt: cnfRaw.jkt } : null;
       if (cnf) {
-        if (!opts.dpop?.proof) throw new chunkMZE4TPFU_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
+        if (!opts.dpop?.proof) throw new chunk2F3RPYJV_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
         await verifyDpopProof(opts.dpop.proof, {
           method: opts.dpop.method,
           url: opts.dpop.url,
@@ -336,11 +336,11 @@ function createTicketVerifier(options) {
           now
         });
       } else if (requireDpop) {
-        throw new chunkMZE4TPFU_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
+        throw new chunk2F3RPYJV_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
       }
       const named = (v) => typeof v === "string" && v ? v : null;
       const clientId = type === "user" ? named(payload.client_id) ?? named(payload.azp) : named(payload.client_id) ?? payload.sub;
-      if (clientId === null) throw new chunkMZE4TPFU_cjs.SsoError("a user ticket names no app (no client_id or azp)");
+      if (clientId === null) throw new chunk2F3RPYJV_cjs.SsoError("a user ticket names no app (no client_id or azp)");
       return {
         principal: payload.sub,
         type,
@@ -357,125 +357,125 @@ function createTicketVerifier(options) {
   };
 }
 function readActor(raw, depth) {
-  if (depth > MAX_ACT_DEPTH) throw new chunkMZE4TPFU_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
+  if (depth > MAX_ACT_DEPTH) throw new chunk2F3RPYJV_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
   const link = raw;
   if (!link || typeof link !== "object" || typeof link.sub !== "string" || link.sub === "") {
-    throw new chunkMZE4TPFU_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
+    throw new chunk2F3RPYJV_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
   }
   return link.act === void 0 ? { sub: link.sub } : { sub: link.sub, act: readActor(link.act, depth + 1) };
 }
 
 Object.defineProperty(exports, "AVATAR_TYPES", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.AVATAR_TYPES; }
+  get: function () { return chunk2F3RPYJV_cjs.AVATAR_TYPES; }
 });
 Object.defineProperty(exports, "DEFAULT_SESSION_MAX_AGE", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.DEFAULT_SESSION_MAX_AGE; }
+  get: function () { return chunk2F3RPYJV_cjs.DEFAULT_SESSION_MAX_AGE; }
 });
 Object.defineProperty(exports, "EMBEDDED_FLOW_MAX_AGE", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.EMBEDDED_FLOW_MAX_AGE; }
+  get: function () { return chunk2F3RPYJV_cjs.EMBEDDED_FLOW_MAX_AGE; }
 });
 Object.defineProperty(exports, "JwksError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.JwksError; }
+  get: function () { return chunk2F3RPYJV_cjs.JwksError; }
 });
 Object.defineProperty(exports, "JwksUnavailableError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.JwksUnavailableError; }
+  get: function () { return chunk2F3RPYJV_cjs.JwksUnavailableError; }
 });
 Object.defineProperty(exports, "JwksUnknownKeyError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.JwksUnknownKeyError; }
+  get: function () { return chunk2F3RPYJV_cjs.JwksUnknownKeyError; }
 });
 Object.defineProperty(exports, "MAX_AVATAR_BYTES", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.MAX_AVATAR_BYTES; }
+  get: function () { return chunk2F3RPYJV_cjs.MAX_AVATAR_BYTES; }
 });
 Object.defineProperty(exports, "MAX_INVITATIONS", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.MAX_INVITATIONS; }
+  get: function () { return chunk2F3RPYJV_cjs.MAX_INVITATIONS; }
 });
 Object.defineProperty(exports, "SsoAppApiError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoAppApiError; }
+  get: function () { return chunk2F3RPYJV_cjs.SsoAppApiError; }
 });
 Object.defineProperty(exports, "SsoAvatarRejectedError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoAvatarRejectedError; }
+  get: function () { return chunk2F3RPYJV_cjs.SsoAvatarRejectedError; }
 });
 Object.defineProperty(exports, "SsoConfigError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoConfigError; }
+  get: function () { return chunk2F3RPYJV_cjs.SsoConfigError; }
 });
 Object.defineProperty(exports, "SsoError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoError; }
+  get: function () { return chunk2F3RPYJV_cjs.SsoError; }
 });
 Object.defineProperty(exports, "SsoInsufficientScopeError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoInsufficientScopeError; }
+  get: function () { return chunk2F3RPYJV_cjs.SsoInsufficientScopeError; }
 });
 Object.defineProperty(exports, "SsoIntrospectionUnavailableError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoIntrospectionUnavailableError; }
+  get: function () { return chunk2F3RPYJV_cjs.SsoIntrospectionUnavailableError; }
 });
 Object.defineProperty(exports, "SsoReauthError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoReauthError; }
+  get: function () { return chunk2F3RPYJV_cjs.SsoReauthError; }
 });
 Object.defineProperty(exports, "SsoTokenInactiveError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoTokenInactiveError; }
+  get: function () { return chunk2F3RPYJV_cjs.SsoTokenInactiveError; }
 });
 Object.defineProperty(exports, "cookieHeader", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.cookieHeader; }
+  get: function () { return chunk2F3RPYJV_cjs.cookieHeader; }
 });
 Object.defineProperty(exports, "createJwksCache", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.createJwksCache; }
+  get: function () { return chunk2F3RPYJV_cjs.createJwksCache; }
 });
 Object.defineProperty(exports, "createSsoClient", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.createSsoClient; }
+  get: function () { return chunk2F3RPYJV_cjs.createSsoClient; }
 });
 Object.defineProperty(exports, "loadSsoConfig", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.loadSsoConfig; }
+  get: function () { return chunk2F3RPYJV_cjs.loadSsoConfig; }
 });
 Object.defineProperty(exports, "memoryTokenStore", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.memoryTokenStore; }
+  get: function () { return chunk2F3RPYJV_cjs.memoryTokenStore; }
 });
 Object.defineProperty(exports, "openEmbeddedFlow", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.openEmbeddedFlow; }
+  get: function () { return chunk2F3RPYJV_cjs.openEmbeddedFlow; }
 });
 Object.defineProperty(exports, "readCookie", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.readCookie; }
+  get: function () { return chunk2F3RPYJV_cjs.readCookie; }
 });
 Object.defineProperty(exports, "sealEmbeddedFlow", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.sealEmbeddedFlow; }
+  get: function () { return chunk2F3RPYJV_cjs.sealEmbeddedFlow; }
 });
 Object.defineProperty(exports, "signSession", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.signSession; }
+  get: function () { return chunk2F3RPYJV_cjs.signSession; }
 });
 Object.defineProperty(exports, "signValue", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.signValue; }
+  get: function () { return chunk2F3RPYJV_cjs.signValue; }
 });
 Object.defineProperty(exports, "verifySession", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.verifySession; }
+  get: function () { return chunk2F3RPYJV_cjs.verifySession; }
 });
 Object.defineProperty(exports, "verifyValue", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.verifyValue; }
+  get: function () { return chunk2F3RPYJV_cjs.verifyValue; }
 });
 exports.DEFAULT_ISSUER = DEFAULT_ISSUER;
 exports.MAX_ACT_DEPTH = MAX_ACT_DEPTH;

package/dist/index.js

@@ -1,5 +1,5 @@
-import { SsoError, ALLOWED_ALGS, JwksUnavailableError, createJwksCache } from './chunk-PQTT74BA.js';
-export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, EMBEDDED_FLOW_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoIntrospectionUnavailableError, SsoReauthError, SsoTokenInactiveError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, openEmbeddedFlow, readCookie, sealEmbeddedFlow, signSession, signValue, verifySession, verifyValue } from './chunk-PQTT74BA.js';
+import { SsoError, ALLOWED_ALGS, JwksUnavailableError, createJwksCache } from './chunk-CCDRB6NJ.js';
+export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, EMBEDDED_FLOW_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoIntrospectionUnavailableError, SsoReauthError, SsoTokenInactiveError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, openEmbeddedFlow, readCookie, sealEmbeddedFlow, signSession, signValue, verifySession, verifyValue } from './chunk-CCDRB6NJ.js';
 import { existsSync } from 'fs';
 import { request } from 'http';
 import { generateKeyPair, exportJWK, calculateJwkThumbprint, SignJWT, decodeProtectedHeader, importJWK, jwtVerify } from 'jose';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@broberg/sso",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "The thin client for BrobergID — send a user to central login, verify the ID token against JWKS, keep a local session. Public client + PKCE only: no passwords, no passkeys, no client secret can live in an app.",
   "type": "module",
   "license": "MIT",