@broberg/sso 0.19.0 → 0.20.0

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkMZE4TPFU_cjs = require('./chunk-MZE4TPFU.cjs');
+var chunkKEBSZBHL_cjs = require('./chunk-KEBSZBHL.cjs');
 var fs = require('fs');
 var http = require('http');
 var jose = require('jose');
@@ -48,37 +48,37 @@ async function verifyDpopProof(proof, o) {
   try {
     header = jose.decodeProtectedHeader(proof);
   } catch {
-    throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof is not a JWS");
+    throw new chunkKEBSZBHL_cjs.SsoError("DPoP proof is not a JWS");
   }
-  if (header.typ !== "dpop+jwt") throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
-  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
+  if (header.typ !== "dpop+jwt") throw new chunkKEBSZBHL_cjs.SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
+  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new chunkKEBSZBHL_cjs.SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
   const jwk = header.jwk;
-  if (!jwk || typeof jwk !== "object") throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof carries no jwk");
-  if ("d" in jwk) throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof jwk contains a private key");
+  if (!jwk || typeof jwk !== "object") throw new chunkKEBSZBHL_cjs.SsoError("DPoP proof carries no jwk");
+  if ("d" in jwk) throw new chunkKEBSZBHL_cjs.SsoError("DPoP proof jwk contains a private key");
   let payload;
   try {
     const key = await jose.importJWK(jwk, header.alg);
     ({ payload } = await jose.jwtVerify(proof, key, { typ: "dpop+jwt", algorithms: [header.alg] }));
   } catch (e) {
-    throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
+    throw new chunkKEBSZBHL_cjs.SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
   }
-  if (await jose.calculateJwkThumbprint(jwk) !== o.jkt) throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof key does not match the ticket's cnf.jkt");
-  if (payload.htm !== o.method.toUpperCase()) throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
+  if (await jose.calculateJwkThumbprint(jwk) !== o.jkt) throw new chunkKEBSZBHL_cjs.SsoError("DPoP proof key does not match the ticket's cnf.jkt");
+  if (payload.htm !== o.method.toUpperCase()) throw new chunkKEBSZBHL_cjs.SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
   let htu;
   try {
     htu = normalizeHtu(String(payload.htu));
   } catch {
-    throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof htu is not a URL");
+    throw new chunkKEBSZBHL_cjs.SsoError("DPoP proof htu is not a URL");
   }
-  if (htu !== normalizeHtu(o.url)) throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
+  if (htu !== normalizeHtu(o.url)) throw new chunkKEBSZBHL_cjs.SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
   const nowSec = Math.floor(o.now() / 1e3);
   if (typeof payload.iat !== "number" || Math.abs(nowSec - payload.iat) > o.iatWindowSec) {
-    throw new chunkMZE4TPFU_cjs.SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
+    throw new chunkKEBSZBHL_cjs.SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
   }
-  if (payload.ath !== await accessTokenHash(o.ticket)) throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof ath does not match this ticket");
-  if (typeof payload.jti !== "string" || payload.jti === "") throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof has no jti");
+  if (payload.ath !== await accessTokenHash(o.ticket)) throw new chunkKEBSZBHL_cjs.SsoError("DPoP proof ath does not match this ticket");
+  if (typeof payload.jti !== "string" || payload.jti === "") throw new chunkKEBSZBHL_cjs.SsoError("DPoP proof has no jti");
   if (await o.replay.seen(`${o.jkt}:${payload.jti}`, o.iatWindowSec * 2 * 1e3)) {
-    throw new chunkMZE4TPFU_cjs.SsoError("DPoP proof was already used (jti replay)");
+    throw new chunkKEBSZBHL_cjs.SsoError("DPoP proof was already used (jti replay)");
   }
 }
 
@@ -134,6 +134,22 @@ function jwtExp(token) {
     return null;
   }
 }
+async function readTicketResponse(res, issuer, target, now) {
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+  }
+  if (res.status >= 500) throw new TicketUnavailableError(`${issuer} answered ${res.status}`);
+  if (!res.ok || !body.access_token) {
+    const desc = body.error_description ?? "";
+    const code = desc.includes(":") ? desc.slice(0, desc.indexOf(":")).trim() : body.error ?? "exchange_refused";
+    throw new TicketExchangeError(`BID refused the ticket for ${target}: ${desc || body.error || res.status}`, code, res.status);
+  }
+  const nowSec = Math.floor(now() / 1e3);
+  const exp = jwtExp(body.access_token) ?? nowSec + (body.expires_in ?? 300);
+  return { token: body.access_token, exp };
+}
 function createTicketClient(options = {}) {
   const issuer = (options.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
   const renewBeforeSec = options.renewBeforeSec ?? 30;
@@ -184,20 +200,7 @@ function createTicketClient(options = {}) {
     } catch (e) {
       throw new TicketUnavailableError(`${issuer} unreachable: ${e instanceof Error ? e.message : String(e)}`);
     }
-    let body = {};
-    try {
-      body = await res.json();
-    } catch {
-    }
-    if (res.status >= 500) throw new TicketUnavailableError(`${issuer} answered ${res.status}`);
-    if (!res.ok || !body.access_token) {
-      const desc = body.error_description ?? "";
-      const code = desc.includes(":") ? desc.slice(0, desc.indexOf(":")).trim() : body.error ?? "exchange_refused";
-      throw new TicketExchangeError(`BID refused the ticket for ${audience}: ${desc || body.error || res.status}`, code, res.status);
-    }
-    const nowSec = Math.floor(now() / 1e3);
-    const exp = jwtExp(body.access_token) ?? nowSec + (body.expires_in ?? 300);
-    return { token: body.access_token, exp };
+    return readTicketResponse(res, issuer, audience, now);
   }
   const client = {
     async authHeaders({ audience, scope, method, url }) {
@@ -226,6 +229,36 @@ function fetchTicket(opts) {
   shared ??= createTicketClient();
   return shared.get(opts);
 }
+async function exchangeUserToken(opts) {
+  const issuer = (opts.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+  const target = opts.resource ?? opts.audience;
+  if (!target) throw new TicketExchangeError("exchangeUserToken needs a receiver: resource (its URL) or audience (BID's name for it)", "malformed_request", 0);
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const now = opts.now ?? (() => Date.now());
+  const form = new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+    subject_token: opts.subjectToken,
+    subject_token_type: "urn:ietf:params:oauth:token-type:access_token"
+  });
+  if (opts.resource) form.set("resource", opts.resource);
+  if (opts.audience) form.set("audience", opts.audience);
+  if (opts.scope) form.set("scope", opts.scope);
+  const tokenUrl = `${issuer}/oauth2/token`;
+  const headers = { "content-type": "application/x-www-form-urlencoded" };
+  if (opts.clientSecret) {
+    headers.authorization = `Basic ${btoa(`${encodeURIComponent(opts.clientId)}:${encodeURIComponent(opts.clientSecret)}`)}`;
+  } else {
+    form.set("client_id", opts.clientId);
+  }
+  if (opts.dpopKey) headers.dpop = await createDpopProof(opts.dpopKey, { method: "POST", url: tokenUrl, now });
+  let res;
+  try {
+    res = await fetchImpl(tokenUrl, { method: "POST", headers, body: form });
+  } catch (e) {
+    throw new TicketUnavailableError(`${issuer} unreachable: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  return readTicketResponse(res, issuer, target, now);
+}
 var PRINCIPAL_TYPES = ["human", "service", "agent", "user"];
 var TICKET_FORMAT_VERSION = 1;
 var MAX_ACT_DEPTH = 5;
@@ -241,10 +274,10 @@ function createTicketVerifier(options) {
     now = () => Date.now()
   } = options;
   const replayStore = options.replayStore ?? createMemoryReplayStore(now);
-  if (!issuer) throw new chunkMZE4TPFU_cjs.SsoError("createTicketVerifier needs an issuer");
-  if (!audience) throw new chunkMZE4TPFU_cjs.SsoError("createTicketVerifier needs this receiver's audience");
+  if (!issuer) throw new chunkKEBSZBHL_cjs.SsoError("createTicketVerifier needs an issuer");
+  if (!audience) throw new chunkKEBSZBHL_cjs.SsoError("createTicketVerifier needs this receiver's audience");
   let cachePromise = null;
-  const cacheFor = (jwksUri) => chunkMZE4TPFU_cjs.createJwksCache({
+  const cacheFor = (jwksUri) => chunkKEBSZBHL_cjs.createJwksCache({
     jwksUri,
     fetchImpl,
     ...options.warmUp ? { warmUp: true } : {},
@@ -260,12 +293,12 @@ function createTicketVerifier(options) {
         if (!res.ok) throw new Error(`answered ${res.status}`);
         doc = await res.json();
       } catch (cause) {
-        throw new chunkMZE4TPFU_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
+        throw new chunkKEBSZBHL_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
       }
       if (doc.issuer !== issuer) {
-        throw new chunkMZE4TPFU_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
+        throw new chunkKEBSZBHL_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
       }
-      if (!doc.jwks_uri) throw new chunkMZE4TPFU_cjs.SsoError(`${url} names no jwks_uri`);
+      if (!doc.jwks_uri) throw new chunkKEBSZBHL_cjs.SsoError(`${url} names no jwks_uri`);
       return cacheFor(doc.jwks_uri);
     })().catch((err) => {
       cachePromise = null;
@@ -281,51 +314,51 @@ function createTicketVerifier(options) {
       try {
         header = jose.decodeProtectedHeader(token);
       } catch {
-        throw new chunkMZE4TPFU_cjs.SsoError("ticket is not a JWS");
+        throw new chunkKEBSZBHL_cjs.SsoError("ticket is not a JWS");
       }
-      if (!header.kid) throw new chunkMZE4TPFU_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
-      if (header.typ === "logout+jwt") throw new chunkMZE4TPFU_cjs.SsoError("a logout token is not a ticket");
+      if (!header.kid) throw new chunkKEBSZBHL_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
+      if (header.typ === "logout+jwt") throw new chunkKEBSZBHL_cjs.SsoError("a logout token is not a ticket");
       const cache = await keys();
       let payload;
       try {
         ({ payload } = await jose.jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "EdDSA"), {
           issuer,
           audience,
-          algorithms: chunkMZE4TPFU_cjs.ALLOWED_ALGS,
+          algorithms: chunkKEBSZBHL_cjs.ALLOWED_ALGS,
           clockTolerance: clockToleranceSec,
           requiredClaims: ["exp", "iat", "jti", "sub"]
         }));
       } catch (e) {
-        if (e instanceof chunkMZE4TPFU_cjs.JwksUnavailableError) throw e;
-        throw new chunkMZE4TPFU_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
+        if (e instanceof chunkKEBSZBHL_cjs.JwksUnavailableError) throw e;
+        throw new chunkKEBSZBHL_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
       }
-      if ("events" in payload) throw new chunkMZE4TPFU_cjs.SsoError("a logout token is not a ticket");
-      if ("nonce" in payload) throw new chunkMZE4TPFU_cjs.SsoError("an ID token is not a ticket");
+      if ("events" in payload) throw new chunkKEBSZBHL_cjs.SsoError("a logout token is not a ticket");
+      if ("nonce" in payload) throw new chunkKEBSZBHL_cjs.SsoError("an ID token is not a ticket");
       const type = payload.principal_type;
       if (typeof type !== "string" || !PRINCIPAL_TYPES.includes(type)) {
-        throw new chunkMZE4TPFU_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
+        throw new chunkKEBSZBHL_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
       }
       const lifetime = payload.exp - payload.iat;
       if (lifetime > maxLifetimeSec) {
-        throw new chunkMZE4TPFU_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
+        throw new chunkKEBSZBHL_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
       }
-      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunkMZE4TPFU_cjs.SsoError("ticket has no sub");
+      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunkKEBSZBHL_cjs.SsoError("ticket has no sub");
       const scopes = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [];
       const required = opts.scope === void 0 ? [] : Array.isArray(opts.scope) ? opts.scope : [opts.scope];
       const missing = required.filter((s) => !scopes.includes(s));
-      if (missing.length) throw new chunkMZE4TPFU_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
+      if (missing.length) throw new chunkKEBSZBHL_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
       const ver = payload.ver === void 0 ? 0 : payload.ver;
       if (typeof ver !== "number" || !Number.isInteger(ver) || ver < 0) {
-        throw new chunkMZE4TPFU_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
+        throw new chunkKEBSZBHL_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
       }
       if (ver > TICKET_FORMAT_VERSION) {
-        throw new chunkMZE4TPFU_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
+        throw new chunkKEBSZBHL_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
       }
       const act = payload.act === void 0 ? null : readActor(payload.act, 1);
       const cnfRaw = payload.cnf;
       const cnf = cnfRaw && typeof cnfRaw.jkt === "string" && cnfRaw.jkt ? { jkt: cnfRaw.jkt } : null;
       if (cnf) {
-        if (!opts.dpop?.proof) throw new chunkMZE4TPFU_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
+        if (!opts.dpop?.proof) throw new chunkKEBSZBHL_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
         await verifyDpopProof(opts.dpop.proof, {
           method: opts.dpop.method,
           url: opts.dpop.url,
@@ -336,11 +369,11 @@ function createTicketVerifier(options) {
           now
         });
       } else if (requireDpop) {
-        throw new chunkMZE4TPFU_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
+        throw new chunkKEBSZBHL_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
       }
       const named = (v) => typeof v === "string" && v ? v : null;
       const clientId = type === "user" ? named(payload.client_id) ?? named(payload.azp) : named(payload.client_id) ?? payload.sub;
-      if (clientId === null) throw new chunkMZE4TPFU_cjs.SsoError("a user ticket names no app (no client_id or azp)");
+      if (clientId === null) throw new chunkKEBSZBHL_cjs.SsoError("a user ticket names no app (no client_id or azp)");
       return {
         principal: payload.sub,
         type,
@@ -357,125 +390,125 @@ function createTicketVerifier(options) {
   };
 }
 function readActor(raw, depth) {
-  if (depth > MAX_ACT_DEPTH) throw new chunkMZE4TPFU_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
+  if (depth > MAX_ACT_DEPTH) throw new chunkKEBSZBHL_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
   const link = raw;
   if (!link || typeof link !== "object" || typeof link.sub !== "string" || link.sub === "") {
-    throw new chunkMZE4TPFU_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
+    throw new chunkKEBSZBHL_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
   }
   return link.act === void 0 ? { sub: link.sub } : { sub: link.sub, act: readActor(link.act, depth + 1) };
 }
 
 Object.defineProperty(exports, "AVATAR_TYPES", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.AVATAR_TYPES; }
+  get: function () { return chunkKEBSZBHL_cjs.AVATAR_TYPES; }
 });
 Object.defineProperty(exports, "DEFAULT_SESSION_MAX_AGE", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.DEFAULT_SESSION_MAX_AGE; }
+  get: function () { return chunkKEBSZBHL_cjs.DEFAULT_SESSION_MAX_AGE; }
 });
 Object.defineProperty(exports, "EMBEDDED_FLOW_MAX_AGE", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.EMBEDDED_FLOW_MAX_AGE; }
+  get: function () { return chunkKEBSZBHL_cjs.EMBEDDED_FLOW_MAX_AGE; }
 });
 Object.defineProperty(exports, "JwksError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.JwksError; }
+  get: function () { return chunkKEBSZBHL_cjs.JwksError; }
 });
 Object.defineProperty(exports, "JwksUnavailableError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.JwksUnavailableError; }
+  get: function () { return chunkKEBSZBHL_cjs.JwksUnavailableError; }
 });
 Object.defineProperty(exports, "JwksUnknownKeyError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.JwksUnknownKeyError; }
+  get: function () { return chunkKEBSZBHL_cjs.JwksUnknownKeyError; }
 });
 Object.defineProperty(exports, "MAX_AVATAR_BYTES", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.MAX_AVATAR_BYTES; }
+  get: function () { return chunkKEBSZBHL_cjs.MAX_AVATAR_BYTES; }
 });
 Object.defineProperty(exports, "MAX_INVITATIONS", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.MAX_INVITATIONS; }
+  get: function () { return chunkKEBSZBHL_cjs.MAX_INVITATIONS; }
 });
 Object.defineProperty(exports, "SsoAppApiError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoAppApiError; }
+  get: function () { return chunkKEBSZBHL_cjs.SsoAppApiError; }
 });
 Object.defineProperty(exports, "SsoAvatarRejectedError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoAvatarRejectedError; }
+  get: function () { return chunkKEBSZBHL_cjs.SsoAvatarRejectedError; }
 });
 Object.defineProperty(exports, "SsoConfigError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoConfigError; }
+  get: function () { return chunkKEBSZBHL_cjs.SsoConfigError; }
 });
 Object.defineProperty(exports, "SsoError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoError; }
+  get: function () { return chunkKEBSZBHL_cjs.SsoError; }
 });
 Object.defineProperty(exports, "SsoInsufficientScopeError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoInsufficientScopeError; }
+  get: function () { return chunkKEBSZBHL_cjs.SsoInsufficientScopeError; }
 });
 Object.defineProperty(exports, "SsoIntrospectionUnavailableError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoIntrospectionUnavailableError; }
+  get: function () { return chunkKEBSZBHL_cjs.SsoIntrospectionUnavailableError; }
 });
 Object.defineProperty(exports, "SsoReauthError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoReauthError; }
+  get: function () { return chunkKEBSZBHL_cjs.SsoReauthError; }
 });
 Object.defineProperty(exports, "SsoTokenInactiveError", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.SsoTokenInactiveError; }
+  get: function () { return chunkKEBSZBHL_cjs.SsoTokenInactiveError; }
 });
 Object.defineProperty(exports, "cookieHeader", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.cookieHeader; }
+  get: function () { return chunkKEBSZBHL_cjs.cookieHeader; }
 });
 Object.defineProperty(exports, "createJwksCache", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.createJwksCache; }
+  get: function () { return chunkKEBSZBHL_cjs.createJwksCache; }
 });
 Object.defineProperty(exports, "createSsoClient", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.createSsoClient; }
+  get: function () { return chunkKEBSZBHL_cjs.createSsoClient; }
 });
 Object.defineProperty(exports, "loadSsoConfig", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.loadSsoConfig; }
+  get: function () { return chunkKEBSZBHL_cjs.loadSsoConfig; }
 });
 Object.defineProperty(exports, "memoryTokenStore", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.memoryTokenStore; }
+  get: function () { return chunkKEBSZBHL_cjs.memoryTokenStore; }
 });
 Object.defineProperty(exports, "openEmbeddedFlow", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.openEmbeddedFlow; }
+  get: function () { return chunkKEBSZBHL_cjs.openEmbeddedFlow; }
 });
 Object.defineProperty(exports, "readCookie", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.readCookie; }
+  get: function () { return chunkKEBSZBHL_cjs.readCookie; }
 });
 Object.defineProperty(exports, "sealEmbeddedFlow", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.sealEmbeddedFlow; }
+  get: function () { return chunkKEBSZBHL_cjs.sealEmbeddedFlow; }
 });
 Object.defineProperty(exports, "signSession", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.signSession; }
+  get: function () { return chunkKEBSZBHL_cjs.signSession; }
 });
 Object.defineProperty(exports, "signValue", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.signValue; }
+  get: function () { return chunkKEBSZBHL_cjs.signValue; }
 });
 Object.defineProperty(exports, "verifySession", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.verifySession; }
+  get: function () { return chunkKEBSZBHL_cjs.verifySession; }
 });
 Object.defineProperty(exports, "verifyValue", {
   enumerable: true,
-  get: function () { return chunkMZE4TPFU_cjs.verifyValue; }
+  get: function () { return chunkKEBSZBHL_cjs.verifyValue; }
 });
 exports.DEFAULT_ISSUER = DEFAULT_ISSUER;
 exports.MAX_ACT_DEPTH = MAX_ACT_DEPTH;
@@ -489,6 +522,7 @@ exports.createDpopProof = createDpopProof;
 exports.createMemoryReplayStore = createMemoryReplayStore;
 exports.createTicketClient = createTicketClient;
 exports.createTicketVerifier = createTicketVerifier;
+exports.exchangeUserToken = exchangeUserToken;
 exports.fetchTicket = fetchTicket;
 exports.normalizeHtu = normalizeHtu;
 exports.verifyDpopProof = verifyDpopProof;