@broberg/sso 0.19.1 → 0.21.0

package/README.md

@@ -264,6 +264,12 @@ const terms = await client.embedded.terms("da");
   (re-fetch `terms()`), `invalid_request`, `unavailable`.
 - A 401 from BID is YOUR configuration (wrong client id/secret) and THROWS `SsoError` — it is never shown to the
   user as a wrong code.
+- **Passkey offer (0.20.0, BID F084.178).** When the user has no passkey, a `done` step also carries
+  `passkeySetup: { setupId, frameUrl, expiresIn }`. Show `frameUrl` in an `<iframe allow="publickey-credentials-create">`.
+  `frameUrl` is always on the issuer's own origin — an offer pointing anywhere else is dropped, not passed on.
+  No offer → the step is exactly `{ kind: "done", result }` as before.
+- **The app's name on the terms (0.20.0, BID F084.177).** `terms(lang)` sends your `client_id`, so BID's consent text
+  can say «hos <your app>».
 
 ## What it will never do
 
@@ -665,3 +671,51 @@ await fetch("https://discovery.broberg.ai/api/fleet", { headers: { authorization
 - **Cached** per audience + scope until 30 s before exp (BID issues 5 min), and concurrent calls share one exchange. `createTicketClient({...})` gives you your own cache and injectable platform/fetch for tests.
 - **Errors:** `TicketExchangeError` (BID refused — `code` is BID's name for it, `status` the HTTP status; permanent, fix the rule) · `TicketUnavailableError` (BID or the platform unreachable / 5xx; transient) · `NoWorkloadIdentityError`. BID's codes include `no_rule_for_audience`, `scope_not_allowed`, `service_not_registered`, `audience_unknown`, `workflow_not_allowed`, `fly_org_untrusted`, `fly_audience_mismatch`, `github_owner_untrusted`, `client_mismatch`, `issuer_unknown`.
 - The ticket is never logged or put in an error message.
+
+## A ticket on behalf of a USER — `exchangeUserToken` (0.20.0, F084.179, BID F087.37)
+
+A signed-in user's BID access token, exchanged for a ticket to ONE receiver. Same ticket format as the
+machines' (`ver` 1), with `principal_type: "user"`, `sub` = the user and `client_id` = your app — so the
+receiver checks it with `createTicketVerifier`, the same as a machine ticket.
+
+```ts
+import { exchangeUserToken } from "@broberg/sso";
+
+const { token, exp } = await exchangeUserToken({
+  clientId: "jam",
+  clientSecret: process.env.SSO_CLIENT_SECRET,   // omit for a public app (a browser extension): client_id goes in the body
+  subjectToken: userAccessToken,                 // the user's BID access token — never logged, never in an error
+  resource: "https://cardmem.com",               // or audience: "<BID's name for the receiver>" — one is required
+  scope: "cardmem:mockups:read",
+  // dpopKey: await createDpopKey(),             // optional: bind the ticket to a key
+});
+```
+
+- **Not cached** — it is per user. When it expires, exchange again with the user's (renewed) access token.
+- **Errors** are the same classes as `fetchTicket`. BID's codes for this path include `subject_token_inactive`
+  (the user's BID login has ended — «log ud» means log out), `client_mismatch` (the token belongs to another app),
+  `subject_is_ticket`, `session_ended`, `no_rule_for_audience`, `scope_not_allowed`, `client_unauthenticated`.
+- BID issues nothing without a rule for (your app, the receiver). Ask broberg-id for the rule.
+
+## Login without a client secret — `clientAuth: "fly"` (0.21.0, F084.181, BID F084.180)
+
+An app on Fly can prove itself at BID's token endpoint with its Fly identity instead of a
+`client_secret`. Nothing to store, nothing to rotate, nothing to leak.
+
+```ts
+const sso = ssoRoutes({ clientAuth: "fly", tokenStore });   // or SSO_CLIENT_AUTH=fly
+```
+
+- At the code exchange (and at refresh) the app asks Fly's machine API for an OIDC token with
+  `aud` = BID's **token endpoint** (not the issuer, so a ticket token cannot be replayed as a login
+  proof) and sends it as `client_assertion` with
+  `client_assertion_type=urn:broberg:params:oauth:client-assertion-type:fly-oidc`. PKCE is unchanged.
+- **No fallback.** With `"fly"`, `client_secret` is never sent to the token endpoint, even if one is
+  configured. If Fly cannot give a token, the login fails: the browser gets one generic 500, the log
+  gets `fly client assertion unavailable: …`.
+- **BID must be switched first**: the client registered as `token_endpoint_auth_method: fly_oidc`,
+  bound to your Fly org and app. Ask broberg-id. Switch the app, measure one login, then BID deletes
+  the secret.
+- `clientSecret` is still what introspection and the embedded login use — those are not the token
+  endpoint's code exchange.
+- Without the option nothing changes: the 0.20.0 request, byte for byte.

package/dist/{chunk-2F3RPYJV.cjs → chunk-2XMKZWC6.cjs}

@@ -1,6 +1,8 @@
 'use strict';
 
 var jose = require('jose');
+var fs = require('fs');
+var http = require('http');
 
 // src/config.ts
 var SsoConfigError = class extends Error {
@@ -16,6 +18,12 @@ function required(env, name, hint) {
   }
   return raw.trim();
 }
+function parseClientAuth(raw) {
+  const v = raw?.trim();
+  if (!v) return void 0;
+  if (v === "secret" || v === "fly") return v;
+  throw new SsoConfigError(`SSO_CLIENT_AUTH must be "secret" or "fly" (got ${JSON.stringify(raw)}).`);
+}
 var DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 7;
 function loadSsoConfig(env = process.env) {
   const rawIssuer = required(
@@ -70,7 +78,8 @@ function loadSsoConfig(env = process.env) {
     cookieName: env.SSO_COOKIE_NAME?.trim() || "bid_session",
     sessionMaxAge,
     postLogoutRedirectUri: env.SSO_POST_LOGOUT_REDIRECT_URI?.trim() || void 0,
-    clientSecret: env.SSO_CLIENT_SECRET?.trim() || void 0
+    clientSecret: env.SSO_CLIENT_SECRET?.trim() || void 0,
+    clientAuth: parseClientAuth(env.SSO_CLIENT_AUTH)
   };
 }
 
@@ -286,6 +295,184 @@ function createJwksCache(options) {
     }
   };
 }
+var DEFAULT_ISSUER = "https://id.broberg.ai";
+var FLY_SOCKET = "/.fly/api";
+var NoWorkloadIdentityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "NoWorkloadIdentityError";
+  }
+};
+var TicketExchangeError = class extends Error {
+  constructor(message, code, status) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.name = "TicketExchangeError";
+  }
+  code;
+  status;
+};
+var TicketUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TicketUnavailableError";
+  }
+};
+function flyOidcOverSocket(aud) {
+  return new Promise((resolve, reject) => {
+    const body = JSON.stringify({ aud });
+    const req = http.request(
+      { socketPath: FLY_SOCKET, path: "/v1/tokens/oidc", method: "POST", headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) } },
+      (res) => {
+        let data = "";
+        res.setEncoding("utf8");
+        res.on("data", (c) => data += c);
+        res.on("end", () => {
+          if ((res.statusCode ?? 0) >= 200 && (res.statusCode ?? 0) < 300) resolve(data.trim());
+          else reject(new TicketUnavailableError(`Fly OIDC answered ${res.statusCode}`));
+        });
+      }
+    );
+    req.on("error", (e) => reject(new TicketUnavailableError(`Fly OIDC socket: ${e.message}`)));
+    req.end(body);
+  });
+}
+function jwtExp(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+async function readTicketResponse(res, issuer, target, now) {
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+  }
+  if (res.status >= 500) throw new TicketUnavailableError(`${issuer} answered ${res.status}`);
+  if (!res.ok || !body.access_token) {
+    const desc = body.error_description ?? "";
+    const code = desc.includes(":") ? desc.slice(0, desc.indexOf(":")).trim() : body.error ?? "exchange_refused";
+    throw new TicketExchangeError(`BID refused the ticket for ${target}: ${desc || body.error || res.status}`, code, res.status);
+  }
+  const nowSec = Math.floor(now() / 1e3);
+  const exp = jwtExp(body.access_token) ?? nowSec + (body.expires_in ?? 300);
+  return { token: body.access_token, exp };
+}
+function createTicketClient(options = {}) {
+  const issuer = (options.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+  const renewBeforeSec = options.renewBeforeSec ?? 30;
+  const env = options.env ?? process.env;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const now = options.now ?? (() => Date.now());
+  const flyOidc = options.flyOidc ?? flyOidcOverSocket;
+  const onFly = options.onFly ?? (() => !!env.FLY_APP_NAME && fs.existsSync(FLY_SOCKET));
+  const cache = /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
+  let dpopKey = null;
+  const ownKey = () => dpopKey ??= createDpopKey();
+  async function platformToken() {
+    if (onFly()) return flyOidc(issuer);
+    const url = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const bearer = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (url && bearer) {
+      let res;
+      try {
+        res = await fetchImpl(`${url}&audience=${encodeURIComponent(issuer)}`, { headers: { authorization: `Bearer ${bearer}` } });
+      } catch (e) {
+        throw new TicketUnavailableError(`GitHub OIDC endpoint unreachable: ${e instanceof Error ? e.message : String(e)}`);
+      }
+      if (!res.ok) throw new TicketUnavailableError(`GitHub OIDC endpoint answered ${res.status}`);
+      const { value } = await res.json();
+      if (!value) throw new TicketUnavailableError("GitHub OIDC endpoint returned no token");
+      return value;
+    }
+    throw new NoWorkloadIdentityError(
+      "No workload identity to exchange for a ticket: not on a Fly machine (FLY_APP_NAME + /.fly/api) and not in a GitHub Actions job (ACTIONS_ID_TOKEN_REQUEST_URL/_TOKEN \u2014 add `permissions: id-token: write`). A Mac session keeps using its session key."
+    );
+  }
+  async function exchange(audience, scope) {
+    const subject = await platformToken();
+    const form = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+      subject_token: subject,
+      subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
+      audience
+    });
+    if (scope) form.set("scope", scope);
+    let res;
+    try {
+      const tokenUrl = `${issuer}/oauth2/token`;
+      const headers = { "content-type": "application/x-www-form-urlencoded" };
+      if (options.dpop) headers.dpop = await createDpopProof(await ownKey(), { method: "POST", url: tokenUrl, now });
+      res = await fetchImpl(tokenUrl, { method: "POST", headers, body: form });
+    } catch (e) {
+      throw new TicketUnavailableError(`${issuer} unreachable: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    return readTicketResponse(res, issuer, audience, now);
+  }
+  const client = {
+    async authHeaders({ audience, scope, method, url }) {
+      const ticket = await client.get({ audience, scope });
+      if (!options.dpop) return { authorization: `Bearer ${ticket}` };
+      return { authorization: `DPoP ${ticket}`, dpop: await createDpopProof(await ownKey(), { method, url, ticket, now }) };
+    },
+    async get({ audience, scope }) {
+      const key = `${audience} ${scope ?? ""}`;
+      const hit = cache.get(key);
+      if (hit && hit.exp - renewBeforeSec > now() / 1e3) return hit.token;
+      const pending = inFlight.get(key);
+      if (pending) return pending;
+      const p = exchange(audience, scope).then((t) => {
+        cache.set(key, t);
+        return t.token;
+      }).finally(() => inFlight.delete(key));
+      inFlight.set(key, p);
+      return p;
+    }
+  };
+  return client;
+}
+var shared = null;
+function fetchTicket(opts) {
+  shared ??= createTicketClient();
+  return shared.get(opts);
+}
+async function exchangeUserToken(opts) {
+  const issuer = (opts.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+  const target = opts.resource ?? opts.audience;
+  if (!target) throw new TicketExchangeError("exchangeUserToken needs a receiver: resource (its URL) or audience (BID's name for it)", "malformed_request", 0);
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const now = opts.now ?? (() => Date.now());
+  const form = new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+    subject_token: opts.subjectToken,
+    subject_token_type: "urn:ietf:params:oauth:token-type:access_token"
+  });
+  if (opts.resource) form.set("resource", opts.resource);
+  if (opts.audience) form.set("audience", opts.audience);
+  if (opts.scope) form.set("scope", opts.scope);
+  const tokenUrl = `${issuer}/oauth2/token`;
+  const headers = { "content-type": "application/x-www-form-urlencoded" };
+  if (opts.clientSecret) {
+    headers.authorization = `Basic ${btoa(`${encodeURIComponent(opts.clientId)}:${encodeURIComponent(opts.clientSecret)}`)}`;
+  } else {
+    form.set("client_id", opts.clientId);
+  }
+  if (opts.dpopKey) headers.dpop = await createDpopProof(opts.dpopKey, { method: "POST", url: tokenUrl, now });
+  let res;
+  try {
+    res = await fetchImpl(tokenUrl, { method: "POST", headers, body: form });
+  } catch (e) {
+    throw new TicketUnavailableError(`${issuer} unreachable: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  return readTicketResponse(res, issuer, target, now);
+}
+
+// src/client.ts
 var SsoError = class extends Error {
   constructor(message) {
     super(message);
@@ -370,6 +557,7 @@ var INVITATION_OUTCOMES = /* @__PURE__ */ new Set([
 var MIGRATION_STATES = /* @__PURE__ */ new Set(["ready", "invited", "expired", "not_invited"]);
 var BACKCHANNEL_EVENT = "http://schemas.openid.net/event/backchannel-logout";
 var MAX_INVITATIONS = 500;
+var FLY_CLIENT_ASSERTION_TYPE = "urn:broberg:params:oauth:client-assertion-type:fly-oidc";
 function excerptForLog(raw, clientSecret) {
   let text = raw.replace(/\s+/g, " ").trim();
   if (clientSecret) text = text.split(clientSecret).join("[redacted client_secret]");
@@ -405,6 +593,18 @@ var ALLOWED_ALGS = [
 function createSsoClient(config, options = {}) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const timeoutMs = options.timeoutMs ?? 1e4;
+  const flyOidc = options.flyOidc ?? flyOidcOverSocket;
+  async function tokenEndpointAuth(tokenEndpoint) {
+    if (config.clientAuth !== "fly") return config.clientSecret ? { client_secret: config.clientSecret } : {};
+    let assertion;
+    try {
+      assertion = await flyOidc(tokenEndpoint);
+    } catch (e) {
+      throw new SsoError(`fly client assertion unavailable: could not get a Fly OIDC token for ${tokenEndpoint} \u2014 ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (!assertion) throw new SsoError(`fly client assertion unavailable: Fly returned an empty token for ${tokenEndpoint}`);
+    return { client_assertion_type: FLY_CLIENT_ASSERTION_TYPE, client_assertion: assertion };
+  }
   async function appPost(path, bearer, payload, what) {
     const url = new URL(path, config.issuer).toString();
     const ctrl = new AbortController();
@@ -688,7 +888,7 @@ function createSsoClient(config, options = {}) {
         // ALWAYS sent, secret or not. See SsoConfig.clientSecret: the two
         // prove different things, so a confidential client keeps PKCE.
         code_verifier: codeVerifier,
-        ...config.clientSecret ? { client_secret: config.clientSecret } : {}
+        ...await tokenEndpointAuth(token_endpoint)
       })
     });
     const raw = await res.text();
@@ -747,10 +947,25 @@ function createSsoClient(config, options = {}) {
     return res.ok ? { ok: true, body: json } : { ok: false, status: res.status, body: json };
   }
   const toError = (r) => r.status === 0 ? { kind: "unavailable", message: `BID did not answer: ${String(r.body.message ?? "")}` } : embeddedError(r.status, r.body);
+  function readPasskeySetup(v) {
+    if (typeof v !== "object" || v === null) return void 0;
+    const o = v;
+    if (typeof o.setup_id !== "string" || !o.setup_id || typeof o.frame_url !== "string") return void 0;
+    let frame;
+    try {
+      frame = new URL(o.frame_url, config.issuer);
+    } catch {
+      return void 0;
+    }
+    if (frame.origin !== new URL(config.issuer).origin) return void 0;
+    return { setupId: o.setup_id, frameUrl: frame.toString(), expiresIn: typeof o.expires_in === "number" ? o.expires_in : 600 };
+  }
   async function embeddedNext(r, flow) {
     if (!r.ok) return { kind: "error", error: toError(r) };
     if (r.body.next === "done" && typeof r.body.code === "string") {
-      return { kind: "done", result: await exchangeCode(r.body.code, flow.codeVerifier, flow.nonce) };
+      const result = await exchangeCode(r.body.code, flow.codeVerifier, flow.nonce);
+      const passkeySetup = readPasskeySetup(r.body.passkey_setup);
+      return passkeySetup ? { kind: "done", result, passkeySetup } : { kind: "done", result };
     }
     if (r.body.next === "second_factor") {
       const methods = (Array.isArray(r.body.methods) ? r.body.methods : []).filter((m) => m === "totp" || m === "sms");
@@ -789,7 +1004,7 @@ function createSsoClient(config, options = {}) {
       return embeddedNext(await embeddedCall("POST", "/second-factor", { flow_id: flow.flowId, method, code }), flow);
     },
     async terms(lang) {
-      const r = await embeddedCall("GET", `/terms?lang=${lang}`);
+      const r = await embeddedCall("GET", `/terms?${new URLSearchParams({ lang, client_id: config.clientId })}`);
       const b = r.body;
       if (!r.ok || typeof b.version !== "string" || typeof b.text !== "string") {
         throw new SsoError(`BID did not answer the signup terms (${r.ok ? "no version/text" : r.status})`);
@@ -853,7 +1068,7 @@ function createSsoClient(config, options = {}) {
           grant_type: "refresh_token",
           refresh_token: refreshToken,
           client_id: config.clientId,
-          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
+          ...await tokenEndpointAuth(token_endpoint)
         })
       });
       const raw = await res.text();
@@ -959,6 +1174,84 @@ function createSsoClient(config, options = {}) {
   };
 }
 
+// src/dpop.ts
+async function createDpopKey() {
+  const { privateKey, publicKey } = await jose.generateKeyPair("ES256", { extractable: false });
+  const jwk = await jose.exportJWK(publicKey);
+  const publicJwk = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+  return { privateKey, publicJwk, jkt: await jose.calculateJwkThumbprint(publicJwk) };
+}
+var enc2 = new TextEncoder();
+var b64url3 = (bytes) => btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function accessTokenHash(ticket) {
+  return b64url3(await crypto.subtle.digest("SHA-256", enc2.encode(ticket)));
+}
+function normalizeHtu(url) {
+  const u = new URL(url);
+  return `${u.protocol}//${u.host}${u.pathname}`;
+}
+async function createDpopProof(key, opts) {
+  const payload = {
+    jti: crypto.randomUUID(),
+    htm: opts.method.toUpperCase(),
+    htu: normalizeHtu(opts.url),
+    iat: Math.floor((opts.now?.() ?? Date.now()) / 1e3)
+  };
+  if (opts.ticket !== void 0) payload.ath = await accessTokenHash(opts.ticket);
+  return new jose.SignJWT(payload).setProtectedHeader({ typ: "dpop+jwt", alg: "ES256", jwk: key.publicJwk }).sign(key.privateKey);
+}
+function createMemoryReplayStore(now = () => Date.now()) {
+  const entries = /* @__PURE__ */ new Map();
+  return {
+    async seen(key, ttlMs) {
+      const t = now();
+      for (const [k, until] of entries) if (until <= t) entries.delete(k);
+      if (entries.has(key)) return true;
+      entries.set(key, t + ttlMs);
+      return false;
+    }
+  };
+}
+var ASYMMETRIC = /* @__PURE__ */ new Set(["ES256", "ES384", "ES512", "EdDSA", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512"]);
+async function verifyDpopProof(proof, o) {
+  let header;
+  try {
+    header = jose.decodeProtectedHeader(proof);
+  } catch {
+    throw new SsoError("DPoP proof is not a JWS");
+  }
+  if (header.typ !== "dpop+jwt") throw new SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
+  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
+  const jwk = header.jwk;
+  if (!jwk || typeof jwk !== "object") throw new SsoError("DPoP proof carries no jwk");
+  if ("d" in jwk) throw new SsoError("DPoP proof jwk contains a private key");
+  let payload;
+  try {
+    const key = await jose.importJWK(jwk, header.alg);
+    ({ payload } = await jose.jwtVerify(proof, key, { typ: "dpop+jwt", algorithms: [header.alg] }));
+  } catch (e) {
+    throw new SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  if (await jose.calculateJwkThumbprint(jwk) !== o.jkt) throw new SsoError("DPoP proof key does not match the ticket's cnf.jkt");
+  if (payload.htm !== o.method.toUpperCase()) throw new SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
+  let htu;
+  try {
+    htu = normalizeHtu(String(payload.htu));
+  } catch {
+    throw new SsoError("DPoP proof htu is not a URL");
+  }
+  if (htu !== normalizeHtu(o.url)) throw new SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
+  const nowSec = Math.floor(o.now() / 1e3);
+  if (typeof payload.iat !== "number" || Math.abs(nowSec - payload.iat) > o.iatWindowSec) {
+    throw new SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
+  }
+  if (payload.ath !== await accessTokenHash(o.ticket)) throw new SsoError("DPoP proof ath does not match this ticket");
+  if (typeof payload.jti !== "string" || payload.jti === "") throw new SsoError("DPoP proof has no jti");
+  if (await o.replay.seen(`${o.jkt}:${payload.jti}`, o.iatWindowSec * 2 * 1e3)) {
+    throw new SsoError("DPoP proof was already used (jti replay)");
+  }
+}
+
 // src/tokens.ts
 var warned = false;
 function memoryTokenStore(options = {}) {
@@ -1008,13 +1301,16 @@ function newSid() {
 
 exports.ALLOWED_ALGS = ALLOWED_ALGS;
 exports.AVATAR_TYPES = AVATAR_TYPES;
+exports.DEFAULT_ISSUER = DEFAULT_ISSUER;
 exports.DEFAULT_SESSION_MAX_AGE = DEFAULT_SESSION_MAX_AGE;
 exports.EMBEDDED_FLOW_MAX_AGE = EMBEDDED_FLOW_MAX_AGE;
+exports.FLY_CLIENT_ASSERTION_TYPE = FLY_CLIENT_ASSERTION_TYPE;
 exports.JwksError = JwksError;
 exports.JwksUnavailableError = JwksUnavailableError;
 exports.JwksUnknownKeyError = JwksUnknownKeyError;
 exports.MAX_AVATAR_BYTES = MAX_AVATAR_BYTES;
 exports.MAX_INVITATIONS = MAX_INVITATIONS;
+exports.NoWorkloadIdentityError = NoWorkloadIdentityError;
 exports.SsoAppApiError = SsoAppApiError;
 exports.SsoAvatarRejectedError = SsoAvatarRejectedError;
 exports.SsoConfigError = SsoConfigError;
@@ -1023,20 +1319,31 @@ exports.SsoInsufficientScopeError = SsoInsufficientScopeError;
 exports.SsoIntrospectionUnavailableError = SsoIntrospectionUnavailableError;
 exports.SsoReauthError = SsoReauthError;
 exports.SsoTokenInactiveError = SsoTokenInactiveError;
+exports.TicketExchangeError = TicketExchangeError;
+exports.TicketUnavailableError = TicketUnavailableError;
+exports.accessTokenHash = accessTokenHash;
 exports.cookieHeader = cookieHeader;
+exports.createDpopKey = createDpopKey;
+exports.createDpopProof = createDpopProof;
 exports.createJwksCache = createJwksCache;
+exports.createMemoryReplayStore = createMemoryReplayStore;
 exports.createSsoClient = createSsoClient;
+exports.createTicketClient = createTicketClient;
+exports.exchangeUserToken = exchangeUserToken;
 exports.expiresAtFrom = expiresAtFrom;
+exports.fetchTicket = fetchTicket;
 exports.loadSsoConfig = loadSsoConfig;
 exports.mediaType = mediaType;
 exports.memoryTokenStore = memoryTokenStore;
 exports.newSid = newSid;
+exports.normalizeHtu = normalizeHtu;
 exports.openEmbeddedFlow = openEmbeddedFlow;
 exports.readCookie = readCookie;
 exports.sealEmbeddedFlow = sealEmbeddedFlow;
 exports.signSession = signSession;
 exports.signValue = signValue;
+exports.verifyDpopProof = verifyDpopProof;
 exports.verifySession = verifySession;
 exports.verifyValue = verifyValue;
-//# sourceMappingURL=chunk-2F3RPYJV.cjs.map
-//# sourceMappingURL=chunk-2F3RPYJV.cjs.map
+//# sourceMappingURL=chunk-2XMKZWC6.cjs.map
+//# sourceMappingURL=chunk-2XMKZWC6.cjs.map