@broberg/sso 0.19.1 → 0.21.0

package/dist/index.cjs

@@ -1,231 +1,8 @@
 'use strict';
 
-var chunk2F3RPYJV_cjs = require('./chunk-2F3RPYJV.cjs');
-var fs = require('fs');
-var http = require('http');
+var chunk2XMKZWC6_cjs = require('./chunk-2XMKZWC6.cjs');
 var jose = require('jose');
 
-async function createDpopKey() {
-  const { privateKey, publicKey } = await jose.generateKeyPair("ES256", { extractable: false });
-  const jwk = await jose.exportJWK(publicKey);
-  const publicJwk = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
-  return { privateKey, publicJwk, jkt: await jose.calculateJwkThumbprint(publicJwk) };
-}
-var enc = new TextEncoder();
-var b64url = (bytes) => btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-async function accessTokenHash(ticket) {
-  return b64url(await crypto.subtle.digest("SHA-256", enc.encode(ticket)));
-}
-function normalizeHtu(url) {
-  const u = new URL(url);
-  return `${u.protocol}//${u.host}${u.pathname}`;
-}
-async function createDpopProof(key, opts) {
-  const payload = {
-    jti: crypto.randomUUID(),
-    htm: opts.method.toUpperCase(),
-    htu: normalizeHtu(opts.url),
-    iat: Math.floor((opts.now?.() ?? Date.now()) / 1e3)
-  };
-  if (opts.ticket !== void 0) payload.ath = await accessTokenHash(opts.ticket);
-  return new jose.SignJWT(payload).setProtectedHeader({ typ: "dpop+jwt", alg: "ES256", jwk: key.publicJwk }).sign(key.privateKey);
-}
-function createMemoryReplayStore(now = () => Date.now()) {
-  const entries = /* @__PURE__ */ new Map();
-  return {
-    async seen(key, ttlMs) {
-      const t = now();
-      for (const [k, until] of entries) if (until <= t) entries.delete(k);
-      if (entries.has(key)) return true;
-      entries.set(key, t + ttlMs);
-      return false;
-    }
-  };
-}
-var ASYMMETRIC = /* @__PURE__ */ new Set(["ES256", "ES384", "ES512", "EdDSA", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512"]);
-async function verifyDpopProof(proof, o) {
-  let header;
-  try {
-    header = jose.decodeProtectedHeader(proof);
-  } catch {
-    throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof is not a JWS");
-  }
-  if (header.typ !== "dpop+jwt") throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
-  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
-  const jwk = header.jwk;
-  if (!jwk || typeof jwk !== "object") throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof carries no jwk");
-  if ("d" in jwk) throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof jwk contains a private key");
-  let payload;
-  try {
-    const key = await jose.importJWK(jwk, header.alg);
-    ({ payload } = await jose.jwtVerify(proof, key, { typ: "dpop+jwt", algorithms: [header.alg] }));
-  } catch (e) {
-    throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
-  }
-  if (await jose.calculateJwkThumbprint(jwk) !== o.jkt) throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof key does not match the ticket's cnf.jkt");
-  if (payload.htm !== o.method.toUpperCase()) throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
-  let htu;
-  try {
-    htu = normalizeHtu(String(payload.htu));
-  } catch {
-    throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof htu is not a URL");
-  }
-  if (htu !== normalizeHtu(o.url)) throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
-  const nowSec = Math.floor(o.now() / 1e3);
-  if (typeof payload.iat !== "number" || Math.abs(nowSec - payload.iat) > o.iatWindowSec) {
-    throw new chunk2F3RPYJV_cjs.SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
-  }
-  if (payload.ath !== await accessTokenHash(o.ticket)) throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof ath does not match this ticket");
-  if (typeof payload.jti !== "string" || payload.jti === "") throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof has no jti");
-  if (await o.replay.seen(`${o.jkt}:${payload.jti}`, o.iatWindowSec * 2 * 1e3)) {
-    throw new chunk2F3RPYJV_cjs.SsoError("DPoP proof was already used (jti replay)");
-  }
-}
-
-// src/fetch-ticket.ts
-var DEFAULT_ISSUER = "https://id.broberg.ai";
-var FLY_SOCKET = "/.fly/api";
-var NoWorkloadIdentityError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "NoWorkloadIdentityError";
-  }
-};
-var TicketExchangeError = class extends Error {
-  constructor(message, code, status) {
-    super(message);
-    this.code = code;
-    this.status = status;
-    this.name = "TicketExchangeError";
-  }
-  code;
-  status;
-};
-var TicketUnavailableError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "TicketUnavailableError";
-  }
-};
-function flyOidcOverSocket(aud) {
-  return new Promise((resolve, reject) => {
-    const body = JSON.stringify({ aud });
-    const req = http.request(
-      { socketPath: FLY_SOCKET, path: "/v1/tokens/oidc", method: "POST", headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) } },
-      (res) => {
-        let data = "";
-        res.setEncoding("utf8");
-        res.on("data", (c) => data += c);
-        res.on("end", () => {
-          if ((res.statusCode ?? 0) >= 200 && (res.statusCode ?? 0) < 300) resolve(data.trim());
-          else reject(new TicketUnavailableError(`Fly OIDC answered ${res.statusCode}`));
-        });
-      }
-    );
-    req.on("error", (e) => reject(new TicketUnavailableError(`Fly OIDC socket: ${e.message}`)));
-    req.end(body);
-  });
-}
-function jwtExp(token) {
-  try {
-    const payload = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
-    return typeof payload.exp === "number" ? payload.exp : null;
-  } catch {
-    return null;
-  }
-}
-function createTicketClient(options = {}) {
-  const issuer = (options.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
-  const renewBeforeSec = options.renewBeforeSec ?? 30;
-  const env = options.env ?? process.env;
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const now = options.now ?? (() => Date.now());
-  const flyOidc = options.flyOidc ?? flyOidcOverSocket;
-  const onFly = options.onFly ?? (() => !!env.FLY_APP_NAME && fs.existsSync(FLY_SOCKET));
-  const cache = /* @__PURE__ */ new Map();
-  const inFlight = /* @__PURE__ */ new Map();
-  let dpopKey = null;
-  const ownKey = () => dpopKey ??= createDpopKey();
-  async function platformToken() {
-    if (onFly()) return flyOidc(issuer);
-    const url = env.ACTIONS_ID_TOKEN_REQUEST_URL;
-    const bearer = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
-    if (url && bearer) {
-      let res;
-      try {
-        res = await fetchImpl(`${url}&audience=${encodeURIComponent(issuer)}`, { headers: { authorization: `Bearer ${bearer}` } });
-      } catch (e) {
-        throw new TicketUnavailableError(`GitHub OIDC endpoint unreachable: ${e instanceof Error ? e.message : String(e)}`);
-      }
-      if (!res.ok) throw new TicketUnavailableError(`GitHub OIDC endpoint answered ${res.status}`);
-      const { value } = await res.json();
-      if (!value) throw new TicketUnavailableError("GitHub OIDC endpoint returned no token");
-      return value;
-    }
-    throw new NoWorkloadIdentityError(
-      "No workload identity to exchange for a ticket: not on a Fly machine (FLY_APP_NAME + /.fly/api) and not in a GitHub Actions job (ACTIONS_ID_TOKEN_REQUEST_URL/_TOKEN \u2014 add `permissions: id-token: write`). A Mac session keeps using its session key."
-    );
-  }
-  async function exchange(audience, scope) {
-    const subject = await platformToken();
-    const form = new URLSearchParams({
-      grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
-      subject_token: subject,
-      subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
-      audience
-    });
-    if (scope) form.set("scope", scope);
-    let res;
-    try {
-      const tokenUrl = `${issuer}/oauth2/token`;
-      const headers = { "content-type": "application/x-www-form-urlencoded" };
-      if (options.dpop) headers.dpop = await createDpopProof(await ownKey(), { method: "POST", url: tokenUrl, now });
-      res = await fetchImpl(tokenUrl, { method: "POST", headers, body: form });
-    } catch (e) {
-      throw new TicketUnavailableError(`${issuer} unreachable: ${e instanceof Error ? e.message : String(e)}`);
-    }
-    let body = {};
-    try {
-      body = await res.json();
-    } catch {
-    }
-    if (res.status >= 500) throw new TicketUnavailableError(`${issuer} answered ${res.status}`);
-    if (!res.ok || !body.access_token) {
-      const desc = body.error_description ?? "";
-      const code = desc.includes(":") ? desc.slice(0, desc.indexOf(":")).trim() : body.error ?? "exchange_refused";
-      throw new TicketExchangeError(`BID refused the ticket for ${audience}: ${desc || body.error || res.status}`, code, res.status);
-    }
-    const nowSec = Math.floor(now() / 1e3);
-    const exp = jwtExp(body.access_token) ?? nowSec + (body.expires_in ?? 300);
-    return { token: body.access_token, exp };
-  }
-  const client = {
-    async authHeaders({ audience, scope, method, url }) {
-      const ticket = await client.get({ audience, scope });
-      if (!options.dpop) return { authorization: `Bearer ${ticket}` };
-      return { authorization: `DPoP ${ticket}`, dpop: await createDpopProof(await ownKey(), { method, url, ticket, now }) };
-    },
-    async get({ audience, scope }) {
-      const key = `${audience} ${scope ?? ""}`;
-      const hit = cache.get(key);
-      if (hit && hit.exp - renewBeforeSec > now() / 1e3) return hit.token;
-      const pending = inFlight.get(key);
-      if (pending) return pending;
-      const p = exchange(audience, scope).then((t) => {
-        cache.set(key, t);
-        return t.token;
-      }).finally(() => inFlight.delete(key));
-      inFlight.set(key, p);
-      return p;
-    }
-  };
-  return client;
-}
-var shared = null;
-function fetchTicket(opts) {
-  shared ??= createTicketClient();
-  return shared.get(opts);
-}
 var PRINCIPAL_TYPES = ["human", "service", "agent", "user"];
 var TICKET_FORMAT_VERSION = 1;
 var MAX_ACT_DEPTH = 5;
@@ -240,11 +17,11 @@ function createTicketVerifier(options) {
     dpopIatWindowSec = 60,
     now = () => Date.now()
   } = options;
-  const replayStore = options.replayStore ?? createMemoryReplayStore(now);
-  if (!issuer) throw new chunk2F3RPYJV_cjs.SsoError("createTicketVerifier needs an issuer");
-  if (!audience) throw new chunk2F3RPYJV_cjs.SsoError("createTicketVerifier needs this receiver's audience");
+  const replayStore = options.replayStore ?? chunk2XMKZWC6_cjs.createMemoryReplayStore(now);
+  if (!issuer) throw new chunk2XMKZWC6_cjs.SsoError("createTicketVerifier needs an issuer");
+  if (!audience) throw new chunk2XMKZWC6_cjs.SsoError("createTicketVerifier needs this receiver's audience");
   let cachePromise = null;
-  const cacheFor = (jwksUri) => chunk2F3RPYJV_cjs.createJwksCache({
+  const cacheFor = (jwksUri) => chunk2XMKZWC6_cjs.createJwksCache({
     jwksUri,
     fetchImpl,
     ...options.warmUp ? { warmUp: true } : {},
@@ -260,12 +37,12 @@ function createTicketVerifier(options) {
         if (!res.ok) throw new Error(`answered ${res.status}`);
         doc = await res.json();
       } catch (cause) {
-        throw new chunk2F3RPYJV_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
+        throw new chunk2XMKZWC6_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
       }
       if (doc.issuer !== issuer) {
-        throw new chunk2F3RPYJV_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
+        throw new chunk2XMKZWC6_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
       }
-      if (!doc.jwks_uri) throw new chunk2F3RPYJV_cjs.SsoError(`${url} names no jwks_uri`);
+      if (!doc.jwks_uri) throw new chunk2XMKZWC6_cjs.SsoError(`${url} names no jwks_uri`);
       return cacheFor(doc.jwks_uri);
     })().catch((err) => {
       cachePromise = null;
@@ -281,52 +58,52 @@ function createTicketVerifier(options) {
       try {
         header = jose.decodeProtectedHeader(token);
       } catch {
-        throw new chunk2F3RPYJV_cjs.SsoError("ticket is not a JWS");
+        throw new chunk2XMKZWC6_cjs.SsoError("ticket is not a JWS");
       }
-      if (!header.kid) throw new chunk2F3RPYJV_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
-      if (header.typ === "logout+jwt") throw new chunk2F3RPYJV_cjs.SsoError("a logout token is not a ticket");
+      if (!header.kid) throw new chunk2XMKZWC6_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
+      if (header.typ === "logout+jwt") throw new chunk2XMKZWC6_cjs.SsoError("a logout token is not a ticket");
       const cache = await keys();
       let payload;
       try {
         ({ payload } = await jose.jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "EdDSA"), {
           issuer,
           audience,
-          algorithms: chunk2F3RPYJV_cjs.ALLOWED_ALGS,
+          algorithms: chunk2XMKZWC6_cjs.ALLOWED_ALGS,
           clockTolerance: clockToleranceSec,
           requiredClaims: ["exp", "iat", "jti", "sub"]
         }));
       } catch (e) {
-        if (e instanceof chunk2F3RPYJV_cjs.JwksUnavailableError) throw e;
-        throw new chunk2F3RPYJV_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
+        if (e instanceof chunk2XMKZWC6_cjs.JwksUnavailableError) throw e;
+        throw new chunk2XMKZWC6_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
       }
-      if ("events" in payload) throw new chunk2F3RPYJV_cjs.SsoError("a logout token is not a ticket");
-      if ("nonce" in payload) throw new chunk2F3RPYJV_cjs.SsoError("an ID token is not a ticket");
+      if ("events" in payload) throw new chunk2XMKZWC6_cjs.SsoError("a logout token is not a ticket");
+      if ("nonce" in payload) throw new chunk2XMKZWC6_cjs.SsoError("an ID token is not a ticket");
       const type = payload.principal_type;
       if (typeof type !== "string" || !PRINCIPAL_TYPES.includes(type)) {
-        throw new chunk2F3RPYJV_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
+        throw new chunk2XMKZWC6_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
       }
       const lifetime = payload.exp - payload.iat;
       if (lifetime > maxLifetimeSec) {
-        throw new chunk2F3RPYJV_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
+        throw new chunk2XMKZWC6_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
       }
-      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunk2F3RPYJV_cjs.SsoError("ticket has no sub");
+      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunk2XMKZWC6_cjs.SsoError("ticket has no sub");
       const scopes = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [];
       const required = opts.scope === void 0 ? [] : Array.isArray(opts.scope) ? opts.scope : [opts.scope];
       const missing = required.filter((s) => !scopes.includes(s));
-      if (missing.length) throw new chunk2F3RPYJV_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
+      if (missing.length) throw new chunk2XMKZWC6_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
       const ver = payload.ver === void 0 ? 0 : payload.ver;
       if (typeof ver !== "number" || !Number.isInteger(ver) || ver < 0) {
-        throw new chunk2F3RPYJV_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
+        throw new chunk2XMKZWC6_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
       }
       if (ver > TICKET_FORMAT_VERSION) {
-        throw new chunk2F3RPYJV_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
+        throw new chunk2XMKZWC6_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
       }
       const act = payload.act === void 0 ? null : readActor(payload.act, 1);
       const cnfRaw = payload.cnf;
       const cnf = cnfRaw && typeof cnfRaw.jkt === "string" && cnfRaw.jkt ? { jkt: cnfRaw.jkt } : null;
       if (cnf) {
-        if (!opts.dpop?.proof) throw new chunk2F3RPYJV_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
-        await verifyDpopProof(opts.dpop.proof, {
+        if (!opts.dpop?.proof) throw new chunk2XMKZWC6_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
+        await chunk2XMKZWC6_cjs.verifyDpopProof(opts.dpop.proof, {
           method: opts.dpop.method,
           url: opts.dpop.url,
           ticket: token,
@@ -336,11 +113,11 @@ function createTicketVerifier(options) {
           now
         });
       } else if (requireDpop) {
-        throw new chunk2F3RPYJV_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
+        throw new chunk2XMKZWC6_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
       }
       const named = (v) => typeof v === "string" && v ? v : null;
       const clientId = type === "user" ? named(payload.client_id) ?? named(payload.azp) : named(payload.client_id) ?? payload.sub;
-      if (clientId === null) throw new chunk2F3RPYJV_cjs.SsoError("a user ticket names no app (no client_id or azp)");
+      if (clientId === null) throw new chunk2XMKZWC6_cjs.SsoError("a user ticket names no app (no client_id or azp)");
       return {
         principal: payload.sub,
         type,
@@ -357,140 +134,184 @@ function createTicketVerifier(options) {
   };
 }
 function readActor(raw, depth) {
-  if (depth > MAX_ACT_DEPTH) throw new chunk2F3RPYJV_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
+  if (depth > MAX_ACT_DEPTH) throw new chunk2XMKZWC6_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
   const link = raw;
   if (!link || typeof link !== "object" || typeof link.sub !== "string" || link.sub === "") {
-    throw new chunk2F3RPYJV_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
+    throw new chunk2XMKZWC6_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
   }
   return link.act === void 0 ? { sub: link.sub } : { sub: link.sub, act: readActor(link.act, depth + 1) };
 }
 
 Object.defineProperty(exports, "AVATAR_TYPES", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.AVATAR_TYPES; }
+  get: function () { return chunk2XMKZWC6_cjs.AVATAR_TYPES; }
+});
+Object.defineProperty(exports, "DEFAULT_ISSUER", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.DEFAULT_ISSUER; }
 });
 Object.defineProperty(exports, "DEFAULT_SESSION_MAX_AGE", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.DEFAULT_SESSION_MAX_AGE; }
+  get: function () { return chunk2XMKZWC6_cjs.DEFAULT_SESSION_MAX_AGE; }
 });
 Object.defineProperty(exports, "EMBEDDED_FLOW_MAX_AGE", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.EMBEDDED_FLOW_MAX_AGE; }
+  get: function () { return chunk2XMKZWC6_cjs.EMBEDDED_FLOW_MAX_AGE; }
+});
+Object.defineProperty(exports, "FLY_CLIENT_ASSERTION_TYPE", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.FLY_CLIENT_ASSERTION_TYPE; }
 });
 Object.defineProperty(exports, "JwksError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.JwksError; }
+  get: function () { return chunk2XMKZWC6_cjs.JwksError; }
 });
 Object.defineProperty(exports, "JwksUnavailableError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.JwksUnavailableError; }
+  get: function () { return chunk2XMKZWC6_cjs.JwksUnavailableError; }
 });
 Object.defineProperty(exports, "JwksUnknownKeyError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.JwksUnknownKeyError; }
+  get: function () { return chunk2XMKZWC6_cjs.JwksUnknownKeyError; }
 });
 Object.defineProperty(exports, "MAX_AVATAR_BYTES", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.MAX_AVATAR_BYTES; }
+  get: function () { return chunk2XMKZWC6_cjs.MAX_AVATAR_BYTES; }
 });
 Object.defineProperty(exports, "MAX_INVITATIONS", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.MAX_INVITATIONS; }
+  get: function () { return chunk2XMKZWC6_cjs.MAX_INVITATIONS; }
+});
+Object.defineProperty(exports, "NoWorkloadIdentityError", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.NoWorkloadIdentityError; }
 });
 Object.defineProperty(exports, "SsoAppApiError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.SsoAppApiError; }
+  get: function () { return chunk2XMKZWC6_cjs.SsoAppApiError; }
 });
 Object.defineProperty(exports, "SsoAvatarRejectedError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.SsoAvatarRejectedError; }
+  get: function () { return chunk2XMKZWC6_cjs.SsoAvatarRejectedError; }
 });
 Object.defineProperty(exports, "SsoConfigError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.SsoConfigError; }
+  get: function () { return chunk2XMKZWC6_cjs.SsoConfigError; }
 });
 Object.defineProperty(exports, "SsoError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.SsoError; }
+  get: function () { return chunk2XMKZWC6_cjs.SsoError; }
 });
 Object.defineProperty(exports, "SsoInsufficientScopeError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.SsoInsufficientScopeError; }
+  get: function () { return chunk2XMKZWC6_cjs.SsoInsufficientScopeError; }
 });
 Object.defineProperty(exports, "SsoIntrospectionUnavailableError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.SsoIntrospectionUnavailableError; }
+  get: function () { return chunk2XMKZWC6_cjs.SsoIntrospectionUnavailableError; }
 });
 Object.defineProperty(exports, "SsoReauthError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.SsoReauthError; }
+  get: function () { return chunk2XMKZWC6_cjs.SsoReauthError; }
 });
 Object.defineProperty(exports, "SsoTokenInactiveError", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.SsoTokenInactiveError; }
+  get: function () { return chunk2XMKZWC6_cjs.SsoTokenInactiveError; }
+});
+Object.defineProperty(exports, "TicketExchangeError", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.TicketExchangeError; }
+});
+Object.defineProperty(exports, "TicketUnavailableError", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.TicketUnavailableError; }
+});
+Object.defineProperty(exports, "accessTokenHash", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.accessTokenHash; }
 });
 Object.defineProperty(exports, "cookieHeader", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.cookieHeader; }
+  get: function () { return chunk2XMKZWC6_cjs.cookieHeader; }
+});
+Object.defineProperty(exports, "createDpopKey", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.createDpopKey; }
+});
+Object.defineProperty(exports, "createDpopProof", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.createDpopProof; }
 });
 Object.defineProperty(exports, "createJwksCache", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.createJwksCache; }
+  get: function () { return chunk2XMKZWC6_cjs.createJwksCache; }
+});
+Object.defineProperty(exports, "createMemoryReplayStore", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.createMemoryReplayStore; }
 });
 Object.defineProperty(exports, "createSsoClient", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.createSsoClient; }
+  get: function () { return chunk2XMKZWC6_cjs.createSsoClient; }
+});
+Object.defineProperty(exports, "createTicketClient", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.createTicketClient; }
+});
+Object.defineProperty(exports, "exchangeUserToken", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.exchangeUserToken; }
+});
+Object.defineProperty(exports, "fetchTicket", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.fetchTicket; }
 });
 Object.defineProperty(exports, "loadSsoConfig", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.loadSsoConfig; }
+  get: function () { return chunk2XMKZWC6_cjs.loadSsoConfig; }
 });
 Object.defineProperty(exports, "memoryTokenStore", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.memoryTokenStore; }
+  get: function () { return chunk2XMKZWC6_cjs.memoryTokenStore; }
+});
+Object.defineProperty(exports, "normalizeHtu", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.normalizeHtu; }
 });
 Object.defineProperty(exports, "openEmbeddedFlow", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.openEmbeddedFlow; }
+  get: function () { return chunk2XMKZWC6_cjs.openEmbeddedFlow; }
 });
 Object.defineProperty(exports, "readCookie", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.readCookie; }
+  get: function () { return chunk2XMKZWC6_cjs.readCookie; }
 });
 Object.defineProperty(exports, "sealEmbeddedFlow", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.sealEmbeddedFlow; }
+  get: function () { return chunk2XMKZWC6_cjs.sealEmbeddedFlow; }
 });
 Object.defineProperty(exports, "signSession", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.signSession; }
+  get: function () { return chunk2XMKZWC6_cjs.signSession; }
 });
 Object.defineProperty(exports, "signValue", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.signValue; }
+  get: function () { return chunk2XMKZWC6_cjs.signValue; }
+});
+Object.defineProperty(exports, "verifyDpopProof", {
+  enumerable: true,
+  get: function () { return chunk2XMKZWC6_cjs.verifyDpopProof; }
 });
 Object.defineProperty(exports, "verifySession", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.verifySession; }
+  get: function () { return chunk2XMKZWC6_cjs.verifySession; }
 });
 Object.defineProperty(exports, "verifyValue", {
   enumerable: true,
-  get: function () { return chunk2F3RPYJV_cjs.verifyValue; }
+  get: function () { return chunk2XMKZWC6_cjs.verifyValue; }
 });
-exports.DEFAULT_ISSUER = DEFAULT_ISSUER;
 exports.MAX_ACT_DEPTH = MAX_ACT_DEPTH;
-exports.NoWorkloadIdentityError = NoWorkloadIdentityError;
 exports.TICKET_FORMAT_VERSION = TICKET_FORMAT_VERSION;
-exports.TicketExchangeError = TicketExchangeError;
-exports.TicketUnavailableError = TicketUnavailableError;
-exports.accessTokenHash = accessTokenHash;
-exports.createDpopKey = createDpopKey;
-exports.createDpopProof = createDpopProof;
-exports.createMemoryReplayStore = createMemoryReplayStore;
-exports.createTicketClient = createTicketClient;
 exports.createTicketVerifier = createTicketVerifier;
-exports.fetchTicket = fetchTicket;
-exports.normalizeHtu = normalizeHtu;
-exports.verifyDpopProof = verifyDpopProof;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map