@broberg/sso 0.21.0 → 0.21.2

package/dist/hono.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk2XMKZWC6_cjs = require('./chunk-2XMKZWC6.cjs');
+var chunkQFUIWC2Q_cjs = require('./chunk-QFUIWC2Q.cjs');
 var hono = require('hono');
 
 var SESSION_KEY = "bidSession";
@@ -31,9 +31,9 @@ function safeReturnTo(raw, fallback) {
   return normalised;
 }
 function ssoRoutes(options = {}) {
-  const baseConfig = options.config ?? chunk2XMKZWC6_cjs.loadSsoConfig();
+  const baseConfig = options.config ?? chunkQFUIWC2Q_cjs.loadSsoConfig();
   const config = options.clientAuth ? { ...baseConfig, clientAuth: options.clientAuth } : baseConfig;
-  const client = options.client ?? chunk2XMKZWC6_cjs.createSsoClient(config);
+  const client = options.client ?? chunkQFUIWC2Q_cjs.createSsoClient(config);
   const loginPath = options.loginPath ?? "/auth";
   const defaultReturnTo = options.defaultReturnTo ?? "/";
   const txCookie = `${config.cookieName}_tx`;
@@ -47,7 +47,7 @@ function ssoRoutes(options = {}) {
   const callbackErrors = options.callbackErrors ?? "single";
   const onCallbackRefused = options.onCallbackRefused ?? ((cause) => console.warn(`[@broberg/sso] /callback refused: ${cause}`));
   async function liveSession(c) {
-    const session = await chunk2XMKZWC6_cjs.verifySession(chunk2XMKZWC6_cjs.readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
+    const session = await chunkQFUIWC2Q_cjs.verifySession(chunkQFUIWC2Q_cjs.readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
     if (!session || !backchannel) return session;
     try {
       const before = await backchannel.store.revokedBefore(session.sub);
@@ -73,7 +73,7 @@ function ssoRoutes(options = {}) {
       try {
         verified = await client.verifyLogoutToken(token);
       } catch (e) {
-        const msg = e instanceof chunk2XMKZWC6_cjs.SsoError ? e.message : "logout_token could not be verified";
+        const msg = e instanceof chunkQFUIWC2Q_cjs.SsoError ? e.message : "logout_token could not be verified";
         return c.json({ error: "invalid_request", error_description: msg }, 400);
       }
       try {
@@ -102,7 +102,7 @@ function ssoRoutes(options = {}) {
       // The signed stamp carries the SERVER's window; the cookie carries the
       // longer browser one, so an expired transaction still reaches us and can
       // be named instead of vanishing.
-      chunk2XMKZWC6_cjs.cookieHeader(txCookie, await chunk2XMKZWC6_cjs.signValue(tx, config.cookieSecret, { maxAgeSeconds: TRANSACTION_MAX_AGE }), {
+      chunkQFUIWC2Q_cjs.cookieHeader(txCookie, await chunkQFUIWC2Q_cjs.signValue(tx, config.cookieSecret, { maxAgeSeconds: TRANSACTION_MAX_AGE }), {
         maxAge: TRANSACTION_COOKIE_MAX_AGE,
         secure: isSecure(c)
       })
@@ -111,7 +111,7 @@ function ssoRoutes(options = {}) {
   });
   app.get("/callback", async (c) => {
     const parsed = await parseTransaction(
-      chunk2XMKZWC6_cjs.readCookie(c.req.header("cookie"), txCookie),
+      chunkQFUIWC2Q_cjs.readCookie(c.req.header("cookie"), txCookie),
       config.cookieSecret
     );
     if (!parsed.ok) {
@@ -143,7 +143,7 @@ function ssoRoutes(options = {}) {
         message: "This login could not be completed. Begin again from the login page."
       } : failures[parsed.reason];
       const { status, ...body } = shown;
-      c.header("Set-Cookie", chunk2XMKZWC6_cjs.cookieHeader(txCookie, "", { maxAge: 0, secure: isSecure(c) }));
+      c.header("Set-Cookie", chunkQFUIWC2Q_cjs.cookieHeader(txCookie, "", { maxAge: 0, secure: isSecure(c) }));
       return c.json(body, status);
     }
     const result = await client.completeLogin({
@@ -156,12 +156,12 @@ function ssoRoutes(options = {}) {
     const exp = nowS + config.sessionMaxAge;
     let sid;
     if (tokenStore && result.accessToken) {
-      sid = chunk2XMKZWC6_cjs.newSid();
+      sid = chunkQFUIWC2Q_cjs.newSid();
       await tokenStore.set(sid, {
         sub: result.claims.sub,
         accessToken: result.accessToken,
         ...result.refreshToken ? { refreshToken: result.refreshToken } : {},
-        expiresAt: chunk2XMKZWC6_cjs.expiresAtFrom(result.expiresIn, result.accessToken, nowS)
+        expiresAt: chunkQFUIWC2Q_cjs.expiresAtFrom(result.expiresIn, result.accessToken, nowS)
       });
     }
     const session = {
@@ -177,14 +177,14 @@ function ssoRoutes(options = {}) {
     };
     c.header(
       "Set-Cookie",
-      chunk2XMKZWC6_cjs.cookieHeader(config.cookieName, await chunk2XMKZWC6_cjs.signSession(session, config.cookieSecret), {
+      chunkQFUIWC2Q_cjs.cookieHeader(config.cookieName, await chunkQFUIWC2Q_cjs.signSession(session, config.cookieSecret), {
         maxAge: config.sessionMaxAge,
         secure: isSecure(c)
       })
     );
     c.header(
       "Set-Cookie",
-      chunk2XMKZWC6_cjs.cookieHeader(idTokenCookie, await chunk2XMKZWC6_cjs.signValue(result.idToken, config.cookieSecret), {
+      chunkQFUIWC2Q_cjs.cookieHeader(idTokenCookie, await chunkQFUIWC2Q_cjs.signValue(result.idToken, config.cookieSecret), {
         maxAge: config.sessionMaxAge,
         secure: isSecure(c)
       }),
@@ -192,27 +192,27 @@ function ssoRoutes(options = {}) {
     );
     c.header(
       "Set-Cookie",
-      chunk2XMKZWC6_cjs.cookieHeader(txCookie, "", { maxAge: 0, secure: isSecure(c) }),
+      chunkQFUIWC2Q_cjs.cookieHeader(txCookie, "", { maxAge: 0, secure: isSecure(c) }),
       { append: true }
     );
     return c.redirect(parsed.tx.returnTo, 302);
   });
   app.get("/logout", async (c) => {
-    const idTokenHint = await chunk2XMKZWC6_cjs.verifyValue(
-      chunk2XMKZWC6_cjs.readCookie(c.req.header("cookie"), idTokenCookie),
+    const idTokenHint = await chunkQFUIWC2Q_cjs.verifyValue(
+      chunkQFUIWC2Q_cjs.readCookie(c.req.header("cookie"), idTokenCookie),
       config.cookieSecret
     );
     if (tokenStore) {
-      const leaving = await chunk2XMKZWC6_cjs.verifySession(chunk2XMKZWC6_cjs.readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
+      const leaving = await chunkQFUIWC2Q_cjs.verifySession(chunkQFUIWC2Q_cjs.readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
       if (leaving?.sid) await tokenStore.delete(leaving.sid);
     }
     c.header(
       "Set-Cookie",
-      chunk2XMKZWC6_cjs.cookieHeader(config.cookieName, "", { maxAge: 0, secure: isSecure(c) })
+      chunkQFUIWC2Q_cjs.cookieHeader(config.cookieName, "", { maxAge: 0, secure: isSecure(c) })
     );
     c.header(
       "Set-Cookie",
-      chunk2XMKZWC6_cjs.cookieHeader(idTokenCookie, "", { maxAge: 0, secure: isSecure(c) }),
+      chunkQFUIWC2Q_cjs.cookieHeader(idTokenCookie, "", { maxAge: 0, secure: isSecure(c) }),
       { append: true }
     );
     if ((options.logout ?? "app") === "app") {
@@ -239,23 +239,23 @@ function ssoRoutes(options = {}) {
   const refreshing = /* @__PURE__ */ new Map();
   async function getAccessToken(c) {
     if (!tokenStore) {
-      throw new chunk2XMKZWC6_cjs.SsoError("getAccessToken needs ssoRoutes({ tokenStore }) \u2014 without one the login's tokens are not kept.");
+      throw new chunkQFUIWC2Q_cjs.SsoError("getAccessToken needs ssoRoutes({ tokenStore }) \u2014 without one the login's tokens are not kept.");
     }
-    const raw = await chunk2XMKZWC6_cjs.verifySession(chunk2XMKZWC6_cjs.readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
+    const raw = await chunkQFUIWC2Q_cjs.verifySession(chunkQFUIWC2Q_cjs.readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
     const live = await liveSession(c);
     if (!live) {
       if (raw?.sid) await tokenStore.delete(raw.sid);
-      throw new chunk2XMKZWC6_cjs.SsoReauthError("no live session \u2014 log in again.", "no_session");
+      throw new chunkQFUIWC2Q_cjs.SsoReauthError("no live session \u2014 log in again.", "no_session");
     }
     const sid = live.sid;
-    if (!sid) throw new chunk2XMKZWC6_cjs.SsoReauthError("this session has no stored tokens (it began before tokenStore was configured) \u2014 log in again.", "no_tokens");
+    if (!sid) throw new chunkQFUIWC2Q_cjs.SsoReauthError("this session has no stored tokens (it began before tokenStore was configured) \u2014 log in again.", "no_tokens");
     const tokens = await tokenStore.get(sid);
-    if (!tokens) throw new chunk2XMKZWC6_cjs.SsoReauthError("no tokens stored for this session \u2014 log in again.", "no_tokens");
+    if (!tokens) throw new chunkQFUIWC2Q_cjs.SsoReauthError("no tokens stored for this session \u2014 log in again.", "no_tokens");
     const now = Math.floor(Date.now() / 1e3);
     if (tokens.expiresAt - 30 > now) return tokens.accessToken;
     if (!tokens.refreshToken) {
       await tokenStore.delete(sid);
-      throw new chunk2XMKZWC6_cjs.SsoReauthError("the access token has expired and there is no refresh token \u2014 log in again.", "expired");
+      throw new chunkQFUIWC2Q_cjs.SsoReauthError("the access token has expired and there is no refresh token \u2014 log in again.", "expired");
     }
     const inFlight = refreshing.get(sid);
     if (inFlight) return inFlight;
@@ -265,14 +265,14 @@ function ssoRoutes(options = {}) {
         next = await client.refreshTokens(tokens.refreshToken);
       } catch (e) {
         await tokenStore.delete(sid);
-        throw new chunk2XMKZWC6_cjs.SsoReauthError(e instanceof chunk2XMKZWC6_cjs.SsoError ? e.message : "token refresh failed", "refresh_failed");
+        throw new chunkQFUIWC2Q_cjs.SsoReauthError(e instanceof chunkQFUIWC2Q_cjs.SsoError ? e.message : "token refresh failed", "refresh_failed");
       }
       await tokenStore.set(sid, {
         sub: tokens.sub,
         accessToken: next.accessToken,
         // Rotation: use the new one if BID issued one, else keep the old.
         ...next.refreshToken ?? tokens.refreshToken ? { refreshToken: next.refreshToken ?? tokens.refreshToken } : {},
-        expiresAt: chunk2XMKZWC6_cjs.expiresAtFrom(next.expiresIn, next.accessToken, Math.floor(Date.now() / 1e3))
+        expiresAt: chunkQFUIWC2Q_cjs.expiresAtFrom(next.expiresIn, next.accessToken, Math.floor(Date.now() / 1e3))
       });
       return next.accessToken;
     })();
@@ -296,7 +296,7 @@ function ssoRoutes(options = {}) {
     if (left <= 0) return;
     c.header(
       "Set-Cookie",
-      chunk2XMKZWC6_cjs.cookieHeader(config.cookieName, await chunk2XMKZWC6_cjs.signSession(next, config.cookieSecret), { maxAge: left, secure: isSecure(c) }),
+      chunkQFUIWC2Q_cjs.cookieHeader(config.cookieName, await chunkQFUIWC2Q_cjs.signSession(next, config.cookieSecret), { maxAge: left, secure: isSecure(c) }),
       { append: true }
     );
   }
@@ -304,9 +304,9 @@ function ssoRoutes(options = {}) {
 }
 async function parseTransaction(raw, secret) {
   if (raw === void 0) return { ok: false, reason: "absent" };
-  const signed = await chunk2XMKZWC6_cjs.verifyValue(raw, secret);
+  const signed = await chunkQFUIWC2Q_cjs.verifyValue(raw, secret);
   if (signed === null) return { ok: false, reason: "unreadable" };
-  const fresh = await chunk2XMKZWC6_cjs.verifyValue(raw, secret, { maxAgeSeconds: TRANSACTION_MAX_AGE });
+  const fresh = await chunkQFUIWC2Q_cjs.verifyValue(raw, secret, { maxAgeSeconds: TRANSACTION_MAX_AGE });
   if (fresh === null) return { ok: false, reason: "expired" };
   try {
     const tx = JSON.parse(fresh);
@@ -376,16 +376,16 @@ function accountRoutes(sso) {
   });
   app.post("/profile/avatar", async (c) => {
     const token = await sso.getAccessToken(c);
-    const type = chunk2XMKZWC6_cjs.mediaType(c.req.header("content-type"));
-    if (!chunk2XMKZWC6_cjs.AVATAR_TYPES.includes(type)) {
-      return c.json({ error: "unsupported_type", accepted: chunk2XMKZWC6_cjs.AVATAR_TYPES }, 415);
+    const type = chunkQFUIWC2Q_cjs.mediaType(c.req.header("content-type"));
+    if (!chunkQFUIWC2Q_cjs.AVATAR_TYPES.includes(type)) {
+      return c.json({ error: "unsupported_type", accepted: chunkQFUIWC2Q_cjs.AVATAR_TYPES }, 415);
     }
     const declared = Number(c.req.header("content-length"));
-    if (Number.isFinite(declared) && declared > chunk2XMKZWC6_cjs.MAX_AVATAR_BYTES) {
-      return c.json({ error: "too_large", max_bytes: chunk2XMKZWC6_cjs.MAX_AVATAR_BYTES }, 413);
+    if (Number.isFinite(declared) && declared > chunkQFUIWC2Q_cjs.MAX_AVATAR_BYTES) {
+      return c.json({ error: "too_large", max_bytes: chunkQFUIWC2Q_cjs.MAX_AVATAR_BYTES }, 413);
     }
-    const bytes = await readCapped(c, chunk2XMKZWC6_cjs.MAX_AVATAR_BYTES);
-    if (!bytes) return c.json({ error: "too_large", max_bytes: chunk2XMKZWC6_cjs.MAX_AVATAR_BYTES }, 413);
+    const bytes = await readCapped(c, chunkQFUIWC2Q_cjs.MAX_AVATAR_BYTES);
+    if (!bytes) return c.json({ error: "too_large", max_bytes: chunkQFUIWC2Q_cjs.MAX_AVATAR_BYTES }, 413);
     return answer(c, await client.uploadAvatar(token, bytes, type));
   });
   app.post("/profile/avatar/remove", async (c) => answer(c, await client.removeAvatar(await sso.getAccessToken(c))));
@@ -398,7 +398,7 @@ function accountRoutes(sso) {
       case "SsoInsufficientScopeError":
         return c.json({ error: "insufficient_scope", scope: e.scope }, 403);
       case "SsoAvatarRejectedError":
-        return e.reason === "too_large" ? c.json({ error: "too_large", max_bytes: chunk2XMKZWC6_cjs.MAX_AVATAR_BYTES }, 413) : c.json({ error: "unsupported_type", accepted: chunk2XMKZWC6_cjs.AVATAR_TYPES }, 415);
+        return e.reason === "too_large" ? c.json({ error: "too_large", max_bytes: chunkQFUIWC2Q_cjs.MAX_AVATAR_BYTES }, 413) : c.json({ error: "unsupported_type", accepted: chunkQFUIWC2Q_cjs.AVATAR_TYPES }, 415);
       case "SsoAppApiError": {
         if (e.status === 401) return c.json({ error: "reauth" }, 401);
         if (typeof e.status === "number" && e.status >= 400 && e.status < 500) {

package/dist/hono.js

@@ -1,4 +1,4 @@
-import { loadSsoConfig, createSsoClient, SsoError, cookieHeader, signValue, readCookie, newSid, expiresAtFrom, signSession, verifyValue, verifySession, mediaType, AVATAR_TYPES, MAX_AVATAR_BYTES, SsoReauthError } from './chunk-UDUPP35Z.js';
+import { loadSsoConfig, createSsoClient, SsoError, cookieHeader, signValue, readCookie, newSid, expiresAtFrom, signSession, verifyValue, verifySession, mediaType, AVATAR_TYPES, MAX_AVATAR_BYTES, SsoReauthError } from './chunk-NIYOPNRE.js';
 import { Hono } from 'hono';
 
 var SESSION_KEY = "bidSession";

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk2XMKZWC6_cjs = require('./chunk-2XMKZWC6.cjs');
+var chunkQFUIWC2Q_cjs = require('./chunk-QFUIWC2Q.cjs');
 var jose = require('jose');
 
 var PRINCIPAL_TYPES = ["human", "service", "agent", "user"];
@@ -17,11 +17,11 @@ function createTicketVerifier(options) {
     dpopIatWindowSec = 60,
     now = () => Date.now()
   } = options;
-  const replayStore = options.replayStore ?? chunk2XMKZWC6_cjs.createMemoryReplayStore(now);
-  if (!issuer) throw new chunk2XMKZWC6_cjs.SsoError("createTicketVerifier needs an issuer");
-  if (!audience) throw new chunk2XMKZWC6_cjs.SsoError("createTicketVerifier needs this receiver's audience");
+  const replayStore = options.replayStore ?? chunkQFUIWC2Q_cjs.createMemoryReplayStore(now);
+  if (!issuer) throw new chunkQFUIWC2Q_cjs.SsoError("createTicketVerifier needs an issuer");
+  if (!audience) throw new chunkQFUIWC2Q_cjs.SsoError("createTicketVerifier needs this receiver's audience");
   let cachePromise = null;
-  const cacheFor = (jwksUri) => chunk2XMKZWC6_cjs.createJwksCache({
+  const cacheFor = (jwksUri) => chunkQFUIWC2Q_cjs.createJwksCache({
     jwksUri,
     fetchImpl,
     ...options.warmUp ? { warmUp: true } : {},
@@ -37,12 +37,12 @@ function createTicketVerifier(options) {
         if (!res.ok) throw new Error(`answered ${res.status}`);
         doc = await res.json();
       } catch (cause) {
-        throw new chunk2XMKZWC6_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
+        throw new chunkQFUIWC2Q_cjs.JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
       }
       if (doc.issuer !== issuer) {
-        throw new chunk2XMKZWC6_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
+        throw new chunkQFUIWC2Q_cjs.SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
       }
-      if (!doc.jwks_uri) throw new chunk2XMKZWC6_cjs.SsoError(`${url} names no jwks_uri`);
+      if (!doc.jwks_uri) throw new chunkQFUIWC2Q_cjs.SsoError(`${url} names no jwks_uri`);
       return cacheFor(doc.jwks_uri);
     })().catch((err) => {
       cachePromise = null;
@@ -58,52 +58,52 @@ function createTicketVerifier(options) {
       try {
         header = jose.decodeProtectedHeader(token);
       } catch {
-        throw new chunk2XMKZWC6_cjs.SsoError("ticket is not a JWS");
+        throw new chunkQFUIWC2Q_cjs.SsoError("ticket is not a JWS");
       }
-      if (!header.kid) throw new chunk2XMKZWC6_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
-      if (header.typ === "logout+jwt") throw new chunk2XMKZWC6_cjs.SsoError("a logout token is not a ticket");
+      if (!header.kid) throw new chunkQFUIWC2Q_cjs.SsoError("ticket has no kid \u2014 cannot pick a signing key");
+      if (header.typ === "logout+jwt") throw new chunkQFUIWC2Q_cjs.SsoError("a logout token is not a ticket");
       const cache = await keys();
       let payload;
       try {
         ({ payload } = await jose.jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "EdDSA"), {
           issuer,
           audience,
-          algorithms: chunk2XMKZWC6_cjs.ALLOWED_ALGS,
+          algorithms: chunkQFUIWC2Q_cjs.ALLOWED_ALGS,
           clockTolerance: clockToleranceSec,
           requiredClaims: ["exp", "iat", "jti", "sub"]
         }));
       } catch (e) {
-        if (e instanceof chunk2XMKZWC6_cjs.JwksUnavailableError) throw e;
-        throw new chunk2XMKZWC6_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
+        if (e instanceof chunkQFUIWC2Q_cjs.JwksUnavailableError) throw e;
+        throw new chunkQFUIWC2Q_cjs.SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
       }
-      if ("events" in payload) throw new chunk2XMKZWC6_cjs.SsoError("a logout token is not a ticket");
-      if ("nonce" in payload) throw new chunk2XMKZWC6_cjs.SsoError("an ID token is not a ticket");
+      if ("events" in payload) throw new chunkQFUIWC2Q_cjs.SsoError("a logout token is not a ticket");
+      if ("nonce" in payload) throw new chunkQFUIWC2Q_cjs.SsoError("an ID token is not a ticket");
       const type = payload.principal_type;
       if (typeof type !== "string" || !PRINCIPAL_TYPES.includes(type)) {
-        throw new chunk2XMKZWC6_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
+        throw new chunkQFUIWC2Q_cjs.SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
       }
       const lifetime = payload.exp - payload.iat;
       if (lifetime > maxLifetimeSec) {
-        throw new chunk2XMKZWC6_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
+        throw new chunkQFUIWC2Q_cjs.SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
       }
-      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunk2XMKZWC6_cjs.SsoError("ticket has no sub");
+      if (typeof payload.sub !== "string" || payload.sub === "") throw new chunkQFUIWC2Q_cjs.SsoError("ticket has no sub");
       const scopes = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [];
       const required = opts.scope === void 0 ? [] : Array.isArray(opts.scope) ? opts.scope : [opts.scope];
       const missing = required.filter((s) => !scopes.includes(s));
-      if (missing.length) throw new chunk2XMKZWC6_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
+      if (missing.length) throw new chunkQFUIWC2Q_cjs.SsoError(`ticket lacks scope ${missing.join(", ")}`);
       const ver = payload.ver === void 0 ? 0 : payload.ver;
       if (typeof ver !== "number" || !Number.isInteger(ver) || ver < 0) {
-        throw new chunk2XMKZWC6_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
+        throw new chunkQFUIWC2Q_cjs.SsoError(`ticket has an invalid ver (got ${JSON.stringify(payload.ver)})`);
       }
       if (ver > TICKET_FORMAT_VERSION) {
-        throw new chunk2XMKZWC6_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
+        throw new chunkQFUIWC2Q_cjs.SsoError(`ticket format version ${ver} is newer than this @broberg/sso understands (${TICKET_FORMAT_VERSION}) \u2014 upgrade @broberg/sso`);
       }
       const act = payload.act === void 0 ? null : readActor(payload.act, 1);
       const cnfRaw = payload.cnf;
       const cnf = cnfRaw && typeof cnfRaw.jkt === "string" && cnfRaw.jkt ? { jkt: cnfRaw.jkt } : null;
       if (cnf) {
-        if (!opts.dpop?.proof) throw new chunk2XMKZWC6_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
-        await chunk2XMKZWC6_cjs.verifyDpopProof(opts.dpop.proof, {
+        if (!opts.dpop?.proof) throw new chunkQFUIWC2Q_cjs.SsoError("ticket is DPoP-bound (cnf.jkt) but no DPoP proof was presented");
+        await chunkQFUIWC2Q_cjs.verifyDpopProof(opts.dpop.proof, {
           method: opts.dpop.method,
           url: opts.dpop.url,
           ticket: token,
@@ -113,11 +113,11 @@ function createTicketVerifier(options) {
           now
         });
       } else if (requireDpop) {
-        throw new chunk2XMKZWC6_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
+        throw new chunkQFUIWC2Q_cjs.SsoError(cnfRaw !== void 0 ? "ticket has a cnf without a string jkt \u2014 DPoP is required here" : "this receiver requires DPoP; the ticket is not bound (no cnf.jkt)");
       }
       const named = (v) => typeof v === "string" && v ? v : null;
       const clientId = type === "user" ? named(payload.client_id) ?? named(payload.azp) : named(payload.client_id) ?? payload.sub;
-      if (clientId === null) throw new chunk2XMKZWC6_cjs.SsoError("a user ticket names no app (no client_id or azp)");
+      if (clientId === null) throw new chunkQFUIWC2Q_cjs.SsoError("a user ticket names no app (no client_id or azp)");
       return {
         principal: payload.sub,
         type,
@@ -134,181 +134,181 @@ function createTicketVerifier(options) {
   };
 }
 function readActor(raw, depth) {
-  if (depth > MAX_ACT_DEPTH) throw new chunk2XMKZWC6_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
+  if (depth > MAX_ACT_DEPTH) throw new chunkQFUIWC2Q_cjs.SsoError(`ticket's delegation chain is deeper than ${MAX_ACT_DEPTH}`);
   const link = raw;
   if (!link || typeof link !== "object" || typeof link.sub !== "string" || link.sub === "") {
-    throw new chunk2XMKZWC6_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
+    throw new chunkQFUIWC2Q_cjs.SsoError(`ticket's act (link ${depth}) has no string sub`);
   }
   return link.act === void 0 ? { sub: link.sub } : { sub: link.sub, act: readActor(link.act, depth + 1) };
 }
 
 Object.defineProperty(exports, "AVATAR_TYPES", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.AVATAR_TYPES; }
+  get: function () { return chunkQFUIWC2Q_cjs.AVATAR_TYPES; }
 });
 Object.defineProperty(exports, "DEFAULT_ISSUER", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.DEFAULT_ISSUER; }
+  get: function () { return chunkQFUIWC2Q_cjs.DEFAULT_ISSUER; }
 });
 Object.defineProperty(exports, "DEFAULT_SESSION_MAX_AGE", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.DEFAULT_SESSION_MAX_AGE; }
+  get: function () { return chunkQFUIWC2Q_cjs.DEFAULT_SESSION_MAX_AGE; }
 });
 Object.defineProperty(exports, "EMBEDDED_FLOW_MAX_AGE", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.EMBEDDED_FLOW_MAX_AGE; }
+  get: function () { return chunkQFUIWC2Q_cjs.EMBEDDED_FLOW_MAX_AGE; }
 });
 Object.defineProperty(exports, "FLY_CLIENT_ASSERTION_TYPE", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.FLY_CLIENT_ASSERTION_TYPE; }
+  get: function () { return chunkQFUIWC2Q_cjs.FLY_CLIENT_ASSERTION_TYPE; }
 });
 Object.defineProperty(exports, "JwksError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.JwksError; }
+  get: function () { return chunkQFUIWC2Q_cjs.JwksError; }
 });
 Object.defineProperty(exports, "JwksUnavailableError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.JwksUnavailableError; }
+  get: function () { return chunkQFUIWC2Q_cjs.JwksUnavailableError; }
 });
 Object.defineProperty(exports, "JwksUnknownKeyError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.JwksUnknownKeyError; }
+  get: function () { return chunkQFUIWC2Q_cjs.JwksUnknownKeyError; }
 });
 Object.defineProperty(exports, "MAX_AVATAR_BYTES", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.MAX_AVATAR_BYTES; }
+  get: function () { return chunkQFUIWC2Q_cjs.MAX_AVATAR_BYTES; }
 });
 Object.defineProperty(exports, "MAX_INVITATIONS", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.MAX_INVITATIONS; }
+  get: function () { return chunkQFUIWC2Q_cjs.MAX_INVITATIONS; }
 });
 Object.defineProperty(exports, "NoWorkloadIdentityError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.NoWorkloadIdentityError; }
+  get: function () { return chunkQFUIWC2Q_cjs.NoWorkloadIdentityError; }
 });
 Object.defineProperty(exports, "SsoAppApiError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.SsoAppApiError; }
+  get: function () { return chunkQFUIWC2Q_cjs.SsoAppApiError; }
 });
 Object.defineProperty(exports, "SsoAvatarRejectedError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.SsoAvatarRejectedError; }
+  get: function () { return chunkQFUIWC2Q_cjs.SsoAvatarRejectedError; }
 });
 Object.defineProperty(exports, "SsoConfigError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.SsoConfigError; }
+  get: function () { return chunkQFUIWC2Q_cjs.SsoConfigError; }
 });
 Object.defineProperty(exports, "SsoError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.SsoError; }
+  get: function () { return chunkQFUIWC2Q_cjs.SsoError; }
 });
 Object.defineProperty(exports, "SsoInsufficientScopeError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.SsoInsufficientScopeError; }
+  get: function () { return chunkQFUIWC2Q_cjs.SsoInsufficientScopeError; }
 });
 Object.defineProperty(exports, "SsoIntrospectionUnavailableError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.SsoIntrospectionUnavailableError; }
+  get: function () { return chunkQFUIWC2Q_cjs.SsoIntrospectionUnavailableError; }
 });
 Object.defineProperty(exports, "SsoReauthError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.SsoReauthError; }
+  get: function () { return chunkQFUIWC2Q_cjs.SsoReauthError; }
 });
 Object.defineProperty(exports, "SsoTokenInactiveError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.SsoTokenInactiveError; }
+  get: function () { return chunkQFUIWC2Q_cjs.SsoTokenInactiveError; }
 });
 Object.defineProperty(exports, "TicketExchangeError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.TicketExchangeError; }
+  get: function () { return chunkQFUIWC2Q_cjs.TicketExchangeError; }
 });
 Object.defineProperty(exports, "TicketUnavailableError", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.TicketUnavailableError; }
+  get: function () { return chunkQFUIWC2Q_cjs.TicketUnavailableError; }
 });
 Object.defineProperty(exports, "accessTokenHash", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.accessTokenHash; }
+  get: function () { return chunkQFUIWC2Q_cjs.accessTokenHash; }
 });
 Object.defineProperty(exports, "cookieHeader", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.cookieHeader; }
+  get: function () { return chunkQFUIWC2Q_cjs.cookieHeader; }
 });
 Object.defineProperty(exports, "createDpopKey", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.createDpopKey; }
+  get: function () { return chunkQFUIWC2Q_cjs.createDpopKey; }
 });
 Object.defineProperty(exports, "createDpopProof", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.createDpopProof; }
+  get: function () { return chunkQFUIWC2Q_cjs.createDpopProof; }
 });
 Object.defineProperty(exports, "createJwksCache", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.createJwksCache; }
+  get: function () { return chunkQFUIWC2Q_cjs.createJwksCache; }
 });
 Object.defineProperty(exports, "createMemoryReplayStore", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.createMemoryReplayStore; }
+  get: function () { return chunkQFUIWC2Q_cjs.createMemoryReplayStore; }
 });
 Object.defineProperty(exports, "createSsoClient", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.createSsoClient; }
+  get: function () { return chunkQFUIWC2Q_cjs.createSsoClient; }
 });
 Object.defineProperty(exports, "createTicketClient", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.createTicketClient; }
+  get: function () { return chunkQFUIWC2Q_cjs.createTicketClient; }
 });
 Object.defineProperty(exports, "exchangeUserToken", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.exchangeUserToken; }
+  get: function () { return chunkQFUIWC2Q_cjs.exchangeUserToken; }
 });
 Object.defineProperty(exports, "fetchTicket", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.fetchTicket; }
+  get: function () { return chunkQFUIWC2Q_cjs.fetchTicket; }
 });
 Object.defineProperty(exports, "loadSsoConfig", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.loadSsoConfig; }
+  get: function () { return chunkQFUIWC2Q_cjs.loadSsoConfig; }
 });
 Object.defineProperty(exports, "memoryTokenStore", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.memoryTokenStore; }
+  get: function () { return chunkQFUIWC2Q_cjs.memoryTokenStore; }
 });
 Object.defineProperty(exports, "normalizeHtu", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.normalizeHtu; }
+  get: function () { return chunkQFUIWC2Q_cjs.normalizeHtu; }
 });
 Object.defineProperty(exports, "openEmbeddedFlow", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.openEmbeddedFlow; }
+  get: function () { return chunkQFUIWC2Q_cjs.openEmbeddedFlow; }
 });
 Object.defineProperty(exports, "readCookie", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.readCookie; }
+  get: function () { return chunkQFUIWC2Q_cjs.readCookie; }
 });
 Object.defineProperty(exports, "sealEmbeddedFlow", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.sealEmbeddedFlow; }
+  get: function () { return chunkQFUIWC2Q_cjs.sealEmbeddedFlow; }
 });
 Object.defineProperty(exports, "signSession", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.signSession; }
+  get: function () { return chunkQFUIWC2Q_cjs.signSession; }
 });
 Object.defineProperty(exports, "signValue", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.signValue; }
+  get: function () { return chunkQFUIWC2Q_cjs.signValue; }
 });
 Object.defineProperty(exports, "verifyDpopProof", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.verifyDpopProof; }
+  get: function () { return chunkQFUIWC2Q_cjs.verifyDpopProof; }
 });
 Object.defineProperty(exports, "verifySession", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.verifySession; }
+  get: function () { return chunkQFUIWC2Q_cjs.verifySession; }
 });
 Object.defineProperty(exports, "verifyValue", {
   enumerable: true,
-  get: function () { return chunk2XMKZWC6_cjs.verifyValue; }
+  get: function () { return chunkQFUIWC2Q_cjs.verifyValue; }
 });
 exports.MAX_ACT_DEPTH = MAX_ACT_DEPTH;
 exports.TICKET_FORMAT_VERSION = TICKET_FORMAT_VERSION;

package/dist/index.d.cts

@@ -134,7 +134,7 @@ interface ExchangeUserTokenOptions {
     issuer?: string;
     /** The app that holds the user's token — it must be the token's own client (BID refuses otherwise). */
     clientId: string;
-    /** A confidential app proves itself with its secret (Basic). A public app (an extension) omits it. */
+    /** A confidential app proves itself with its secret (in the form body, client_secret_post). A public app (an extension) omits it. */
     clientSecret?: string;
     /** The user's BID access token. Never logged, never in an error. */
     subjectToken: string;

package/dist/index.d.ts

@@ -134,7 +134,7 @@ interface ExchangeUserTokenOptions {
     issuer?: string;
     /** The app that holds the user's token — it must be the token's own client (BID refuses otherwise). */
     clientId: string;
-    /** A confidential app proves itself with its secret (Basic). A public app (an extension) omits it. */
+    /** A confidential app proves itself with its secret (in the form body, client_secret_post). A public app (an extension) omits it. */
     clientSecret?: string;
     /** The user's BID access token. Never logged, never in an error. */
     subjectToken: string;

package/dist/index.js

@@ -1,5 +1,5 @@
-import { createMemoryReplayStore, SsoError, ALLOWED_ALGS, JwksUnavailableError, verifyDpopProof, createJwksCache } from './chunk-UDUPP35Z.js';
-export { AVATAR_TYPES, DEFAULT_ISSUER, DEFAULT_SESSION_MAX_AGE, EMBEDDED_FLOW_MAX_AGE, FLY_CLIENT_ASSERTION_TYPE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, NoWorkloadIdentityError, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoIntrospectionUnavailableError, SsoReauthError, SsoTokenInactiveError, TicketExchangeError, TicketUnavailableError, accessTokenHash, cookieHeader, createDpopKey, createDpopProof, createJwksCache, createMemoryReplayStore, createSsoClient, createTicketClient, exchangeUserToken, fetchTicket, loadSsoConfig, memoryTokenStore, normalizeHtu, openEmbeddedFlow, readCookie, sealEmbeddedFlow, signSession, signValue, verifyDpopProof, verifySession, verifyValue } from './chunk-UDUPP35Z.js';
+import { createMemoryReplayStore, SsoError, ALLOWED_ALGS, JwksUnavailableError, verifyDpopProof, createJwksCache } from './chunk-NIYOPNRE.js';
+export { AVATAR_TYPES, DEFAULT_ISSUER, DEFAULT_SESSION_MAX_AGE, EMBEDDED_FLOW_MAX_AGE, FLY_CLIENT_ASSERTION_TYPE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, NoWorkloadIdentityError, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoIntrospectionUnavailableError, SsoReauthError, SsoTokenInactiveError, TicketExchangeError, TicketUnavailableError, accessTokenHash, cookieHeader, createDpopKey, createDpopProof, createJwksCache, createMemoryReplayStore, createSsoClient, createTicketClient, exchangeUserToken, fetchTicket, loadSsoConfig, memoryTokenStore, normalizeHtu, openEmbeddedFlow, readCookie, sealEmbeddedFlow, signSession, signValue, verifyDpopProof, verifySession, verifyValue } from './chunk-NIYOPNRE.js';
 import { decodeProtectedHeader, jwtVerify } from 'jose';
 
 var PRINCIPAL_TYPES = ["human", "service", "agent", "user"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@broberg/sso",
-  "version": "0.21.0",
+  "version": "0.21.2",
   "description": "The thin client for BrobergID — send a user to central login, verify the ID token against JWKS, keep a local session. Public client + PKCE only: no passwords, no passkeys, no client secret can live in an app.",
   "type": "module",
   "license": "MIT",