@broberg/sso 0.8.0 → 0.10.0

package/dist/index.d.cts

@@ -201,6 +201,55 @@ interface Discovery {
 declare class SsoError extends Error {
     constructor(message: string);
 }
+/**
+ * F095.2 — the user must log in again: there is no live session, no stored
+ * tokens, or the renewal was refused. `reason` says which; "no_session" means
+ * there never was a login to recover, the others mean there was one and it is
+ * spent. Thrown by getAccessToken.
+ */
+declare class SsoReauthError extends SsoError {
+    readonly reason: "no_session" | "no_tokens" | "expired" | "refresh_failed";
+    constructor(message: string, reason: "no_session" | "no_tokens" | "expired" | "refresh_failed");
+}
+/**
+ * F095.2 — BID's app API answered with an error, or did not answer at all.
+ * `status` is BID's HTTP status (null when nothing came back: timeout, network);
+ * `code` is BID's own `error` field when it sent one. The message carries the
+ * URL, the status and the code — never the body, never a token.
+ */
+declare class SsoAppApiError extends SsoError {
+    readonly status: number | null;
+    readonly code: string | undefined;
+    constructor(message: string, status: number | null, code: string | undefined);
+}
+/**
+ * F095.2 — BID refused because the user's token lacks a scope (403
+ * insufficient_scope). For the profile writes that is `profile:write`: the app
+ * must request it at login, and a user who logged in before it did must log in
+ * again. That is the one actionable fact, so it gets its own class.
+ */
+declare class SsoInsufficientScopeError extends SsoAppApiError {
+    readonly scope: string;
+    constructor(message: string, scope: string);
+}
+/** F095.2 — an avatar refused BEFORE it was sent: too big, or not PNG/JPEG/WebP. */
+declare class SsoAvatarRejectedError extends SsoError {
+    readonly reason: "too_large" | "unsupported_type";
+    constructor(message: string, reason: "too_large" | "unsupported_type");
+}
+/** BID's limit for a profile picture (llms.txt step 7a: "max 2 MB", read as 2 MiB). */
+declare const MAX_AVATAR_BYTES: number;
+/** The picture types BID accepts. */
+declare const AVATAR_TYPES: readonly string[];
+/** The signed-in user's own profile, as BID's GET /api/app/profile returns it. */
+interface BidProfile {
+    sub: string;
+    name: string | null;
+    picture: string | null;
+    email: string | null;
+    /** BID's own account page — mail, password, passkeys, 2FA and sessions live there. */
+    account_url: string;
+}
 /**
  * What `beginLogin` produces. Every field except `url` must survive the round
  * trip to BID and back — the adapter stores them in a short-lived cookie.
@@ -239,6 +288,8 @@ interface LoginResult {
     idToken: string;
     accessToken?: string;
     refreshToken?: string;
+    /** Seconds the access token lives, when BID said so (`expires_in`). */
+    expiresIn?: number;
 }
 /**
  * `prompt=none` asks BID to answer WITHOUT showing anything (components-F084.6).
@@ -278,6 +329,16 @@ interface SsoClient {
      * answers — see the implementation for why that must never become "unverified".
      */
     addressOwnership(accessToken: string, address: string): Promise<AddressOwnership>;
+    /**
+     * F095.1 — trade a refresh token for a new access token (`grant_type=refresh_token`).
+     * Throws SsoError on refusal; the message carries the status and BID's error
+     * code, never a token.
+     */
+    refreshTokens(refreshToken: string): Promise<{
+        accessToken: string;
+        refreshToken?: string;
+        expiresIn?: number;
+    }>;
     /**
      * Invite users to BID on behalf of this app (the app's OWN key, `bidk_…`).
      * One result per email. Throws SsoError on anything BID did not clearly say.
@@ -294,6 +355,21 @@ interface SsoClient {
      * Throws SsoError on anything that is not a valid, sub-only logout token.
      */
     verifyLogoutToken(token: string): Promise<LogoutToken>;
+    /**
+     * F095.2 — the signed-in user's own profile (scope `profile`), with the user's
+     * access token. Throws SsoAppApiError on any refusal.
+     */
+    getProfile(accessToken: string): Promise<BidProfile>;
+    /** F095.2 — change the user's own name (scope `profile:write`). Returns the new profile. */
+    updateProfile(accessToken: string, name: string): Promise<BidProfile>;
+    /**
+     * F095.2 — replace the user's picture (scope `profile:write`). Refuses more than
+     * MAX_AVATAR_BYTES or a type outside AVATAR_TYPES with SsoAvatarRejectedError
+     * BEFORE anything is sent.
+     */
+    uploadAvatar(accessToken: string, bytes: Uint8Array | ArrayBuffer, contentType: string): Promise<BidProfile>;
+    /** F095.2 — remove the user's picture (scope `profile:write`). */
+    removeAvatar(accessToken: string): Promise<BidProfile>;
     /** Exposed for tests and for a health check; not needed in normal use. */
     readonly jwks: JwksCache;
 }
@@ -371,6 +447,12 @@ interface SessionPayload {
      * older than any logout.
      */
     iat?: number;
+    /**
+     * F095.1 — the key to this session's server-side tokens (ssoRoutes'
+     * `tokenStore`). Random, 128 bits. The tokens themselves are NEVER in the
+     * cookie: it is signed, not encrypted, and the browser can read it.
+     */
+    sid?: string;
     /** Optional convenience copies; never authorisation data. */
     email?: string;
     name?: string;
@@ -449,4 +531,50 @@ declare function cookieHeader(name: string, value: string, opts: {
 }): string;
 declare function readCookie(header: string | null | undefined, name: string): string | undefined;
 
-export { type AddressOwnership, type BeginLoginOptions, type CreateSsoClientOptions, DEFAULT_SESSION_MAX_AGE, type Discovery, type InvitationOutcome, type InvitationResult, type InviteUsersInput, type JwksCache, type JwksCacheOptions, JwksError, JwksUnavailableError, JwksUnknownKeyError, type LoginResult, type LoginStart, type LogoutToken, MAX_INVITATIONS, type MigrationState, type MigrationStatus, type SessionPayload, type SsoClaims, type SsoClient, type SsoConfig, SsoConfigError, SsoError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, readCookie, signSession, signValue, verifySession, verifyValue };
+/**
+ * Server-side tokens for calling Broberg ID on the user's behalf (F095.1).
+ *
+ * The login already RECEIVES an access token and a refresh token; before 0.9.0
+ * ssoRoutes dropped both, so an app could not call BID's app API (the account
+ * page: read and change your own name and picture) as the user.
+ *
+ * ── WHY NOT IN THE COOKIE ────────────────────────────────────────────────
+ * The session cookie is SIGNED, not encrypted, and the browser can read it. A
+ * refresh token is the longest-lived, highest-value credential in the whole
+ * flow: whoever holds it can mint access tokens until it is revoked. So the
+ * tokens live server-side, keyed by a random `sid` that is the only thing the
+ * cookie carries. A stolen cookie still needs the server to be useful.
+ */
+interface TokenSet {
+    /** The BID subject the tokens belong to — lets «Log ud overalt» find them. */
+    sub: string;
+    accessToken: string;
+    refreshToken?: string;
+    /** Unix seconds. */
+    expiresAt: number;
+}
+/**
+ * Where the tokens live. The APP provides it in production, backed by
+ * something every instance shares (SQLite on one machine, a database or Redis
+ * on several) — the same reason BackchannelStore has no in-memory default.
+ */
+interface TokenStore {
+    get(sid: string): Promise<TokenSet | undefined>;
+    set(sid: string, tokens: TokenSet): Promise<void>;
+    delete(sid: string): Promise<void>;
+    /** Drop every token set for `sub` — what «Log ud overalt» calls. */
+    deleteSub(sub: string): Promise<void>;
+}
+/**
+ * An in-process TokenStore. Fine for tests and a single dev process. In
+ * production it LOSES every user's tokens on a restart (they must log in again
+ * before the account page works) and is not shared between machines — so it
+ * says so, once, when created.
+ */
+declare function memoryTokenStore(options?: {
+    quiet?: boolean;
+}): TokenStore & {
+    readonly size: number;
+};
+
+export { AVATAR_TYPES, type AddressOwnership, type BeginLoginOptions, type BidProfile, type CreateSsoClientOptions, DEFAULT_SESSION_MAX_AGE, type Discovery, type InvitationOutcome, type InvitationResult, type InviteUsersInput, type JwksCache, type JwksCacheOptions, JwksError, JwksUnavailableError, JwksUnknownKeyError, type LoginResult, type LoginStart, type LogoutToken, MAX_AVATAR_BYTES, MAX_INVITATIONS, type MigrationState, type MigrationStatus, type SessionPayload, SsoAppApiError, SsoAvatarRejectedError, type SsoClaims, type SsoClient, type SsoConfig, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoReauthError, type TokenSet, type TokenStore, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue };

package/dist/index.d.ts

@@ -201,6 +201,55 @@ interface Discovery {
 declare class SsoError extends Error {
     constructor(message: string);
 }
+/**
+ * F095.2 — the user must log in again: there is no live session, no stored
+ * tokens, or the renewal was refused. `reason` says which; "no_session" means
+ * there never was a login to recover, the others mean there was one and it is
+ * spent. Thrown by getAccessToken.
+ */
+declare class SsoReauthError extends SsoError {
+    readonly reason: "no_session" | "no_tokens" | "expired" | "refresh_failed";
+    constructor(message: string, reason: "no_session" | "no_tokens" | "expired" | "refresh_failed");
+}
+/**
+ * F095.2 — BID's app API answered with an error, or did not answer at all.
+ * `status` is BID's HTTP status (null when nothing came back: timeout, network);
+ * `code` is BID's own `error` field when it sent one. The message carries the
+ * URL, the status and the code — never the body, never a token.
+ */
+declare class SsoAppApiError extends SsoError {
+    readonly status: number | null;
+    readonly code: string | undefined;
+    constructor(message: string, status: number | null, code: string | undefined);
+}
+/**
+ * F095.2 — BID refused because the user's token lacks a scope (403
+ * insufficient_scope). For the profile writes that is `profile:write`: the app
+ * must request it at login, and a user who logged in before it did must log in
+ * again. That is the one actionable fact, so it gets its own class.
+ */
+declare class SsoInsufficientScopeError extends SsoAppApiError {
+    readonly scope: string;
+    constructor(message: string, scope: string);
+}
+/** F095.2 — an avatar refused BEFORE it was sent: too big, or not PNG/JPEG/WebP. */
+declare class SsoAvatarRejectedError extends SsoError {
+    readonly reason: "too_large" | "unsupported_type";
+    constructor(message: string, reason: "too_large" | "unsupported_type");
+}
+/** BID's limit for a profile picture (llms.txt step 7a: "max 2 MB", read as 2 MiB). */
+declare const MAX_AVATAR_BYTES: number;
+/** The picture types BID accepts. */
+declare const AVATAR_TYPES: readonly string[];
+/** The signed-in user's own profile, as BID's GET /api/app/profile returns it. */
+interface BidProfile {
+    sub: string;
+    name: string | null;
+    picture: string | null;
+    email: string | null;
+    /** BID's own account page — mail, password, passkeys, 2FA and sessions live there. */
+    account_url: string;
+}
 /**
  * What `beginLogin` produces. Every field except `url` must survive the round
  * trip to BID and back — the adapter stores them in a short-lived cookie.
@@ -239,6 +288,8 @@ interface LoginResult {
     idToken: string;
     accessToken?: string;
     refreshToken?: string;
+    /** Seconds the access token lives, when BID said so (`expires_in`). */
+    expiresIn?: number;
 }
 /**
  * `prompt=none` asks BID to answer WITHOUT showing anything (components-F084.6).
@@ -278,6 +329,16 @@ interface SsoClient {
      * answers — see the implementation for why that must never become "unverified".
      */
     addressOwnership(accessToken: string, address: string): Promise<AddressOwnership>;
+    /**
+     * F095.1 — trade a refresh token for a new access token (`grant_type=refresh_token`).
+     * Throws SsoError on refusal; the message carries the status and BID's error
+     * code, never a token.
+     */
+    refreshTokens(refreshToken: string): Promise<{
+        accessToken: string;
+        refreshToken?: string;
+        expiresIn?: number;
+    }>;
     /**
      * Invite users to BID on behalf of this app (the app's OWN key, `bidk_…`).
      * One result per email. Throws SsoError on anything BID did not clearly say.
@@ -294,6 +355,21 @@ interface SsoClient {
      * Throws SsoError on anything that is not a valid, sub-only logout token.
      */
     verifyLogoutToken(token: string): Promise<LogoutToken>;
+    /**
+     * F095.2 — the signed-in user's own profile (scope `profile`), with the user's
+     * access token. Throws SsoAppApiError on any refusal.
+     */
+    getProfile(accessToken: string): Promise<BidProfile>;
+    /** F095.2 — change the user's own name (scope `profile:write`). Returns the new profile. */
+    updateProfile(accessToken: string, name: string): Promise<BidProfile>;
+    /**
+     * F095.2 — replace the user's picture (scope `profile:write`). Refuses more than
+     * MAX_AVATAR_BYTES or a type outside AVATAR_TYPES with SsoAvatarRejectedError
+     * BEFORE anything is sent.
+     */
+    uploadAvatar(accessToken: string, bytes: Uint8Array | ArrayBuffer, contentType: string): Promise<BidProfile>;
+    /** F095.2 — remove the user's picture (scope `profile:write`). */
+    removeAvatar(accessToken: string): Promise<BidProfile>;
     /** Exposed for tests and for a health check; not needed in normal use. */
     readonly jwks: JwksCache;
 }
@@ -371,6 +447,12 @@ interface SessionPayload {
      * older than any logout.
      */
     iat?: number;
+    /**
+     * F095.1 — the key to this session's server-side tokens (ssoRoutes'
+     * `tokenStore`). Random, 128 bits. The tokens themselves are NEVER in the
+     * cookie: it is signed, not encrypted, and the browser can read it.
+     */
+    sid?: string;
     /** Optional convenience copies; never authorisation data. */
     email?: string;
     name?: string;
@@ -449,4 +531,50 @@ declare function cookieHeader(name: string, value: string, opts: {
 }): string;
 declare function readCookie(header: string | null | undefined, name: string): string | undefined;
 
-export { type AddressOwnership, type BeginLoginOptions, type CreateSsoClientOptions, DEFAULT_SESSION_MAX_AGE, type Discovery, type InvitationOutcome, type InvitationResult, type InviteUsersInput, type JwksCache, type JwksCacheOptions, JwksError, JwksUnavailableError, JwksUnknownKeyError, type LoginResult, type LoginStart, type LogoutToken, MAX_INVITATIONS, type MigrationState, type MigrationStatus, type SessionPayload, type SsoClaims, type SsoClient, type SsoConfig, SsoConfigError, SsoError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, readCookie, signSession, signValue, verifySession, verifyValue };
+/**
+ * Server-side tokens for calling Broberg ID on the user's behalf (F095.1).
+ *
+ * The login already RECEIVES an access token and a refresh token; before 0.9.0
+ * ssoRoutes dropped both, so an app could not call BID's app API (the account
+ * page: read and change your own name and picture) as the user.
+ *
+ * ── WHY NOT IN THE COOKIE ────────────────────────────────────────────────
+ * The session cookie is SIGNED, not encrypted, and the browser can read it. A
+ * refresh token is the longest-lived, highest-value credential in the whole
+ * flow: whoever holds it can mint access tokens until it is revoked. So the
+ * tokens live server-side, keyed by a random `sid` that is the only thing the
+ * cookie carries. A stolen cookie still needs the server to be useful.
+ */
+interface TokenSet {
+    /** The BID subject the tokens belong to — lets «Log ud overalt» find them. */
+    sub: string;
+    accessToken: string;
+    refreshToken?: string;
+    /** Unix seconds. */
+    expiresAt: number;
+}
+/**
+ * Where the tokens live. The APP provides it in production, backed by
+ * something every instance shares (SQLite on one machine, a database or Redis
+ * on several) — the same reason BackchannelStore has no in-memory default.
+ */
+interface TokenStore {
+    get(sid: string): Promise<TokenSet | undefined>;
+    set(sid: string, tokens: TokenSet): Promise<void>;
+    delete(sid: string): Promise<void>;
+    /** Drop every token set for `sub` — what «Log ud overalt» calls. */
+    deleteSub(sub: string): Promise<void>;
+}
+/**
+ * An in-process TokenStore. Fine for tests and a single dev process. In
+ * production it LOSES every user's tokens on a restart (they must log in again
+ * before the account page works) and is not shared between machines — so it
+ * says so, once, when created.
+ */
+declare function memoryTokenStore(options?: {
+    quiet?: boolean;
+}): TokenStore & {
+    readonly size: number;
+};
+
+export { AVATAR_TYPES, type AddressOwnership, type BeginLoginOptions, type BidProfile, type CreateSsoClientOptions, DEFAULT_SESSION_MAX_AGE, type Discovery, type InvitationOutcome, type InvitationResult, type InviteUsersInput, type JwksCache, type JwksCacheOptions, JwksError, JwksUnavailableError, JwksUnknownKeyError, type LoginResult, type LoginStart, type LogoutToken, MAX_AVATAR_BYTES, MAX_INVITATIONS, type MigrationState, type MigrationStatus, type SessionPayload, SsoAppApiError, SsoAvatarRejectedError, type SsoClaims, type SsoClient, type SsoConfig, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoReauthError, type TokenSet, type TokenStore, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue };

package/dist/index.js

@@ -171,6 +171,45 @@ var SsoError = class extends Error {
     this.name = "SsoError";
   }
 };
+var SsoReauthError = class extends SsoError {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "SsoReauthError";
+  }
+  reason;
+};
+var SsoAppApiError = class extends SsoError {
+  constructor(message, status, code) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "SsoAppApiError";
+  }
+  status;
+  code;
+};
+var SsoInsufficientScopeError = class extends SsoAppApiError {
+  constructor(message, scope) {
+    super(message, 403, "insufficient_scope");
+    this.scope = scope;
+    this.name = "SsoInsufficientScopeError";
+  }
+  scope;
+};
+var SsoAvatarRejectedError = class extends SsoError {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "SsoAvatarRejectedError";
+  }
+  reason;
+};
+var MAX_AVATAR_BYTES = 2 * 1024 * 1024;
+var AVATAR_TYPES = ["image/png", "image/jpeg", "image/webp"];
+function mediaType(contentType) {
+  return (contentType ?? "").split(";")[0].trim().toLowerCase();
+}
 var b64url = (bytes) => {
   const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
   let s = "";
@@ -262,6 +301,68 @@ function createSsoClient(config, options = {}) {
       clearTimeout(timer);
     }
   }
+  async function appRequest(path, bearer, init, what) {
+    const url = new URL(path, config.issuer).toString();
+    const ctrl = new AbortController();
+    let timer;
+    const timedOut = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        reject(new SsoAppApiError(`${url} did not answer within ${timeoutMs} ms \u2014 ${what} is unknown.`, null, void 0));
+        ctrl.abort();
+      }, timeoutMs);
+    });
+    const headers = { authorization: `Bearer ${bearer}` };
+    let body;
+    if (init.json !== void 0) {
+      headers["content-type"] = "application/json";
+      body = JSON.stringify(init.json);
+    } else if (init.bytes !== void 0) {
+      headers["content-type"] = init.contentType ?? "application/octet-stream";
+      body = init.bytes;
+    }
+    try {
+      const res = await Promise.race([
+        fetchImpl(url, { method: init.method, headers, ...body !== void 0 ? { body } : {}, signal: ctrl.signal }),
+        timedOut
+      ]);
+      const raw = await Promise.race([res.text(), timedOut]);
+      let parsed;
+      try {
+        parsed = raw.trim() === "" ? void 0 : JSON.parse(raw);
+      } catch {
+        parsed = void 0;
+      }
+      const fields = parsed && typeof parsed === "object" ? parsed : {};
+      const code = typeof fields.error === "string" ? fields.error : void 0;
+      if (!res.ok) {
+        if (res.status === 403 && code === "insufficient_scope") {
+          const scope = typeof fields.scope === "string" && fields.scope ? fields.scope : init.method === "GET" ? "profile" : "profile:write";
+          throw new SsoInsufficientScopeError(
+            `${url} answered 403 insufficient_scope \u2014 the user's token lacks scope "${scope}"; log in again with it requested.`,
+            scope
+          );
+        }
+        throw new SsoAppApiError(`${url} answered ${res.status}${code ? ` (${code})` : ""} \u2014 ${what} is unknown.`, res.status, code);
+      }
+      if (parsed === void 0) {
+        throw new SsoAppApiError(`${url} answered ${res.status} with a body that is not JSON \u2014 ${what} is unknown.`, res.status, void 0);
+      }
+      return parsed;
+    } catch (e) {
+      if (e instanceof SsoError) throw e;
+      throw new SsoAppApiError(`${url} could not be reached (${e instanceof Error ? e.name : "error"}) \u2014 ${what} is unknown.`, null, void 0);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  function asProfile(body, path) {
+    const b = body ?? {};
+    if (typeof b.sub !== "string" || b.sub === "" || typeof b.account_url !== "string") {
+      throw new SsoAppApiError(`${path} returned no "sub" or "account_url" \u2014 the profile is unknown.`, 200, void 0);
+    }
+    const opt = (v) => typeof v === "string" ? v : null;
+    return { sub: b.sub, name: opt(b.name), picture: opt(b.picture), email: opt(b.email), account_url: b.account_url };
+  }
   let discoveryPromise = null;
   let jwksCache = null;
   async function discovery() {
@@ -445,7 +546,36 @@ function createSsoClient(config, options = {}) {
         unverifiedClaims: merged.unverifiedClaims,
         idToken: body.id_token,
         ...body.access_token ? { accessToken: body.access_token } : {},
-        ...body.refresh_token ? { refreshToken: body.refresh_token } : {}
+        ...body.refresh_token ? { refreshToken: body.refresh_token } : {},
+        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
+      };
+    },
+    async refreshTokens(refreshToken) {
+      const { token_endpoint } = await discovery();
+      const res = await fetchImpl(token_endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: config.clientId,
+          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
+        })
+      });
+      const raw = await res.text();
+      let body;
+      try {
+        body = raw.trim() === "" ? {} : JSON.parse(raw);
+      } catch {
+        throw new SsoError(`token refresh failed (${res.status}): the response body is not JSON`);
+      }
+      if (!res.ok || typeof body.access_token !== "string" || body.access_token === "") {
+        throw new SsoError(`token refresh failed (${res.status}): ${body.error ?? "no access_token in response"}`);
+      }
+      return {
+        accessToken: body.access_token,
+        ...typeof body.refresh_token === "string" && body.refresh_token ? { refreshToken: body.refresh_token } : {},
+        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
       };
     },
     async logoutUrl(opts = {}) {
@@ -476,6 +606,35 @@ function createSsoClient(config, options = {}) {
       return status;
     },
     verifyLogoutToken,
+    async getProfile(accessToken) {
+      const path = "/api/app/profile";
+      return asProfile(await appRequest(path, accessToken, { method: "GET" }, "the profile"), path);
+    },
+    async updateProfile(accessToken, name) {
+      const path = "/api/app/profile";
+      return asProfile(await appRequest(path, accessToken, { method: "POST", json: { name } }, "the new name"), path);
+    },
+    async uploadAvatar(accessToken, bytes, contentType) {
+      const type = mediaType(contentType);
+      if (!AVATAR_TYPES.includes(type)) {
+        throw new SsoAvatarRejectedError(
+          `uploadAvatar: "${type}" is not accepted \u2014 BID takes ${AVATAR_TYPES.join(", ")}.`,
+          "unsupported_type"
+        );
+      }
+      if (bytes.byteLength > MAX_AVATAR_BYTES) {
+        throw new SsoAvatarRejectedError(
+          `uploadAvatar: ${bytes.byteLength} bytes \u2014 BID takes at most ${MAX_AVATAR_BYTES}.`,
+          "too_large"
+        );
+      }
+      const path = "/api/app/profile/avatar";
+      return asProfile(await appRequest(path, accessToken, { method: "POST", bytes, contentType: type }, "the new picture"), path);
+    },
+    async removeAvatar(accessToken) {
+      const path = "/api/app/profile/avatar/remove";
+      return asProfile(await appRequest(path, accessToken, { method: "POST" }, "the removed picture"), path);
+    },
     async inviteUsers(appKey, input) {
       if (input.users.length > MAX_INVITATIONS) {
         throw new SsoError(`inviteUsers: ${input.users.length} users, BID accepts at most ${MAX_INVITATIONS} per call.`);
@@ -596,6 +755,35 @@ function readCookie(header, name) {
   return void 0;
 }
 
-export { DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_INVITATIONS, SsoConfigError, SsoError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, readCookie, signSession, signValue, verifySession, verifyValue };
+// src/tokens.ts
+var warned = false;
+function memoryTokenStore(options = {}) {
+  if (!options.quiet && !warned) {
+    warned = true;
+    console.warn(
+      "@broberg/sso: memoryTokenStore() keeps tokens in this process only \u2014 they are lost on restart and not shared between instances. Give ssoRoutes a TokenStore backed by your database in production."
+    );
+  }
+  const rows = /* @__PURE__ */ new Map();
+  return {
+    get size() {
+      return rows.size;
+    },
+    async get(sid) {
+      return rows.get(sid);
+    },
+    async set(sid, tokens) {
+      rows.set(sid, { ...tokens });
+    },
+    async delete(sid) {
+      rows.delete(sid);
+    },
+    async deleteSub(sub) {
+      for (const [sid, t] of rows) if (t.sub === sub) rows.delete(sid);
+    }
+  };
+}
+
+export { AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoReauthError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map