@adonis-agora/authkit-server 1.0.0-rc.1 → 1.0.0-rc.3

package/build/src/service_tenants/provider_hooks.js

@@ -0,0 +1,124 @@
+import { errors } from 'oidc-provider';
+import { serviceTenantOf } from './client_metadata.js';
+import { findServiceTenantResource } from './config.js';
+/**
+ * The provider hooks behind service tenants:
+ *
+ * - a service-tenant resource is granted only to a service-tenant client, only on the
+ *   `client_credentials` grant, always as a JWT access token (RFC 9068);
+ * - a service-tenant client can only get tokens for a service-tenant resource (when
+ *   it sends no `resource` and exactly one is declared, that one is used);
+ * - its tokens carry the `partition` (and `capabilities`) claims read from the client
+ *   at issuance time, so an edit applies to the next token.
+ */
+export function createServiceTenantHooks(deps) {
+    const { serviceTenants } = deps;
+    const memo = new WeakMap();
+    let adapter;
+    const read = async (clientId) => {
+        adapter ??= new deps.AdapterClass('Client');
+        return serviceTenantOf((await adapter.find(clientId)));
+    };
+    /** Service-tenant info of the client, memoized per request. */
+    const tenantOf = (ctx, clientId) => {
+        if (!clientId)
+            return Promise.resolve(null);
+        const key = ctx && typeof ctx === 'object' ? ctx : null;
+        if (!key)
+            return read(clientId);
+        let byClient = memo.get(key);
+        if (!byClient) {
+            byClient = new Map();
+            memo.set(key, byClient);
+        }
+        let pending = byClient.get(clientId);
+        if (!pending) {
+            pending = read(clientId);
+            byClient.set(clientId, pending);
+        }
+        return pending;
+    };
+    return {
+        enabled: serviceTenants.enabled,
+        /**
+         * `defaultResource` for a service-tenant client: the only declared resource, or
+         * `invalid_target` when several are declared. `undefined` for any other client.
+         */
+        async defaultResource(ctx, client) {
+            if (!serviceTenants.enabled)
+                return undefined;
+            if (!(await tenantOf(ctx, client?.clientId)))
+                return undefined;
+            const keys = Object.keys(serviceTenants.resources);
+            if (keys.length === 1)
+                return keys[0];
+            throw new errors.InvalidTarget('a service tenant must send the resource parameter');
+        },
+        /**
+         * `getResourceServerInfo` for service tenants. Returns the info for a
+         * service-tenant resource, `undefined` when neither the resource nor the client is
+         * a service-tenant one (the caller handles it), and throws `invalid_target` for a
+         * mismatch.
+         */
+        async resourceServerInfo(ctx, indicator, client, signAlg) {
+            if (!serviceTenants.enabled)
+                return undefined;
+            const found = findServiceTenantResource(serviceTenants, indicator);
+            const tenant = await tenantOf(ctx, client?.clientId);
+            if (found) {
+                const grantType = ctx?.oidc?.params?.grant_type;
+                if (!tenant || grantType !== 'client_credentials') {
+                    throw new errors.InvalidTarget(`resource indicator not allowed: ${indicator}`);
+                }
+                return {
+                    scope: found.resource.scopes.join(' '),
+                    audience: found.resource.audience,
+                    accessTokenFormat: 'jwt',
+                    accessTokenTTL: found.resource.expiresIn,
+                    jwt: { sign: { alg: signAlg } },
+                };
+            }
+            if (tenant) {
+                throw new errors.InvalidTarget(`resource indicator not allowed for a service tenant: ${indicator}`);
+            }
+            return undefined;
+        },
+        /** `extraTokenClaims` for a service-tenant token; audits the issuance. */
+        async extraClaims(ctx, token) {
+            if (!serviceTenants.enabled || token?.kind !== 'ClientCredentials')
+                return undefined;
+            const rs = token.resourceServer;
+            const indicator = typeof rs?.identifier === 'function' ? rs.identifier() : undefined;
+            if (typeof indicator !== 'string')
+                return undefined;
+            const found = findServiceTenantResource(serviceTenants, indicator);
+            if (!found)
+                return undefined;
+            const tenant = await tenantOf(ctx, token.clientId);
+            if (!tenant)
+                return undefined;
+            try {
+                await deps.audit
+                    ?.record({
+                    type: 'service_tenant.token_issued',
+                    clientId: token.clientId,
+                    ip: typeof ctx?.ip === 'string' ? ctx.ip : null,
+                    metadata: {
+                        partition: tenant.partition,
+                        resource: found.key,
+                        jti: token.jti,
+                        expiresIn: found.resource.expiresIn,
+                    },
+                })
+                    .catch(() => { });
+            }
+            catch {
+                // Auditing is best-effort: it never fails an issuance.
+            }
+            return {
+                partition: tenant.partition,
+                ...(tenant.capabilities.length ? { capabilities: tenant.capabilities } : {}),
+            };
+        },
+    };
+}

package/build/src/service_tenants/tenant_verifier.d.ts

@@ -0,0 +1,73 @@
+import type { ResolvedServiceTenantsConfig } from './config.js';
+/**
+ * What a verified tenant token authenticates as. Same shape as `VerifiedTenant` in
+ * `@adonis-agora/durable` (declared here: authkit never imports durable).
+ */
+export interface VerifiedTenant {
+    tenant: string;
+    capabilities?: string[] | undefined;
+}
+/** The input a control plane hands to its tenant verifier. */
+export interface TenantVerifierInput {
+    /** The token the tenant presented. */
+    token?: string | undefined;
+    /** The tenant the request claims to be. Advisory only: the token decides. */
+    tenant?: string | undefined;
+}
+/** The issuer the verifier checks against: the local authkit server. */
+export interface TenantTokenIssuer {
+    readonly publicJwks: {
+        keys: Record<string, any>[];
+    };
+    readonly config: {
+        issuer: string;
+        serviceTenants?: ResolvedServiceTenantsConfig;
+    };
+}
+export interface AuthkitTenantVerifierOptions {
+    /**
+     * Expected `aud`. Default: the audience of the only resource in
+     * `serviceTenants.resources` (required when several are declared).
+     */
+    audience?: string;
+    /** Claim holding the partition. Default: `'partition'`. */
+    partitionClaim?: string;
+    /** Claim holding the capabilities. Default: `'capabilities'`. */
+    capabilitiesClaim?: string;
+    /** Allowed clock skew in seconds for `exp`/`nbf`/`iat`. Default: 30. */
+    clockToleranceSec?: number;
+    /**
+     * Where the issuer comes from. Default: the `authkit.server` binding of the booted
+     * app. Read on every call, so a signing-key rotation applies right away.
+     */
+    issuer?: () => TenantTokenIssuer | Promise<TenantTokenIssuer>;
+}
+/**
+ * Verifies service-tenant tokens against the local authkit issuer and its JWKS (no
+ * network call), and returns the tenant they authenticate as, or `null`.
+ *
+ * Satisfies durable's `TenantVerifierContract` (`verify(input)`); usable as a class in
+ * `verifyTenant` (built by the container with the default options) or through
+ * {@link authkitTenantVerifier}.
+ */
+export declare class AuthkitTenantVerifier {
+    #private;
+    constructor(options?: AuthkitTenantVerifierOptions);
+    verify(input: TenantVerifierInput): Promise<VerifiedTenant | null>;
+}
+/** A tenant verifier usable both as a function and as an object with `verify`. */
+export type AuthkitTenantVerifierFn = ((input: TenantVerifierInput) => Promise<VerifiedTenant | null>) & {
+    verify(input: TenantVerifierInput): Promise<VerifiedTenant | null>;
+};
+/**
+ * Tenant verifier for a durable control plane hosted by the authkit app:
+ *
+ * ```ts
+ * // config/durable.ts
+ * verifyTenant: authkitTenantVerifier()
+ * ```
+ *
+ * The result is a function (durable's `TenantVerifier`) that also has `verify`
+ * (durable's `TenantVerifierContract`).
+ */
+export declare function authkitTenantVerifier(options?: AuthkitTenantVerifierOptions): AuthkitTenantVerifierFn;

package/build/src/service_tenants/tenant_verifier.js

@@ -0,0 +1,104 @@
+import { createLocalJWKSet, errors as joseErrors, jwtVerify } from 'jose';
+import { getBootedApp } from '../../services/booted_app.js';
+/** Asymmetric JWS algorithms only: never `none`, never `HS*`. */
+const ALGORITHMS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'EdDSA',
+    'Ed25519',
+];
+const defaultIssuer = async () => (await getBootedApp().container.make('authkit.server'));
+function audienceFor(issuer, explicit) {
+    if (explicit)
+        return explicit;
+    const resources = Object.values(issuer.config.serviceTenants?.resources ?? {});
+    if (resources.length === 1)
+        return resources[0].audience;
+    throw new Error(resources.length === 0
+        ? 'authkitTenantVerifier: no serviceTenants.resources declared in config/authkit.ts'
+        : 'authkitTenantVerifier: several serviceTenants.resources are declared; pass { audience }');
+}
+/**
+ * Verifies service-tenant tokens against the local authkit issuer and its JWKS (no
+ * network call), and returns the tenant they authenticate as, or `null`.
+ *
+ * Satisfies durable's `TenantVerifierContract` (`verify(input)`); usable as a class in
+ * `verifyTenant` (built by the container with the default options) or through
+ * {@link authkitTenantVerifier}.
+ */
+export class AuthkitTenantVerifier {
+    #options;
+    #jwks;
+    #keySet;
+    constructor(options = {}) {
+        this.#options = options;
+    }
+    #keySetFor(jwks) {
+        // `publicJwks` is a new object whenever the keys change (rotation/reload).
+        if (jwks !== this.#jwks || !this.#keySet) {
+            this.#jwks = jwks;
+            this.#keySet = createLocalJWKSet(jwks);
+        }
+        return this.#keySet;
+    }
+    async verify(input) {
+        const token = input?.token;
+        if (typeof token !== 'string' || !token)
+            return null;
+        const issuer = await (this.#options.issuer ?? defaultIssuer)();
+        const audience = audienceFor(issuer, this.#options.audience);
+        let payload;
+        try {
+            ({ payload } = await jwtVerify(token, this.#keySetFor(issuer.publicJwks), {
+                issuer: issuer.config.issuer,
+                audience,
+                algorithms: ALGORITHMS,
+                typ: 'at+jwt',
+                clockTolerance: this.#options.clockToleranceSec ?? 30,
+                requiredClaims: ['exp', 'sub'],
+            }));
+        }
+        catch (error) {
+            if (error instanceof joseErrors.JOSEError)
+                return null;
+            throw error;
+        }
+        // A client_credentials token: no user behind it, `sub` is the client.
+        const clientId = payload.client_id;
+        if (typeof clientId !== 'string' || payload.sub !== clientId)
+            return null;
+        const partition = payload[this.#options.partitionClaim ?? 'partition'];
+        if (typeof partition !== 'string' || !partition)
+            return null;
+        const rawCapabilities = payload[this.#options.capabilitiesClaim ?? 'capabilities'];
+        if (rawCapabilities === undefined)
+            return { tenant: partition };
+        if (!Array.isArray(rawCapabilities) || rawCapabilities.some((c) => typeof c !== 'string')) {
+            return null;
+        }
+        return { tenant: partition, capabilities: rawCapabilities };
+    }
+}
+/**
+ * Tenant verifier for a durable control plane hosted by the authkit app:
+ *
+ * ```ts
+ * // config/durable.ts
+ * verifyTenant: authkitTenantVerifier()
+ * ```
+ *
+ * The result is a function (durable's `TenantVerifier`) that also has `verify`
+ * (durable's `TenantVerifierContract`).
+ */
+export function authkitTenantVerifier(options = {}) {
+    const verifier = new AuthkitTenantVerifier(options);
+    const verify = (input) => verifier.verify(input);
+    return Object.assign(verify, { verify });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "1.0.0-rc.1",
+  "version": "1.0.0-rc.3",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -117,7 +117,7 @@
     "qrcode": "1.5.4"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-react": "1.0.0-rc.0",
+    "@adonis-agora/authkit-react": "1.0.0-rc.2",
     "@adonis-agora/durable": "0.59.0",
     "@adonis-agora/telescope": "0.27.1",
     "@adonisjs/ally": "6.3.2",

package/build/src/agents/poppy/client_registry.d.ts

@@ -1,50 +0,0 @@
-/**
- * Identidade do personal agent no Poppy (§4.1): o `client_id` é uma URL HTTPS
- * que devolve o documento de metadata do agente (OAuth Client ID Metadata
- * Document). Buscamos (à prova de SSRF), validamos, guardamos em cache e
- * importamos as chaves públicas do `jwks_uri`.
- */
-import { type JWTVerifyGetKey } from 'jose';
-import type { ResolvedPoppyConfig } from './config.js';
-import { type JsonFetcher } from './safe_fetch.js';
-export interface PoppyClient {
-    clientId: string;
-    /** `client_name`, ou o host do `client_id`. */
-    name: string;
-    logoUri: string | null;
-    jwksUri: string;
-    redirectUris: string[];
-    extensions: Record<string, unknown>;
-    /** Chaves públicas do `jwks_uri`. */
-    keys: JWTVerifyGetKey;
-}
-/**
- * `redirect_uri` igual a uma entrada de `redirect_uris`; numa loopback redirect URI a porta não
- * conta (§4.2, RFC 8252 §7.3).
- */
-export declare function redirectUriAllowed(registered: string[], redirectUri: string): boolean;
-/** Valida um documento de metadata e devolve os campos usados. Lança `invalid_client`. */
-export declare function validateClientMetadata(fetchedFrom: string, doc: unknown, options?: {
-    allowHttp?: boolean;
-}): Omit<PoppyClient, 'keys'>;
-export interface PoppyClientRegistryOptions {
-    /** Busca de JSON. Default: {@link safeFetchJson}. */
-    fetchJson?: JsonFetcher;
-    now?: () => number;
-}
-/**
- * Resolve e valida agentes pelo `client_id`, com cache (respeita `max-age`,
- * entre 1 min e 24 h; falhas ficam 1 min em cache para que o mesmo `client_id`
- * não vire uma busca de saída por request).
- */
-export declare class PoppyClientRegistry {
-    #private;
-    constructor(cfg: ResolvedPoppyConfig, options?: PoppyClientRegistryOptions);
-    /**
-     * O agente, ou `invalid_client`: `client_id` não é HTTPS, bloqueado, não
-     * registrado (quando o app exige registro), metadata inválida/inalcançável.
-     */
-    resolve(clientId: unknown): Promise<PoppyClient>;
-    /** Nome de exibição sem falhar (console de conta): metadata em cache/buscada, ou o host. */
-    displayName(clientId: string): Promise<string>;
-}

package/build/src/agents/poppy/client_registry.js

@@ -1,260 +0,0 @@
-/**
- * Identidade do personal agent no Poppy (§4.1): o `client_id` é uma URL HTTPS
- * que devolve o documento de metadata do agente (OAuth Client ID Metadata
- * Document). Buscamos (à prova de SSRF), validamos, guardamos em cache e
- * importamos as chaves públicas do `jwks_uri`.
- */
-import { createLocalJWKSet } from 'jose';
-import { PoppyError } from './errors.js';
-import { insecureDevFetchJson, SafeFetchError, safeFetchJson, } from './safe_fetch.js';
-const MIN_TTL_MS = 60 * 1000;
-const MAX_TTL_MS = 24 * 3600 * 1000;
-const DEFAULT_TTL_MS = 3600 * 1000;
-const FAILURE_TTL_MS = 60 * 1000;
-const MAX_CACHED = 1000;
-/** Releitura do JWKS quando o `kid` não está no conjunto em cache — no máximo a cada 30 s. */
-const JWKS_REFRESH_COOLDOWN_MS = 30 * 1000;
-function hostOf(url) {
-    try {
-        return new URL(url).host.toLowerCase();
-    }
-    catch {
-        return null;
-    }
-}
-function isHttpsUrl(value, allowHttp = false) {
-    if (typeof value !== 'string')
-        return false;
-    try {
-        const url = new URL(value);
-        const schemeOk = url.protocol === 'https:' || (allowHttp && url.protocol === 'http:');
-        return schemeOk && !url.username && !url.password && !url.hash;
-    }
-    catch {
-        return false;
-    }
-}
-/** Loopback redirect URI (RFC 8252 §7.3): `http`, IP de loopback literal, sem fragmento. */
-function isLoopbackRedirect(value) {
-    if (typeof value !== 'string')
-        return false;
-    try {
-        const url = new URL(value);
-        return (url.protocol === 'http:' &&
-            (url.hostname === '127.0.0.1' || url.hostname === '[::1]') &&
-            !url.username &&
-            !url.password &&
-            !url.hash);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * `redirect_uri` igual a uma entrada de `redirect_uris`; numa loopback redirect URI a porta não
- * conta (§4.2, RFC 8252 §7.3).
- */
-export function redirectUriAllowed(registered, redirectUri) {
-    if (registered.includes(redirectUri))
-        return true;
-    if (!isLoopbackRedirect(redirectUri))
-        return false;
-    const withoutPort = (value) => {
-        const url = new URL(value);
-        url.port = '';
-        return url.toString();
-    };
-    return registered.some((r) => isLoopbackRedirect(r) && withoutPort(r) === withoutPort(redirectUri));
-}
-function ttlFrom(maxAge) {
-    if (maxAge === null)
-        return DEFAULT_TTL_MS;
-    return Math.min(MAX_TTL_MS, Math.max(MIN_TTL_MS, maxAge * 1000));
-}
-function setBounded(map, key, value) {
-    map.delete(key);
-    map.set(key, value);
-    if (map.size > MAX_CACHED)
-        map.delete(map.keys().next().value);
-}
-/** Valida um documento de metadata e devolve os campos usados. Lança `invalid_client`. */
-export function validateClientMetadata(fetchedFrom, doc, options = {}) {
-    const allowHttp = options.allowHttp === true;
-    const bad = (why) => new PoppyError('invalid_client', `client metadata: ${why}`);
-    if (!doc || typeof doc !== 'object' || Array.isArray(doc))
-        throw bad('not a JSON object');
-    const d = doc;
-    if (d.client_id !== fetchedFrom)
-        throw bad('client_id must equal the URL it was fetched from');
-    const host = hostOf(fetchedFrom);
-    if (!isHttpsUrl(d.jwks_uri, allowHttp) || hostOf(d.jwks_uri) !== host) {
-        throw bad('jwks_uri must be an HTTPS URL on the same domain as client_id');
-    }
-    const redirects = d.redirect_uris ?? [];
-    if (!Array.isArray(redirects))
-        throw bad('redirect_uris must be an array');
-    for (const uri of redirects) {
-        if (isLoopbackRedirect(uri))
-            continue;
-        if (!isHttpsUrl(uri, allowHttp) || hostOf(uri) !== host) {
-            throw bad('every redirect_uri must be an HTTPS URL on the same domain as client_id, or a loopback URI');
-        }
-    }
-    if (d.token_endpoint_auth_method !== 'private_key_jwt') {
-        throw bad('token_endpoint_auth_method must be private_key_jwt');
-    }
-    if (d.jwks !== undefined)
-        throw bad('keys are published at jwks_uri only');
-    const name = typeof d.client_name === 'string' && d.client_name.trim() ? d.client_name : host;
-    const extensions = d.extensions && typeof d.extensions === 'object' && !Array.isArray(d.extensions)
-        ? d.extensions
-        : {};
-    return {
-        clientId: fetchedFrom,
-        name: name.slice(0, 200),
-        logoUri: isHttpsUrl(d.logo_uri, allowHttp) ? d.logo_uri : null,
-        jwksUri: d.jwks_uri,
-        redirectUris: redirects,
-        extensions,
-    };
-}
-/** Só chaves públicas (§4.1) e pelo menos uma. */
-function validateJwks(doc) {
-    const keys = doc?.keys;
-    if (!Array.isArray(keys) || keys.length === 0) {
-        throw new PoppyError('invalid_client', 'jwks_uri must serve a non-empty JWK set');
-    }
-    for (const key of keys) {
-        if (!key || typeof key !== 'object')
-            throw new PoppyError('invalid_client', 'invalid JWK');
-        const k = key;
-        if ('d' in k || 'p' in k || 'q' in k || k.kty === 'oct') {
-            throw new PoppyError('invalid_client', 'jwks_uri must contain only public keys');
-        }
-    }
-    return { keys: keys };
-}
-/**
- * Resolve e valida agentes pelo `client_id`, com cache (respeita `max-age`,
- * entre 1 min e 24 h; falhas ficam 1 min em cache para que o mesmo `client_id`
- * não vire uma busca de saída por request).
- */
-export class PoppyClientRegistry {
-    #cfg;
-    #fetch;
-    #now;
-    #clients = new Map();
-    #jwks = new Map();
-    constructor(cfg, options = {}) {
-        this.#cfg = cfg;
-        this.#fetch =
-            options.fetchJson ??
-                (cfg.allowInsecureClientIds
-                    ? (url) => insecureDevFetchJson(url)
-                    : (url) => safeFetchJson(url));
-        this.#now = options.now ?? Date.now;
-    }
-    /**
-     * O agente, ou `invalid_client`: `client_id` não é HTTPS, bloqueado, não
-     * registrado (quando o app exige registro), metadata inválida/inalcançável.
-     */
-    async resolve(clientId) {
-        if (!isHttpsUrl(clientId, this.#cfg.allowInsecureClientIds)) {
-            throw new PoppyError('invalid_client', 'client_id must be an HTTPS URL');
-        }
-        if (await this.#cfg.clients.isBlocked(clientId)) {
-            throw new PoppyError('invalid_client', 'client_id is blocked');
-        }
-        if (this.#cfg.clients.requireRegistration &&
-            !(await this.#cfg.clients.isRegistered(clientId))) {
-            throw new PoppyError('invalid_client', 'client_id is not registered');
-        }
-        const meta = await this.#metadata(clientId);
-        return { ...meta, keys: this.#keySet(meta.jwksUri) };
-    }
-    /** Nome de exibição sem falhar (console de conta): metadata em cache/buscada, ou o host. */
-    async displayName(clientId) {
-        try {
-            return (await this.#metadata(clientId)).name;
-        }
-        catch {
-            return hostOf(clientId) ?? clientId;
-        }
-    }
-    #metadata(clientId) {
-        const now = this.#now();
-        const cached = this.#clients.get(clientId);
-        if (cached && cached.expiresAt > now)
-            return cached.value;
-        const entry = {
-            value: Promise.resolve(null),
-            expiresAt: now + FAILURE_TTL_MS,
-        };
-        entry.value = (async () => {
-            let fetched;
-            try {
-                fetched = await this.#fetch(clientId);
-            }
-            catch (error) {
-                const why = error instanceof SafeFetchError ? error.message : 'unreachable';
-                throw new PoppyError('invalid_client', `client metadata: ${why}`);
-            }
-            const meta = validateClientMetadata(clientId, fetched.body, {
-                allowHttp: this.#cfg.allowInsecureClientIds,
-            });
-            entry.expiresAt = this.#now() + ttlFrom(fetched.maxAge);
-            return meta;
-        })();
-        entry.value.catch(() => {
-            entry.expiresAt = this.#now() + FAILURE_TTL_MS;
-        });
-        setBounded(this.#clients, clientId, entry);
-        return entry.value;
-    }
-    #fetchJwks(jwksUri, force) {
-        const now = this.#now();
-        const cached = this.#jwks.get(jwksUri);
-        if (cached && cached.expiresAt > now && !force)
-            return cached.value;
-        if (cached && force && now - cached.fetchedAt < JWKS_REFRESH_COOLDOWN_MS)
-            return cached.value;
-        const entry = {
-            value: Promise.resolve({ keys: [] }),
-            expiresAt: now + FAILURE_TTL_MS,
-            fetchedAt: now,
-        };
-        entry.value = (async () => {
-            let fetched;
-            try {
-                fetched = await this.#fetch(jwksUri);
-            }
-            catch (error) {
-                const why = error instanceof SafeFetchError ? error.message : 'unreachable';
-                throw new PoppyError('invalid_client', `jwks_uri: ${why}`);
-            }
-            const jwks = validateJwks(fetched.body);
-            entry.expiresAt = this.#now() + ttlFrom(fetched.maxAge);
-            return jwks;
-        })();
-        entry.value.catch(() => {
-            entry.expiresAt = this.#now() + FAILURE_TTL_MS;
-        });
-        setBounded(this.#jwks, jwksUri, entry);
-        return entry.value;
-    }
-    /** `JWTVerifyGetKey` que relê o JWKS uma vez quando o `kid` é desconhecido (rotação). */
-    #keySet(jwksUri) {
-        return async (header, token) => {
-            const jwks = await this.#fetchJwks(jwksUri, false);
-            try {
-                return await createLocalJWKSet(jwks)(header, token);
-            }
-            catch (error) {
-                const refreshed = await this.#fetchJwks(jwksUri, true);
-                if (refreshed === jwks)
-                    throw error;
-                return createLocalJWKSet(refreshed)(header, token);
-            }
-        };
-    }
-}