@dereekb/oauth-resource 14.4.0

package/index.esm.js

@@ -0,0 +1,1066 @@
+import { BaseError } from 'make-error';
+import { cachedGetter } from '@dereekb/util';
+import { createRemoteJWKSet, decodeJwt, decodeProtectedHeader, errors, jwtVerify } from 'jose';
+
+// MARK: Conversion
+/**
+ * Fallback `clientId` used for a verified Firebase ID token, which names no OAuth client.
+ */ var FIREBASE_AUTH_INFO_CLIENT_ID = 'firebase';
+/**
+ * Splits a space-delimited OAuth `scope` claim into its entries.
+ *
+ * @param scope - The raw `scope` claim value, if any.
+ * @returns The scope entries, empty when the claim is absent or not a string.
+ */ function scopesFromScopeClaim(scope) {
+    return typeof scope === 'string' ? scope.split(' ').filter(function(entry) {
+        return entry.length > 0;
+    }) : [];
+}
+/**
+ * Converts a {@link VerifiedBearer} into the {@link OAuthResourceAuthInfo} attached to the request.
+ *
+ * A token with no `client_id` claim is not from an OAuth client: a Firebase ID token reports
+ * {@link FIREBASE_AUTH_INFO_CLIENT_ID}, and any other issuer falls back to the subject.
+ *
+ * @param verified - The verified bearer token.
+ * @returns The auth info.
+ */ function oauthResourceAuthInfoForVerifiedBearer(verified) {
+    var claimClientId = verified.claims['client_id'];
+    var fallbackClientId = verified.kind === 'firebase' ? FIREBASE_AUTH_INFO_CLIENT_ID : verified.subject;
+    return {
+        token: verified.token,
+        clientId: typeof claimClientId === 'string' ? claimClientId : fallbackClientId,
+        scopes: scopesFromScopeClaim(verified.claims['scope']),
+        expiresAt: verified.claims.exp,
+        extra: {
+            sub: verified.subject,
+            iss: verified.issuer,
+            kind: verified.kind
+        }
+    };
+}
+
+// MARK: Challenge
+/**
+ * Builds the `WWW-Authenticate: Bearer ...` challenge string emitted alongside a 401 / 403 on an
+ * OAuth-protected route.
+ *
+ * Per RFC 6750 §3 / RFC 7235, auth-params are comma-separated. Parameter order is not significant
+ * to a client; this emits `realm`, `resource_metadata`, `error`, `error_description`, `scope`.
+ *
+ * @param config - The error token plus the optional realm / metadata / description / scope params.
+ * @returns The header value, e.g. `Bearer resource_metadata="…", error="invalid_token"`.
+ */ function buildBearerChallenge(config) {
+    var params = [];
+    if (config.realm) {
+        params.push('realm="'.concat(config.realm, '"'));
+    }
+    if (config.resourceMetadataUrl) {
+        params.push('resource_metadata="'.concat(config.resourceMetadataUrl, '"'));
+    }
+    params.push('error="'.concat(config.error, '"'));
+    if (config.errorDescription) {
+        params.push('error_description="'.concat(config.errorDescription, '"'));
+    }
+    if (config.scope) {
+        params.push('scope="'.concat(config.scope, '"'));
+    }
+    return "Bearer ".concat(params.join(', '));
+}
+/**
+ * Selects the RFC 6750 §3 `error` token for a failure: `insufficient_scope` for a policy (403)
+ * failure, `invalid_token` when a token was presented but failed, and `invalid_request` when the
+ * request carried no token at all.
+ *
+ * @param config - The failure code and whether a token was presented.
+ * @returns The RFC 6750 error token.
+ */ function bearerChallengeErrorForCode(config) {
+    var result;
+    if (config.code === 'forbidden') {
+        result = 'insufficient_scope';
+    } else if (config.hadToken) {
+        result = 'invalid_token';
+    } else {
+        result = 'invalid_request';
+    }
+    return result;
+}
+// MARK: Header
+/**
+ * The `Authorization` header scheme prefix a bearer token is presented with.
+ */ var BEARER_AUTHORIZATION_PREFIX = 'Bearer ';
+/**
+ * Reads the raw bearer token out of an `Authorization` header value.
+ *
+ * @param header - The raw `Authorization` header value, if any.
+ * @returns The token, or `undefined` when the header is absent, uses another scheme, or is empty.
+ */ function readBearerToken(header) {
+    var token;
+    if (header === null || header === void 0 ? void 0 : header.startsWith(BEARER_AUTHORIZATION_PREFIX)) {
+        var raw = header.slice(BEARER_AUTHORIZATION_PREFIX.length).trim();
+        token = raw.length > 0 ? raw : undefined;
+    }
+    return token;
+}
+
+function _assert_this_initialized(self) {
+    if (self === void 0) throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
+    return self;
+}
+function _call_super(_this, derived, args) {
+    derived = _get_prototype_of(derived);
+    return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, args || [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) throw new TypeError("Cannot call a class as a function");
+}
+function _defineProperties(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    return Constructor;
+}
+function _define_property$1(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _get_prototype_of(o) {
+    _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
+        return o.__proto__ || Object.getPrototypeOf(o);
+    };
+    return _get_prototype_of(o);
+}
+function _inherits(subClass, superClass) {
+    if (typeof superClass !== "function" && superClass !== null) {
+        throw new TypeError("Super expression must either be null or a function");
+    }
+    subClass.prototype = Object.create(superClass && superClass.prototype, {
+        constructor: {
+            value: subClass,
+            writable: true,
+            configurable: true
+        }
+    });
+    if (superClass) _set_prototype_of(subClass, superClass);
+}
+function _instanceof$1(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
+function _is_native_reflect_construct() {
+    try {
+        var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {}));
+    } catch (_) {}
+    return (_is_native_reflect_construct = function() {
+        return !!result;
+    })();
+}
+function _object_spread$1(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property$1(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function _possible_constructor_return(self, call) {
+    if (call && (_type_of(call) === "object" || typeof call === "function")) return call;
+    return _assert_this_initialized(self);
+}
+function _set_prototype_of(o, p) {
+    _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o, p) {
+        o.__proto__ = p;
+        return o;
+    };
+    return _set_prototype_of(o, p);
+}
+function _type_of(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+/**
+ * HTTP status paired with each {@link OAuthResourceErrorCode}.
+ */ var OAUTH_RESOURCE_ERROR_STATUS_CODES = {
+    unauthorized: 401,
+    forbidden: 403
+};
+// MARK: Error
+/**
+ * Error raised when a bearer token fails verification or a policy gate.
+ *
+ * Consumers that already have their own API error type do not have to catch and re-wrap this one:
+ * pass an {@link OAuthResourceErrorFactory} on the verification options and the verifier throws
+ * that type instead.
+ */ var OAuthResourceError = /*#__PURE__*/ function(BaseError) {
+    _inherits(OAuthResourceError, BaseError);
+    function OAuthResourceError(input) {
+        _class_call_check(this, OAuthResourceError);
+        var _this;
+        var _input_status;
+        _this = _call_super(this, OAuthResourceError, [
+            input.message
+        ]), _define_property$1(_this, "code", void 0), _define_property$1(_this, "status", void 0), _define_property$1(_this, "details", void 0);
+        _this.code = input.code;
+        _this.status = (_input_status = input.status) !== null && _input_status !== void 0 ? _input_status : OAUTH_RESOURCE_ERROR_STATUS_CODES[input.code];
+        if (input.details != null) {
+            _this.details = input.details;
+        }
+        return _this;
+    }
+    _create_class(OAuthResourceError, [
+        {
+            /**
+     * Builds the default JSON error body for this error.
+     *
+     * @returns The error envelope.
+     */ key: "toEnvelope",
+            value: function toEnvelope() {
+                return {
+                    error: _object_spread$1({
+                        code: this.code,
+                        message: this.message
+                    }, this.details == null ? {} : {
+                        details: this.details
+                    })
+                };
+            }
+        }
+    ]);
+    return OAuthResourceError;
+}(BaseError);
+/**
+ * Default {@link OAuthResourceErrorFactory}, producing an {@link OAuthResourceError}.
+ *
+ * @param input - The code, message, status, and details of the failure.
+ * @returns The error to throw.
+ */ var defaultOAuthResourceErrorFactory = function defaultOAuthResourceErrorFactory(input) {
+    return new OAuthResourceError(input);
+};
+/**
+ * Returns true when the input is an {@link OAuthResourceError}.
+ *
+ * @param error - The value to test.
+ * @returns Whether the value is an {@link OAuthResourceError}.
+ */ function isOAuthResourceError(error) {
+    return _instanceof$1(error, OAuthResourceError);
+}
+
+function asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator$1(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep$1(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _ts_generator$1(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+// MARK: Constants
+/**
+ * Google's public JWKS for Firebase ID tokens (the `securetoken` signer).
+ */ var FIREBASE_SECURETOKEN_JWKS_URL = 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com';
+/**
+ * Path appended to an issuer to read its OpenID Connect discovery document.
+ */ var OPENID_CONFIGURATION_PATH = '/.well-known/openid-configuration';
+/**
+ * Builds the `iss` value Firebase stamps on a project's ID tokens.
+ *
+ * @param projectId - The Firebase project id.
+ * @returns The issuer URL.
+ */ function firebaseIssuerForProject(projectId) {
+    return "https://securetoken.google.com/".concat(projectId);
+}
+// MARK: Profiles
+/**
+ * Builds the issuer → profile map the bearer verifier dispatches on: one
+ * Firebase profile per trusted project id (sharing Google's JWKS) and one
+ * OIDC profile per trusted issuer (JWKS discovered from
+ * `{iss}/.well-known/openid-configuration`, falling back to `{iss}/jwks`).
+ *
+ * @param config - The trusted project ids / issuers / audiences + optional fetch.
+ * @returns Profiles keyed by their `iss` value.
+ */ function buildIssuerProfiles(config) {
+    var _config_fetch, _config_audiences, _config_firebaseProjectIds, _config_oidcIssuers;
+    var fetchFn = (_config_fetch = config.fetch) !== null && _config_fetch !== void 0 ? _config_fetch : globalThis.fetch.bind(globalThis);
+    var audiences = (_config_audiences = config.audiences) !== null && _config_audiences !== void 0 ? _config_audiences : [];
+    var profiles = new Map();
+    // jose caches the key set and refetches on an unknown `kid` (30 s cooldown). Built on first use
+    // rather than at map-construction time, so a bad URL is a per-request 401 and not a boot failure.
+    var firebaseKeys = cachedGetter(function() {
+        var _config_firebaseJwksUrl;
+        return createRemoteJWKSet(new URL((_config_firebaseJwksUrl = config.firebaseJwksUrl) !== null && _config_firebaseJwksUrl !== void 0 ? _config_firebaseJwksUrl : FIREBASE_SECURETOKEN_JWKS_URL));
+    });
+    ((_config_firebaseProjectIds = config.firebaseProjectIds) !== null && _config_firebaseProjectIds !== void 0 ? _config_firebaseProjectIds : []).forEach(function(projectId) {
+        var issuer = firebaseIssuerForProject(projectId);
+        profiles.set(issuer, {
+            kind: 'firebase',
+            issuer: issuer,
+            audiences: [
+                projectId
+            ],
+            getKey: function getKey() {
+                return _async_to_generator$1(function() {
+                    return _ts_generator$1(this, function(_state) {
+                        return [
+                            2,
+                            firebaseKeys()
+                        ];
+                    });
+                })();
+            }
+        });
+    });
+    ((_config_oidcIssuers = config.oidcIssuers) !== null && _config_oidcIssuers !== void 0 ? _config_oidcIssuers : []).forEach(function(input) {
+        var _entry_getKey, _entry_audiences;
+        var entry = typeof input === 'string' ? {
+            issuer: input
+        } : input;
+        var issuer = entry.issuer;
+        var getKey = (_entry_getKey = entry.getKey) !== null && _entry_getKey !== void 0 ? _entry_getKey : memoizeSuccess(function() {
+            return discoverOidcJwks(issuer, fetchFn);
+        });
+        profiles.set(issuer, {
+            kind: 'oidc',
+            issuer: issuer,
+            audiences: (_entry_audiences = entry.audiences) !== null && _entry_audiences !== void 0 ? _entry_audiences : audiences,
+            getKey: getKey
+        });
+    });
+    return profiles;
+}
+function discoverOidcJwks(issuer, fetchFn) {
+    return _async_to_generator$1(function() {
+        var jwksUri, response, document;
+        return _ts_generator$1(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    jwksUri = "".concat(issuer, "/jwks");
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        5,
+                        ,
+                        6
+                    ]);
+                    return [
+                        4,
+                        fetchFn("".concat(issuer).concat(OPENID_CONFIGURATION_PATH))
+                    ];
+                case 2:
+                    response = _state.sent();
+                    if (!response.ok) return [
+                        3,
+                        4
+                    ];
+                    return [
+                        4,
+                        response.json()
+                    ];
+                case 3:
+                    document = _state.sent();
+                    if (typeof document.jwks_uri === 'string' && document.jwks_uri.length > 0) {
+                        jwksUri = document.jwks_uri;
+                    }
+                    _state.label = 4;
+                case 4:
+                    return [
+                        3,
+                        6
+                    ];
+                case 5:
+                    _state.sent();
+                    return [
+                        3,
+                        6
+                    ];
+                case 6:
+                    return [
+                        2,
+                        createRemoteJWKSet(new URL(jwksUri))
+                    ];
+            }
+        });
+    })();
+}
+// Caches the resolved value only once it resolved — a rejected attempt is
+// retried on the next call, so a discovery outage never latches.
+function memoizeSuccess(load) {
+    var cached;
+    return function() {
+        var result = cached;
+        if (result == null) {
+            result = load().catch(function(error) {
+                cached = undefined;
+                throw error;
+            });
+            cached = result;
+        }
+        return result;
+    };
+}
+
+function _array_like_to_array$1(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes$1(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array$1(arr);
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else obj[key] = value;
+    return obj;
+}
+function _iterable_to_array$1(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
+        return Array.from(iter);
+    }
+}
+function _non_iterable_spread$1() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function _to_consumable_array$1(arr) {
+    return _array_without_holes$1(arr) || _iterable_to_array$1(arr) || _unsupported_iterable_to_array$1(arr) || _non_iterable_spread$1();
+}
+function _unsupported_iterable_to_array$1(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array$1(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array$1(o, minLen);
+}
+// MARK: Constants
+/**
+ * RFC 9728 §3 well-known path for OAuth 2.0 protected-resource metadata.
+ */ var OAUTH_PROTECTED_RESOURCE_PATH = '/.well-known/oauth-protected-resource';
+/**
+ * Builds the RFC 9728 §3.1 path-suffixed well-known path for a resource — the form MCP clients
+ * try first (e.g. `/.well-known/oauth-protected-resource/mcp` for a resource served at `/mcp`).
+ *
+ * @param resourcePath - The resource's path on the origin, with or without a leading slash.
+ * @returns The path-suffixed well-known path.
+ */ function oauthProtectedResourcePathForResource(resourcePath) {
+    var suffix = resourcePath.replace(/^\/+/, '').replace(/\/+$/, '');
+    return suffix.length > 0 ? "".concat(OAUTH_PROTECTED_RESOURCE_PATH, "/").concat(suffix) : OAUTH_PROTECTED_RESOURCE_PATH;
+}
+/**
+ * Builds the RFC 9728 protected-resource metadata document.
+ *
+ * Hand-rolled deliberately: the MCP SDK's builder also wants the authorization-server metadata
+ * document, which a resource server never hosts — it points at one instead.
+ *
+ * @param config - The resource identifier, its authorization servers, and the advertised scopes.
+ * @returns The metadata document.
+ */ function buildProtectedResourceMetadata(config) {
+    var _config_scopesSupported, _config_bearerMethodsSupported;
+    return _object_spread({
+        resource: config.resource,
+        authorization_servers: _to_consumable_array$1(config.authorizationServers),
+        scopes_supported: _to_consumable_array$1((_config_scopesSupported = config.scopesSupported) !== null && _config_scopesSupported !== void 0 ? _config_scopesSupported : []),
+        bearer_methods_supported: _to_consumable_array$1((_config_bearerMethodsSupported = config.bearerMethodsSupported) !== null && _config_bearerMethodsSupported !== void 0 ? _config_bearerMethodsSupported : [
+            'header'
+        ])
+    }, config.resourceName == null ? {} : {
+        resource_name: config.resourceName
+    }, config.resourceDocumentation == null ? {} : {
+        resource_documentation: config.resourceDocumentation
+    });
+}
+
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array(arr);
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) resolve(value);
+    else Promise.resolve(value).then(_next, _throw);
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _instanceof(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
+function _iterable_to_array(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) {
+        return Array.from(iter);
+    }
+}
+function _non_iterable_spread() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array(arr) {
+    return _array_without_holes(arr) || _iterable_to_array(arr) || _unsupported_iterable_to_array(arr) || _non_iterable_spread();
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+// MARK: Constants
+/**
+ * Leeway applied to `exp` / `nbf` / `iat` / `auth_time`.
+ */ var BEARER_CLOCK_TOLERANCE_SECONDS = 60;
+/**
+ * The signing algorithms accepted by default (Firebase and oidc-provider both sign RS256).
+ */ var BEARER_ALGORITHMS = [
+    'RS256'
+];
+/**
+ * Issuer kinds the claim gates apply to by default.
+ */ var DEFAULT_BEARER_CLAIM_GATE_KINDS = [
+    'firebase'
+];
+// MARK: Verify
+/**
+ * Verifies a bearer JWT against the trusted issuer profiles: the `iss`
+ * claim selects the profile, the profile's JWKS verifies the RS256
+ * signature, and jose enforces `iss` / `aud` / `exp` / `nbf` / `iat` with a
+ * 60 s tolerance. Firebase tokens additionally get the `auth_time` sanity
+ * check and the optional claim gates. Under the Firebase emulator an
+ * unsigned (`alg: none`) token is accepted after the same claim checks —
+ * the emulator never signs, and the flag is never set in production.
+ *
+ * Scopes are deliberately NOT enforced here: a resource server's scope policy is per-route, so it
+ * belongs to the caller (see the Express adapter's `requiredScopes`).
+ *
+ * @param token - The raw bearer token.
+ * @param options - Trusted profiles + policy.
+ * @returns The verified token.
+ * @throws {OAuthResourceError} `unauthorized` for any malformed / untrusted / invalid token; `forbidden` when a claim gate fails. Replaceable via {@link VerifyBearerOptions.errorFactory}.
+ */ function verifyBearerJwt(token, options) {
+    return _async_to_generator(function() {
+        var _options_errorFactory, _options_clockToleranceSeconds, _options_nowSeconds, _options_claimGateKinds, errorFactory, clockTolerance, unverified, profile, now, context, claims, _options_algorithms, authTime, claimGateKinds;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    errorFactory = (_options_errorFactory = options.errorFactory) !== null && _options_errorFactory !== void 0 ? _options_errorFactory : defaultOAuthResourceErrorFactory;
+                    clockTolerance = (_options_clockToleranceSeconds = options.clockToleranceSeconds) !== null && _options_clockToleranceSeconds !== void 0 ? _options_clockToleranceSeconds : BEARER_CLOCK_TOLERANCE_SECONDS;
+                    try {
+                        unverified = decodeJwt(token);
+                    } catch (unused) {
+                        throw errorFactory({
+                            code: 'unauthorized',
+                            message: 'Malformed bearer token.'
+                        });
+                    }
+                    profile = unverified.iss === undefined ? undefined : options.profiles.get(unverified.iss);
+                    if (!profile) {
+                        throw errorFactory({
+                            code: 'unauthorized',
+                            message: 'Untrusted token issuer.'
+                        });
+                    }
+                    now = ((_options_nowSeconds = options.nowSeconds) !== null && _options_nowSeconds !== void 0 ? _options_nowSeconds : defaultNowSeconds)();
+                    context = {
+                        profile: profile,
+                        now: now,
+                        clockTolerance: clockTolerance,
+                        errorFactory: errorFactory
+                    };
+                    if (!(profile.kind === 'firebase' && options.firebaseEmulator === true && isUnsignedToken(token))) return [
+                        3,
+                        1
+                    ];
+                    claims = verifyUnsignedEmulatorToken(unverified, context);
+                    return [
+                        3,
+                        3
+                    ];
+                case 1:
+                    return [
+                        4,
+                        verifySignedToken(token, context, (_options_algorithms = options.algorithms) !== null && _options_algorithms !== void 0 ? _options_algorithms : BEARER_ALGORITHMS)
+                    ];
+                case 2:
+                    claims = _state.sent();
+                    _state.label = 3;
+                case 3:
+                    if (typeof claims.sub !== 'string' || claims.sub.length === 0) {
+                        throw errorFactory({
+                            code: 'unauthorized',
+                            message: 'Token has no subject.'
+                        });
+                    }
+                    if (profile.kind === 'firebase') {
+                        authTime = claims['auth_time'];
+                        if (typeof authTime === 'number' && authTime > now + clockTolerance) {
+                            throw errorFactory({
+                                code: 'unauthorized',
+                                message: 'Token auth_time is in the future.'
+                            });
+                        }
+                    }
+                    claimGateKinds = (_options_claimGateKinds = options.claimGateKinds) !== null && _options_claimGateKinds !== void 0 ? _options_claimGateKinds : DEFAULT_BEARER_CLAIM_GATE_KINDS;
+                    if (!claimGateKinds.includes(profile.kind)) return [
+                        3,
+                        5
+                    ];
+                    return [
+                        4,
+                        assertClaimGates(claims, options, context)
+                    ];
+                case 4:
+                    _state.sent();
+                    _state.label = 5;
+                case 5:
+                    return [
+                        2,
+                        {
+                            kind: profile.kind,
+                            issuer: profile.issuer,
+                            subject: claims.sub,
+                            claims: claims,
+                            token: token
+                        }
+                    ];
+            }
+        });
+    })();
+}
+function defaultNowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+function isUnsignedToken(token) {
+    var unsigned = false;
+    try {
+        unsigned = decodeProtectedHeader(token).alg === 'none';
+    } catch (unused) {
+    // undecodable header — treat as signed so the signature path rejects it
+    }
+    return unsigned;
+}
+function assertClaimGates(claims, options, context) {
+    return _async_to_generator(function() {
+        var _options_requiredClaims, requiredClaims, missingClaim, allowed;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    requiredClaims = (_options_requiredClaims = options.requiredClaims) !== null && _options_requiredClaims !== void 0 ? _options_requiredClaims : [];
+                    missingClaim = requiredClaims.find(function(claim) {
+                        return !claims[claim];
+                    });
+                    if (missingClaim != null) {
+                        throw context.errorFactory({
+                            code: 'forbidden',
+                            message: 'Token is missing the required "'.concat(missingClaim, '" claim.'),
+                            details: {
+                                claim: missingClaim
+                            }
+                        });
+                    }
+                    if (!(options.claimPredicate != null)) return [
+                        3,
+                        2
+                    ];
+                    return [
+                        4,
+                        options.claimPredicate(claims, context.profile)
+                    ];
+                case 1:
+                    allowed = _state.sent();
+                    if (!allowed) {
+                        throw context.errorFactory({
+                            code: 'forbidden',
+                            message: 'Token failed the resource server claim policy.'
+                        });
+                    }
+                    _state.label = 2;
+                case 2:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+function verifySignedToken(token, context, algorithms) {
+    return _async_to_generator(function() {
+        var profile, now, clockTolerance, errorFactory, claims, getKey, verified, error, code;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    profile = context.profile, now = context.now, clockTolerance = context.clockTolerance, errorFactory = context.errorFactory;
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        profile.getKey()
+                    ];
+                case 2:
+                    getKey = _state.sent();
+                    return [
+                        4,
+                        jwtVerify(token, getKey, {
+                            issuer: profile.issuer,
+                            audience: _to_consumable_array(profile.audiences),
+                            algorithms: _to_consumable_array(algorithms),
+                            clockTolerance: clockTolerance,
+                            currentDate: new Date(now * 1000)
+                        })
+                    ];
+                case 3:
+                    verified = _state.sent();
+                    claims = verified.payload;
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    error = _state.sent();
+                    code = _instanceof(error, errors.JOSEError) ? error.code : 'ERR_JWT_INVALID';
+                    throw errorFactory({
+                        code: 'unauthorized',
+                        message: "Invalid bearer token (".concat(code, ").")
+                    });
+                case 5:
+                    return [
+                        2,
+                        claims
+                    ];
+            }
+        });
+    })();
+}
+// The emulator issues `alg: none` tokens; firebase-admin skips the signature
+// under FIREBASE_AUTH_EMULATOR_HOST and checks the claims only, so the same
+// iss / aud / exp / iat gates are applied here. The error strings reproduce jose's
+// so both paths look identical to a caller.
+function verifyUnsignedEmulatorToken(claims, context) {
+    var _claims_aud;
+    var profile = context.profile, now = context.now, clockTolerance = context.clockTolerance, errorFactory = context.errorFactory;
+    var audiences = typeof claims.aud === 'string' ? [
+        claims.aud
+    ] : (_claims_aud = claims.aud) !== null && _claims_aud !== void 0 ? _claims_aud : [];
+    if (claims.iss !== profile.issuer) {
+        throw errorFactory({
+            code: 'unauthorized',
+            message: 'Invalid bearer token (ERR_JWT_CLAIM_VALIDATION_FAILED: iss).'
+        });
+    }
+    if (!audiences.some(function(aud) {
+        return profile.audiences.includes(aud);
+    })) {
+        throw errorFactory({
+            code: 'unauthorized',
+            message: 'Invalid bearer token (ERR_JWT_CLAIM_VALIDATION_FAILED: aud).'
+        });
+    }
+    if (typeof claims.exp !== 'number' || claims.exp + clockTolerance <= now) {
+        throw errorFactory({
+            code: 'unauthorized',
+            message: 'Invalid bearer token (ERR_JWT_EXPIRED).'
+        });
+    }
+    if (typeof claims.nbf === 'number' && claims.nbf > now + clockTolerance) {
+        throw errorFactory({
+            code: 'unauthorized',
+            message: 'Invalid bearer token (ERR_JWT_CLAIM_VALIDATION_FAILED: nbf).'
+        });
+    }
+    if (typeof claims.iat === 'number' && claims.iat > now + clockTolerance) {
+        throw errorFactory({
+            code: 'unauthorized',
+            message: 'Invalid bearer token (ERR_JWT_CLAIM_VALIDATION_FAILED: iat).'
+        });
+    }
+    return claims;
+}
+
+export { BEARER_ALGORITHMS, BEARER_AUTHORIZATION_PREFIX, BEARER_CLOCK_TOLERANCE_SECONDS, DEFAULT_BEARER_CLAIM_GATE_KINDS, FIREBASE_AUTH_INFO_CLIENT_ID, FIREBASE_SECURETOKEN_JWKS_URL, OAUTH_PROTECTED_RESOURCE_PATH, OAUTH_RESOURCE_ERROR_STATUS_CODES, OAuthResourceError, OPENID_CONFIGURATION_PATH, bearerChallengeErrorForCode, buildBearerChallenge, buildIssuerProfiles, buildProtectedResourceMetadata, defaultOAuthResourceErrorFactory, firebaseIssuerForProject, isOAuthResourceError, oauthProtectedResourcePathForResource, oauthResourceAuthInfoForVerifiedBearer, readBearerToken, scopesFromScopeClaim, verifyBearerJwt };