@frontmcp/auth 1.11.1 → 1.11.3

package/browser/cimd/cimd.errors.mjs

@@ -124,12 +124,23 @@ var CimdResponseTooLargeError = class extends CimdError {
     return "Client metadata document is too large";
   }
 };
+var CimdClientAssertionError = class extends CimdError {
+  reason;
+  constructor(clientIdUrl, reason) {
+    super(`Client assertion refused for ${clientIdUrl}: ${reason}`, "CIMD_CLIENT_ASSERTION_INVALID", 401, clientIdUrl);
+    this.reason = reason;
+  }
+  getPublicMessage() {
+    return "Client authentication failed";
+  }
+};
 var CimdDisabledError = class extends CimdError {
   constructor() {
     super("CIMD (Client ID Metadata Documents) is disabled on this server", "CIMD_DISABLED", 400);
   }
 };
 export {
+  CimdClientAssertionError,
   CimdClientIdMismatchError,
   CimdDisabledError,
   CimdError,

package/browser/cimd/cimd.service.mjs

@@ -1,12 +1,15 @@
 // libs/auth/src/cimd/cimd.service.ts
 import { isRedirectResponse } from "@frontmcp/utils";
-import { createCimdCache } from "./cimd.cache.mjs";
+import { verifyClientAssertion } from "./cimd-client-assertion.mjs";
+import { createCimdCache, extractCacheHeaders, parseCacheHeaders } from "./cimd.cache.mjs";
 import {
+  CimdClientAssertionError,
   CimdClientIdMismatchError,
   CimdFetchError,
   CimdResponseTooLargeError,
   CimdSecurityError,
   CimdValidationError,
+  InvalidClientIdUrlError,
   RedirectUriMismatchError
 } from "./cimd.errors.mjs";
 import { noopLogger } from "./cimd.logger.mjs";
@@ -15,15 +18,19 @@ import {
   cimdConfigSchema,
   cimdNetworkConfigSchema,
   cimdSecurityConfigSchema,
+  clientJwksSchema,
   clientMetadataDocumentSchema
 } from "./cimd.types.mjs";
 import { assertHostNotSsrf, hasOnlyLocalhostRedirectUris, isCimdClientId, validateClientIdUrl } from "./cimd.validator.mjs";
+var MAX_CACHED_KEY_SETS = 500;
+var KEY_SET_REFRESH_COOLDOWN_MS = 3e4;
 var CimdService = class {
   config;
   cacheConfig;
   securityConfig;
   networkConfig;
   cacheBackend;
+  keySets = /* @__PURE__ */ new Map();
   logger;
   /**
    * Whether CIMD is enabled.
@@ -152,6 +159,91 @@ var CimdService = class {
       throw new RedirectUriMismatchError(metadata.client_id, redirectUri, metadata.redirect_uris);
     }
   }
+  /**
+   * Check that this server can honor the client as its document declares it: it authenticates at the token
+   * endpoint with `none`, or with `private_key_jwt` and exactly one of `jwks` / `jwks_uri` (a public document holds
+   * no shared secret, so `client_secret_*` is refused), and it uses the authorization code grant with
+   * `response_type=code`.
+   *
+   * @param metadata - The client's metadata document
+   * @throws CimdValidationError naming each declaration this server cannot honor
+   */
+  assertSupportedClient(metadata) {
+    const problems = [];
+    const method = metadata.token_endpoint_auth_method;
+    if (method === "private_key_jwt") {
+      problems.push(...this.keySourceProblems(metadata));
+    } else if (method !== "none") {
+      problems.push(`token_endpoint_auth_method "${method}" is not supported, only "none" or "private_key_jwt"`);
+    }
+    if (!metadata.grant_types.includes("authorization_code")) {
+      problems.push('grant_types must include "authorization_code"');
+    }
+    if (!metadata.response_types.includes("code")) {
+      problems.push('response_types must include "code"');
+    }
+    if (problems.length > 0) {
+      throw new CimdValidationError(metadata.client_id, problems);
+    }
+  }
+  /**
+   * Authenticate a `private_key_jwt` client by its assertion (RFC 7523): see {@link verifyClientAssertion}.
+   *
+   * @param metadata - The client's metadata document, which declares `private_key_jwt`
+   * @param check - The token request's assertion, the audiences it may name, and the `jti` store
+   * @throws CimdClientAssertionError when the assertion is missing or refused
+   * @throws CimdFetchError, CimdResponseTooLargeError or CimdSecurityError when `jwks_uri` can't be fetched
+   */
+  async verifyClientAssertion(metadata, check) {
+    await verifyClientAssertion({
+      ...check,
+      clientId: metadata.client_id,
+      keys: (refresh) => this.clientKeys(metadata, refresh)
+    });
+  }
+  /**
+   * The client's keys: its inline `jwks`, or the key set at its `jwks_uri`, fetched like the document itself
+   * (SSRF guard, redirect policy, timeout, size limit) and cached for the TTL its cache headers give, within
+   * `cache.minTtlMs` and `cache.maxTtlMs`. With `refresh`, a cached key set at least
+   * {@link KEY_SET_REFRESH_COOLDOWN_MS} old is fetched again.
+   */
+  async clientKeys(metadata, refresh) {
+    if (metadata.jwks) return metadata.jwks;
+    const jwksUri = metadata.jwks_uri;
+    if (!jwksUri) throw new CimdClientAssertionError(metadata.client_id, "no_keys");
+    const now = Date.now();
+    const cached = this.keySets.get(jwksUri);
+    const reusable = cached && cached.expiresAt > now && (!refresh || now - cached.fetchedAt < KEY_SET_REFRESH_COOLDOWN_MS);
+    if (reusable) return cached.keys;
+    validateClientIdUrl(jwksUri, this.securityConfig);
+    const fetched = await this.fetchJson(jwksUri);
+    if (fetched.notModified) throw new CimdFetchError(jwksUri, "304 Not Modified to an unconditional request");
+    const parsed = clientJwksSchema.safeParse(fetched.document);
+    if (!parsed.success) throw new CimdValidationError(jwksUri, ["jwks_uri did not return a JSON Web Key Set"]);
+    const { ttlMs } = parseCacheHeaders(extractCacheHeaders(fetched.headers), this.cacheConfig);
+    this.keySets.delete(jwksUri);
+    this.keySets.set(jwksUri, { keys: parsed.data, fetchedAt: now, expiresAt: now + ttlMs });
+    if (this.keySets.size > MAX_CACHED_KEY_SETS) {
+      const oldest = this.keySets.keys().next().value;
+      if (oldest !== void 0) this.keySets.delete(oldest);
+    }
+    return parsed.data;
+  }
+  /** Why a `private_key_jwt` document's keys can't be used: neither or both of `jwks` / `jwks_uri`, or a bad URI. */
+  keySourceProblems(metadata) {
+    if (!metadata.jwks === !metadata.jwks_uri) {
+      return ['token_endpoint_auth_method "private_key_jwt" needs exactly one of "jwks" or "jwks_uri"'];
+    }
+    if (!metadata.jwks_uri) return [];
+    try {
+      validateClientIdUrl(metadata.jwks_uri, this.securityConfig);
+      return [];
+    } catch (error) {
+      if (error instanceof InvalidClientIdUrlError) return [`jwks_uri is not allowed: ${error.reason}`];
+      if (error instanceof CimdSecurityError) return [`jwks_uri is not allowed: ${error.securityReason}`];
+      throw error;
+    }
+  }
   /**
    * Clear the cache for a specific client or all clients.
    *
@@ -177,24 +269,39 @@ var CimdService = class {
     };
   }
   /**
-   * Fetch a metadata document from a CIMD URL.
+   * Fetch a metadata document from a CIMD URL, revalidating a cached one with a conditional request.
+   */
+  async fetchMetadataDocument(clientId) {
+    const cache = await this.cache();
+    const conditionalHeaders = await cache.getConditionalHeaders(clientId);
+    const fetched = await this.fetchJson(clientId, conditionalHeaders);
+    if (!fetched.notModified) return fetched;
+    const staleEntry = await cache.getStale(clientId);
+    if (!staleEntry) {
+      throw new CimdFetchError(clientId, "304 Not Modified but no cached entry", { httpStatus: 304 });
+    }
+    await cache.revalidate(clientId, fetched.headers);
+    this.logger.debug(`CIMD document not modified: ${clientId}`);
+    return { document: staleEntry.document, headers: fetched.headers };
+  }
+  /**
+   * Fetch a JSON document (a client metadata document or a client's `jwks_uri`) with the SSRF guard on every hop,
+   * the redirect policy, the timeout and the size limit. `url` names the document in every error.
    *
    * Following the JwksService.fetchJson() pattern.
    */
-  async fetchMetadataDocument(clientId) {
+  async fetchJson(url, conditionalHeaders) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.networkConfig.timeoutMs);
     try {
-      const cache = await this.cache();
-      const conditionalHeaders = await cache.getConditionalHeaders(clientId);
-      const originalOrigin = new URL(clientId).origin;
+      const originalOrigin = new URL(url).origin;
       const maxRedirects = this.networkConfig.maxRedirects;
-      let currentUrl = clientId;
+      let currentUrl = url;
       let redirectCount = 0;
       let isFirstRequest = true;
       while (true) {
         if (this.securityConfig.blockPrivateIPs && !this.securityConfig.allowInsecureForTesting) {
-          await assertHostNotSsrf(new URL(currentUrl).hostname, clientId);
+          await assertHostNotSsrf(new URL(currentUrl).hostname, url);
         }
         const headers = {
           Accept: "application/json"
@@ -209,23 +316,12 @@ var CimdService = class {
           redirect: "manual"
         });
         if (response.status === 304) {
-          const staleEntry = await cache.getStale(clientId);
-          if (staleEntry) {
-            await cache.revalidate(clientId, response.headers);
-            this.logger.debug(`CIMD document not modified: ${clientId}`);
-            return {
-              document: staleEntry.document,
-              headers: response.headers
-            };
-          }
-          throw new CimdFetchError(clientId, "304 Not Modified but no cached entry", {
-            httpStatus: 304
-          });
+          return { notModified: true, headers: response.headers };
         }
         if (isRedirectResponse(response)) {
           const location = response.headers.get("location");
           if (!location) {
-            throw new CimdFetchError(clientId, "Redirect response missing Location header", {
+            throw new CimdFetchError(url, "Redirect response missing Location header", {
               httpStatus: response.status
             });
           }
@@ -233,7 +329,7 @@ var CimdService = class {
           const redirectPolicy = this.networkConfig.redirectPolicy;
           if (redirectPolicy === "deny") {
             throw new CimdFetchError(
-              clientId,
+              url,
               `CIMD fetch redirected to "${nextUrl}" but redirects are disabled. Host the metadata at the client_id URL or set auth.cimd.network.redirectPolicy to "same-origin" or "allow".`,
               { httpStatus: response.status }
             );
@@ -242,7 +338,7 @@ var CimdService = class {
             const nextOrigin = new URL(nextUrl).origin;
             if (nextOrigin !== originalOrigin) {
               throw new CimdFetchError(
-                clientId,
+                url,
                 `CIMD fetch redirected to "${nextUrl}" which is not the same origin as "${originalOrigin}". Host the metadata at the client_id URL or set auth.cimd.network.redirectPolicy to "allow".`,
                 { httpStatus: response.status }
               );
@@ -252,7 +348,7 @@ var CimdService = class {
           redirectCount += 1;
           if (redirectCount > maxRedirects) {
             throw new CimdFetchError(
-              clientId,
+              url,
               `CIMD fetch exceeded max redirects (${maxRedirects}). Host the metadata at the client_id URL or increase auth.cimd.network.maxRedirects.`
             );
           }
@@ -262,7 +358,7 @@ var CimdService = class {
           continue;
         }
         if (!response.ok) {
-          throw new CimdFetchError(clientId, `HTTP ${response.status} ${response.statusText}`, {
+          throw new CimdFetchError(url, `HTTP ${response.status} ${response.statusText}`, {
             httpStatus: response.status
           });
         }
@@ -270,30 +366,30 @@ var CimdService = class {
         if (contentLength) {
           const length = parseInt(contentLength, 10);
           if (!isNaN(length) && length > this.networkConfig.maxResponseSizeBytes) {
-            throw new CimdResponseTooLargeError(clientId, this.networkConfig.maxResponseSizeBytes, length);
+            throw new CimdResponseTooLargeError(url, this.networkConfig.maxResponseSizeBytes, length);
           }
         }
-        const text = await this.readResponseWithLimit(response, this.networkConfig.maxResponseSizeBytes, clientId);
+        const text = await this.readResponseWithLimit(response, this.networkConfig.maxResponseSizeBytes, url);
         let document;
         try {
           document = JSON.parse(text);
         } catch (e) {
-          throw new CimdFetchError(clientId, "Invalid JSON response", {
+          throw new CimdFetchError(url, "Invalid JSON response", {
             originalError: e instanceof Error ? e : new Error(String(e))
           });
         }
-        return { document, headers: response.headers };
+        return { notModified: false, document, headers: response.headers };
       }
     } catch (error) {
       if (error instanceof CimdFetchError || error instanceof CimdResponseTooLargeError || error instanceof CimdSecurityError) {
         throw error;
       }
       if (error instanceof Error && error.name === "AbortError") {
-        throw new CimdFetchError(clientId, "Request timeout", {
+        throw new CimdFetchError(url, "Request timeout", {
           originalError: error
         });
       }
-      throw new CimdFetchError(clientId, error instanceof Error ? error.message : "Unknown error", {
+      throw new CimdFetchError(url, error instanceof Error ? error.message : "Unknown error", {
         originalError: error instanceof Error ? error : void 0
       });
     } finally {

package/browser/cimd/cimd.types.mjs

@@ -1,5 +1,8 @@
 // libs/auth/src/cimd/cimd.types.ts
 import { internalZ as z } from "@frontmcp/lazy-zod";
+var clientJwksSchema = z.object({
+  keys: z.array(z.record(z.string(), z.unknown()))
+});
 var clientMetadataDocumentSchema = z.object({
   // REQUIRED per CIMD spec
   /**
@@ -17,15 +20,17 @@ var clientMetadataDocumentSchema = z.object({
   redirect_uris: z.array(z.string().url()).min(1),
   // OPTIONAL per RFC 7591
   /**
-   * Token endpoint authentication method.
+   * Token endpoint authentication method. FrontMCP's authorization server accepts `none` (a public client) and
+   * `private_key_jwt` (a client assertion signed with a key from `jwks` / `jwks_uri`, RFC 7523). A public document
+   * holds no shared secret, so `client_secret_*` is refused.
    * @default 'none'
    */
   token_endpoint_auth_method: z.enum(["none", "client_secret_basic", "client_secret_post", "private_key_jwt"]).default("none"),
   /**
-   * OAuth grant types the client can use.
-   * @default ['authorization_code']
+   * OAuth grant types the client can use. Without `refresh_token`, the client gets no refresh token.
+   * @default ['authorization_code', 'refresh_token']
    */
-  grant_types: z.array(z.string()).default(["authorization_code"]),
+  grant_types: z.array(z.string()).default(["authorization_code", "refresh_token"]),
   /**
    * OAuth response types the client can request.
    * @default ['code']
@@ -40,15 +45,14 @@ var clientMetadataDocumentSchema = z.object({
    */
   logo_uri: z.string().url().optional(),
   /**
-   * URL of the client's JWKS (for private_key_jwt).
+   * URL of the client's JWKS, for `private_key_jwt`. Fetched with the same protections as the document itself,
+   * and cached. Not together with `jwks`.
    */
   jwks_uri: z.string().url().optional(),
   /**
-   * Inline JWKS (for private_key_jwt).
+   * Inline JWKS, for `private_key_jwt`. Not together with `jwks_uri`.
    */
-  jwks: z.object({
-    keys: z.array(z.record(z.string(), z.unknown()))
-  }).optional(),
+  jwks: clientJwksSchema.optional(),
   /**
    * URL of the client's terms of service.
    */
@@ -58,7 +62,7 @@ var clientMetadataDocumentSchema = z.object({
    */
   policy_uri: z.string().url().optional(),
   /**
-   * Requested OAuth scopes.
+   * Space-separated scopes the client may be granted (RFC 7591); a request for others is narrowed to these.
    */
   scope: z.string().optional(),
   /**
@@ -224,5 +228,6 @@ export {
   cimdNetworkConfigSchema,
   cimdRedisCacheConfigSchema,
   cimdSecurityConfigSchema,
+  clientJwksSchema,
   clientMetadataDocumentSchema
 };

package/browser/cimd/index.mjs

@@ -1,6 +1,7 @@
 // libs/auth/src/cimd/index.ts
 import { noopLogger } from "./cimd.logger.mjs";
 import {
+  clientJwksSchema,
   clientMetadataDocumentSchema,
   cimdCacheConfigSchema,
   cimdRedisCacheConfigSchema,
@@ -17,8 +18,14 @@ import {
   CimdSecurityError,
   RedirectUriMismatchError,
   CimdResponseTooLargeError,
-  CimdDisabledError
+  CimdDisabledError,
+  CimdClientAssertionError
 } from "./cimd.errors.mjs";
+import {
+  CLIENT_ASSERTION_TYPE_JWT_BEARER,
+  CLIENT_ASSERTION_SIGNING_ALGORITHMS,
+  MAX_CLIENT_ASSERTION_LIFETIME_SECONDS
+} from "./cimd-client-assertion.mjs";
 import {
   isCimdClientId,
   validateClientIdUrl,
@@ -34,6 +41,9 @@ import {
 import { RedisCimdCache } from "./cimd-redis.cache.mjs";
 import { CimdService } from "./cimd.service.mjs";
 export {
+  CLIENT_ASSERTION_SIGNING_ALGORITHMS,
+  CLIENT_ASSERTION_TYPE_JWT_BEARER,
+  CimdClientAssertionError,
   CimdClientIdMismatchError,
   CimdDisabledError,
   CimdError,
@@ -44,6 +54,7 @@ export {
   CimdValidationError,
   InMemoryCimdCache,
   InvalidClientIdUrlError,
+  MAX_CLIENT_ASSERTION_LIFETIME_SECONDS,
   RedirectUriMismatchError,
   RedisCimdCache,
   checkSsrfProtection,
@@ -52,6 +63,7 @@ export {
   cimdNetworkConfigSchema,
   cimdRedisCacheConfigSchema,
   cimdSecurityConfigSchema,
+  clientJwksSchema,
   clientMetadataDocumentSchema,
   createCimdCache,
   extractCacheHeaders,

package/browser/errors/auth-internal.error.mjs

@@ -1,12 +1,12 @@
 // libs/auth/src/errors/auth-internal.error.ts
-import { randomBytes, bytesToHex } from "@frontmcp/utils";
+import { bytesToHex, randomBytes } from "@frontmcp/utils";
 var AuthInternalError = class extends Error {
   /**
    * Unique error ID for tracking in logs.
    */
   errorId;
   /**
-   * Whether this error should expose details to the client.
+   * Whether the client sees the message: true only for an error that names a setting and nothing secret.
    */
   isPublic = false;
   /**
@@ -28,6 +28,7 @@ var AuthInternalError = class extends Error {
    * Get the public-facing error message.
    */
   getPublicMessage() {
+    if (this.isPublic) return this.message;
     return `Internal auth error. Please contact support with error ID: ${this.errorId}`;
   }
   /**

package/browser/errors/auth-internal.errors.mjs

@@ -58,16 +58,22 @@ var JwtSecretWeakError = class extends AuthInternalError {
     );
   }
 };
+var SigningKeyInvalidError = class extends AuthInternalError {
+  constructor(message) {
+    super(message, "SIGNING_KEY_INVALID");
+  }
+};
 var CredentialProviderAlreadyRegisteredError = class extends AuthInternalError {
   constructor(name) {
     super(`Credential provider "${name}" is already registered`, "CREDENTIAL_PROVIDER_ALREADY_REGISTERED");
   }
 };
 var AuthProvidersNotConfiguredError = class extends AuthInternalError {
+  isPublic = true;
   constructor(providerName) {
     const register = "Register it in @FrontMcp({ authProvidersVault: { providers: [...] } }).";
     super(
-      providerName === void 0 ? "Auth providers are not configured: this server registers no auth providers." : `Auth provider "${providerName}" is not configured: this server registers no auth providers. ${register}`,
+      providerName === void 0 ? "Auth providers are not configured: this server registers no auth providers. Register them in @FrontMcp({ authProvidersVault: { providers: [...] } })." : `Auth provider "${providerName}" is not configured: this server registers no auth providers. ${register}`,
       "AUTH_PROVIDERS_NOT_CONFIGURED"
     );
   }
@@ -146,6 +152,7 @@ export {
   SecureStoreConfigError,
   SessionIdEmptyError,
   SessionSecretRequiredError,
+  SigningKeyInvalidError,
   TokenLeakDetectedError,
   TokenNotAvailableError,
   TokenStoreRequiredError,

package/browser/errors/index.mjs

@@ -10,6 +10,7 @@ import {
   TokenLeakDetectedError,
   JwtSecretRequiredError,
   JwtSecretWeakError,
+  SigningKeyInvalidError,
   SessionSecretRequiredError,
   CredentialProviderAlreadyRegisteredError,
   AuthProvidersNotConfiguredError,
@@ -45,6 +46,7 @@ export {
   SecureStoreConfigError,
   SessionIdEmptyError,
   SessionSecretRequiredError,
+  SigningKeyInvalidError,
   TokenLeakDetectedError,
   TokenNotAvailableError,
   TokenStoreRequiredError,

package/browser/index.mjs

@@ -1,5 +1,5 @@
 // libs/auth/src/index.ts
-import { JwksService, trimSlash, normalizeIssuer, decodeJwtPayloadSafe } from "./jwks/index.mjs";
+import { JwksService, LocalTokenKeys, trimSlash, normalizeIssuer, decodeJwtPayloadSafe } from "./jwks/index.mjs";
 import {
   CDN,
   DEFAULT_THEME,
@@ -15,6 +15,7 @@ import {
   buildConsentPage,
   buildIncrementalAuthPage,
   buildFederatedLoginPage,
+  buildFederatedStepPage,
   buildToolConsentPage,
   buildLoginPage,
   buildConnectPage,
@@ -108,6 +109,7 @@ import {
   decryptSessionJson,
   safeDecrypt,
   resetCachedKey,
+  isSessionSecretConfigured,
   RedisSessionStore,
   VercelKvSessionStore,
   InMemoryOrchestratedTokenStore,
@@ -143,6 +145,7 @@ import {
   DEFAULT_RESUME_TTL_MS,
   signIncrementalAuthTicket,
   verifyIncrementalAuthTicket,
+  openIncrementalAuthTicketProfile,
   DEFAULT_INCREMENTAL_TICKET_TTL_MS,
   CREDENTIALS_ACCESSOR,
   CredentialsAccessorImpl,
@@ -183,6 +186,7 @@ import {
   TokenLeakDetectedError,
   JwtSecretRequiredError,
   JwtSecretWeakError,
+  SigningKeyInvalidError,
   SessionSecretRequiredError,
   CredentialProviderAlreadyRegisteredError,
   AuthProvidersNotConfiguredError,
@@ -262,6 +266,10 @@ import {
   RedirectUriMismatchError,
   CimdResponseTooLargeError,
   CimdDisabledError,
+  CimdClientAssertionError,
+  CLIENT_ASSERTION_TYPE_JWT_BEARER,
+  CLIENT_ASSERTION_SIGNING_ALGORITHMS,
+  MAX_CLIENT_ASSERTION_LIFETIME_SECONDS,
   isCimdClientId,
   validateClientIdUrl,
   checkSsrfProtection,
@@ -271,6 +279,7 @@ import {
   parseCacheHeaders,
   CimdService
 } from "./cimd/index.mjs";
+import { resolveUpstreamClient, UpstreamClientRegistrationError } from "./upstream/index.mjs";
 import { FrontMcpAuthContextImpl, buildAuthContext } from "./context/index.mjs";
 export { AuthoritiesContextBuilder, AuthoritiesEngine, AuthoritiesEvaluatorRegistry, AuthoritiesProfileRegistry, AuthorityDeniedError, abacConditionSchema, abacOperatorSchema, abacPolicySchema, authoritiesClaimsMappingSchema, authoritiesConfigSchema, authoritiesMetadataSchema, authoritiesPolicySchema, findAuthoritiesProfileProblems, findAuthoritiesRuleProblems, isAnonymousSubject, rbacPermissionsPolicySchema, rbacRolesPolicySchema, rebacPolicySchema, resolveRequiredScopes, resourceIdRefSchema } from "./authorities/index.mjs";
 import {
@@ -306,7 +315,10 @@ export {
   AuthorizationBase,
   BUILT_IN_AUTH_PAGE_CSP,
   CDN,
+  CLIENT_ASSERTION_SIGNING_ALGORITHMS,
+  CLIENT_ASSERTION_TYPE_JWT_BEARER,
   CREDENTIALS_ACCESSOR,
+  CimdClientAssertionError,
   CimdClientIdMismatchError,
   CimdDisabledError,
   CimdError,
@@ -346,7 +358,9 @@ export {
   JwtSecretRequiredError,
   JwtSecretWeakError,
   LazyCredentialLoader,
+  LocalTokenKeys,
   LoopbackTokenAuth,
+  MAX_CLIENT_ASSERTION_LIFETIME_SECONDS,
   NoProviderIdError,
   NullOrchestratedAuthAccessor,
   ORCHESTRATED_AUTH_ACCESSOR,
@@ -370,6 +384,7 @@ export {
   SessionIdEmptyError,
   SessionRateLimiter,
   SessionSecretRequiredError,
+  SigningKeyInvalidError,
   StorageAuthorizationStore,
   StorageAuthorizationVault,
   StorageConsentStore,
@@ -385,6 +400,7 @@ export {
   TransportIdGenerator,
   TypedStorage,
   UNIDENTIFIED_SESSION_PREFIX,
+  UpstreamClientRegistrationError,
   VaultEncryption,
   VaultLoadError,
   VaultNotFoundError,
@@ -418,6 +434,7 @@ export {
   buildCredentialResumeUrl,
   buildErrorPage,
   buildFederatedLoginPage,
+  buildFederatedStepPage,
   buildIncrementalAuthPage,
   buildInsufficientScopeHeader,
   buildInvalidRequestHeader,
@@ -499,6 +516,7 @@ export {
   isPersistentTokenStorage,
   isRedisTokenStorage,
   isSessionComplete,
+  isSessionSecretConfigured,
   isSharedServerNonce,
   isSignedSession,
   isSoonExpiring,
@@ -514,6 +532,7 @@ export {
   noopLogger,
   normalizeIssuer,
   oauthCredentialSchema,
+  openIncrementalAuthTicketProfile,
   openPendingLogin,
   parseCacheHeaders,
   parseWwwAuthenticate,
@@ -532,6 +551,7 @@ export {
   renderLocalLoginPage,
   renderToHtml,
   resetCachedKey,
+  resolveUpstreamClient,
   resourceScopesFor,
   safeDecrypt,
   scopesFromClaims,

package/browser/jwks/index.mjs

@@ -1,8 +1,10 @@
 // libs/auth/src/jwks/index.ts
 import { JwksService } from "./jwks.service.mjs";
+import { LocalTokenKeys } from "./local-token-keys.mjs";
 import { trimSlash, normalizeIssuer, decodeJwtPayloadSafe } from "./jwks.utils.mjs";
 export {
   JwksService,
+  LocalTokenKeys,
   decodeJwtPayloadSafe,
   normalizeIssuer,
   trimSlash