@frontmcp/auth 1.11.2 → 1.12.0-rc.1

package/browser/ui/templates.mjs

@@ -117,14 +117,14 @@ function buildIncrementalAuthPage(params) {
   return centeredCardLayout(content, { title: `Authorize ${app.appName}` });
 }
 function buildFederatedLoginPage(params) {
-  const { providers, clientName, pendingAuthId, callbackPath } = params;
+  const { providers, clientName, pendingAuthId, callbackPath, allowSkip = true } = params;
   const providerCards = providers.map((provider) => {
     const isPrimaryBadge = provider.isPrimary ? `<span class="px-2 py-0.5 text-xs font-medium bg-blue-600 text-white rounded-full">Primary</span>` : "";
     const providerUrl = provider.providerUrl ? `<p class="text-xs text-gray-400 font-mono truncate">${escapeHtml(provider.providerUrl)}</p>` : "";
     const appIds = provider.appIds.length > 0 ? `<p class="text-xs text-gray-500 mt-1">Apps: ${provider.appIds.map((id) => escapeHtml(id)).join(", ")}</p>` : "";
     return `<label class="flex items-start gap-4 p-4 bg-white border-2 border-gray-200 rounded-xl cursor-pointer hover:border-blue-300 transition-colors has-[:checked]:border-blue-500 has-[:checked]:bg-blue-50">
       <input type="checkbox" name="providers" value="${escapeHtml(provider.providerId)}"
-        class="mt-1 w-5 h-5 rounded border-gray-300" ${provider.isPrimary ? "checked" : ""}>
+        class="mt-1 w-5 h-5 rounded border-gray-300" ${provider.isPrimary || provider.required ? "checked" : ""}${provider.required ? " required" : ""}>
       <div class="flex-1">
         <div class="flex items-center gap-2 mb-1">
           <span class="font-semibold text-gray-900">${escapeHtml(provider.providerName)}</span>
@@ -136,6 +136,14 @@ function buildFederatedLoginPage(params) {
       </div>
     </label>`;
   }).join("\n");
+  const skipAllButton = allowSkip ? `<button type="button"
+          class="flex-1 px-6 py-3 text-gray-700 bg-gray-100 hover:bg-gray-200 font-medium rounded-lg transition-colors"
+          onclick="document.querySelectorAll('input[name=providers]').forEach(cb => cb.checked = false); document.getElementById('federated-form').submit();">
+          Skip All
+        </button>` : "";
+  const skipNote = allowSkip ? `<div class="mt-6 p-4 bg-blue-50 border border-blue-200 rounded-lg text-sm text-blue-800">
+      Skipped providers can be authorized later when you try to use their tools (progressive authorization).
+    </div>` : "";
   const content = `
     <h1 class="text-3xl font-bold text-gray-900 mb-4">Select Authorization Providers</h1>
     <p class="text-gray-600 mb-8">
@@ -167,23 +175,68 @@ function buildFederatedLoginPage(params) {
 
       <!-- Buttons -->
       <div class="flex gap-4">
-        <button type="button"
-          class="flex-1 px-6 py-3 text-gray-700 bg-gray-100 hover:bg-gray-200 font-medium rounded-lg transition-colors"
-          onclick="document.querySelectorAll('input[name=providers]').forEach(cb => cb.checked = false); document.getElementById('federated-form').submit();">
-          Skip All
-        </button>
+        ${skipAllButton}
         <button type="submit"
           class="flex-1 px-6 py-3 bg-blue-600 hover:bg-blue-700 text-white font-medium rounded-lg transition-colors">
           Continue
         </button>
       </div>
     </form>
-
-    <div class="mt-6 p-4 bg-blue-50 border border-blue-200 rounded-lg text-sm text-blue-800">
-      Skipped providers can be authorized later when you try to use their tools (progressive authorization).
-    </div>`;
+    ${skipNote}`;
   return wideLayout(content, { title: "Select Providers" });
 }
+function buildFederatedStepPage(params) {
+  const { provider, step, clientName, pendingAuthId, callbackPath, csrfToken, error } = params;
+  const primaryBadge = provider.isPrimary ? `<span class="px-2 py-0.5 text-xs font-medium bg-blue-600 text-white rounded-full">Primary</span>` : "";
+  const providerUrl = provider.providerUrl ? `<p class="text-xs text-gray-400 font-mono truncate">${escapeHtml(provider.providerUrl)}</p>` : "";
+  const appIds = provider.appIds.length > 0 ? `<p class="text-xs text-gray-500 mt-1">Apps: ${provider.appIds.map((id) => escapeHtml(id)).join(", ")}</p>` : "";
+  const errorBanner = error ? `<div class="mb-6 p-4 bg-red-50 border border-red-200 rounded-lg text-sm text-red-800">${escapeHtml(error)}</div>` : "";
+  const emailField = step.last ? `<div class="mb-6">
+        <label for="email" class="block text-sm font-medium text-gray-700 mb-2">Email</label>
+        <input type="email" id="email" name="email" required placeholder="you@example.com"
+          class="w-full px-4 py-3 border border-gray-300 rounded-lg focus:ring-2 focus:ring-blue-500 focus:border-blue-500">
+      </div>` : "";
+  const secondaryButton = "flex-1 px-6 py-3 text-gray-700 bg-gray-100 hover:bg-gray-200 font-medium rounded-lg transition-colors";
+  const skipButton = step.canSkip ? `<button type="submit" name="action" value="skip" class="${secondaryButton}">Skip</button>` : "";
+  const backButton = step.canGoBack ? `<button type="submit" name="action" value="back" formnovalidate class="${secondaryButton}">Back</button>` : "";
+  const skipNote = step.canSkip ? `<div class="mt-6 p-4 bg-blue-50 border border-blue-200 rounded-lg text-sm text-blue-800">
+      A skipped provider can be authorized later when you try to use its tools (progressive authorization).
+    </div>` : "";
+  const content = `
+    <p class="text-sm font-medium text-blue-600 mb-2">Step ${step.index + 1} of ${step.count}</p>
+    <h1 class="text-3xl font-bold text-gray-900 mb-4">Authorize ${escapeHtml(provider.providerName)}</h1>
+    <p class="text-gray-600 mb-8">
+      ${escapeHtml(clientName)} uses multiple authentication providers. Authorize them one at a time.
+    </p>
+    ${errorBanner}
+    <form method="POST" action="${escapeHtml(callbackPath)}" id="federated-step-form">
+      <input type="hidden" name="pending_auth_id" value="${escapeHtml(pendingAuthId)}">
+      <input type="hidden" name="federated" value="true">
+      <input type="hidden" name="federated_step" value="${step.index}">
+      <input type="hidden" name="csrf" value="${escapeHtml(csrfToken)}">
+
+      <div class="p-4 bg-white border-2 border-blue-500 rounded-xl mb-8">
+        <div class="flex items-center gap-2 mb-1">
+          <span class="font-semibold text-gray-900">${escapeHtml(provider.providerName)}</span>
+          ${primaryBadge}
+        </div>
+        <p class="text-sm text-gray-500">Mode: ${escapeHtml(provider.mode)}</p>
+        ${providerUrl}
+        ${appIds}
+      </div>
+      ${emailField}
+      <div class="flex flex-row-reverse gap-4">
+        <button type="submit" name="action" value="continue"
+          class="flex-1 px-6 py-3 bg-blue-600 hover:bg-blue-700 text-white font-medium rounded-lg transition-colors">
+          ${step.last ? "Finish" : "Continue"}
+        </button>
+        ${skipButton}
+        ${backButton}
+      </div>
+    </form>
+    ${skipNote}`;
+  return wideLayout(content, { title: `Authorize ${provider.providerName}` });
+}
 function buildToolConsentPage(params) {
   const {
     tools,
@@ -474,6 +527,7 @@ export {
   buildConsentPage,
   buildErrorPage,
   buildFederatedLoginPage,
+  buildFederatedStepPage,
   buildIncrementalAuthPage,
   buildLoginPage,
   buildToolConsentPage,

package/browser/upstream/index.mjs

@@ -0,0 +1,6 @@
+// libs/auth/src/upstream/index.ts
+import { resolveUpstreamClient, UpstreamClientRegistrationError } from "./upstream-client-registration.mjs";
+export {
+  UpstreamClientRegistrationError,
+  resolveUpstreamClient
+};

package/browser/upstream/upstream-client-registration.mjs

@@ -0,0 +1,273 @@
+// libs/auth/src/upstream/upstream-client-registration.ts
+import { internalZ as z } from "@frontmcp/lazy-zod";
+import {
+  base64urlDecode,
+  base64urlEncode,
+  decryptAesGcm,
+  encryptAesGcm,
+  hkdfSha256,
+  isProduction,
+  randomBytes,
+  sha256Hex,
+  StorageNotSupportedError
+} from "@frontmcp/utils";
+import { noopAuthLogger } from "../common/auth-logger.interface.mjs";
+import { AuthInternalError } from "../errors/auth-internal.error.mjs";
+import { normalizeIssuer, trimSlash } from "../jwks/jwks.utils.mjs";
+var STORAGE_KEY_PREFIX = "upstream-client:";
+var HKDF_SALT = new TextEncoder().encode("frontmcp-upstream-client");
+var DEFAULT_TIMEOUT_MS = 1e4;
+var SECRET_EXPIRY_MARGIN_SECONDS = 60;
+var SUPPORTED_AUTH_METHODS = ["client_secret_post", "none"];
+var UpstreamClientRegistrationError = class extends AuthInternalError {
+  constructor(provider, reason) {
+    super(
+      `Dynamic client registration with ${provider} failed: ${reason}. Register a client at the provider and set clientId (and clientSecret), or fix providerConfig.registrationEndpoint.`,
+      "UPSTREAM_CLIENT_REGISTRATION_FAILED"
+    );
+  }
+};
+var storedClientSchema = z.object({
+  clientId: z.string().min(1),
+  clientSecret: z.string().optional(),
+  clientSecretExpiresAt: z.number().optional(),
+  redirectUri: z.string()
+});
+var registrationResponseSchema = z.object({
+  client_id: z.string().min(1),
+  client_secret: z.string().optional(),
+  client_secret_expires_at: z.number().optional(),
+  redirect_uris: z.array(z.string()).optional(),
+  token_endpoint_auth_method: z.string().optional()
+});
+var metadataSchema = z.object({
+  issuer: z.string().optional(),
+  registration_endpoint: z.string().optional()
+});
+async function resolveUpstreamClient(options) {
+  const logger = options.logger ?? noopAuthLogger;
+  const { storage } = options;
+  const storageKey = upstreamClientStorageKey(options);
+  const cached = storage ? await readStoredClient(storage, options, storageKey) : { status: "missing" };
+  if (cached.status === "usable") {
+    logger.info(`Using client ${cached.client.clientId}, registered earlier with ${options.provider}`);
+    return cached.client;
+  }
+  const registered = await registerUpstreamClient(options);
+  logger.info(`Registered client ${registered.clientId} with ${options.provider}`);
+  if (!storage) {
+    logger.info("No persistent tokenStorage is configured, so the server registers again on its next start");
+    return registered;
+  }
+  return storeClient(storage, options, storageKey, registered, cached.status === "stale");
+}
+async function registerUpstreamClient(options) {
+  const endpoint = options.registrationEndpoint ?? await discoverRegistrationEndpoint(options);
+  assertFetchableUrl(options.provider, endpoint);
+  const requestBody = {
+    client_name: options.clientName,
+    redirect_uris: [options.redirectUri],
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    token_endpoint_auth_method: "client_secret_post",
+    ...options.scopes.length > 0 ? { scope: options.scopes.join(" ") } : {}
+  };
+  let response;
+  try {
+    response = await fetchWithTimeout(options, endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify(requestBody)
+    });
+  } catch (error) {
+    throw new UpstreamClientRegistrationError(
+      options.provider,
+      `${endpoint} could not be reached (${describe(error)})`
+    );
+  }
+  const responseBody = await response.json().catch(() => void 0);
+  if (!response.ok) {
+    throw new UpstreamClientRegistrationError(
+      options.provider,
+      `${endpoint} answered ${response.status}${describeOAuthError(responseBody)}`
+    );
+  }
+  const parsed = registrationResponseSchema.safeParse(responseBody);
+  if (!parsed.success) {
+    throw new UpstreamClientRegistrationError(options.provider, `${endpoint} answered without a client_id`);
+  }
+  const registration = parsed.data;
+  if (registration.redirect_uris && !registration.redirect_uris.includes(options.redirectUri)) {
+    throw new UpstreamClientRegistrationError(
+      options.provider,
+      `the provider registered other redirect URIs than ${options.redirectUri}`
+    );
+  }
+  const authMethod = registration.token_endpoint_auth_method;
+  if (authMethod && !SUPPORTED_AUTH_METHODS.includes(authMethod)) {
+    (options.logger ?? noopAuthLogger).warn(
+      `${options.provider} registered the client for token_endpoint_auth_method "${authMethod}"; FrontMCP sends the client secret in the token request body (client_secret_post)`
+    );
+  }
+  return {
+    clientId: registration.client_id,
+    clientSecret: registration.client_secret,
+    clientSecretExpiresAt: registration.client_secret_expires_at,
+    redirectUri: options.redirectUri
+  };
+}
+async function discoverRegistrationEndpoint(options) {
+  const logger = options.logger ?? noopAuthLogger;
+  const issuer = trimSlash(options.provider);
+  const issuerUrl = new URL(issuer);
+  const issuerPath = issuerUrl.pathname === "/" ? "" : issuerUrl.pathname;
+  const metadataUrls = [
+    `${issuerUrl.origin}/.well-known/oauth-authorization-server${issuerPath}`,
+    `${issuer}/.well-known/openid-configuration`
+  ];
+  for (const metadataUrl of metadataUrls) {
+    const metadata = await fetchMetadata(options, metadataUrl);
+    if (!metadata) continue;
+    if (normalizeIssuer(metadata.issuer) !== normalizeIssuer(issuer)) {
+      logger.warn(`Ignoring ${metadataUrl}: its issuer "${metadata.issuer ?? ""}" is not ${issuer}`);
+      continue;
+    }
+    if (metadata.registration_endpoint) return metadata.registration_endpoint;
+  }
+  throw new UpstreamClientRegistrationError(
+    options.provider,
+    `no registration_endpoint found in ${metadataUrls.join(" or ")}`
+  );
+}
+async function fetchMetadata(options, metadataUrl) {
+  assertFetchableUrl(options.provider, metadataUrl);
+  try {
+    const response = await fetchWithTimeout(options, metadataUrl, { headers: { Accept: "application/json" } });
+    if (!response.ok) return void 0;
+    const parsed = metadataSchema.safeParse(await response.json());
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readStoredClient(storage, options, storageKey) {
+  const logger = options.logger ?? noopAuthLogger;
+  let sealed;
+  try {
+    sealed = await storage.get(storageKey);
+  } catch (error) {
+    logger.warn(`Could not read the stored upstream client (${describe(error)}); registering a new one`);
+    return { status: "missing" };
+  }
+  if (!sealed) return { status: "missing" };
+  const client = openClient(options.encryptionKey, storageKey, sealed);
+  if (!client) {
+    logger.warn("The stored upstream client could not be decrypted (did JWT_SECRET change?); registering a new one");
+    return { status: "stale" };
+  }
+  if (client.redirectUri !== options.redirectUri || isSecretExpired(client)) return { status: "stale" };
+  return { status: "usable", client };
+}
+async function storeClient(storage, options, storageKey, client, replace) {
+  const logger = options.logger ?? noopAuthLogger;
+  const sealed = sealClient(options.encryptionKey, storageKey, client);
+  const ttlSeconds = secretTtlSeconds(client);
+  try {
+    if (replace) {
+      await storage.set(storageKey, sealed, { ttlSeconds });
+      return client;
+    }
+    try {
+      await storage.set(storageKey, sealed, { ttlSeconds, ifNotExists: true });
+    } catch (error) {
+      if (!(error instanceof StorageNotSupportedError)) throw error;
+      await storage.set(storageKey, sealed, { ttlSeconds });
+      return client;
+    }
+    const stored = await storage.get(storageKey);
+    const winner = stored ? openClient(options.encryptionKey, storageKey, stored) : void 0;
+    if (winner && winner.clientId !== client.clientId) {
+      logger.info(`Another instance registered client ${winner.clientId} first; using it`);
+      return winner;
+    }
+  } catch (error) {
+    logger.warn(`Could not store the upstream client (${describe(error)}); it is used by this process only`);
+  }
+  return client;
+}
+function upstreamClientStorageKey(options) {
+  const scopes = [...options.scopes].sort().join(" ");
+  return `${STORAGE_KEY_PREFIX}${sha256Hex(`${normalizeIssuer(options.provider)}
+${options.redirectUri}
+${scopes}`)}`;
+}
+function recordKey(encryptionKey, storageKey) {
+  return hkdfSha256(encryptionKey, HKDF_SALT, new TextEncoder().encode(storageKey), 32);
+}
+function sealClient(encryptionKey, storageKey, client) {
+  const iv = randomBytes(12);
+  const plaintext = new TextEncoder().encode(JSON.stringify(client));
+  const { ciphertext, tag } = encryptAesGcm(recordKey(encryptionKey, storageKey), plaintext, iv);
+  return JSON.stringify({ iv: base64urlEncode(iv), tag: base64urlEncode(tag), data: base64urlEncode(ciphertext) });
+}
+function openClient(encryptionKey, storageKey, sealed) {
+  try {
+    const envelope = JSON.parse(sealed);
+    const plaintext = decryptAesGcm(
+      recordKey(encryptionKey, storageKey),
+      base64urlDecode(envelope.data),
+      base64urlDecode(envelope.iv),
+      base64urlDecode(envelope.tag)
+    );
+    const parsed = storedClientSchema.safeParse(JSON.parse(new TextDecoder().decode(plaintext)));
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isSecretExpired(client) {
+  const expiresAt = client.clientSecretExpiresAt;
+  if (!expiresAt) return false;
+  return expiresAt - SECRET_EXPIRY_MARGIN_SECONDS <= Math.floor(Date.now() / 1e3);
+}
+function secretTtlSeconds(client) {
+  const expiresAt = client.clientSecretExpiresAt;
+  if (!expiresAt) return void 0;
+  return Math.max(1, expiresAt - Math.floor(Date.now() / 1e3));
+}
+function assertFetchableUrl(provider, url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new UpstreamClientRegistrationError(provider, `"${url}" is not a URL`);
+  }
+  const host = parsed.hostname.toLowerCase();
+  const isLoopback = host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host.endsWith(".localhost");
+  const allowed = parsed.protocol === "https:" || parsed.protocol === "http:" && (isLoopback || !isProduction());
+  if (!allowed) {
+    throw new UpstreamClientRegistrationError(provider, `${url} is not an https URL`);
+  }
+}
+async function fetchWithTimeout(options, url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, redirect: "error", signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function describeOAuthError(body) {
+  if (!body || typeof body !== "object") return "";
+  const { error, error_description: description } = body;
+  if (typeof error !== "string") return "";
+  return typeof description === "string" ? `: ${error} (${description})` : `: ${error}`;
+}
+function describe(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+export {
+  UpstreamClientRegistrationError,
+  resolveUpstreamClient
+};

package/cimd/cimd-client-assertion.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `private_key_jwt` client authentication (RFC 7523 §2.2 and §3, RFC 7521 §4.2) for clients whose client ID
+ * metadata document declares it: the client signs a short-lived JWT with a key from its `jwks` / `jwks_uri`.
+ */
+import type { JSONWebKeySet } from 'jose';
+/** The `client_assertion_type` of a JWT client assertion (RFC 7523 §2.2). */
+export declare const CLIENT_ASSERTION_TYPE_JWT_BEARER = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+/** The signature algorithms a client assertion may use: asymmetric only, so never `none` or `HS*`. */
+export declare const CLIENT_ASSERTION_SIGNING_ALGORITHMS: string[];
+/** How far in the future an assertion's `exp` may be. */
+export declare const MAX_CLIENT_ASSERTION_LIFETIME_SECONDS = 600;
+/** What a token request carries to authenticate a `private_key_jwt` client. */
+export interface ClientAssertionInput {
+    /** The request's `client_assertion_type`. */
+    type?: string;
+    /** The request's `client_assertion`. */
+    assertion?: string;
+    /** What the assertion's `aud` may name: this server's token endpoint and its issuer. */
+    audiences: readonly string[];
+}
+/** {@link ClientAssertionInput}, with the store that makes each assertion's `jti` single-use. */
+export interface ClientAssertionCheck extends ClientAssertionInput {
+    /**
+     * Claim `key` for `ttlMs`, exactly once across the deployment.
+     * @returns `true` for the first claim, `false` when the key was already claimed or the store is unavailable
+     */
+    claimOnce(key: string, ttlMs: number): Promise<boolean>;
+}
+interface ClientAssertionContext extends ClientAssertionCheck {
+    clientId: string;
+    /** The client's keys; `refresh` asks for a fresh copy when the assertion names a key the cached one lacks. */
+    keys(refresh: boolean): Promise<JSONWebKeySet>;
+}
+/**
+ * Verify a client assertion: an asymmetric signature by one of the client's keys; `iss` and `sub` equal to the
+ * `client_id`; an `aud` naming this server; an `exp` at most {@link MAX_CLIENT_ASSERTION_LIFETIME_SECONDS} ahead;
+ * `nbf` and `iat` not in the future; and a `jti` never seen before within the assertion's lifetime.
+ *
+ * @throws CimdClientAssertionError naming the check that refused it
+ */
+export declare function verifyClientAssertion(context: ClientAssertionContext): Promise<void>;
+export {};
+//# sourceMappingURL=cimd-client-assertion.d.ts.map

package/cimd/cimd-client-assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-client-assertion.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd-client-assertion.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,MAAM,CAAC;AAOtD,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,2DAA2D,CAAC;AAEzG,sGAAsG;AACtG,eAAO,MAAM,mCAAmC,UAY/C,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAKzD,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED,UAAU,sBAAuB,SAAQ,oBAAoB;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,8GAA8G;IAC9G,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAChD;AAID;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC1F"}

package/cimd/cimd-redis.cache.d.ts

@@ -1,5 +1,5 @@
-import type { CimdCacheBackend, CimdCacheEntry, CimdCacheTtlConfig } from './cimd.cache';
-import type { ClientMetadataDocument, CimdCacheConfig } from './cimd.types';
+import { type CimdCacheBackend, type CimdCacheEntry, type CimdCacheTtlConfig } from './cimd.cache';
+import type { CimdCacheConfig, ClientMetadataDocument } from './cimd.types';
 /**
  * Redis-backed CIMD document cache.
  *

package/cimd/cimd-redis.cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd-redis.cache.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd-redis.cache.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEzF,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAa5E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,cAAe,YAAW,gBAAgB;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAElC,MAAM,EAAE,eAAe;IA+BnC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAKhB;;;;;OAKG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IA0BhE;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAerE;;;;;;OAMG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB9F;;;;;OAKG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4BtE;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhD;;;;;OAKG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IA0B1F;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAK7B;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IA2BhC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"cimd-redis.cache.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd-redis.cache.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAa5E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,cAAe,YAAW,gBAAgB;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAElC,MAAM,EAAE,eAAe;IA+BnC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAKhB;;;;;OAKG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IA0BhE;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAerE;;;;;;OAMG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB9F;;;;;OAKG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4BtE;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhD;;;;;OAKG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IA0B1F;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAK7B;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IA2BhC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/cimd/cimd.cache.d.ts

@@ -6,7 +6,7 @@
  *
  * Supports both in-memory and Redis backends.
  */
-import type { ClientMetadataDocument, CimdCacheConfig } from './cimd.types';
+import type { CimdCacheConfig, ClientMetadataDocument } from './cimd.types';
 /**
  * Cache entry for a CIMD document.
  */

package/cimd/cimd.cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.cache.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,QAAQ,EAAE,sBAAsB,CAAC;IAEjC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAE3D;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEhE;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzF;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3C;;OAEG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC;IAErF;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;OAEG;IACH,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAExB;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE3B;;OAEG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAQtE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,kBAAkB,GACzB;IACD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAwDA;AA6BD;;;;;GAKG;AACH,qBAAa,iBAAkB,YAAW,gBAAgB;IACxD,OAAO,CAAC,KAAK,CAAqC;IAClD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAElC,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;IAQ7C;;;;;OAKG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAiBhE;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAIrE;;;;;;OAMG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB9F;;;;;OAKG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBtE;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD;;;;;OAKG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAmB1F;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;CAcjC;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAezF"}
+{"version":3,"file":"cimd.cache.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,QAAQ,EAAE,sBAAsB,CAAC;IAEjC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAE3D;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAEhE;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzF;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3C;;OAEG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC;IAErF;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;OAEG;IACH,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAExB;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE3B;;OAEG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAQtE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,kBAAkB,GACzB;IACD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAwDA;AA6BD;;;;;GAKG;AACH,qBAAa,iBAAkB,YAAW,gBAAgB;IACxD,OAAO,CAAC,KAAK,CAAqC;IAClD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAElC,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;IAQ7C;;;;;OAKG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAiBhE;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAIrE;;;;;;OAMG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB9F;;;;;OAKG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBtE;;;;;OAKG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD;;;;;OAKG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAmB1F;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;CAcjC;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAezF"}

package/cimd/cimd.errors.d.ts

@@ -115,6 +115,20 @@ export declare class CimdResponseTooLargeError extends CimdError {
     constructor(clientIdUrl: string, maxBytes: number, actualBytes?: number);
     getPublicMessage(): string;
 }
+/**
+ * Which check refused a `private_key_jwt` client assertion. For the server's own logs: the client is told only
+ * that its authentication failed.
+ */
+export type ClientAssertionRefusal = 'missing_assertion' | 'unsupported_assertion_type' | 'malformed' | 'unsupported_algorithm' | 'no_keys' | 'unknown_key' | 'bad_signature' | 'wrong_issuer' | 'wrong_subject' | 'wrong_audience' | 'missing_claim' | 'expired' | 'not_yet_valid' | 'lifetime_too_long' | 'replayed';
+/**
+ * Thrown when a client that authenticates with `private_key_jwt` presents no valid client assertion
+ * (RFC 7523 §3). The token endpoint answers `invalid_client`.
+ */
+export declare class CimdClientAssertionError extends CimdError {
+    readonly reason: ClientAssertionRefusal;
+    constructor(clientIdUrl: string, reason: ClientAssertionRefusal);
+    getPublicMessage(): string;
+}
 /**
  * Thrown when CIMD is disabled but a CIMD client_id is used.
  */

package/cimd/cimd.errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.errors.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;GAKG;AACH,8BAAsB,SAAU,SAAQ,KAAK;IAC3C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAElB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;IAanF;;;OAGG;IACH,gBAAgB,IAAI,MAAM;CAG3B;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAKtC,gBAAgB,IAAI,MAAM;CAGpC;AAED;;;;;;;GAOG;AACH,qBAAa,cAAe,SAAQ,SAAS;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;gBAEnB,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,KAAK,CAAA;KAAE;IAMjG,gBAAgB,IAAI,MAAM;CAMpC;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;gBAExB,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;IAKxC,gBAAgB,IAAI,MAAM;CAGpC;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,SAAS;IACtD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM;IAUhD,gBAAgB,IAAI,MAAM;CAGpC;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAKtC,gBAAgB,IAAI,MAAM;CAGpC;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,SAAS;IACrD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;gBAE3B,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE;IAWnF,gBAAgB,IAAI,MAAM;CAGpC;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,SAAS;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAElB,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;IAa9D,gBAAgB,IAAI,MAAM;CAGpC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;;CAI/C"}
+{"version":3,"file":"cimd.errors.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;GAKG;AACH,8BAAsB,SAAU,SAAQ,KAAK;IAC3C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAElB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;IAanF;;;OAGG;IACH,gBAAgB,IAAI,MAAM;CAG3B;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAKtC,gBAAgB,IAAI,MAAM;CAGpC;AAED;;;;;;;GAOG;AACH,qBAAa,cAAe,SAAQ,SAAS;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;gBAEnB,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,KAAK,CAAA;KAAE;IAMjG,gBAAgB,IAAI,MAAM;CAMpC;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;gBAExB,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;IAKxC,gBAAgB,IAAI,MAAM;CAGpC;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,SAAS;IACtD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM;IAUhD,gBAAgB,IAAI,MAAM;CAGpC;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAKtC,gBAAgB,IAAI,MAAM;CAGpC;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,SAAS;IACrD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;gBAE3B,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE;IAWnF,gBAAgB,IAAI,MAAM;CAGpC;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,SAAS;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAElB,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;IAa9D,gBAAgB,IAAI,MAAM;CAGpC;AAED;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAC9B,mBAAmB,GACnB,4BAA4B,GAC5B,WAAW,GACX,uBAAuB,GACvB,SAAS,GACT,aAAa,GACb,eAAe,GACf,cAAc,GACd,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,SAAS,GACT,eAAe,GACf,mBAAmB,GACnB,UAAU,CAAC;AAEf;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,SAAS;IACrD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;gBAE5B,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB;IAKtD,gBAAgB,IAAI,MAAM;CAGpC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;;CAI/C"}

package/cimd/cimd.service.d.ts

@@ -1,3 +1,4 @@
+import { type ClientAssertionCheck } from './cimd-client-assertion';
 import { type CimdLogger } from './cimd.logger';
 import { type CimdConfigInput, type CimdResolutionResult, type ClientMetadataDocument } from './cimd.types';
 /**
@@ -11,6 +12,7 @@ export declare class CimdService {
     private readonly securityConfig;
     private readonly networkConfig;
     private cacheBackend?;
+    private readonly keySets;
     private readonly logger;
     /**
      * Whether CIMD is enabled.
@@ -60,6 +62,34 @@ export declare class CimdService {
      * @throws RedirectUriMismatchError if the redirect_uri is not registered
      */
     validateRedirectUri(redirectUri: string, metadata: ClientMetadataDocument): void;
+    /**
+     * Check that this server can honor the client as its document declares it: it authenticates at the token
+     * endpoint with `none`, or with `private_key_jwt` and exactly one of `jwks` / `jwks_uri` (a public document holds
+     * no shared secret, so `client_secret_*` is refused), and it uses the authorization code grant with
+     * `response_type=code`.
+     *
+     * @param metadata - The client's metadata document
+     * @throws CimdValidationError naming each declaration this server cannot honor
+     */
+    assertSupportedClient(metadata: ClientMetadataDocument): void;
+    /**
+     * Authenticate a `private_key_jwt` client by its assertion (RFC 7523): see {@link verifyClientAssertion}.
+     *
+     * @param metadata - The client's metadata document, which declares `private_key_jwt`
+     * @param check - The token request's assertion, the audiences it may name, and the `jti` store
+     * @throws CimdClientAssertionError when the assertion is missing or refused
+     * @throws CimdFetchError, CimdResponseTooLargeError or CimdSecurityError when `jwks_uri` can't be fetched
+     */
+    verifyClientAssertion(metadata: ClientMetadataDocument, check: ClientAssertionCheck): Promise<void>;
+    /**
+     * The client's keys: its inline `jwks`, or the key set at its `jwks_uri`, fetched like the document itself
+     * (SSRF guard, redirect policy, timeout, size limit) and cached for the TTL its cache headers give, within
+     * `cache.minTtlMs` and `cache.maxTtlMs`. With `refresh`, a cached key set at least
+     * {@link KEY_SET_REFRESH_COOLDOWN_MS} old is fetched again.
+     */
+    private clientKeys;
+    /** Why a `private_key_jwt` document's keys can't be used: neither or both of `jwks` / `jwks_uri`, or a bad URI. */
+    private keySourceProblems;
     /**
      * Clear the cache for a specific client or all clients.
      *
@@ -73,11 +103,16 @@ export declare class CimdService {
         size: number;
     }>;
     /**
-     * Fetch a metadata document from a CIMD URL.
+     * Fetch a metadata document from a CIMD URL, revalidating a cached one with a conditional request.
+     */
+    private fetchMetadataDocument;
+    /**
+     * Fetch a JSON document (a client metadata document or a client's `jwks_uri`) with the SSRF guard on every hop,
+     * the redirect policy, the timeout and the size limit. `url` names the document in every error.
      *
      * Following the JwksService.fetchJson() pattern.
      */
-    private fetchMetadataDocument;
+    private fetchJson;
     /**
      * Read response body with size limit.
      */

package/cimd/cimd.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.service.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.service.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAQL,KAAK,eAAe,EAEpB,KAAK,oBAAoB,EAEzB,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAGtB;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,YAAY,CAAC,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC;;OAEG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;gBACS,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;IAyBlE;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;OAGG;IACH,OAAO,CAAC,KAAK;IAUb,2FAA2F;IACrF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;;OAQG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqD5E;;;;;;OAMG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAUhF;;;;OAIG;IACG,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAOhD;;;;OAIG;YACW,qBAAqB;IAqKnC;;OAEG;YACW,qBAAqB;IAyCnC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;CAiBzB"}
+{"version":3,"file":"cimd.service.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.service.ts"],"names":[],"mappings":"AAWA,OAAO,EAAyB,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAY3F,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EASL,KAAK,eAAe,EAEpB,KAAK,oBAAoB,EAEzB,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AAmBtB;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,YAAY,CAAC,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC;;OAEG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;gBACS,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC;IAyBlE;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;;OAGG;IACH,OAAO,CAAC,KAAK;IAUb,2FAA2F;IACrF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ9B;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;;OAQG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqD5E;;;;;;OAMG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAUhF;;;;;;;;OAQG;IACH,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAmB7D;;;;;;;OAOG;IACG,qBAAqB,CAAC,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzG;;;;;OAKG;YACW,UAAU;IA2BxB,mHAAmH;IACnH,OAAO,CAAC,iBAAiB;IAezB;;;;OAIG;IACG,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAOhD;;OAEG;YACW,qBAAqB;IAenC;;;;;OAKG;YACW,SAAS;IAqJvB;;OAEG;YACW,qBAAqB;IAyCnC;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;CAiBzB"}

package/cimd/cimd.types.d.ts

@@ -7,6 +7,12 @@
  * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00
  */
 import { internalZ as z } from '@frontmcp/lazy-zod';
+/**
+ * A client's JSON Web Key Set: its inline `jwks`, or the document at its `jwks_uri`.
+ */
+export declare const clientJwksSchema: import("@frontmcp/lazy-zod").ZodObject<{
+    keys: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnknown>>;
+}, import("zod/v4/core").$strip>;
 /**
  * OAuth Client Metadata Document schema.
  *

package/cimd/cimd.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd.types.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAMpD;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;gCAiGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMvF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;gCAwCrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;gCA+BhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;gCAoCnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;gCA2BlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAqB3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM/D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,YAAY,EAAE,OAAO,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAElC;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}
+{"version":3,"file":"cimd.types.d.ts","sourceRoot":"","sources":["../../src/cimd/cimd.types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,MAAM,oBAAoB,CAAC;AAMpD;;GAEG;AACH,eAAO,MAAM,gBAAgB;;gCAE3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;gCAgGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMvF;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;gCAwCrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;gCA+BhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;gCAoCnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;gCA2BlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAqB3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM/D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,YAAY,EAAE,OAAO,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAElC;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/cimd/index.d.ts

@@ -7,8 +7,9 @@
  * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00
  */
 export { type CimdLogger, noopLogger } from './cimd.logger';
-export { clientMetadataDocumentSchema, cimdCacheConfigSchema, cimdRedisCacheConfigSchema, cimdSecurityConfigSchema, cimdNetworkConfigSchema, cimdConfigSchema, type ClientMetadataDocument, type ClientMetadataDocumentInput, type CimdCacheConfig, type CimdRedisCacheConfig, type CimdSecurityConfig, type CimdNetworkConfig, type CimdConfig, type CimdConfigInput, type CimdResolutionResult, } from './cimd.types';
-export { CimdError, InvalidClientIdUrlError, CimdFetchError, CimdValidationError, CimdClientIdMismatchError, CimdSecurityError, RedirectUriMismatchError, CimdResponseTooLargeError, CimdDisabledError, } from './cimd.errors';
+export { clientJwksSchema, clientMetadataDocumentSchema, cimdCacheConfigSchema, cimdRedisCacheConfigSchema, cimdSecurityConfigSchema, cimdNetworkConfigSchema, cimdConfigSchema, type ClientMetadataDocument, type ClientMetadataDocumentInput, type CimdCacheConfig, type CimdRedisCacheConfig, type CimdSecurityConfig, type CimdNetworkConfig, type CimdConfig, type CimdConfigInput, type CimdResolutionResult, } from './cimd.types';
+export { CimdError, InvalidClientIdUrlError, CimdFetchError, CimdValidationError, CimdClientIdMismatchError, CimdSecurityError, RedirectUriMismatchError, CimdResponseTooLargeError, CimdDisabledError, CimdClientAssertionError, type ClientAssertionRefusal, } from './cimd.errors';
+export { CLIENT_ASSERTION_TYPE_JWT_BEARER, CLIENT_ASSERTION_SIGNING_ALGORITHMS, MAX_CLIENT_ASSERTION_LIFETIME_SECONDS, type ClientAssertionInput, type ClientAssertionCheck, } from './cimd-client-assertion';
 export { isCimdClientId, validateClientIdUrl, checkSsrfProtection, hasOnlyLocalhostRedirectUris, } from './cimd.validator';
 export { InMemoryCimdCache, createCimdCache, extractCacheHeaders, parseCacheHeaders, type CimdCacheBackend, type CimdCacheEntry, type CimdCacheTtlConfig, type CacheableHeaders, } from './cimd.cache';
 export { RedisCimdCache } from './cimd-redis.cache';