@frontmcp/auth 1.8.3 → 1.8.4

package/authorities/authorities.engine.d.ts

@@ -23,8 +23,9 @@ export declare class AuthoritiesEngine {
     private readonly ruleProblems;
     constructor(profiles: AuthoritiesProfileRegistry, evaluators: AuthoritiesEvaluatorRegistry);
     /**
-     * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}).
-     * The server reports them when it starts; {@link evaluate} denies such a value.
+     * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
+     * and each profile name it uses that no registered profile has. The server reports them when it
+     * starts; {@link evaluate} denies such a value (an unknown profile as `profile '…' is not registered`).
      */
     findRuleProblems(authorities: unknown): string[];
     /**

package/authorities/authorities.engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AA0B7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;gBAG7C,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;;OAGG;IACH,gBAAgB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE;IAIhD;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAM/B;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkB/G;;OAEG;YACW,eAAe;IAyB7B,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;OAEG;YACW,oBAAoB;IAclC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;YACW,cAAc;IA2B5B;;;;OAIG;YACW,cAAc;IAyB5B;;OAEG;YACW,aAAa;IAiB3B;;OAEG;YACW,aAAa;IAwB3B;;OAEG;YACW,WAAW;IAczB;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;CAGpE"}
+{"version":3,"file":"authorities.engine.d.ts","sourceRoot":"","sources":["../../src/authorities/authorities.engine.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AA0B7B;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;gBAG7C,QAAQ,EAAE,0BAA0B,EACpC,UAAU,EAAE,4BAA4B;IAG3D;;;;OAIG;IACH,gBAAgB,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,EAAE;IAShD;;;OAGG;IACH,mBAAmB,IAAI,MAAM,EAAE;IAM/B;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,EAAE,4BAA4B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkB/G;;OAEG;YACW,eAAe;IAyB7B,yEAAyE;IACzE,OAAO,CAAC,UAAU;IAUlB;;OAEG;YACW,oBAAoB;IAclC;;OAEG;YACW,cAAc;IA+C5B;;OAEG;IACH,OAAO,CAAC,cAAc;IA0BtB;;OAEG;YACW,cAAc;IA2B5B;;;;OAIG;YACW,cAAc;IAyB5B;;OAEG;YACW,aAAa;IAiB3B;;OAEG;YACW,aAAa;IAwB3B;;OAEG;YACW,WAAW;IAczB;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS;CAGpE"}

package/esm/index.mjs

@@ -619,6 +619,12 @@ var TRANSPARENT_JWT_ALGS = [
 ];
 var MAX_JWKS_FETCH_BYTES = 1048576;
 var MAX_JWKS_FETCH_HOPS = 3;
+var MISSING_EXP_ERROR = 'missing required "exp" claim';
+function isMissingExpError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const { code, claim, reason } = error;
+  return code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && claim === "exp" && reason === "missing";
+}
 var WEAK_KEY_WARNING = `
 \u26A0\uFE0F  SECURITY WARNING: OAuth provider is using an RSA key smaller than 2048 bits.
     This is considered insecure and should be updated.
@@ -688,6 +694,7 @@ var JwksService = class {
       kid = typeof header?.kid === "string" ? header.kid : void 0;
     } catch {
     }
+    let missingExp = false;
     for (const p of candidates) {
       let jwks;
       try {
@@ -719,11 +726,14 @@ var JwksService = class {
             if (fallbackResult.ok) {
               return fallbackResult;
             }
+            if (fallbackResult.error === "missing_exp") missingExp = true;
           }
         }
+        if (isMissingExpError(e)) missingExp = true;
         this.logger.debug("[JwksService] Failed to verify token for provider: %s", p.id, e);
       }
     }
+    if (missingExp) return { ok: false, error: MISSING_EXP_ERROR };
     return { ok: false, error: `no_provider_verified${kid ? ` (kid=${kid})` : ""}` };
   }
   /**
@@ -856,7 +866,10 @@ var JwksService = class {
    *   1) inline jwks (if provided) → cache & return
    *   2) cached & fresh (TTL)      → return
    *   3) explicit jwksUri          → fetch, cache, return
-   *   4) discover jwks_uri via AS  → fetch AS metadata, then jwks_uri, cache, return
+   *   4) discover jwks_uri         → the issuer's OAuth authorization server
+   *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
+   *      Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
+   *      then fetch jwks_uri, cache, return
    */
   async getJwksForProvider(ref) {
     if (ref.jwks?.keys?.length) {
@@ -872,11 +885,13 @@ var JwksService = class {
       if (fromUri?.keys?.length) return fromUri;
     }
     const issuer = trimSlash(ref.issuerUrl);
-    const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/oauth-authorization-server`);
-    const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
-    if (uri) {
-      const fromMeta = await this.tryFetchJwks(ref.id, uri);
-      if (fromMeta?.keys?.length) return fromMeta;
+    for (const document of ["oauth-authorization-server", "openid-configuration"]) {
+      const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/${document}`);
+      const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
+      if (uri) {
+        const fromMeta = await this.tryFetchJwks(ref.id, uri);
+        if (fromMeta?.keys?.length) return fromMeta;
+      }
     }
     const maxStaleMs = Math.max(this.opts.providerJwksTtlMs * 4, 6e4);
     if (cached && Date.now() - cached.fetchedAt < maxStaleMs) {
@@ -9048,6 +9063,13 @@ function grantScopes(requested, allowed) {
   }
   return granted;
 }
+function advertisedScopes(allowed) {
+  const scopes = [];
+  for (const scope of allowed ?? DEFAULT_ALLOWED_SCOPES) {
+    if (scope && !scope.includes("*") && !scopes.includes(scope)) scopes.push(scope);
+  }
+  return scopes;
+}
 
 // libs/auth/src/utils/redirect-uri.utils.ts
 function isLoopbackRedirectUri(uri) {
@@ -10864,11 +10886,15 @@ var AuthoritiesEngine = class {
   /** Problems found per rule object, so a rule is validated once however often it is evaluated. */
   ruleProblems = /* @__PURE__ */ new WeakMap();
   /**
-   * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}).
-   * The server reports them when it starts; {@link evaluate} denies such a value.
+   * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
+   * and each profile name it uses that no registered profile has. The server reports them when it
+   * starts; {@link evaluate} denies such a value (an unknown profile as `profile '…' is not registered`).
    */
   findRuleProblems(authorities) {
-    return findAuthoritiesRuleProblems(authorities);
+    const problems = findAuthoritiesRuleProblems(authorities);
+    if (problems.length > 0) return problems;
+    const names = typeof authorities === "string" ? [authorities] : Array.isArray(authorities) ? authorities : [];
+    return names.filter((name) => typeof name === "string" && !this.profiles.has(name)).map((name) => `names an unknown profile "${name}"`);
   }
   /**
    * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}).
@@ -11429,6 +11455,7 @@ export {
   abacConditionSchema,
   abacOperatorSchema,
   abacPolicySchema,
+  advertisedScopes,
   aiPlatformTypeSchema,
   allowsPublicAccess,
   apiKeyCredentialSchema,

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,8 +47,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.3",
-    "@frontmcp/storage-sqlite": "1.8.3",
+    "@frontmcp/lazy-zod": "1.8.4",
+    "@frontmcp/storage-sqlite": "1.8.4",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.8.3",
-    "@frontmcp/utils": "1.8.3",
+    "@frontmcp/di": "1.8.4",
+    "@frontmcp/utils": "1.8.4",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/index.d.ts

@@ -49,7 +49,7 @@ export * from './options';
 export { consentToolItemSchema, consentSelectionSchema, consentStateSchema, federatedProviderItemSchema, federatedLoginStateSchema, federatedSelectionSchema, } from './consent';
 export type { ConsentToolItem, ConsentSelection, ConsentState, FederatedProviderItem, FederatedLoginState, FederatedSelection, } from './consent';
 export * from './detection';
-export { buildWwwAuthenticate, buildPrmUrl, buildUnauthorizedHeader, buildInvalidTokenHeader, buildInsufficientScopeHeader, buildInvalidRequestHeader, parseWwwAuthenticate, validateAudience, createAudienceValidator, deriveExpectedAudience, AudienceValidator, deriveAuthorizationId, DEFAULT_ALLOWED_SCOPES, grantScopes, isLoopbackRedirectUri, } from './utils';
+export { buildWwwAuthenticate, buildPrmUrl, buildUnauthorizedHeader, buildInvalidTokenHeader, buildInsufficientScopeHeader, buildInvalidRequestHeader, parseWwwAuthenticate, validateAudience, createAudienceValidator, deriveExpectedAudience, AudienceValidator, deriveAuthorizationId, advertisedScopes, DEFAULT_ALLOWED_SCOPES, grantScopes, isLoopbackRedirectUri, } from './utils';
 export type { BearerErrorCode, WwwAuthenticateOptions, AudienceValidationResult, AudienceValidatorOptions, } from './utils';
 export { type CredentialScope, type LoadingStrategy, type GetCredentialOptions, type ResolvedCredential, type CredentialFactoryContext, type CredentialFactory, type CredentialRefreshFn, type CredentialHeadersFn, type CredentialProviderConfig, type AuthProviderMapping, type CredentialCacheEntry, type VaultStorageKey, type AuthProvidersVaultOptions, type CredentialEventType, type CredentialEvent, type CacheStats, credentialScopeSchema, loadingStrategySchema, getCredentialOptionsSchema, credentialProviderConfigSchema, authProviderMappingSchema, authProvidersVaultOptionsSchema, extractCredentialExpiry, CredentialCache, type AuthProvidersAccessor, AUTH_PROVIDERS_ACCESSOR, AuthProvidersAccessorImpl, AuthProvidersRegistry, AUTH_PROVIDERS_REGISTRY, type NormalizedProviderConfig, AuthProvidersVault, AUTH_PROVIDERS_VAULT, EagerCredentialLoader, type EagerLoadResult, LazyCredentialLoader, } from './vault';
 export { type CimdLogger, noopLogger, clientMetadataDocumentSchema, cimdCacheConfigSchema, cimdSecurityConfigSchema, cimdNetworkConfigSchema, cimdConfigSchema, type ClientMetadataDocument, type ClientMetadataDocumentInput, type CimdCacheConfig, type CimdSecurityConfig, type CimdNetworkConfig, type CimdConfig, type CimdConfigInput, type CimdResolutionResult, CimdError, InvalidClientIdUrlError, CimdFetchError, CimdValidationError, CimdClientIdMismatchError, CimdSecurityError, RedirectUriMismatchError, CimdResponseTooLargeError, CimdDisabledError, isCimdClientId, validateClientIdUrl, checkSsrfProtection, hasOnlyLocalhostRedirectUris, InMemoryCimdCache, extractCacheHeaders, parseCacheHeaders, type CimdCacheEntry, type CacheableHeaders, CimdService, } from './cimd';

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKlF,OAAO,EAEL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EAEtB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,EAEZ,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,kBAAkB,GACnB,MAAM,MAAM,CAAC;AAKd,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,UAAU,EACV,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAE7B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAE7B,0BAA0B,EAE1B,yBAAyB,EAEzB,qBAAqB,EACrB,qBAAqB,EAErB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EAEf,UAAU,EAEV,iBAAiB,EAEjB,YAAY,EAEZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EAEb,YAAY,EAEZ,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,EAEpB,kBAAkB,EAClB,yBAAyB,EAEzB,oBAAoB,EAEpB,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EAEd,iBAAiB,EAEjB,oBAAoB,EAEpB,8BAA8B,EAC9B,6BAA6B,EAE7B,iCAAiC,EACjC,gCAAgC,EAChC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EAEjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAEhB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EAExB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAEpB,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,SAAS,EAET,sBAAsB,EACtB,4BAA4B,EAE5B,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EAErB,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,EAEjC,oBAAoB,EACpB,uBAAuB,EAEvB,kCAAkC,EAClC,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAEV,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACb,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,gCAAgC,EAEhC,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,iCAAiC,EACjC,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,UAAU,EAEV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAEhC,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,EAErB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAEjB,aAAa,EACb,oBAAoB,EAEpB,wBAAwB,EACxB,eAAe,EAEf,uBAAuB,EAEvB,qBAAqB,EAErB,qCAAqC,EACrC,oCAAoC,EACpC,uCAAuC,EAEvC,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAEhC,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAE1B,eAAe,EACf,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EAEd,gBAAgB,EAChB,6BAA6B,EAC7B,mCAAmC,EAEnC,uBAAuB,EAEvB,4BAA4B,EAE5B,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EAEvB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,yCAAyC,EACzC,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAKnB,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAElB,YAAY,EAEZ,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EAEjB,mBAAmB,EACnB,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AAKzB,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAKnG,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,EACjC,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAKlB,cAAc,WAAW,CAAC;AAK1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAKnB,cAAc,aAAa,CAAC;AAU5B,OAAO,EAEL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EAEpB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EAEjB,qBAAqB,EAErB,sBAAsB,EACtB,WAAW,EAEX,qBAAqB,GACtB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,UAAU,EAEf,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,EAE/B,uBAAuB,EAEvB,eAAe,EAEf,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,yBAAyB,EAEzB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,wBAAwB,EAE7B,kBAAkB,EAClB,oBAAoB,EAEpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,UAAU,EACf,UAAU,EAEV,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,SAAS,EACT,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAE5B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,WAAW,GACZ,MAAM,QAAQ,CAAC;AAKhB,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAK9F,cAAc,eAAe,CAAC;AAK9B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACvF,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKlF,OAAO,EAEL,GAAG,EACH,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EAEtB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,YAAY,EAEZ,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,MAAM,CAAC;AACd,YAAY,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,kBAAkB,GACnB,MAAM,MAAM,CAAC;AAKd,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,UAAU,EACV,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAE7B,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAEhB,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAE7B,0BAA0B,EAE1B,yBAAyB,EAEzB,qBAAqB,EACrB,qBAAqB,EAErB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EAEf,UAAU,EAEV,iBAAiB,EAEjB,YAAY,EAEZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EAEb,YAAY,EAEZ,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,iCAAiC,EACjC,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,EAEpB,kBAAkB,EAClB,yBAAyB,EAEzB,oBAAoB,EAEpB,KAAK,EACL,4BAA4B,EAC5B,eAAe,EACf,kBAAkB,EAClB,MAAM,EACN,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EAEd,iBAAiB,EAEjB,oBAAoB,EAEpB,8BAA8B,EAC9B,6BAA6B,EAE7B,iCAAiC,EACjC,gCAAgC,EAChC,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EAEjB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAEhB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EAExB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EAEpB,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,SAAS,EAET,sBAAsB,EACtB,4BAA4B,EAE5B,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EAErB,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,EAEjC,oBAAoB,EACpB,uBAAuB,EAEvB,kCAAkC,EAClC,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EAEV,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACb,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,gCAAgC,EAEhC,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,iCAAiC,EACjC,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,UAAU,EAEV,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,4BAA4B,EAC5B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,gCAAgC,EAEhC,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,qBAAqB,EAErB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAEjB,aAAa,EACb,oBAAoB,EAEpB,wBAAwB,EACxB,eAAe,EAEf,uBAAuB,EAEvB,qBAAqB,EAErB,qCAAqC,EACrC,oCAAoC,EACpC,uCAAuC,EAEvC,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAEhC,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAE1B,eAAe,EACf,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EAEd,gBAAgB,EAChB,6BAA6B,EAC7B,mCAAmC,EAEnC,uBAAuB,EAEvB,4BAA4B,EAE5B,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EAEvB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,yCAAyC,EACzC,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAKnB,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAElB,YAAY,EAEZ,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EAEjB,mBAAmB,EACnB,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,kCAAkC,EACvC,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,0BAA0B,EAE1B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AAKzB,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAKnG,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,mBAAmB,EACnB,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,iCAAiC,EACjC,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAKlB,cAAc,WAAW,CAAC;AAK1B,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAKnB,cAAc,aAAa,CAAC;AAU5B,OAAO,EAEL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EAEpB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EAEjB,qBAAqB,EAErB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EAEX,qBAAqB,GACtB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,UAAU,EAEf,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,EAE/B,uBAAuB,EAEvB,eAAe,EAEf,KAAK,qBAAqB,EAC1B,uBAAuB,EACvB,yBAAyB,EAEzB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,wBAAwB,EAE7B,kBAAkB,EAClB,oBAAoB,EAEpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AAKjB,OAAO,EAEL,KAAK,UAAU,EACf,UAAU,EAEV,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,SAAS,EACT,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EAEjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAE5B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,WAAW,GACZ,MAAM,QAAQ,CAAC;AAKhB,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAK9F,cAAc,eAAe,CAAC;AAK9B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC"}

package/index.js

@@ -332,6 +332,7 @@ __export(index_exports, {
   abacConditionSchema: () => abacConditionSchema,
   abacOperatorSchema: () => abacOperatorSchema,
   abacPolicySchema: () => abacPolicySchema,
+  advertisedScopes: () => advertisedScopes,
   aiPlatformTypeSchema: () => aiPlatformTypeSchema,
   allowsPublicAccess: () => allowsPublicAccess,
   apiKeyCredentialSchema: () => apiKeyCredentialSchema,
@@ -957,6 +958,12 @@ var TRANSPARENT_JWT_ALGS = [
 ];
 var MAX_JWKS_FETCH_BYTES = 1048576;
 var MAX_JWKS_FETCH_HOPS = 3;
+var MISSING_EXP_ERROR = 'missing required "exp" claim';
+function isMissingExpError(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const { code, claim, reason } = error;
+  return code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && claim === "exp" && reason === "missing";
+}
 var WEAK_KEY_WARNING = `
 \u26A0\uFE0F  SECURITY WARNING: OAuth provider is using an RSA key smaller than 2048 bits.
     This is considered insecure and should be updated.
@@ -1026,6 +1033,7 @@ var JwksService = class {
       kid = typeof header?.kid === "string" ? header.kid : void 0;
     } catch {
     }
+    let missingExp = false;
     for (const p of candidates) {
       let jwks;
       try {
@@ -1057,11 +1065,14 @@ var JwksService = class {
             if (fallbackResult.ok) {
               return fallbackResult;
             }
+            if (fallbackResult.error === "missing_exp") missingExp = true;
           }
         }
+        if (isMissingExpError(e)) missingExp = true;
         this.logger.debug("[JwksService] Failed to verify token for provider: %s", p.id, e);
       }
     }
+    if (missingExp) return { ok: false, error: MISSING_EXP_ERROR };
     return { ok: false, error: `no_provider_verified${kid ? ` (kid=${kid})` : ""}` };
   }
   /**
@@ -1194,7 +1205,10 @@ var JwksService = class {
    *   1) inline jwks (if provided) → cache & return
    *   2) cached & fresh (TTL)      → return
    *   3) explicit jwksUri          → fetch, cache, return
-   *   4) discover jwks_uri via AS  → fetch AS metadata, then jwks_uri, cache, return
+   *   4) discover jwks_uri         → the issuer's OAuth authorization server
+   *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
+   *      Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
+   *      then fetch jwks_uri, cache, return
    */
   async getJwksForProvider(ref) {
     if (ref.jwks?.keys?.length) {
@@ -1210,11 +1224,13 @@ var JwksService = class {
       if (fromUri?.keys?.length) return fromUri;
     }
     const issuer = trimSlash(ref.issuerUrl);
-    const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/oauth-authorization-server`);
-    const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
-    if (uri) {
-      const fromMeta = await this.tryFetchJwks(ref.id, uri);
-      if (fromMeta?.keys?.length) return fromMeta;
+    for (const document of ["oauth-authorization-server", "openid-configuration"]) {
+      const meta = await this.tryFetchAsMeta(`${issuer}/.well-known/${document}`);
+      const uri = meta && typeof meta === "object" && meta["jwks_uri"] ? String(meta["jwks_uri"]) : void 0;
+      if (uri) {
+        const fromMeta = await this.tryFetchJwks(ref.id, uri);
+        if (fromMeta?.keys?.length) return fromMeta;
+      }
     }
     const maxStaleMs = Math.max(this.opts.providerJwksTtlMs * 4, 6e4);
     if (cached && Date.now() - cached.fetchedAt < maxStaleMs) {
@@ -9359,6 +9375,13 @@ function grantScopes(requested, allowed) {
   }
   return granted;
 }
+function advertisedScopes(allowed) {
+  const scopes = [];
+  for (const scope of allowed ?? DEFAULT_ALLOWED_SCOPES) {
+    if (scope && !scope.includes("*") && !scopes.includes(scope)) scopes.push(scope);
+  }
+  return scopes;
+}
 
 // libs/auth/src/utils/redirect-uri.utils.ts
 function isLoopbackRedirectUri(uri) {
@@ -11175,11 +11198,15 @@ var AuthoritiesEngine = class {
   /** Problems found per rule object, so a rule is validated once however often it is evaluated. */
   ruleProblems = /* @__PURE__ */ new WeakMap();
   /**
-   * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}).
-   * The server reports them when it starts; {@link evaluate} denies such a value.
+   * Problems with an `authorities` value declared on an entry (see {@link findAuthoritiesRuleProblems}),
+   * and each profile name it uses that no registered profile has. The server reports them when it
+   * starts; {@link evaluate} denies such a value (an unknown profile as `profile '…' is not registered`).
    */
   findRuleProblems(authorities) {
-    return findAuthoritiesRuleProblems(authorities);
+    const problems = findAuthoritiesRuleProblems(authorities);
+    if (problems.length > 0) return problems;
+    const names = typeof authorities === "string" ? [authorities] : Array.isArray(authorities) ? authorities : [];
+    return names.filter((name) => typeof name === "string" && !this.profiles.has(name)).map((name) => `names an unknown profile "${name}"`);
   }
   /**
    * Problems with every registered profile's rule (see {@link findAuthoritiesRuleProblems}).
@@ -11741,6 +11768,7 @@ var FetchCredentialMiddleware = class {
   abacConditionSchema,
   abacOperatorSchema,
   abacPolicySchema,
+  advertisedScopes,
   aiPlatformTypeSchema,
   allowsPublicAccess,
   apiKeyCredentialSchema,

package/jwks/jwks.service.d.ts

@@ -57,7 +57,10 @@ export declare class JwksService {
      *   1) inline jwks (if provided) → cache & return
      *   2) cached & fresh (TTL)      → return
      *   3) explicit jwksUri          → fetch, cache, return
-     *   4) discover jwks_uri via AS  → fetch AS metadata, then jwks_uri, cache, return
+     *   4) discover jwks_uri         → the issuer's OAuth authorization server
+     *      metadata (RFC 8414), else its OpenID configuration (OpenID Connect
+     *      Discovery 1.0 §4, where Google, Okta, Auth0 and Entra publish it),
+     *      then fetch jwks_uri, cache, return
      */
     getJwksForProvider(ref: ProviderVerifyRef): Promise<JSONWebKeySet | undefined>;
     /** Return the orchestrator public JWKS (generates/rotates as needed). */

package/jwks/jwks.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwks.service.d.ts","sourceRoot":"","sources":["../../src/jwks/jwks.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,aAAa,EAAY,MAAM,MAAM,CAAC;AAczG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAmClG,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+C;IAEpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,eAAe,CAAqB;IAG5C,OAAO,CAAC,eAAe,CAKrB;IAGF,OAAO,CAAC,YAAY,CAAiE;IAGrF,OAAO,CAAC,cAAc,CAAS;IAE/B,OAAO,CAAC,cAAc,CAA4B;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;gBAE5B,IAAI,CAAC,EAAE,kBAAkB;IAcrC;;;OAGG;YACW,iBAAiB;IAc/B,mFAAmF;IAC7E,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;IAQ7C;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IA2DnG;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,iBAAiB;IAwG/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa;IAIvD;;;;;;OAMG;IACG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA2CpF,yEAAyE;IACnE,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKnD,wEAAwE;IAClE,yBAAyB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,aAAa,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;YAShG,YAAY;YAaZ,cAAc;YAQd,SAAS;YAgET,qBAAqB;YAyBrB,yBAAyB;IA+DvC,OAAO,CAAC,WAAW;CAgBpB"}
+{"version":3,"file":"jwks.service.d.ts","sourceRoot":"","sources":["../../src/jwks/jwks.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAuD,KAAK,aAAa,EAAY,MAAM,MAAM,CAAC;AAczG,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAgDlG,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+C;IAEpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,eAAe,CAAqB;IAG5C,OAAO,CAAC,eAAe,CAKrB;IAGF,OAAO,CAAC,YAAY,CAAiE;IAGrF,OAAO,CAAC,cAAc,CAAS;IAE/B,OAAO,CAAC,cAAc,CAA4B;IAElD,OAAO,CAAC,cAAc,CAAC,CAAiB;gBAE5B,IAAI,CAAC,EAAE,kBAAkB;IAcrC;;;OAGG;YACW,iBAAiB;IAc/B,mFAAmF;IAC7E,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;IAQ7C;;;OAGG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAmEnG;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,iBAAiB;IAwG/B;;OAEG;IACH,OAAO,CAAC,eAAe;IAuBvB,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa;IAIvD;;;;;;;;;OASG;IACG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IA8CpF,yEAAyE;IACnE,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKnD,wEAAwE;IAClE,yBAAyB,IAAI,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,aAAa,EAAE,SAAS,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;YAShG,YAAY;YAaZ,cAAc;YAQd,SAAS;YAgET,qBAAqB;YAyBrB,yBAAyB;IA+DvC,OAAO,CAAC,WAAW;CAgBpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/auth",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "FrontMCP Auth - Authentication, session management, and credential vault",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -47,8 +47,8 @@
     "node": ">=24.0.0"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.3",
-    "@frontmcp/storage-sqlite": "1.8.3",
+    "@frontmcp/lazy-zod": "1.8.4",
+    "@frontmcp/storage-sqlite": "1.8.4",
     "@vercel/kv": "^3.0.0",
     "ioredis": "^5.0.0"
   },
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@frontmcp/di": "1.8.3",
-    "@frontmcp/utils": "1.8.3",
+    "@frontmcp/di": "1.8.4",
+    "@frontmcp/utils": "1.8.4",
     "jose": "^6.0.0"
   },
   "devDependencies": {

package/utils/index.d.ts

@@ -6,6 +6,6 @@ export type { BearerErrorCode, WwwAuthenticateOptions } from './www-authenticate
 export { validateAudience, createAudienceValidator, deriveExpectedAudience, AudienceValidator, } from './audience.validator';
 export type { AudienceValidationResult, AudienceValidatorOptions } from './audience.validator';
 export { deriveAuthorizationId } from './authorization-id.utils';
-export { DEFAULT_ALLOWED_SCOPES, grantScopes } from './scope-grant.utils';
+export { advertisedScopes, DEFAULT_ALLOWED_SCOPES, grantScopes } from './scope-grant.utils';
 export { isLoopbackRedirectUri } from './redirect-uri.utils';
 //# sourceMappingURL=index.d.ts.map

package/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}

package/utils/scope-grant.utils.d.ts

@@ -8,4 +8,14 @@ export declare const DEFAULT_ALLOWED_SCOPES: readonly string[];
  * @param allowed   The configured allowlist; `undefined` means {@link DEFAULT_ALLOWED_SCOPES}.
  */
 export declare function grantScopes(requested: readonly string[], allowed: readonly string[] | undefined): string[];
+/**
+ * The scope values to advertise as `scopes_supported` (RFC 8414 §2, RFC 9728 §2)
+ * for a server that grants `allowed`: the literal entries, in order, without
+ * duplicates. A `*` glob such as `'tickets:*'` names no single scope a client
+ * could ask for, so it isn't advertised (RFC 8414 lets a server leave supported
+ * scopes out); list a scope literally to advertise it.
+ *
+ * @param allowed The configured allowlist; `undefined` means {@link DEFAULT_ALLOWED_SCOPES}.
+ */
+export declare function advertisedScopes(allowed: readonly string[] | undefined): string[];
 //# sourceMappingURL=scope-grant.utils.d.ts.map

package/utils/scope-grant.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-grant.utils.d.ts","sourceRoot":"","sources":["../../src/utils/scope-grant.utils.ts"],"names":[],"mappings":"AASA,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAQ1G"}
+{"version":3,"file":"scope-grant.utils.d.ts","sourceRoot":"","sources":["../../src/utils/scope-grant.utils.ts"],"names":[],"mappings":"AASA,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAQ1G;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAMjF"}