@hivemagnus/hive-common 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -6,6 +6,43 @@ All notable changes to `@hivemagnus/hive-common` are recorded here. The format f
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-11-12
+
+Native-issuer service tokens. Oathweave signs client-credentials tokens with its native issuer
+(its `JWT_ISSUER`, for example `hive-iam`), which is a name, not an https URL, so 0.2.0 refused the
+configuration and products kept a local jose check for those tokens. Every change is additive:
+without the new options a verifier behaves as in 0.2.0.
+
+### Added
+
+- `/oathweave`: `nativeIssuers` accepts tokens whose `iss` is one of the listed native
+  identifiers. Each must match `OATHWEAVE_NATIVE_ISSUER_PATTERN` (`^[a-z][a-z0-9-]{0,63}$`), so a
+  URL or anything else is a startup error. They are verified with the same `jwksUrl` (still https)
+  or `keys` as the https issuer, because Oathweave signs both with one key. A native issuer is never
+  accepted unless listed. `verifier.nativeIssuers` lists them.
+- `/oathweave`: `nativeIssuerAccept` (default `'service'`) limits which principals a native issuer
+  may sign for. A user token from a native issuer is refused with `invalid_issuer` by default,
+  before any userinfo call.
+- `/oathweave`: `maxLifetimeSec` also takes `{ user?, service? }`, one limit per principal kind;
+  each defaults to 900. `ClaimPolicy.maxLifetimeSec` and `principalFromClaims()` take the same
+  shape. The `OathweaveLifetimeLimits` type is exported.
+- `/oathweave/conformance`: `ConformanceVectors.nativeIssuers` and `ConformanceContext.nativeIssuers`.
+  `hiveCommonConformanceVerify()` configures them.
+- Conformance vectors: `valid-native-service` (accept), `unconfigured-native-issuer` (401
+  `invalid_issuer`) and `native-service-lifetime-too-long` (401 `invalid_lifetime`). There is no
+  vector for a native-issuer user token, because Oathweave does issue those (to registered clients
+  that are not suite browser clients); refusing them is a product setting, not a contract.
+- README: "Native issuers", and native-issuer and per-kind lifetime rows in "Choosing settings for
+  an existing product".
+
+### Changed
+
+- The conformance vectors were regenerated with `npm run vectors:generate` to sign the new tokens,
+  so every token and the test JWKS changed (the signing keys are discarded after each run). The
+  existing vectors keep their names, claims and expected outcomes. A product verifier that is not
+  configured with `ctx.nativeIssuers` now fails `valid-native-service`; configure it, or exclude
+  that vector with `only` until the product accepts native issuers.
+
 ## [0.2.0] - 2026-11-12
 
 Options that let a product keep its existing behaviour without wrapping the shared helpers. Every
@@ -60,6 +97,7 @@ verifier and its own error, health and request-ID conventions.
   pagination and agent identity.
 - `/hono` and `/node-http` adapters for auth, request context, the error envelope and health.
 
-[Unreleased]: https://github.com/ChefTaco/HiveCommon/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/ChefTaco/HiveCommon/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/ChefTaco/HiveCommon/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/ChefTaco/HiveCommon/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/ChefTaco/HiveCommon/releases/tag/v0.1.0

package/README.md

@@ -100,7 +100,8 @@ What it checks, in order: a compact JWT of at most 16 KiB; header `alg` is `RS25
 HMAC key confusion never reach a key); signature against the JWKS (cached for 10 minutes and
 refetched, at most every 30 s, when a token names an unknown `kid`); `iss` is one of the issuers;
 `aud` is exactly the audience; `sub`, `iat`, `exp`, `jti` present; `exp`, `nbf` and `iat` within
-30 s of clock tolerance; `exp - iat` and token age at most 900 s; then the principal rules:
+30 s of clock tolerance; `exp - iat` and token age at most 900 s (`maxLifetimeSec`, one number or
+`{ user, service }`); then the principal rules:
 
 - **User:** `actorType: "USER"`, a `sessionId`, a `clientId` other than the subject, string-array
   `permissions` and (optional) `roles`. With `userinfoUrl`, the session is confirmed online; the
@@ -138,17 +139,48 @@ Two options make the claim rules stricter for products that always required more
   `'client_id'` (RFC 9068) or `'either'` (the default). When both claims are present they must
   agree in every mode.
 
+#### Native issuers
+
+Oathweave signs browser-client tokens with its https issuer, but client-credentials tokens with its
+*native* issuer (its `JWT_ISSUER`, for example `hive-iam`) unless the client's machine policy selects
+the browser issuer. Both are signed by the same key and published in the same JWKS. List the native
+identifiers in `nativeIssuers` to accept those tokens too:
+
+```ts
+const verifier = createOathweaveVerifier({
+  issuer: process.env.OATHWEAVE_ISSUER!,  // still required, still https
+  nativeIssuers: ['hive-iam'],             // exact `iss` values; never accepted unless listed
+  audience: 'hivemem',
+  jwksUrl: process.env.OATHWEAVE_JWKS_URL!, // the one https JWKS serves both issuers
+  userinfoUrl: process.env.OATHWEAVE_USERINFO_URL,
+  accept: 'service',
+});
+```
+
+- Each entry must match `OATHWEAVE_NATIVE_ISSUER_PATTERN` (`^[a-z][a-z0-9-]{0,63}$`), so a URL or
+  any other shape is a startup error. There is no separate JWKS setting: `jwksUrl` (https, or
+  loopback http with `allowInsecureLoopback`) or `keys` verify both kinds of issuer.
+- A native issuer signs service principals only, by default: a user token from a native issuer is
+  refused with `invalid_issuer` before any session check. Suite user tokens come from browser
+  clients, which Oathweave always signs with the https issuer. `nativeIssuerAccept: 'any'` (or
+  `'user'`) changes that for a product that really takes native user tokens.
+- Every other rule (audience, lifetime, principal rules) is unchanged. `principal.issuer` is the
+  native identifier, so identity and service links keyed by `(issuer, clientId)` keep working.
+  `verifier.nativeIssuers` lists them; `verifier.issuers` still lists only the https issuers.
+
 Identity links name the local account `localUserId`. `localId`, the name older deployment configs
 use, is accepted as an alias; an entry that sets both to different values is refused. Parsed links
 always carry `localUserId`.
 
 Endpoints must be `https`. For tests against a loopback server, pass `allowInsecureLoopback: true`.
+Native issuer identifiers are names, not endpoints, and are never fetched.
 
 ### Conformance vectors
 
-`test-vectors/oathweave/vectors.json` ships a test JWKS and twelve pre-signed tokens (valid user,
+`test-vectors/oathweave/vectors.json` ships a test JWKS and fifteen pre-signed tokens (valid user,
 valid service, expired, not yet valid, wrong audience, wrong issuer, bad signature, unknown `kid`,
-`alg: none`, HS256 key confusion, overlong lifetime, user without session), evaluated at a fixed
+`alg: none`, HS256 key confusion, overlong lifetime, user without session, valid native-issuer
+service, unconfigured native issuer, overlong native-issuer service token), evaluated at a fixed
 clock so they never expire. Run them against your product's verifier:
 
 ```ts
@@ -157,13 +189,15 @@ import { runOathweaveConformance } from '@hivemagnus/hive-common/oathweave/confo
 it('meets the Oathweave conformance vectors', async () => {
   await runOathweaveConformance((token, ctx) => createProductVerifier({
     issuer: ctx.issuer, audience: ctx.audience, jwksUrl: ctx.jwksUrl, userinfoUrl: ctx.userinfoUrl,
+    nativeIssuers: ctx.nativeIssuers, // native issuers the vectors use, for service tokens
     fetch: ctx.fetch,          // serves the vectors' JWKS and userinfo
     now: () => ctx.nowMs,      // the fixed clock
   })(token));
 });
 ```
 
-It throws a readable error listing failed vectors. A refusal passes when the verifier rejects
+A verifier that does not accept native issuers fails `valid-native-service`; pass `only` to run
+the other vectors until it does. It throws a readable error listing failed vectors. A refusal passes when the verifier rejects
 (and any numeric `status` on the error matches); `strictReasons: true` also compares `reason`.
 
 ### errors
@@ -406,6 +440,8 @@ existing behaviour with these settings instead of wrapping the shared helpers:
 | `sessionCacheTtlMs: 0` (verifier) | 10 000 | an online session check on every request, so sign-out is immediate |
 | `requireRoles: true` (verifier) | `false` | refusing tokens without a `roles` array |
 | `clientIdClaim: 'clientId'` (verifier) | `'either'` | requiring the Oathweave `clientId` claim; RFC 9068 `client_id` alone is refused |
+| `nativeIssuers: ['hive-iam']` (verifier) | none | accepting client-credentials tokens signed with Oathweave's native issuer, which a local jose check used to handle |
+| `maxLifetimeSec: { user, service }` (verifier) | 900 for both | a different limit per principal kind, for example `{ user: 900, service: 300 }` |
 | `trustInboundRequestId: false` with `trustInboundTrace: true` (context, `/hono`, `/node-http`) | both `trustInbound` | generating every request ID on an internet-facing service while continuing callers' traces |
 | `liveBody` (health, `/hono`, `/node-http`) | the standard body | a published `/health/live` body such as `{ status: 'ok' }` |
 | `localId` in identity links | `localUserId` | existing link configs, unchanged |
@@ -423,6 +459,25 @@ registerHealthRoutes(app, { service: 'chattermost', liveBody: { status: 'ok' } }
 Every refusal, including 503 `auth_unavailable`, is still an `OathweaveError`; a product that
 answers 401 for all of them maps the error in its own handler.
 
+Service tokens from a native issuer. Products that kept a local jose verifier for Oathweave's
+native issuer replace it with a second shared verifier on the same key source, so one JWKS cache
+serves both:
+
+```ts
+const keys = createRemoteJWKSet(new URL(jwksUrl)); // or let each verifier fetch jwksUrl itself
+const users = createOathweaveVerifier({ issuer, audience: 'hivemem', keys, userinfoUrl, /* user settings */ });
+const services = createOathweaveVerifier({
+  issuer,                                   // https; browser-issued machine clients use it
+  nativeIssuers: ['hive-iam'],              // Oathweave's JWT_ISSUER, from configuration
+  audience: 'hivemem', keys, accept: 'service',
+  clientIdClaim: 'clientId',                // Oathweave service tokens always carry clientId
+});
+```
+
+The fifteen-minute limit applies to service tokens as before (`maxLifetimeSec` sets it per kind).
+Native identifiers are exact: configure the value Oathweave's `JWT_ISSUER` is set to, and keep the
+service links that grant access keyed by that issuer.
+
 ## Development
 
 ```bash

package/dist/oathweave/claims.d.ts

@@ -58,10 +58,18 @@ export declare function extractScopes(payload: JWTPayload): string[];
 export declare function extractRoles(payload: JWTPayload, required?: boolean): string[] | undefined;
 /** A service token is one whose client ID equals its subject. */
 export declare function principalKindOf(payload: JWTPayload, claim?: ClientIdClaim): PrincipalKind;
+/** A lifetime limit in seconds for each principal kind. */
+export interface OathweaveLifetimeLimits {
+    readonly user?: number;
+    readonly service?: number;
+}
 export interface ClaimPolicy {
     readonly accept: AcceptPrincipal;
-    /** Largest allowed `exp - iat`, in seconds. */
-    readonly maxLifetimeSec: number;
+    /**
+     * Largest allowed `exp - iat`, in seconds: one limit for every token, or one per principal
+     * kind. A kind missing from the object gets `OATHWEAVE_MAX_LIFETIME_SEC` (900).
+     */
+    readonly maxLifetimeSec: number | OathweaveLifetimeLimits;
     /** Refuse a token without a `roles` claim. Defaults to false: an absent claim is no roles. */
     readonly requireRoles?: boolean;
     /** Which claim names supply the client ID. Defaults to `either`. */

package/dist/oathweave/claims.js

@@ -1,4 +1,6 @@
 import { OathweaveError } from './errors.js';
+/** Mirrors `OATHWEAVE_MAX_LIFETIME_SEC`, which lives in the verifier module. */
+const MAX_LIFETIME_SEC = 900;
 function stringArray(value) {
     return Array.isArray(value) && value.every(item => typeof item === 'string');
 }
@@ -52,18 +54,19 @@ function validAuthTime(value) {
  */
 export function principalFromClaims(payload, policy) {
     const { iat, exp, sub, jti, iss } = payload;
-    if (typeof iat !== 'number' || typeof exp !== 'number' || exp <= iat || exp - iat > policy.maxLifetimeSec) {
+    const clientIdClaim = policy.clientIdClaim ?? 'either';
+    const kind = principalKindOf(payload, clientIdClaim);
+    const maxLifetimeSec = typeof policy.maxLifetimeSec === 'number' ? policy.maxLifetimeSec : policy.maxLifetimeSec[kind] ?? MAX_LIFETIME_SEC;
+    if (typeof iat !== 'number' || typeof exp !== 'number' || exp <= iat || exp - iat > maxLifetimeSec) {
         throw new OathweaveError('invalid_lifetime');
     }
     if (!nonEmpty(sub) || !nonEmpty(jti) || !nonEmpty(iss))
         throw new OathweaveError('invalid_claims');
     const permissions = payload['permissions'];
-    const clientIdClaim = policy.clientIdClaim ?? 'either';
     const roles = extractRoles(payload, policy.requireRoles ?? false);
     const clientId = clientIdOf(payload, clientIdClaim);
     if (!stringArray(permissions) || roles === undefined || clientId === undefined)
         throw new OathweaveError('invalid_claims');
-    const kind = principalKindOf(payload, clientIdClaim);
     if (policy.accept !== 'any' && policy.accept !== kind)
         throw new OathweaveError('wrong_principal_kind', { details: { kind } });
     const base = {

package/dist/oathweave/conformance.d.ts

@@ -25,6 +25,8 @@ export interface ConformanceVector {
 export interface ConformanceVectors {
     readonly schema: 1;
     readonly issuer: string;
+    /** Native issuer identifiers the verifier under test must be configured to accept. */
+    readonly nativeIssuers?: readonly string[];
     readonly audience: string;
     readonly jwksUrl: string;
     readonly userinfoUrl: string;
@@ -35,6 +37,11 @@ export interface ConformanceVectors {
 }
 export interface ConformanceContext {
     readonly issuer: string;
+    /**
+     * Native issuer identifiers (such as `hive-iam`) to configure alongside `issuer`, for service
+     * tokens. Empty when the vectors have none.
+     */
+    readonly nativeIssuers: readonly string[];
     readonly audience: string;
     readonly jwks: JSONWebKeySet;
     readonly jwksUrl: string;

package/dist/oathweave/conformance.js

@@ -76,6 +76,7 @@ export async function runOathweaveConformance(verify, options = {}) {
             continue;
         const context = {
             issuer: vectors.issuer,
+            nativeIssuers: vectors.nativeIssuers ?? [],
             audience: vectors.audience,
             jwks: vectors.jwks,
             jwksUrl: vectors.jwksUrl,
@@ -116,6 +117,7 @@ export async function runOathweaveConformance(verify, options = {}) {
 export function hiveCommonConformanceVerify() {
     return (token, context) => createOathweaveVerifier({
         issuer: context.issuer,
+        nativeIssuers: context.nativeIssuers,
         audience: context.audience,
         keys: context.jwks,
         now: () => context.nowMs,

package/dist/oathweave/index.d.ts

@@ -2,8 +2,8 @@
  * `@hivemagnus/hive-common/oathweave`: Oathweave access-token verification for suite services.
  * Framework-free; see `/hono` and `/node-http` for middleware.
  */
-export { createOathweaveVerifier, parseBearerToken, OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC, OATHWEAVE_FAILED_CHECK_TTL_MS, OATHWEAVE_MAX_LIFETIME_SEC, OATHWEAVE_MAX_TOKEN_LENGTH, OATHWEAVE_REQUEST_TIMEOUT_MS, OATHWEAVE_SESSION_CACHE_MAX, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, type OathweaveVerifier, type OathweaveVerifierOptions, type VerifyOptions, } from './verifier.js';
-export { CLIENT_ID_CLAIMS, clientIdOf, extractRoles, extractScopes, principalFromClaims, principalKindOf, type AcceptPrincipal, type ClaimPolicy, type ClientIdClaim, type OathweavePrincipal, type OathweaveServicePrincipal, type OathweaveUserPrincipal, type PrincipalKind, } from './claims.js';
+export { createOathweaveVerifier, parseBearerToken, OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC, OATHWEAVE_FAILED_CHECK_TTL_MS, OATHWEAVE_MAX_LIFETIME_SEC, OATHWEAVE_MAX_TOKEN_LENGTH, OATHWEAVE_NATIVE_ISSUER_PATTERN, OATHWEAVE_REQUEST_TIMEOUT_MS, OATHWEAVE_SESSION_CACHE_MAX, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, type OathweaveVerifier, type OathweaveVerifierOptions, type VerifyOptions, } from './verifier.js';
+export { CLIENT_ID_CLAIMS, clientIdOf, extractRoles, extractScopes, principalFromClaims, principalKindOf, type AcceptPrincipal, type ClaimPolicy, type ClientIdClaim, type OathweaveLifetimeLimits, type OathweavePrincipal, type OathweaveServicePrincipal, type OathweaveUserPrincipal, type PrincipalKind, } from './claims.js';
 export { OathweaveError, isOathweaveError, statusForReason, type OathweaveFailureReason } from './errors.js';
 export { assertOathweaveEndpoint, endpointProblem, isLoopbackHost, isOathweaveEndpoint, type EndpointOptions } from './endpoint.js';
 export { effectivePermissions, hasAnyRole, hasPermissions, hasScopes, IdentityLinkError, parseIdentityLinks, permissionMatches, requireIdentityLink, requirePermissions, uniqueIdentityLink, type OathweaveIdentityLink, type ParseIdentityLinksOptions, type PermissionOptions, } from './links.js';

package/dist/oathweave/index.js

@@ -2,7 +2,7 @@
  * `@hivemagnus/hive-common/oathweave`: Oathweave access-token verification for suite services.
  * Framework-free; see `/hono` and `/node-http` for middleware.
  */
-export { createOathweaveVerifier, parseBearerToken, OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC, OATHWEAVE_FAILED_CHECK_TTL_MS, OATHWEAVE_MAX_LIFETIME_SEC, OATHWEAVE_MAX_TOKEN_LENGTH, OATHWEAVE_REQUEST_TIMEOUT_MS, OATHWEAVE_SESSION_CACHE_MAX, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, } from './verifier.js';
+export { createOathweaveVerifier, parseBearerToken, OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC, OATHWEAVE_FAILED_CHECK_TTL_MS, OATHWEAVE_MAX_LIFETIME_SEC, OATHWEAVE_MAX_TOKEN_LENGTH, OATHWEAVE_NATIVE_ISSUER_PATTERN, OATHWEAVE_REQUEST_TIMEOUT_MS, OATHWEAVE_SESSION_CACHE_MAX, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, } from './verifier.js';
 export { CLIENT_ID_CLAIMS, clientIdOf, extractRoles, extractScopes, principalFromClaims, principalKindOf, } from './claims.js';
 export { OathweaveError, isOathweaveError, statusForReason } from './errors.js';
 export { assertOathweaveEndpoint, endpointProblem, isLoopbackHost, isOathweaveEndpoint } from './endpoint.js';

package/dist/oathweave/verifier.d.ts

@@ -1,5 +1,5 @@
 import { type JSONWebKeySet, type JWTVerifyGetKey } from 'jose';
-import { type AcceptPrincipal, type ClientIdClaim, type OathweavePrincipal, type OathweaveServicePrincipal, type OathweaveUserPrincipal } from './claims.js';
+import { type AcceptPrincipal, type ClientIdClaim, type OathweaveLifetimeLimits, type OathweavePrincipal, type OathweaveServicePrincipal, type OathweaveUserPrincipal } from './claims.js';
 import { type EndpointOptions } from './endpoint.js';
 /** How long a userinfo answer is reused, measured from when its request started. */
 export declare const OATHWEAVE_SESSION_CACHE_TTL_MS = 10000;
@@ -14,9 +14,28 @@ export declare const OATHWEAVE_MAX_LIFETIME_SEC = 900;
 export declare const OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC = 30;
 /** Longest accepted compact token. Real Oathweave tokens are well under 4 KiB. */
 export declare const OATHWEAVE_MAX_TOKEN_LENGTH = 16384;
+/**
+ * What a native issuer identifier must look like: a lowercase name such as `hive-iam`, never a
+ * URL, so it cannot be confused with an https issuer.
+ */
+export declare const OATHWEAVE_NATIVE_ISSUER_PATTERN: RegExp;
 export interface OathweaveVerifierOptions extends EndpointOptions {
     /** Accepted issuer, or issuers. Each must be an https URL. */
     readonly issuer: string | readonly string[];
+    /**
+     * Oathweave's native issuer identifiers (its `JWT_ISSUER`, for example `hive-iam`) to accept
+     * as well. Oathweave signs client-credentials tokens with its native issuer unless the
+     * client's policy selects the browser issuer, and with the same keys, so these tokens are
+     * verified against the same `jwksUrl` or `keys`. Each must match
+     * `OATHWEAVE_NATIVE_ISSUER_PATTERN`. Defaults to none: a native issuer is never accepted
+     * unless it is listed here.
+     */
+    readonly nativeIssuers?: readonly string[];
+    /**
+     * Which principals a native issuer may sign for. Defaults to `service`: suite user tokens
+     * come from browser clients, which Oathweave always signs with the https issuer.
+     */
+    readonly nativeIssuerAccept?: AcceptPrincipal;
     /** This service's resource audience, for example `hivemem`. Matched exactly. */
     readonly audience: string;
     /** The issuer's JWKS endpoint. Required unless `keys` is given. */
@@ -32,8 +51,11 @@ export interface OathweaveVerifierOptions extends EndpointOptions {
     readonly accept?: AcceptPrincipal;
     /** Seconds of clock skew tolerated on `exp`, `nbf` and `iat`. Defaults to 30. */
     readonly clockToleranceSec?: number;
-    /** Largest `exp - iat` and token age in seconds. Defaults to 900. */
-    readonly maxLifetimeSec?: number;
+    /**
+     * Largest `exp - iat` and token age in seconds: one limit for every token, or one per
+     * principal kind (`{ user: 900, service: 300 }`). Each defaults to 900.
+     */
+    readonly maxLifetimeSec?: number | OathweaveLifetimeLimits;
     readonly fetch?: typeof fetch;
     /** Clock in epoch milliseconds. */
     readonly now?: () => number;
@@ -64,7 +86,10 @@ export interface VerifyOptions {
     readonly accept?: AcceptPrincipal;
 }
 export interface OathweaveVerifier {
+    /** The accepted https issuers. */
     readonly issuers: readonly string[];
+    /** The accepted native issuer identifiers; empty unless configured. */
+    readonly nativeIssuers: readonly string[];
     readonly audience: string;
     verify(token: string, options?: VerifyOptions): Promise<OathweavePrincipal>;
     verifyUser(token: string): Promise<OathweaveUserPrincipal>;

package/dist/oathweave/verifier.js

@@ -23,6 +23,11 @@ export const OATHWEAVE_MAX_LIFETIME_SEC = 900;
 export const OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC = 30;
 /** Longest accepted compact token. Real Oathweave tokens are well under 4 KiB. */
 export const OATHWEAVE_MAX_TOKEN_LENGTH = 16_384;
+/**
+ * What a native issuer identifier must look like: a lowercase name such as `hive-iam`, never a
+ * URL, so it cannot be confused with an https issuer.
+ */
+export const OATHWEAVE_NATIVE_ISSUER_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
 const BEARER = /^Bearer[ ]+([A-Za-z0-9\-._~+/]+=*)[ ]*$/i;
 /**
  * The token in an `Authorization: Bearer` header (RFC 6750). Undefined when there is no
@@ -91,6 +96,31 @@ function mapVerifyError(error) {
     // JOSEAlgNotAllowed cannot occur: the header precheck already refused every algorithm but RS256.
     return new OathweaveError('malformed_token');
 }
+const ACCEPT_VALUES = ['user', 'service', 'any'];
+/** Validate the configured native issuer identifiers. */
+function nativeIssuerList(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw new TypeError('Oathweave nativeIssuers must be an array');
+    for (const issuer of value) {
+        if (typeof issuer !== 'string' || !OATHWEAVE_NATIVE_ISSUER_PATTERN.test(issuer)) {
+            throw new TypeError('Oathweave nativeIssuers entries must be lowercase identifiers such as hive-iam');
+        }
+    }
+    return [...new Set(value)];
+}
+/** Resolve `maxLifetimeSec` into one limit per principal kind. */
+function lifetimeLimits(value) {
+    const limits = typeof value === 'object' && value !== null
+        ? { user: value.user ?? OATHWEAVE_MAX_LIFETIME_SEC, service: value.service ?? OATHWEAVE_MAX_LIFETIME_SEC }
+        : { user: value ?? OATHWEAVE_MAX_LIFETIME_SEC, service: value ?? OATHWEAVE_MAX_LIFETIME_SEC };
+    for (const limit of [limits.user, limits.service]) {
+        if (!(typeof limit === 'number' && limit > 0 && limit <= 86_400))
+            throw new TypeError('maxLifetimeSec must be 1-86400');
+    }
+    return limits;
+}
 /** Create a verifier. Throws a TypeError at startup when the configuration is unsafe. */
 export function createOathweaveVerifier(options) {
     const issuers = typeof options.issuer === 'string' ? [options.issuer] : [...options.issuer];
@@ -98,6 +128,10 @@ export function createOathweaveVerifier(options) {
         throw new TypeError('At least one Oathweave issuer is required');
     for (const issuer of issuers)
         assertOathweaveEndpoint(issuer, 'issuer', options);
+    const nativeIssuers = nativeIssuerList(options.nativeIssuers);
+    const nativeIssuerAccept = options.nativeIssuerAccept ?? 'service';
+    if (!ACCEPT_VALUES.includes(nativeIssuerAccept))
+        throw new TypeError("nativeIssuerAccept must be 'user', 'service' or 'any'");
     if (options.jwksUrl !== undefined)
         assertOathweaveEndpoint(options.jwksUrl, 'jwksUrl', options);
     if (options.userinfoUrl !== undefined)
@@ -105,11 +139,9 @@ export function createOathweaveVerifier(options) {
     if (typeof options.audience !== 'string' || !options.audience)
         throw new TypeError('Oathweave audience is required');
     const clockTolerance = options.clockToleranceSec ?? OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC;
-    const maxLifetimeSec = options.maxLifetimeSec ?? OATHWEAVE_MAX_LIFETIME_SEC;
+    const lifetimes = lifetimeLimits(options.maxLifetimeSec);
     if (!(clockTolerance >= 0 && clockTolerance <= 300))
         throw new TypeError('clockToleranceSec must be 0-300');
-    if (!(maxLifetimeSec > 0 && maxLifetimeSec <= 86_400))
-        throw new TypeError('maxLifetimeSec must be 1-86400');
     const requireRoles = options.requireRoles ?? false;
     const clientIdClaim = options.clientIdClaim ?? 'either';
     if (typeof requireRoles !== 'boolean')
@@ -121,6 +153,7 @@ export function createOathweaveVerifier(options) {
     const request = options.fetch ?? ((input, init) => fetch(input, init));
     const now = options.now ?? Date.now;
     const keys = keySource(options, request, timeoutMs);
+    const acceptedIssuers = [...issuers, ...nativeIssuers];
     const sessionTtl = options.sessionCacheTtlMs ?? OATHWEAVE_SESSION_CACHE_TTL_MS;
     const sessionMax = options.sessionCacheMax ?? OATHWEAVE_SESSION_CACHE_MAX;
     // Holds only tokens whose signature verified, so garbage can neither fill it nor reach userinfo.
@@ -194,10 +227,11 @@ export function createOathweaveVerifier(options) {
         try {
             ({ payload } = await jwtVerify(token, keys, {
                 algorithms: ['RS256'],
-                issuer: issuers,
+                issuer: acceptedIssuers,
                 audience: options.audience,
                 requiredClaims: ['sub', 'iat', 'exp', 'jti'],
-                maxTokenAge: maxLifetimeSec,
+                // The per-kind limit is checked on `exp - iat` below, which also bounds the age.
+                maxTokenAge: Math.max(lifetimes.user, lifetimes.service),
                 clockTolerance,
                 currentDate: new Date(now()),
             }));
@@ -210,10 +244,14 @@ export function createOathweaveVerifier(options) {
             throw new OathweaveError('invalid_audience');
         const principal = principalFromClaims(payload, {
             accept: verifyOptions.accept ?? defaultAccept,
-            maxLifetimeSec,
+            maxLifetimeSec: lifetimes,
             requireRoles,
             clientIdClaim,
         });
+        // A native issuer signs only the principals it was configured for.
+        if (nativeIssuers.includes(principal.issuer) && nativeIssuerAccept !== 'any' && nativeIssuerAccept !== principal.kind) {
+            throw new OathweaveError('invalid_issuer');
+        }
         if (principal.kind === 'user' && options.userinfoUrl) {
             const displayName = await sessionCheck(token, principal.subject);
             return { ...principal, displayName, sessionChecked: true };
@@ -222,6 +260,7 @@ export function createOathweaveVerifier(options) {
     }
     return {
         issuers,
+        nativeIssuers,
         audience: options.audience,
         verify,
         verifyUser: token => verify(token, { accept: 'user' }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/hive-common",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Shared server kit for the Hive:Magnus suite: Oathweave token verification, error envelope, health, request context, registry client, logging, events and framework adapters",
   "keywords": [
     "hive",

package/test-vectors/README.md

@@ -3,8 +3,8 @@
 `oathweave/vectors.json` holds a test JWKS and pre-signed Oathweave access tokens with the
 outcome every suite verifier must produce. `oathweave/jwks.json` is the same JWKS on its own.
 
-All tokens are synthetic: the issuer is `https://oathweave.example.test`, the audience is
-`conformance`, and the signing keys were discarded after generation. Evaluate them at the fixed
+All tokens are synthetic: the issuer is `https://oathweave.example.test`, the native issuer
+(`nativeIssuers`) is `conformance-iam`, the audience is `conformance`, and the signing keys were discarded after generation. Evaluate them at the fixed
 time in `now` (`2026-01-01T00:00:00Z`), because Oathweave tokens live at most fifteen minutes.
 
 | Vector | Expected |
@@ -21,7 +21,11 @@ time in `now` (`2026-01-01T00:00:00Z`), because Oathweave tokens live at most fi
 | `hs256-confusion` | 401 `algorithm_not_allowed` |
 | `lifetime-too-long` | 401 `invalid_lifetime` |
 | `user-without-session` | 401 `invalid_claims` |
+| `valid-native-service` | accept, service principal signed with the native issuer |
+| `unconfigured-native-issuer` | 401 `invalid_issuer` |
+| `native-service-lifetime-too-long` | 401 `invalid_lifetime` |
 
-Run them with `runOathweaveConformance()` from `@hivemagnus/hive-common/oathweave/conformance`.
+Configure the verifier under test with `nativeIssuers` from the file (the runner passes them as
+`ctx.nativeIssuers`). Run them with `runOathweaveConformance()` from `@hivemagnus/hive-common/oathweave/conformance`.
 Regenerate with `npm run vectors:generate` in the HiveCommon repository; that replaces every
 token and key, so it is a changelog-worthy change.

package/test-vectors/oathweave/jwks.json

@@ -2,7 +2,7 @@
   "keys": [
     {
       "kty": "RSA",
-      "n": "golRKNCwa4EHgHIg8TdQPKbdQ2ZcEyA86q-Nnhlpv77c8ivnED12nAcQC29yuR7aUkLNH1FJHvbChiXndB_PqDk_AtF_fmm0XPhdKthO6GPZOjLEX5LeWzFilQ4EmgieFIOAa-4LvWZfuvqsX2jXkbABiDFnJKwQ2hfegLTGkmqRQfEfBIZZcTlGI3tVjLV2B8Fh1cutNyUpCAtTFMUBUleioFtA9BzuIl3pBJ4Q3aBMxDvkAcaV7o9FpSz5Z1bfXUaNxi_k3jfdZh8OYStAQD0SPNWjt_Wannm9N_cSVl34jMmnFBUtyiAOHf8jVZeYtcVF75RtUJRg-QopglyIow",
+      "n": "yqMr7bkXQ5W1vFW-cIyvEdkdZNAdJ6S3JsmE88aLNyNTDSM8cPskt-1ZntDBFqVc2SyhMtpPHr6zQHo8EkG6VU8vmg0u-X7whM63Pnj3xM-NNJlMCyUfH66imW2N-rITu-cyCOMmWN6WprFzhsXAR4bTw8qnuVfBHQ19fKwRhOHZuTFEQbK_OUj0k_GgzOWVyaoRnCW3_AnesQuBwp68f2JEwllYRYX2vv75Q9ckl8pstGS3E1AAtgPrGp7nAxvbmQHoMlS1xYppZuWjoUttb7qVttduuMESpFva5oDqol5xKe9J0_dP9ZPEWInpzV7LfWgkry21asEIwojglTFgaQ",
       "e": "AQAB",
       "kid": "conformance-1",
       "alg": "RS256",

package/test-vectors/oathweave/vectors.json

@@ -2,6 +2,9 @@
   "schema": 1,
   "description": "Oathweave access-token conformance vectors. Synthetic: the signing keys were discarded after generation.",
   "issuer": "https://oathweave.example.test",
+  "nativeIssuers": [
+    "conformance-iam"
+  ],
   "audience": "conformance",
   "jwksUrl": "https://oathweave.example.test/jwks",
   "userinfoUrl": "https://oathweave.example.test/userinfo",
@@ -10,7 +13,7 @@
     "keys": [
       {
         "kty": "RSA",
-        "n": "golRKNCwa4EHgHIg8TdQPKbdQ2ZcEyA86q-Nnhlpv77c8ivnED12nAcQC29yuR7aUkLNH1FJHvbChiXndB_PqDk_AtF_fmm0XPhdKthO6GPZOjLEX5LeWzFilQ4EmgieFIOAa-4LvWZfuvqsX2jXkbABiDFnJKwQ2hfegLTGkmqRQfEfBIZZcTlGI3tVjLV2B8Fh1cutNyUpCAtTFMUBUleioFtA9BzuIl3pBJ4Q3aBMxDvkAcaV7o9FpSz5Z1bfXUaNxi_k3jfdZh8OYStAQD0SPNWjt_Wannm9N_cSVl34jMmnFBUtyiAOHf8jVZeYtcVF75RtUJRg-QopglyIow",
+        "n": "yqMr7bkXQ5W1vFW-cIyvEdkdZNAdJ6S3JsmE88aLNyNTDSM8cPskt-1ZntDBFqVc2SyhMtpPHr6zQHo8EkG6VU8vmg0u-X7whM63Pnj3xM-NNJlMCyUfH66imW2N-rITu-cyCOMmWN6WprFzhsXAR4bTw8qnuVfBHQ19fKwRhOHZuTFEQbK_OUj0k_GgzOWVyaoRnCW3_AnesQuBwp68f2JEwllYRYX2vv75Q9ckl8pstGS3E1AAtgPrGp7nAxvbmQHoMlS1xYppZuWjoUttb7qVttduuMESpFva5oDqol5xKe9J0_dP9ZPEWInpzV7LfWgkry21asEIwojglTFgaQ",
         "e": "AQAB",
         "kid": "conformance-1",
         "alg": "RS256",
@@ -23,7 +26,7 @@
       "name": "valid-user",
       "description": "A user access token with a session, signed by the trusted key.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.H_M25DpT8q8xWyVFydzNrBQd6m1j1M_ziDq8yiLem2jgDoG2eetf_gGl0eUSwP-RuRlcykPvHGou1XZ3MIbbzaOP4AqxOr4aTl3HaxpXbYudYMG89ty5fcJKsFnT15zy61VjV0ZNkj734DrXDo04XbFnLuhi300ojsJpYJkWi6v-o3B-_DFVygHk_5ZNHA6hboIOCgv8ZO-kOWcHrw8Zr_VpwSmKxpj-5B8uLxXsEDb_WqGdHyXAFFt_dDjQb1dw9ssUtFhxRLE0kI2LXq6mjy_P76Z7bk_S1sSFGvMAWL_mh8QNzHspJ3CBhJmJ93JimimZu7EUpJb1vH8wIvmSVg",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.h_xGzySHyRl_bLLqz7bRQfI6FXeeoFGX7WVhauLK9LUZG0tn5mtc89p6muVppqStzCpo9NtYJC-ZD1UpF_SU3CAUC7vBU8yRkVPHHGVR26nI5n29jjr1zocAHsKg0Aia7k8hWBRDdxkfxNC6clj0fzLRR2BHNlM0m4UrE29nyQItI5hYt49ngLl74ieFStYYCo1QxJR4_x0AjDcAOUtT-hATSalaBjuS9ASrGoHjhUmal-teXcUbzXV5LXQseY1IspAtx3ujIliFp4qVhCgD2DjGf0j-0vy6tD2NBNSZL6BRJfU8ODhVy9jw1drHj9HncPPgYbr9TT96qaFRklFMKw",
       "expect": {
         "outcome": "accept",
         "kind": "user",
@@ -45,7 +48,7 @@
       "name": "valid-service",
       "description": "A client-credentials token whose client ID equals its subject.",
       "principal": "service",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJTRVJWSUNFX0FDQ09VTlQiLCJjbGllbnRJZCI6ImNvbmZvcm1hbmNlLXNlcnZpY2UiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIiwicm9sZXMiOltdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTp3cml0ZSJdLCJzY29wZSI6ImNvbmZvcm1hbmNlOndyaXRlIiwiaXNzIjoiaHR0cHM6Ly9vYXRod2VhdmUuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS1zZXJ2aWNlIiwianRpIjoiY29uZm9ybWFuY2Utc2VydmljZS0xNzY3MjI1NTcwLTE3NjcyMjU4NzAiLCJpYXQiOjE3NjcyMjU1NzAsImV4cCI6MTc2NzIyNTg3MH0.GX3VfFVnjLp2mPZQn3nI8FkLUT52ZAZoV5QWfSpjGqycR7FRgvaK3ba0RUimrTKrK_2-DZAQOLKJ-TGPjsJDJnyCNbUY-0V63QkSSZ15nKyDWpE9M8ubjjNM5cblP4GpyUog6rdhZryShHp9Q6eyjFMOUDlr2eVcxIFF3kuIMn_rfrO8rAqyk8jHu5Qpld0lls3hQIxEIf4c3WZOviVFkUEdqYmhNwwDkCM7uVSaFKv_Sh48KYWIJVPQH46FjiGOXiDxfpCwEn8ox2ZUICL0YbM3k2XB7FI3V32Ao6D9brVQ5GzDINI6yXsZJ4ylbaVHbEbXgvtnHqojkrzfAZ7FXg",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJTRVJWSUNFX0FDQ09VTlQiLCJjbGllbnRJZCI6ImNvbmZvcm1hbmNlLXNlcnZpY2UiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIiwicm9sZXMiOltdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTp3cml0ZSJdLCJzY29wZSI6ImNvbmZvcm1hbmNlOndyaXRlIiwiaXNzIjoiaHR0cHM6Ly9vYXRod2VhdmUuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS1zZXJ2aWNlIiwianRpIjoiY29uZm9ybWFuY2Utc2VydmljZS0xNzY3MjI1NTcwLTE3NjcyMjU4NzAiLCJpYXQiOjE3NjcyMjU1NzAsImV4cCI6MTc2NzIyNTg3MH0.OX7smVqC33kIdki0cnQvYIS3TTV2Hn9Pwdgh2jBJ4SHLq_ns3StMOqaDt9uz6QB7f52JM08a-e_JitdhbqPy6J7W2JIixaqV9mSC1_T8PEKRNdJ6TbkJ_zdnw4wG20VyFBOQqXz3uL8Y9hi4rk_qCmG3iXnRBTmTFw2Ra0J9ndS4Gd6oQH8VNkjBQzS6En-yNQpOEN0kn-ssYeidPJmvOkZ2Kglp4s8sri3OtF19clwcChrbChONJSITLpg6Ee3PBJIiye_h2HONCGeYbnEkKAuqUsnkmwR37rS-Eb58nOeR6A2tornF0iX1dXUShC-siuhalYOP03ijrsLh4Th0qw",
       "expect": {
         "outcome": "accept",
         "kind": "service",
@@ -64,7 +67,7 @@
       "name": "expired",
       "description": "Expired fifteen minutes before the evaluation time.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjM4MDAtMTc2NzIyNDcwMCIsImlhdCI6MTc2NzIyMzgwMCwiZXhwIjoxNzY3MjI0NzAwfQ.J3EHtT1KeCqs6XoHbGMC6cenCD8VW8YPHNKR2ipOlu7z1g5zNsF5M1MINm3ATEplsbNs8cC1Kaw4hbXwn0VfvRqv8jSfOhmG3kW70I9X1GYZjLPIzcvR_cQZ271_KcfcSZujnoHu5EuZBblyNB8MAEQhhfjV_KTfmtz1cDoR2ZpULYWzuqdwyeyI-9Aw_kFk_ueg-E45b1dhkx9mGUSO2cOUa43DZzVtzHqkhwHfxeSTKTxYk3oICaY_329q25cUh4w2ss7ZQQgYIV1fhY5COBQYQ61TuePgHhiGTuBuUkWIfJ0Uw2i3ZzmqrBkpMYURctE1cZ9gLAXUMu0YiZN7_g",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjM4MDAtMTc2NzIyNDcwMCIsImlhdCI6MTc2NzIyMzgwMCwiZXhwIjoxNzY3MjI0NzAwfQ.vRA51HlCDqr-pfDhUKoDIO50zsykGJM-ob1umb5ByYj2uDOLPl800zyu9v5PJrGPDEQMGsxKgsEDTL5vVFKTDMGQyqYVs3JUnrJhVaIV9C8Ua_e1IZqa2V7qa-sKjiXDgLnMW0s-DQGNvoL2QKf1N9kevht-UtdfW7V9OGnSloo2wJyTN1a4j9qslV5l5PK0hXV_IWcI4oQINFhOUvI5Kt7NYUkVuOqotd-TcKNYcjwmI8v-w_2CP6fG86EP07cipUBHadpxjrA6IT8r21UAa8-Oqh5FnUE6-GY1sUZRl49fNDWrY2UDZqdYnOaGSun3cJuX1sLghStSwTXU6Gm0lA",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -75,7 +78,7 @@
       "name": "not-yet-valid",
       "description": "nbf is ten minutes after the evaluation time, beyond any clock tolerance.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwLCJuYmYiOjE3NjcyMjYyMDB9.IrT2Yb6p46ok6yxC33vXiQSz1YlkYr9v4tOuYyOXjaP6VLDojFzp9ePUVSpRJ3KGseYvx5wQqJEC89EVebuBGbPX4prXSFVeiJsUk9ugIX272l3_fPKhvoo8-U0hIOefqy-yE4wtr99pC3o5pVTNkRVBeLf3Dj9qK_qJuUIpkTsyq4lXMQCr5nODmrND5NHFd1RvpSgRIbmUyuS02fWW67v_nrfacRnawKCYkheBoa9Zdq-9yHiW_aeclYhXUDFE35VPTtFIQH9sODWDwGaeHN6PxsqAuaNgKK3S4Oi9W9hN6N9hKf-XctefpSMDmR8qz3NW3ICcDmEy64Zv-kpltw",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwLCJuYmYiOjE3NjcyMjYyMDB9.VqgN6KtelOkvYszNnlXsZmpHVx_TnuiEBt6e9Lqb2YvPiZvZvYZLS8VMXkujQtV9dQK2q3rEOWK7WpzwsW7ejdCQVX6aixsW5W4PdsG0xPUL4NO5_Sw5f9Uk2wNccEb5fTLqm2_3As-PXe59AXtX_o7JLLsZAkqr0lycsaysp9bO53KshB04WDHWpY5jL-fmDuKPurMD3XPMQ4oe-TFvpqAMlOMLeaH3JgdT6Xiv97NtYAfWU_3vzp0O-GLxxTirRlwL9nMkXZ1lj5Bboyp4rOlwu6OBxNEo69LEgMm7Cmify2KpDotPxnqWJXCW6knwROlInIefqnkRAopF1QhkUQ",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -86,7 +89,7 @@
       "name": "wrong-audience",
       "description": "Issued for another product.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImFub3RoZXItcHJvZHVjdCIsInN1YiI6ImNvbmZvcm1hbmNlLXVzZXItc3ViamVjdCIsImp0aSI6ImNvbmZvcm1hbmNlLXVzZXItc3ViamVjdC0xNzY3MjI1NTQwLTE3NjcyMjY0NDAiLCJpYXQiOjE3NjcyMjU1NDAsImV4cCI6MTc2NzIyNjQ0MH0.eeXV-yXckuctyJcs7zMEu--CzOJ5jUBtGIaqZQmF8Q3qAZM9hibaQJB3Ew0gLVTQD1PIFOUM5JIv0OwUJWW7FuaEijhynTpBK037yTe-y5Hvo1btDlvGgQ7QdotS39WqLPdIorI2IndzPSq0j9CiiG9i7TRYaPUaep0dWgM4uBu-p7Tdg4n3hMFeXdaGtd9AzsMoMh-4kJx0W7jKF7YiHEibkCu1-hXmlNdylDiJ-OdaYmhPJu1HDoBs9D0KcLlJyqsvCV4E_3pK3eGLyGwRQ54v5PR5J-kHcXAXoIe-iZlYdPpfX5DxRtOAklHeRyNmNy8csGAcGFgJP7NkQ_VQnw",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImFub3RoZXItcHJvZHVjdCIsInN1YiI6ImNvbmZvcm1hbmNlLXVzZXItc3ViamVjdCIsImp0aSI6ImNvbmZvcm1hbmNlLXVzZXItc3ViamVjdC0xNzY3MjI1NTQwLTE3NjcyMjY0NDAiLCJpYXQiOjE3NjcyMjU1NDAsImV4cCI6MTc2NzIyNjQ0MH0.XXFWK7gQfhV-zF0GhBm3RrgqOeQyQIpVfCXLfle2EERERF5DvLIEg4YZo6YoVR7oo-NfS9AAr4bQOom-WEGY_vrqA678LbS3626K2jE2WiPSvgj1wJnhrDPT0NoSXF05zr5FhhnVbOGF9-SCcv6hSm8K8nyftdLBG8GykqUPhwmiUDlAFJXwcLdI5vIEPKQbZLqijq-JlMngcbPq54CzqkB6xw1Fi1N791zw7uXRkwlzji55Ld6wUHpqU-lk0pLF6iKzM5xkhuCXgTS7KXK0HUaIYIGxzldCzfVNq3SVkj8dRd6UF0v7CnJxGXzNyZm9cAiwwJ1J46Nl3dsn2XnXWA",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -97,7 +100,7 @@
       "name": "wrong-issuer",
       "description": "Signed by the trusted key but naming another issuer.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vaW1wb3N0b3IuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QiLCJqdGkiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QtMTc2NzIyNTU0MC0xNzY3MjI2NDQwIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.ZpN1PfxxUKc3dszqk_eciJKkvvwirMRF9SfKKOHH8_bLeq8mS6XpmZDPsq70u3mI0OSw1Cuzmfbr2U78Bi6Kt49VBHVo5M5K3LxmCNJkLhUddB1bpxFP1fBQbBDrqUzLntaDL30HmEWwdLagVhsw-MviWBk7C_viMh1WdgXMv_0-XEYsA76juNjrz4PU5mlpPW8zS9hIuwl7EYNlZa8kB8ok24yfPksZtE1hg8YUVrMi2i2RkgnKG-CW_WBh59sVBlouY4csr8IMHn3zV3kwdHCBAIKeiNh-z3P3asarMRPUDFUwL636ihvXyZRony6jJUjCOegYcvB9dSH6ZEQlMQ",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vaW1wb3N0b3IuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QiLCJqdGkiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QtMTc2NzIyNTU0MC0xNzY3MjI2NDQwIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.XJq-_kga-yWW33-wyjYjevshWgeLOgMK2QuHMQncUV5-FGE8qEZZDXpGRYi_qd40EdlzxMdZJLFXqf38Ub6pZZoo9lKmLN-zfwdLZgiujoMgruTdJzkk0JUe6_kbtVbiQIFepm7VfLmnhFeN4o0p9npmXINE3FDDMMXKBrI8APkJA1JX_zOIdamvNRZqMOF_r6lJLr2flIaPM1zAsP45AdUgNY0NHiK4jZqO5rNCMJgvwPDpBuU78zNzW5ZH5iYbdKvG_QE_AVROg9Enxg4cfH2zbrxl377AfqwbqAz1f65AaWgPx5rG_1-OWcoA8FRA2p38-Z4ZBXohlk7vERd26A",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -108,7 +111,7 @@
       "name": "bad-signature",
       "description": "Names the trusted key ID but is signed by another key.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.N6ySuCzMIpFUbnd-Or30sjD_E98oAQFEJlel7thmoyEWhFuiIVmwyU24bKs148r8Ko9sPQ7HKPP7lTO1G0q7IKGEjn5Ds4LkE97T0VAnViYp_5PHZ7BgvYKtFoawJZc5RQKFlXwkSUb50BjFJ_iotnroPsBYzfy_oDVcVoctizQSvCydknDzNBI-R7WTJHdK73XlUyjwJiIxfsgDdNVnm4VagQfJraQcVJGeCIrWzFz_YQZ0mWQOwMLRlwaaWBOCJ_ClaU9qTU0Vhy4AMKW2_0p61u8rN_mtA_qWSEiZYMIVYgDxYvgTO4OwVuUi_un-tA_2k8v_GikXIuyOK6ohDg",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.PonwzwBFqrqWQitpXSoAaTbqsRaPS-XfF-QJkIsZG2vRJVkoJaoL6LSqEMvZs0lbGjFfqliLIJgJXsWiheGzz922AQvbsOIAeJbiGuec9yZ5E8qe2NTsdutUMZkSnC1XMhw4n7n1EihjqJXQhTxqwmuFHRKYPjRFfObIX8VMlKw-cEP0DtZZrjWBO1YXaOwg5NgzgQf4z6ZMhfAkAngPHHAcjx50Fwkje79YxfTlXFMwSbcTrBJm4Dfd81mQFpFN3mEUkJyNcGM-Nypk1HGcxSO7hiq7qI7_wohxk05EcW47Lb4sj5hxgnEoxKD2otOo5M5Tv7Ao14YOjLj2Hk-r2w",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -119,7 +122,7 @@
       "name": "unknown-kid",
       "description": "Signed by a key the JWKS does not contain.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLXVua25vd24iLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.PRXTFRE263S0jKbuv9l_As6iEEPFib-_d-mXNeQ5dffjbCCt7JCzT8YZyxzS_IgpNwTB1Te6oDa69TcrgGjTnh7nCUye0_tN64ZoEANPCNgS16LHWaNemW88r-Nzi-2dBtWaSHMpHMFr43B5JcIwsR9jCksguIk8oclt3i1yNIYB1dR_I5YbsWnwy26lNYgo0rlgIbkpkL35VZwejYfuHe3YYozJNbLTvwRUrAbzruNRC_ZoeRnmwAyMaBLx4SVmZSJnxzcuTiy7saArv0vedV34pst4-a9DVvwpeZy_EKHHVFlTnzLVdGVr2ZDly3Fc5uHWDApsfq_LVxuq0vE-DA",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLXVua25vd24iLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyNjQ0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI2NDQwfQ.Gc9towTbaDvWaUZ54DPl4Qil36n0ajn0Ql6-uopacIHucHhD5zfQAXHNvwI6BAppRegDWewR1n764TM4W-UESIWxrReLNlEdPi_vSlWOm4ft-z5IzfGX9y-INDEUsRq2L4Ps2lRz4HPQUIW57239c_nl9UOeYHzbrg4jswbRg_Ld2d2Qc5PhUTYKIzsNCeV3UtQQQFbASnfGNEGUe-9OodPwtACmDoMfm_ZqMTZxCWEnwPdH1KeL3i7oGV2rGmRLQj3458RBY6xrGLx1CIQ1iS73jKsxuMxBWtzCOkZOPfsYo4nDAUzdyGwBXNwuP4PjDJy3W8iVyA6_HNuFRr4cPw",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -141,7 +144,7 @@
       "name": "hs256-confusion",
       "description": "HS256, keyed with the trusted public key, to exploit key-type confusion.",
       "principal": "user",
-      "token": "eyJhbGciOiJIUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiZm9yZ2VkIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.X3tuRAouszRyCO7IV3TpgE-80FuN1XfsH3bfYRp9r6s",
+      "token": "eyJhbGciOiJIUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiZm9yZ2VkIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.khNhRMAyBq4h1BGtn5ElcDfoPkmDMA4eFYTXeR3UMk4",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -152,7 +155,7 @@
       "name": "lifetime-too-long",
       "description": "A one-hour token; Oathweave access tokens live at most fifteen minutes.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyOTE0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI5MTQwfQ.Txf8bZffFR4740gNpE5gb7wNAoQLwC6lrDSN57-ZeqpbdzYykF3-FtkBbRBHsGvOnUysoK7rCkatUki4Yb3YASncBHFYrpQJ10j6BpAZMFevE4GM_b021cWC5vMVLur9foh0j5F4KcvuBPeaFWvGw_NlhVA8oyVV4xkm2MPcUT5e4G8ZvKI2trBDR1RZSgJqv8WgqXUW7_hTCjXs1eazV_rqCJ5WeEaLmynQASVqSwaOIjiIZQC_UWp_0RLkLcEoTFkhKCfYZGrtuCA2yGqPbtoPK_mzzedWv-ww1dP39J4CTA2K4v5w-7kcPNrRO8SvSrVo42FVkD-FwaI-Ybkz5g",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwic2Vzc2lvbklkIjoiY29uZm9ybWFuY2Utc2Vzc2lvbiIsInVzZXJuYW1lIjoiY29uZm9ybWFuY2UtdXNlciIsInJvbGVzIjpbIlZJRVdFUiJdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTpyZWFkIl0sInNjb3BlIjoib3BlbmlkIGNvbmZvcm1hbmNlOnJlYWQiLCJhdXRoX3RpbWUiOjE3NjcyMjU0ODAsImlzcyI6Imh0dHBzOi8vb2F0aHdlYXZlLmV4YW1wbGUudGVzdCIsImF1ZCI6ImNvbmZvcm1hbmNlIiwic3ViIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0IiwianRpIjoiY29uZm9ybWFuY2UtdXNlci1zdWJqZWN0LTE3NjcyMjU1NDAtMTc2NzIyOTE0MCIsImlhdCI6MTc2NzIyNTU0MCwiZXhwIjoxNzY3MjI5MTQwfQ.Bse6FyPkiHXCRdtFFuMKxUpCoSVRp0-WrKTaD3FFo8bKcewHe67hyFKpXHJNulnrtExvDzRD1V0tJKhTQPnyzxGp-GarlwPKIrQuu6aMOOTkSdFdVzgZSCK8yhvL5xZPbtkD8EiX5o7t7aWKZ4XadvAWL0B-FKXTaPCOTIMhNMbi3OX3l0xgiRWZcfPiSLgJQ2ExAzuYYyh-ick6fqY9raLjuDnp4Kms3X2VxYvPzoiV5h8HfPsa_sPJDnlYOx4n1UKWpIyaN1tR0wuKo_1pBGnOLwpN4_yTgbMWo3vLI-99ONmDEQc7iVYyOGjdKWqT0cNPhee0XcpMGfzty4DRmg",
       "expect": {
         "outcome": "reject",
         "status": 401,
@@ -163,12 +166,53 @@
       "name": "user-without-session",
       "description": "A USER token with no session cannot be revoked and is refused.",
       "principal": "user",
-      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwidXNlcm5hbWUiOiJjb25mb3JtYW5jZS11c2VyIiwicm9sZXMiOlsiVklFV0VSIl0sInBlcm1pc3Npb25zIjpbImNvbmZvcm1hbmNlOnJlYWQiXSwic2NvcGUiOiJvcGVuaWQgY29uZm9ybWFuY2U6cmVhZCIsImF1dGhfdGltZSI6MTc2NzIyNTQ4MCwiaXNzIjoiaHR0cHM6Ly9vYXRod2VhdmUuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QiLCJqdGkiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QtMTc2NzIyNTU0MC0xNzY3MjI2NDQwIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.Gy_tAGnksWVv8bf_k4hRoA1bSr_3r6Q6wdEa-q-4ZQAGX5L10O-o_uZHhW-DFjS7Z9LDWNarrHH04MW1kkC2DUX5hylt-JX72vHJXHDJH4XedJC8yZ5y2yDz2qgss68iSx-4y4cmTddI1Vzra3lJ7F_W9BG9znvGP-u8IfxXxu1iIBjt7oNnPbYw2xQOETFst7_exu0XbfY8t1F86x5N2a5iyOSO4_ocvj6wwXwGSKBlnLZ9he12CiRraIpOrUkJlzW3Sia_KCsBBwrrBIHDBm6WJRl8SlfbLScQJlJxA5n6riGtjPqmN44d0H2z_rj8RsyHB15ocNMUsUGapiIUHA",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJVU0VSIiwiY2xpZW50SWQiOiJoaXZleHVpIiwidXNlcm5hbWUiOiJjb25mb3JtYW5jZS11c2VyIiwicm9sZXMiOlsiVklFV0VSIl0sInBlcm1pc3Npb25zIjpbImNvbmZvcm1hbmNlOnJlYWQiXSwic2NvcGUiOiJvcGVuaWQgY29uZm9ybWFuY2U6cmVhZCIsImF1dGhfdGltZSI6MTc2NzIyNTQ4MCwiaXNzIjoiaHR0cHM6Ly9vYXRod2VhdmUuZXhhbXBsZS50ZXN0IiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QiLCJqdGkiOiJjb25mb3JtYW5jZS11c2VyLXN1YmplY3QtMTc2NzIyNTU0MC0xNzY3MjI2NDQwIiwiaWF0IjoxNzY3MjI1NTQwLCJleHAiOjE3NjcyMjY0NDB9.QoN7my4VGDehZNulCrZCXdq4d01trKuSzKYofoZdzsDOlP5tjCHPxlnKVDmvIh6NXahlV3Yxauj4w6_Q_7WPytXTvJqAHF7VlqZihvMk7Qt0YPD12vjkMHC7yJSRqOiCilvAhH2nzYV6gwbHUCx_dXLhsrH3X5mWFinllLj_yrvqR7n0IXLB8oUzBNii6tcDwVXSsAtyIm0pd876XjvSfOQcAZ2kHznUtRgIybX_w3kWTnfGAEdF6qE9ksWY6RNr063pv__5UFfXDOQdMaqxpO6TA6Vonoq0e0X0vW8DIWKyxAt_rZCE1ju_pX2wP29Lt5Ja6wMRTZWs6K2yRoy8-A",
       "expect": {
         "outcome": "reject",
         "status": 401,
         "reason": "invalid_claims"
       }
+    },
+    {
+      "name": "valid-native-service",
+      "description": "A client-credentials token signed with the configured native issuer and the same keys.",
+      "principal": "service",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJTRVJWSUNFX0FDQ09VTlQiLCJjbGllbnRJZCI6ImNvbmZvcm1hbmNlLXNlcnZpY2UiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIiwicm9sZXMiOltdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTp3cml0ZSJdLCJzY29wZSI6ImNvbmZvcm1hbmNlOndyaXRlIiwiaXNzIjoiY29uZm9ybWFuY2UtaWFtIiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS1zZXJ2aWNlIiwianRpIjoiY29uZm9ybWFuY2Utc2VydmljZS0xNzY3MjI1NTcwLTE3NjcyMjU4NzAiLCJpYXQiOjE3NjcyMjU1NzAsImV4cCI6MTc2NzIyNTg3MH0.tzDv8M9EYauZzS1hVvgoW5miWyRdnlatpGh6QfIxvxn2b8qG90FMQmLdPZffcXiD5T4gAq0JGO_LGiaPeY8rp7Jq_mz4RZXIAvVvQ_2hjC_o7nh8mu6KWtbqAfK1UB6ZerMo3w_9T6Dcll1-irNzlSTGvjItY1dJJHMvq-y_rKY5c_GpWOEy6BIkqAZXbl5D2If_zZIJgonJ0S65fVbG-rHUxHzlL7G4UrDO6KplCqVJbU_wBhmS7Tcgrpb2RX_tUGXZkr1B5xkSnJ-gAlm5-1YEOw9V64wK94fRn6V2hdHP6xp3fQs444GRpnhl9YytlW5bwzV9Il7h5lGvoW_Tgg",
+      "expect": {
+        "outcome": "accept",
+        "kind": "service",
+        "subject": "conformance-service",
+        "clientId": "conformance-service",
+        "roles": [],
+        "permissions": [
+          "conformance:write"
+        ],
+        "scopes": [
+          "conformance:write"
+        ]
+      }
+    },
+    {
+      "name": "unconfigured-native-issuer",
+      "description": "A client-credentials token from a native issuer that is not configured.",
+      "principal": "service",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJTRVJWSUNFX0FDQ09VTlQiLCJjbGllbnRJZCI6ImNvbmZvcm1hbmNlLXNlcnZpY2UiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIiwicm9sZXMiOltdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTp3cml0ZSJdLCJzY29wZSI6ImNvbmZvcm1hbmNlOndyaXRlIiwiaXNzIjoiaW1wb3N0b3ItaWFtIiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS1zZXJ2aWNlIiwianRpIjoiY29uZm9ybWFuY2Utc2VydmljZS0xNzY3MjI1NTcwLTE3NjcyMjU4NzAiLCJpYXQiOjE3NjcyMjU1NzAsImV4cCI6MTc2NzIyNTg3MH0.au69pXP0GSRHLRlcE3mF3_pquzd7OK2_2xkfZNJPmvBzdkgDG2-xTk3oInpgYdEqBS2gHyi9P2ZbkEM3UhhD0sgDNudQYZQsYSzaptX17oQYEJAk_3fnPL9WMUlmEqt0ifpOaXmIkSq-gPu9G3GXP1VMtZPpueuMBRshQQncj7bs5amNTck-48MaR8IY7LY95ghzkczgVOdO783lqjPu0u1tvYKwLe7MP8I8DxKzYwEhn7aHYlL_f6a1i6QAmrq_D55_M39CEff-AZC6koqo7SlaeQcJpj6dJSpZIDwbbHUdlzCmpzwWDLlEqnJOEoRdw_teSP0223Xd-LwNkJfSnw",
+      "expect": {
+        "outcome": "reject",
+        "status": 401,
+        "reason": "invalid_issuer"
+      }
+    },
+    {
+      "name": "native-service-lifetime-too-long",
+      "description": "A one-hour client-credentials token from the native issuer.",
+      "principal": "service",
+      "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImNvbmZvcm1hbmNlLTEiLCJ0eXAiOiJKV1QifQ.eyJhY3RvclR5cGUiOiJTRVJWSUNFX0FDQ09VTlQiLCJjbGllbnRJZCI6ImNvbmZvcm1hbmNlLXNlcnZpY2UiLCJ0b2tlbl90eXBlIjoiYWNjZXNzIiwicm9sZXMiOltdLCJwZXJtaXNzaW9ucyI6WyJjb25mb3JtYW5jZTp3cml0ZSJdLCJzY29wZSI6ImNvbmZvcm1hbmNlOndyaXRlIiwiaXNzIjoiY29uZm9ybWFuY2UtaWFtIiwiYXVkIjoiY29uZm9ybWFuY2UiLCJzdWIiOiJjb25mb3JtYW5jZS1zZXJ2aWNlIiwianRpIjoiY29uZm9ybWFuY2Utc2VydmljZS0xNzY3MjI1NTcwLTE3NjcyMjkxNzAiLCJpYXQiOjE3NjcyMjU1NzAsImV4cCI6MTc2NzIyOTE3MH0.d0o46Nuw0c29NsGRaeCrdaIN2tUoUX5tLech0f1sIwMw3qxGYPWIyVkhrefmGOWkOW2gP3HMF7UhNiUo26suDSnIRB5qwlZQ48rqA4ymRYWbeT_cfArXU_F-7tUOTgnaMSe8r6TqbvaGfQjJciuv_NULkta_Q7mrFz6hYHxu2beDoFP1xrlBOIqUxzYpBznAUro08cjIumN-kMP29D_v3MaQac0ea4_C1ZBtdUd-VISe756pIv9qygtTal3QG3nU00OrKTKNEgNNmmjMmX6C3On5rSD4LFZhsFXfkvIBS6KJWHSHs2fLTC9V2m0EIJI5oHtOYYN6ij4YEaVE9Vi1gw",
+      "expect": {
+        "outcome": "reject",
+        "status": 401,
+        "reason": "invalid_lifetime"
+      }
     }
   ]
 }