@keycardai/oauth 0.2.0 → 0.4.0

package/README.md

@@ -1,6 +1,10 @@
 # @keycardai/oauth
 
-Pure OAuth 2.0 primitives for Keycard — JWKS key management, JWT signing/verification, authorization server discovery, and token exchange. **Zero MCP dependencies.**
+> **Preview.** This SDK has not reached parity with the Keycard Python
+> SDK. APIs may change between minor versions. The preview label will
+> be removed once feature parity is reached.
+
+OAuth 2.0 primitives for Keycard: JWKS key management, JWT signing and verification, authorization server discovery, RFC 8693 token exchange (including impersonation), and server-tier primitives (`AccessContext`, `TokenVerifier`, `ClientSecret`) with multi-zone support. **Zero MCP dependencies.**
 
 This is the foundational layer of the [Keycard TypeScript SDK](../../README.md). If you're building an MCP server, you probably want [`@keycardai/mcp`](../mcp/) instead, which includes this package as a dependency.
 
@@ -28,8 +32,13 @@ const token = await signer.sign({
   scope: "read write",
 });
 
-// Verify a JWT
-const verifier = new JWTVerifier(keyring);
+// Verify a JWT. `issuers` is required — it binds the verifier to the
+// authorization server(s) you trust. Tokens with any other `iss` are
+// rejected before the keyring is consulted.
+const verifier = new JWTVerifier(keyring, {
+  issuers: "https://your-zone.keycard.cloud",
+  // audiences: "https://api.example.com", // optional
+});
 const claims = await verifier.verify(token);
 ```
 
@@ -63,6 +72,70 @@ const response = await client.exchangeToken({
 console.log(response.accessToken);
 ```
 
+### Impersonation (substitute-user token exchange)
+
+```typescript
+import { TokenExchangeClient } from "@keycardai/oauth/tokenExchange";
+
+const client = new TokenExchangeClient("https://your-zone.keycard.cloud", {
+  clientId: "your-client-id",
+  clientSecret: "your-client-secret",
+});
+
+const response = await client.impersonate({
+  userIdentifier: "user@example.com",
+  resource: "https://graph.microsoft.com",
+});
+
+console.log(response.accessToken);
+```
+
+Impersonation is a privileged operation gated by Keycard policy. The calling
+application authenticates via client credentials, and the impersonated user
+must have a delegated grant for the target resource.
+
+### Multi-Zone Credentials
+
+```typescript
+import { TokenExchangeClient } from "@keycardai/oauth/tokenExchange";
+import { ClientSecret } from "@keycardai/oauth/server";
+
+const credential = new ClientSecret({
+  "zone-a": ["client-id-a", "client-secret-a"],
+  "zone-b": ["client-id-b", "client-secret-b"],
+});
+
+const client = new TokenExchangeClient("https://keycard.cloud", { credential });
+
+const response = await client.exchangeToken(
+  { subjectToken: userToken, resource: "https://api.example.com" },
+  { zoneId: "zone-a" },
+);
+```
+
+### Server-tier Token Verification
+
+```typescript
+import { TokenVerifier } from "@keycardai/oauth/server";
+
+const verifier = new TokenVerifier({
+  issuer: "https://your-zone.keycard.cloud",
+  requiredScopes: ["read"],
+  audience: "https://api.example.com",
+});
+
+const accessToken = await verifier.verifyToken(bearerToken);
+if (!accessToken) {
+  // 401 Unauthorized
+}
+console.log(accessToken.clientId, accessToken.scopes);
+```
+
+`verifyToken` returns `AccessToken | null`. Verification failures (bad signature,
+expired token, missing scope, audience mismatch) return `null`; callers map that
+to an HTTP 401. `verifyTokenForZone(token, zoneId)` enables per-zone validation
+when the verifier is constructed with `enableMultiZone: true`.
+
 ## API Overview
 
 ### JWKS Key Management
@@ -86,7 +159,19 @@ console.log(response.accessToken);
 | Export | Import Path | Description |
 |---|---|---|
 | `fetchAuthorizationServerMetadata` | `@keycardai/oauth/discovery` | Fetches `.well-known/oauth-authorization-server` metadata |
-| `TokenExchangeClient` | `@keycardai/oauth/tokenExchange` | RFC 8693 token exchange client with auto-discovery |
+| `TokenExchangeClient` | `@keycardai/oauth/tokenExchange` | RFC 8693 token exchange client with auto-discovery, plus `impersonate()` for substitute-user exchange |
+| `TokenType` | `@keycardai/oauth/tokenExchange` | URN constants: `ACCESS_TOKEN`, `SUBSTITUTE_USER` |
+| `buildSubstituteUserToken` | `@keycardai/oauth/jwt/substituteUser` | Builds the unsigned subject JWT for impersonation calls |
+
+### Server-tier Primitives
+
+| Export | Import Path | Description |
+|---|---|---|
+| `TokenVerifier` | `@keycardai/oauth/server` | High-level JWT verifier with JWKS discovery, multi-zone, audience and scope validation; returns `AccessToken \| null` |
+| `AccessToken` (type) | `@keycardai/oauth/server` | Verified token shape (`token`, `clientId`, `scopes`, `expiresAt?`, `resource?`) |
+| `AccessContext` | `@keycardai/oauth/server` | Non-throwing per-resource token container with partial-error tracking |
+| `ClientSecret` | `@keycardai/oauth/server` | Application credential provider; supports `(clientId, clientSecret)`, tuple, or `Record<zoneId, [id, secret]>` |
+| `ApplicationCredential` (type) | `@keycardai/oauth/credentials` | Interface for credential providers |
 
 ### Errors
 
@@ -98,6 +183,8 @@ console.log(response.accessToken);
 | `OAuthError` | `@keycardai/oauth/errors` | OAuth error with error code and URI |
 | `InvalidTokenError` | `@keycardai/oauth/errors` | Token validation failure |
 | `InsufficientScopeError` | `@keycardai/oauth/errors` | Missing required scopes |
+| `ResourceAccessError` | `@keycardai/oauth/errors` | Thrown by `AccessContext.access()` on missing or failed resource |
+| `AuthProviderConfigurationError` | `@keycardai/oauth/errors` | Configuration guard for auth providers |
 
 ### Utilities
 

package/dist/cjs/credentials.d.ts

@@ -0,0 +1,22 @@
+import type { TokenExchangeRequest } from "./tokenExchange.js";
+/**
+ * Common interface for application-level credentials used in token exchange.
+ *
+ * Implementations live in downstream packages (@keycardai/mcp, @keycardai/cloudflare)
+ * because they depend on platform-specific APIs (Node.js fs, Cloudflare Workers, etc.).
+ *
+ * The optional `zoneId` parameter routes per-zone credentials in multi-zone deployments.
+ * Implementations that ignore the zone (single-zone) are accepted by the interface.
+ */
+export interface ApplicationCredential {
+    getAuth(zoneId?: string): {
+        clientId: string;
+        clientSecret: string;
+    } | null;
+    prepareTokenExchangeRequest(subjectToken: string, resource: string, options?: {
+        tokenEndpoint?: string;
+        authInfo?: Record<string, string>;
+        zoneId?: string;
+    }): Promise<TokenExchangeRequest>;
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/cjs/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,2BAA2B,CACzB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACvF,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC"}

package/dist/cjs/credentials.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=credentials.js.map

package/dist/cjs/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/credentials.ts"],"names":[],"mappings":""}

package/dist/cjs/errors.d.ts

@@ -16,4 +16,27 @@ export declare class InvalidTokenError extends OAuthError {
 export declare class InsufficientScopeError extends OAuthError {
     constructor(message: string, errorUri?: string);
 }
+export type ErrorDetail = {
+    message: string;
+    code?: string;
+    description?: string;
+    rawError?: string;
+};
+export type ResourceAccessErrorType = "global_error" | "resource_error" | "missing_token";
+export interface ResourceAccessErrorOptions {
+    resource?: string;
+    errorType?: ResourceAccessErrorType;
+    availableResources?: readonly string[];
+    errorDetails?: ErrorDetail | null;
+}
+export declare class ResourceAccessError extends Error {
+    readonly resource?: string;
+    readonly errorType?: ResourceAccessErrorType;
+    readonly availableResources?: readonly string[];
+    readonly errorDetails: ErrorDetail | null;
+    constructor(message?: string, options?: ResourceAccessErrorOptions);
+}
+export declare class AuthProviderConfigurationError extends Error {
+    constructor(message?: string);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/cjs/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAU,SAAQ,KAAK;gBAEhC,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,eAAgB,SAAQ,SAAS;CAC7C;AAED,qBAAa,iBAAkB,SAAQ,SAAS;CAC/C;AAED,qBAAa,UAAW,SAAQ,KAAK;aAEjB,SAAS,EAAE,MAAM;aAEjB,QAAQ,CAAC,EAAE,MAAM;gBAFjB,SAAS,EAAE,MAAM,EACjC,OAAO,EAAE,MAAM,EACC,QAAQ,CAAC,EAAE,MAAM,YAAA;CAIpC;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;CAG/C;AAED,qBAAa,sBAAuB,SAAQ,UAAU;gBACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;CAG/C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAU,SAAQ,KAAK;gBAEhC,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,eAAgB,SAAQ,SAAS;CAC7C;AAED,qBAAa,iBAAkB,SAAQ,SAAS;CAC/C;AAED,qBAAa,UAAW,SAAQ,KAAK;aAEjB,SAAS,EAAE,MAAM;aAEjB,QAAQ,CAAC,EAAE,MAAM;gBAFjB,SAAS,EAAE,MAAM,EACjC,OAAO,EAAE,MAAM,EACC,QAAQ,CAAC,EAAE,MAAM,YAAA;CAIpC;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;CAG/C;AAED,qBAAa,sBAAuB,SAAQ,UAAU;gBACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;CAG/C;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,cAAc,GACd,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,YAAY,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACnC;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,WAAW,GAAG,IAAI,CAAC;gBAE9B,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;CAQnE;AA4BD,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,OAAO,CAAC,EAAE,MAAM;CAI7B"}

package/dist/cjs/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InsufficientScopeError = exports.InvalidTokenError = exports.OAuthError = exports.UnauthorizedError = exports.BadRequestError = exports.HTTPError = void 0;
+exports.AuthProviderConfigurationError = exports.ResourceAccessError = exports.InsufficientScopeError = exports.InvalidTokenError = exports.OAuthError = exports.UnauthorizedError = exports.BadRequestError = exports.HTTPError = void 0;
 class HTTPError extends Error {
     constructor(message) {
         super(message);
@@ -33,4 +33,45 @@ class InsufficientScopeError extends OAuthError {
     }
 }
 exports.InsufficientScopeError = InsufficientScopeError;
+class ResourceAccessError extends Error {
+    constructor(message, options) {
+        super(message ?? buildResourceAccessMessage(options));
+        this.name = "ResourceAccessError";
+        this.resource = options?.resource;
+        this.errorType = options?.errorType;
+        this.availableResources = options?.availableResources;
+        this.errorDetails = options?.errorDetails ?? null;
+    }
+}
+exports.ResourceAccessError = ResourceAccessError;
+function buildResourceAccessMessage(options) {
+    if (!options?.errorType) {
+        return "Resource access denied or token not available";
+    }
+    const { resource, errorType, availableResources, errorDetails } = options;
+    const label = resource ? `'${resource}'` : "resource";
+    switch (errorType) {
+        case "global_error": {
+            const inner = errorDetails?.message ?? "Unknown global error";
+            return `Cannot access resource ${label}: global authentication error. ${inner}`;
+        }
+        case "resource_error": {
+            const inner = errorDetails?.message ?? "Unknown resource error";
+            return `Cannot access resource ${label}: ${inner}`;
+        }
+        case "missing_token": {
+            const list = availableResources && availableResources.length > 0
+                ? ` Available: ${availableResources.join(", ")}.`
+                : "";
+            return `No access token available for resource ${label}.${list}`;
+        }
+    }
+}
+class AuthProviderConfigurationError extends Error {
+    constructor(message) {
+        super(message ?? "AuthProvider configuration is invalid");
+        this.name = "AuthProviderConfigurationError";
+    }
+}
+exports.AuthProviderConfigurationError = AuthProviderConfigurationError;
 //# sourceMappingURL=errors.js.map

package/dist/cjs/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":";;;AAAA,MAAa,SAAU,SAAQ,KAAK;IAClC,YACE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAND,8BAMC;AAED,MAAa,eAAgB,SAAQ,SAAS;CAC7C;AADD,0CACC;AAED,MAAa,iBAAkB,SAAQ,SAAS;CAC/C;AADD,8CACC;AAED,MAAa,UAAW,SAAQ,KAAK;IACnC,YACkB,SAAiB,EACjC,OAAe,EACC,QAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,cAAS,GAAT,SAAS,CAAQ;QAEjB,aAAQ,GAAR,QAAQ,CAAS;IAGnC,CAAC;CACF;AARD,gCAQC;AAED,MAAa,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;CACF;AAJD,8CAIC;AAED,MAAa,sBAAuB,SAAQ,UAAU;IACpD,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;CACF;AAJD,wDAIC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":";;;AAAA,MAAa,SAAU,SAAQ,KAAK;IAClC,YACE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAND,8BAMC;AAED,MAAa,eAAgB,SAAQ,SAAS;CAC7C;AADD,0CACC;AAED,MAAa,iBAAkB,SAAQ,SAAS;CAC/C;AADD,8CACC;AAED,MAAa,UAAW,SAAQ,KAAK;IACnC,YACkB,SAAiB,EACjC,OAAe,EACC,QAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,cAAS,GAAT,SAAS,CAAQ;QAEjB,aAAQ,GAAR,QAAQ,CAAS;IAGnC,CAAC;CACF;AARD,gCAQC;AAED,MAAa,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;CACF;AAJD,8CAIC;AAED,MAAa,sBAAuB,SAAQ,UAAU;IACpD,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;CACF;AAJD,wDAIC;AAqBD,MAAa,mBAAoB,SAAQ,KAAK;IAM5C,YAAY,OAAgB,EAAE,OAAoC;QAChE,KAAK,CAAC,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;QACpC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QACtD,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IACpD,CAAC;CACF;AAdD,kDAcC;AAED,SAAS,0BAA0B,CAAC,OAAoC;IACtE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;QACxB,OAAO,+CAA+C,CAAC;IACzD,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;IAEtD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,KAAK,GAAG,YAAY,EAAE,OAAO,IAAI,sBAAsB,CAAC;YAC9D,OAAO,0BAA0B,KAAK,kCAAkC,KAAK,EAAE,CAAC;QAClF,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,YAAY,EAAE,OAAO,IAAI,wBAAwB,CAAC;YAChE,OAAO,0BAA0B,KAAK,KAAK,KAAK,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,IAAI,GACR,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC;gBACjD,CAAC,CAAC,eAAe,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACjD,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,0CAA0C,KAAK,IAAI,IAAI,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAa,8BAA+B,SAAQ,KAAK;IACvD,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,uCAAuC,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AALD,wEAKC"}

package/dist/cjs/index.d.ts

@@ -3,10 +3,14 @@ export { JWKSOAuthKeyring } from "./keyring.js";
 export { default as base64url } from "./base64url.js";
 export { fetchAuthorizationServerMetadata } from "./discovery.js";
 export type { OAuthAuthorizationServerMetadata } from "./discovery.js";
-export { HTTPError, BadRequestError, UnauthorizedError, OAuthError, InvalidTokenError, InsufficientScopeError } from "./errors.js";
+export { HTTPError, BadRequestError, UnauthorizedError, OAuthError, InvalidTokenError, InsufficientScopeError, ResourceAccessError, AuthProviderConfigurationError, } from "./errors.js";
 export { JWTSigner } from "./jwt/signer.js";
 export type { JWTClaims } from "./jwt/signer.js";
 export { JWTVerifier } from "./jwt/verifier.js";
-export { TokenExchangeClient } from "./tokenExchange.js";
-export type { TokenExchangeRequest, TokenResponse, TokenExchangeClientOptions } from "./tokenExchange.js";
+export { buildSubstituteUserToken } from "./jwt/substituteUser.js";
+export { TokenExchangeClient, TokenType } from "./tokenExchange.js";
+export type { TokenExchangeRequest, TokenResponse, TokenExchangeClientOptions, ExchangeOptions, ImpersonateRequest, } from "./tokenExchange.js";
+export type { ApplicationCredential } from "./credentials.js";
+export { AccessContext, TokenVerifier, ClientSecret } from "./server/index.js";
+export type { ErrorDetail, AccessContextStatus, AccessToken, TokenVerifierOptions, ClientSecretCredentials, } from "./server/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACnI,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC"}

package/dist/cjs/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenExchangeClient = exports.JWTVerifier = exports.JWTSigner = exports.InsufficientScopeError = exports.InvalidTokenError = exports.OAuthError = exports.UnauthorizedError = exports.BadRequestError = exports.HTTPError = exports.fetchAuthorizationServerMetadata = exports.base64url = exports.JWKSOAuthKeyring = void 0;
+exports.ClientSecret = exports.TokenVerifier = exports.AccessContext = exports.TokenType = exports.TokenExchangeClient = exports.buildSubstituteUserToken = exports.JWTVerifier = exports.JWTSigner = exports.AuthProviderConfigurationError = exports.ResourceAccessError = exports.InsufficientScopeError = exports.InvalidTokenError = exports.OAuthError = exports.UnauthorizedError = exports.BadRequestError = exports.HTTPError = exports.fetchAuthorizationServerMetadata = exports.base64url = exports.JWKSOAuthKeyring = void 0;
 var keyring_js_1 = require("./keyring.js");
 Object.defineProperty(exports, "JWKSOAuthKeyring", { enumerable: true, get: function () { return keyring_js_1.JWKSOAuthKeyring; } });
 var base64url_js_1 = require("./base64url.js");
@@ -17,10 +17,19 @@ Object.defineProperty(exports, "UnauthorizedError", { enumerable: true, get: fun
 Object.defineProperty(exports, "OAuthError", { enumerable: true, get: function () { return errors_js_1.OAuthError; } });
 Object.defineProperty(exports, "InvalidTokenError", { enumerable: true, get: function () { return errors_js_1.InvalidTokenError; } });
 Object.defineProperty(exports, "InsufficientScopeError", { enumerable: true, get: function () { return errors_js_1.InsufficientScopeError; } });
+Object.defineProperty(exports, "ResourceAccessError", { enumerable: true, get: function () { return errors_js_1.ResourceAccessError; } });
+Object.defineProperty(exports, "AuthProviderConfigurationError", { enumerable: true, get: function () { return errors_js_1.AuthProviderConfigurationError; } });
 var signer_js_1 = require("./jwt/signer.js");
 Object.defineProperty(exports, "JWTSigner", { enumerable: true, get: function () { return signer_js_1.JWTSigner; } });
 var verifier_js_1 = require("./jwt/verifier.js");
 Object.defineProperty(exports, "JWTVerifier", { enumerable: true, get: function () { return verifier_js_1.JWTVerifier; } });
+var substituteUser_js_1 = require("./jwt/substituteUser.js");
+Object.defineProperty(exports, "buildSubstituteUserToken", { enumerable: true, get: function () { return substituteUser_js_1.buildSubstituteUserToken; } });
 var tokenExchange_js_1 = require("./tokenExchange.js");
 Object.defineProperty(exports, "TokenExchangeClient", { enumerable: true, get: function () { return tokenExchange_js_1.TokenExchangeClient; } });
+Object.defineProperty(exports, "TokenType", { enumerable: true, get: function () { return tokenExchange_js_1.TokenType; } });
+var index_js_1 = require("./server/index.js");
+Object.defineProperty(exports, "AccessContext", { enumerable: true, get: function () { return index_js_1.AccessContext; } });
+Object.defineProperty(exports, "TokenVerifier", { enumerable: true, get: function () { return index_js_1.TokenVerifier; } });
+Object.defineProperty(exports, "ClientSecret", { enumerable: true, get: function () { return index_js_1.ClientSecret; } });
 //# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;AACA,2CAAgD;AAAvC,8GAAA,gBAAgB,OAAA;AACzB,+CAAsD;AAA7C,0HAAA,OAAO,OAAa;AAC7B,+CAAkE;AAAzD,gIAAA,gCAAgC,OAAA;AAEzC,yCAAmI;AAA1H,sGAAA,SAAS,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAAE,uGAAA,UAAU,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAAE,mHAAA,sBAAsB,OAAA;AAC7G,6CAA4C;AAAnC,sGAAA,SAAS,OAAA;AAElB,iDAAgD;AAAvC,0GAAA,WAAW,OAAA;AACpB,uDAAyD;AAAhD,uHAAA,mBAAmB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;AACA,2CAAgD;AAAvC,8GAAA,gBAAgB,OAAA;AACzB,+CAAsD;AAA7C,0HAAA,OAAO,OAAa;AAC7B,+CAAkE;AAAzD,gIAAA,gCAAgC,OAAA;AAEzC,yCASqB;AARnB,sGAAA,SAAS,OAAA;AACT,4GAAA,eAAe,OAAA;AACf,8GAAA,iBAAiB,OAAA;AACjB,uGAAA,UAAU,OAAA;AACV,8GAAA,iBAAiB,OAAA;AACjB,mHAAA,sBAAsB,OAAA;AACtB,gHAAA,mBAAmB,OAAA;AACnB,2HAAA,8BAA8B,OAAA;AAEhC,6CAA4C;AAAnC,sGAAA,SAAS,OAAA;AAElB,iDAAgD;AAAvC,0GAAA,WAAW,OAAA;AACpB,6DAAmE;AAA1D,6HAAA,wBAAwB,OAAA;AACjC,uDAAoE;AAA3D,uHAAA,mBAAmB,OAAA;AAAE,6GAAA,SAAS,OAAA;AASvC,8CAA+E;AAAtE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,wGAAA,YAAY,OAAA"}

package/dist/cjs/jwt/substituteUser.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Build the substitute-user assertion sent as the `subject_token` of an
+ * impersonation token exchange (RFC 8693, Keycard vendor extension).
+ *
+ * This is NOT a signed JWT and is NOT a general-purpose JWT builder. The
+ * assertion's `alg: "none"` is intentional: the Keycard authorization server
+ * trusts the call by validating the requesting client's credentials and the
+ * vendor URN `urn:keycard:params:oauth:token-type:substitute-user`, not the
+ * subject token's signature. Authority comes from the calling application's
+ * client credentials plus the impersonation policy on the AS.
+ *
+ * For signing arbitrary JWTs, use `JWTSigner` from `@keycardai/oauth/jwt/signer`.
+ */
+export declare function buildSubstituteUserToken(identifier: string): string;
+//# sourceMappingURL=substituteUser.d.ts.map

package/dist/cjs/jwt/substituteUser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"substituteUser.d.ts","sourceRoot":"","sources":["../../../src/jwt/substituteUser.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOnE"}

package/dist/cjs/jwt/substituteUser.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSubstituteUserToken = buildSubstituteUserToken;
+const SUBSTITUTE_USER_HEADER = { typ: "vnd.kc.su+jwt", alg: "none" };
+/**
+ * Build the substitute-user assertion sent as the `subject_token` of an
+ * impersonation token exchange (RFC 8693, Keycard vendor extension).
+ *
+ * This is NOT a signed JWT and is NOT a general-purpose JWT builder. The
+ * assertion's `alg: "none"` is intentional: the Keycard authorization server
+ * trusts the call by validating the requesting client's credentials and the
+ * vendor URN `urn:keycard:params:oauth:token-type:substitute-user`, not the
+ * subject token's signature. Authority comes from the calling application's
+ * client credentials plus the impersonation policy on the AS.
+ *
+ * For signing arbitrary JWTs, use `JWTSigner` from `@keycardai/oauth/jwt/signer`.
+ */
+function buildSubstituteUserToken(identifier) {
+    if (!identifier) {
+        throw new Error("identifier is required");
+    }
+    const header = btoau(JSON.stringify(SUBSTITUTE_USER_HEADER));
+    const payload = btoau(JSON.stringify({ sub: identifier }));
+    return `${header}.${payload}.`;
+}
+function btoau(str) {
+    return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+//# sourceMappingURL=substituteUser.js.map

package/dist/cjs/jwt/substituteUser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"substituteUser.js","sourceRoot":"","sources":["../../../src/jwt/substituteUser.ts"],"names":[],"mappings":";;AAeA,4DAOC;AAtBD,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,SAAgB,wBAAwB,CAAC,UAAkB;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO,GAAG,MAAM,IAAI,OAAO,GAAG,CAAC;AACjC,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC"}

package/dist/cjs/jwt/verifier.d.ts

@@ -1,8 +1,29 @@
 import { OAuthKeyring } from "../keyring.js";
 import type { JWTClaims } from "./signer.js";
+export interface JWTVerifierOptions {
+    /**
+     * Issuer(s) this verifier will accept. The `iss` claim in a presented token
+     * must exactly match (string equality) one of these values. Tokens with any
+     * other issuer are rejected before any key lookup or network I/O runs.
+     */
+    issuers: string | readonly string[];
+    /**
+     * Audience(s) the token must be intended for. When configured, the token's
+     * `aud` claim must be present and contain at least one of these values.
+     * When omitted, audience is not validated.
+     */
+    audiences?: string | readonly string[];
+    /**
+     * Allowed JWT algorithms. Defaults to `["RS256"]`. The `alg` header of a
+     * presented token must be a member. `"none"` is always rejected. Values
+     * must be in the set the verifier actually implements (currently only
+     * `"RS256"`).
+     */
+    algorithms?: readonly string[];
+}
 export declare class JWTVerifier {
     #private;
-    constructor(keyring: OAuthKeyring);
+    constructor(keyring: OAuthKeyring, options: JWTVerifierOptions);
     verify(token: string): Promise<JWTClaims>;
 }
 //# sourceMappingURL=verifier.d.ts.map

package/dist/cjs/jwt/verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/jwt/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,qBAAa,WAAW;;gBAGV,OAAO,EAAE,YAAY;IAI3B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;CA2BhD"}
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/jwt/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAEpC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAEvC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAUD,qBAAa,WAAW;;gBAMV,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB;IA+BxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;CA4FhD"}

package/dist/cjs/jwt/verifier.js

@@ -13,27 +13,119 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-var _JWTVerifier_keyring;
+var _JWTVerifier_keyring, _JWTVerifier_issuers, _JWTVerifier_audiences, _JWTVerifier_algorithms;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JWTVerifier = void 0;
 const errors_js_1 = require("../errors.js");
 const base64url_js_1 = __importDefault(require("../base64url.js"));
+// The single `crypto.subtle.verify` call in `verify()` is hardcoded to
+// RSASSA-PKCS1-v1_5 + SHA-256, so the `algorithms` option is only meaningful
+// as an allowlist that's a subset of what we actually implement. Used both
+// as the default when the option is omitted and to validate user-supplied
+// values at construction time.
+const SUPPORTED_ALGORITHMS = ["RS256"];
+const SUPPORTED_ALGORITHM_SET = new Set(SUPPORTED_ALGORITHMS);
 class JWTVerifier {
-    constructor(keyring) {
+    constructor(keyring, options) {
         _JWTVerifier_keyring.set(this, void 0);
+        _JWTVerifier_issuers.set(this, void 0);
+        _JWTVerifier_audiences.set(this, void 0);
+        _JWTVerifier_algorithms.set(this, void 0);
+        const rawIssuers = typeof options?.issuers === "string" ? [options.issuers] : options?.issuers ?? [];
+        if (rawIssuers.length === 0) {
+            throw new Error("JWTVerifier requires at least one trusted issuer");
+        }
+        const rawAudiences = typeof options.audiences === "string"
+            ? [options.audiences]
+            : options.audiences ?? [];
+        const rawAlgorithms = options.algorithms ?? SUPPORTED_ALGORITHMS;
+        for (const alg of rawAlgorithms) {
+            if (!SUPPORTED_ALGORITHM_SET.has(alg)) {
+                throw new Error(`JWTVerifier does not implement signature verification for "${alg}". ` +
+                    `Supported: ${SUPPORTED_ALGORITHMS.join(", ")}.`);
+            }
+        }
         __classPrivateFieldSet(this, _JWTVerifier_keyring, keyring, "f");
+        __classPrivateFieldSet(this, _JWTVerifier_issuers, new Set(rawIssuers), "f");
+        // An empty `audiences` list means "unconfigured" — matches the ergonomic
+        // intent of passing `audiences: []`. A non-empty list switches audience
+        // validation on; a missing `aud` fails closed.
+        __classPrivateFieldSet(this, _JWTVerifier_audiences, rawAudiences.length > 0 ? new Set(rawAudiences) : undefined, "f");
+        __classPrivateFieldSet(this, _JWTVerifier_algorithms, new Set(rawAlgorithms), "f");
     }
     async verify(token) {
-        const [header, payload, signature, ...rest] = token.split('.');
-        const jsonHeader = JSON.parse(autob(header));
-        const jsonPayload = JSON.parse(autob(payload));
+        const parts = token.split(".");
+        if (parts.length !== 3) {
+            throw new errors_js_1.InvalidTokenError("Malformed JWT");
+        }
+        const [header, payload, signature] = parts;
+        let jsonHeader;
+        let jsonPayload;
+        try {
+            jsonHeader = JSON.parse(autob(header));
+            jsonPayload = JSON.parse(autob(payload));
+        }
+        catch {
+            throw new errors_js_1.InvalidTokenError("Malformed JWT");
+        }
+        // Algorithm allowlist. Reject "none" and anything outside the allowlist
+        // before any other work.
+        if (!jsonHeader.alg || jsonHeader.alg === "none" || !__classPrivateFieldGet(this, _JWTVerifier_algorithms, "f").has(jsonHeader.alg)) {
+            throw new errors_js_1.InvalidTokenError(`Unsupported JWT algorithm: ${jsonHeader.alg ?? "none"}`);
+        }
+        // Issuer allowlist. Rejected BEFORE any keyring call — guarantees a token
+        // with an attacker-controlled `iss` can't trigger discovery against an
+        // untrusted URL.
         if (!jsonPayload.iss) {
             throw new errors_js_1.InvalidTokenError("JWT missing issuer (iss) claim");
         }
+        if (!__classPrivateFieldGet(this, _JWTVerifier_issuers, "f").has(jsonPayload.iss)) {
+            throw new errors_js_1.InvalidTokenError("Untrusted issuer");
+        }
+        // Required claims per RFC 9068 § 2.2. Reject NaN / Infinity explicitly —
+        // `typeof NaN === "number"` passes the type check but would make every
+        // comparison below false (and with `exp: NaN` that means effectively no
+        // expiration).
+        if (!Number.isFinite(jsonPayload.exp)) {
+            throw new errors_js_1.InvalidTokenError("JWT missing expiration (exp) claim");
+        }
+        if (!jsonPayload.client_id) {
+            throw new errors_js_1.InvalidTokenError("JWT missing client_id claim");
+        }
+        // Time-based claims.
+        const now = Math.floor(Date.now() / 1000);
+        if (now > jsonPayload.exp) {
+            throw new errors_js_1.InvalidTokenError("Token expired");
+        }
+        if (jsonPayload.nbf !== undefined) {
+            if (!Number.isFinite(jsonPayload.nbf)) {
+                throw new errors_js_1.InvalidTokenError("JWT has invalid not-before (nbf) claim");
+            }
+            if (now < jsonPayload.nbf) {
+                throw new errors_js_1.InvalidTokenError("Token not yet valid");
+            }
+        }
+        // Audience check, if configured. Missing `aud` fails closed when audiences
+        // are required — matches RFC 8707 resource-indicator expectations.
+        if (__classPrivateFieldGet(this, _JWTVerifier_audiences, "f")) {
+            const aud = jsonPayload.aud;
+            if (aud === undefined) {
+                throw new errors_js_1.InvalidTokenError("JWT missing audience (aud) claim");
+            }
+            const audValues = Array.isArray(aud) ? aud : [aud];
+            const matched = audValues.some((a) => __classPrivateFieldGet(this, _JWTVerifier_audiences, "f").has(a));
+            if (!matched) {
+                throw new errors_js_1.InvalidTokenError("Audience mismatch");
+            }
+        }
+        // Only after all cheap policy checks do we touch the keyring.
+        if (!jsonHeader.kid) {
+            throw new errors_js_1.InvalidTokenError("JWT missing key id (kid) header");
+        }
         const key = await __classPrivateFieldGet(this, _JWTVerifier_keyring, "f").key(jsonPayload.iss, jsonHeader.kid);
         const verified = await crypto.subtle.verify({
-            name: 'RSASSA-PKCS1-v1_5',
-            hash: { name: 'SHA-256' },
+            name: "RSASSA-PKCS1-v1_5",
+            hash: { name: "SHA-256" },
         }, key, base64url_js_1.default.decode(signature), new TextEncoder().encode(`${header}.${payload}`));
         if (!verified) {
             throw new errors_js_1.InvalidTokenError("Invalid signature");
@@ -42,8 +134,8 @@ class JWTVerifier {
     }
 }
 exports.JWTVerifier = JWTVerifier;
-_JWTVerifier_keyring = new WeakMap();
+_JWTVerifier_keyring = new WeakMap(), _JWTVerifier_issuers = new WeakMap(), _JWTVerifier_audiences = new WeakMap(), _JWTVerifier_algorithms = new WeakMap();
 function autob(data) {
-    return atob(data.replace(/-/g, '+').replace(/_/g, '/'));
+    return atob(data.replace(/-/g, "+").replace(/_/g, "/"));
 }
 //# sourceMappingURL=verifier.js.map

package/dist/cjs/jwt/verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/jwt/verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AACA,4CAAiD;AACjD,mEAAwC;AAGxC,MAAa,WAAW;IAGtB,YAAY,OAAqB;QAFjC,uCAAuB;QAGrB,uBAAA,IAAI,wBAAY,OAAO,MAAA,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE/D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAc,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE1D,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,6BAAiB,CAAC,gCAAgC,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,uBAAA,IAAI,4BAAS,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QAErE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACzC;YACE,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,EACD,GAAG,EACH,sBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAC3B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CACjD,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,6BAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AAlCD,kCAkCC;;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/jwt/verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AACA,4CAAiD;AACjD,mEAAwC;AA2BxC,uEAAuE;AACvE,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,+BAA+B;AAC/B,MAAM,oBAAoB,GAAG,CAAC,OAAO,CAAU,CAAC;AAChD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS,oBAAoB,CAAC,CAAC;AAEtE,MAAa,WAAW;IAMtB,YAAY,OAAqB,EAAE,OAA2B;QAL9D,uCAAuB;QACvB,uCAA8B;QAC9B,yCAAiC;QACjC,0CAAiC;QAG/B,MAAM,UAAU,GACd,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QACpF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;YACnC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YACrB,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QAE9B,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAC;QACjE,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,8DAA8D,GAAG,KAAK;oBACpE,cAAc,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,uBAAA,IAAI,wBAAY,OAAO,MAAA,CAAC;QACxB,uBAAA,IAAI,wBAAY,IAAI,GAAG,CAAC,UAAU,CAAC,MAAA,CAAC;QACpC,yEAAyE;QACzE,wEAAwE;QACxE,+CAA+C;QAC/C,uBAAA,IAAI,0BAAc,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,MAAA,CAAC;QAC9E,uBAAA,IAAI,2BAAe,IAAI,GAAG,CAAC,aAAa,CAAC,MAAA,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,6BAAiB,CAAC,eAAe,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAE3C,IAAI,UAA0C,CAAC;QAC/C,IAAI,WAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,6BAAiB,CAAC,eAAe,CAAC,CAAC;QAC/C,CAAC;QAED,wEAAwE;QACxE,yBAAyB;QACzB,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,uBAAA,IAAI,+BAAY,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,6BAAiB,CAAC,8BAA8B,UAAU,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,iBAAiB;QACjB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,6BAAiB,CAAC,gCAAgC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,uBAAA,IAAI,4BAAS,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,6BAAiB,CAAC,kBAAkB,CAAC,CAAC;QAClD,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,eAAe;QACf,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,6BAAiB,CAAC,oCAAoC,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,6BAAiB,CAAC,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QAED,qBAAqB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAI,WAAW,CAAC,GAAc,EAAE,CAAC;YACtC,MAAM,IAAI,6BAAiB,CAAC,eAAe,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,6BAAiB,CAAC,wCAAwC,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,GAAG,GAAI,WAAW,CAAC,GAAc,EAAE,CAAC;gBACtC,MAAM,IAAI,6BAAiB,CAAC,qBAAqB,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,mEAAmE;QACnE,IAAI,uBAAA,IAAI,8BAAW,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC;YAC5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,6BAAiB,CAAC,kCAAkC,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAA,IAAI,8BAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,6BAAiB,CAAC,mBAAmB,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;YACpB,MAAM,IAAI,6BAAiB,CAAC,iCAAiC,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,uBAAA,IAAI,4BAAS,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QAErE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACzC;YACE,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,EACD,GAAG,EACH,sBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAC3B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CACjD,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,6BAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AAjID,kCAiIC;;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/cjs/keyring.d.ts

@@ -22,5 +22,11 @@ export declare class JWKSOAuthKeyring implements OAuthKeyring {
     constructor(options?: JWKSOAuthKeyringOptions);
     key(issuer: string, kid: string): Promise<CryptoKey>;
     invalidate(issuer: string, kid: string): void;
+    /**
+     * Drops all cached keys, JWKS URI discoveries, and inflight resolutions.
+     * Use after a global key rotation when targeted `invalidate(issuer, kid)`
+     * is impractical. Subsequent `key()` calls re-discover and re-fetch.
+     */
+    clear(): void;
 }
 //# sourceMappingURL=keyring.d.ts.map

package/dist/cjs/keyring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keyring.d.ts","sourceRoot":"","sources":["../../src/keyring.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;CACrD;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;CAC7C;AAED,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAuDD,qBAAa,gBAAiB,YAAW,YAAY;;gBAWvC,OAAO,CAAC,EAAE,uBAAuB;IAMvC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAW1D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;CA4H9C"}
+{"version":3,"file":"keyring.d.ts","sourceRoot":"","sources":["../../src/keyring.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;CACrD;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;CAC7C;AAED,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAuDD,qBAAa,gBAAiB,YAAW,YAAY;;gBAWvC,OAAO,CAAC,EAAE,uBAAuB;IAMvC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAW1D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAQ7C;;;;OAIG;IACH,KAAK,IAAI,IAAI;CA2Hd"}

package/dist/cjs/keyring.js

@@ -79,6 +79,17 @@ class JWKSOAuthKeyring {
         __classPrivateFieldGet(this, _JWKSOAuthKeyring_discoveryCache, "f").delete(issuer);
         __classPrivateFieldGet(this, _JWKSOAuthKeyring_discoveryInflight, "f").delete(issuer);
     }
+    /**
+     * Drops all cached keys, JWKS URI discoveries, and inflight resolutions.
+     * Use after a global key rotation when targeted `invalidate(issuer, kid)`
+     * is impractical. Subsequent `key()` calls re-discover and re-fetch.
+     */
+    clear() {
+        __classPrivateFieldGet(this, _JWKSOAuthKeyring_keyCache, "f").clear();
+        __classPrivateFieldGet(this, _JWKSOAuthKeyring_keyInflight, "f").clear();
+        __classPrivateFieldGet(this, _JWKSOAuthKeyring_discoveryCache, "f").clear();
+        __classPrivateFieldGet(this, _JWKSOAuthKeyring_discoveryInflight, "f").clear();
+    }
 }
 exports.JWKSOAuthKeyring = JWKSOAuthKeyring;
 _JWKSOAuthKeyring_keyTtlMs = new WeakMap(), _JWKSOAuthKeyring_discoveryTtlMs = new WeakMap(), _JWKSOAuthKeyring_fetchTimeoutMs = new WeakMap(), _JWKSOAuthKeyring_discoveryCache = new WeakMap(), _JWKSOAuthKeyring_keyCache = new WeakMap(), _JWKSOAuthKeyring_discoveryInflight = new WeakMap(), _JWKSOAuthKeyring_keyInflight = new WeakMap(), _JWKSOAuthKeyring_instances = new WeakSet(), _JWKSOAuthKeyring_resolveJwksUri =