@mcp-z/oauth 1.0.0

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth/src/index.ts"],"sourcesContent":["/**\n * @mcp-z/oauth - Multi-account OAuth orchestration and secure token storage for MCP servers\n *\n * Provides account management functions, account tools generation, and secure logging utilities.\n * Designed to work with any storage backend (file, Redis, DuckDB) via Keyv interface.\n */\n\n// Core account management - Public API\n// Internal functions - For provider implementations and testing\nexport { addAccount, getActiveAccount, getToken, removeAccount, setAccountInfo, setActiveAccount, setToken } from './account-utils.ts';\n// Auth classes - For multi-tenant testing\nexport { JWTUserAuth } from './jwt-auth.ts';\nexport { type AccountKeyParams, type AccountKeyType, createAccountKey, createServiceKey, listAccountIds, type ServiceKeyParams, type ServiceKeyType } from './key-utils.ts';\n// Account server and factory functions - Public API\nexport { type AccountLoopbackConfig, AccountServer, type AccountStatelessConfig, createLoopback, createStateless } from './lib/account-server/index.ts';\n// DCR types - Public API\nexport type { DcrClientInformation, DcrClientMetadata, DcrConfig, DcrErrorResponse, ProviderTokens } from './lib/dcr-types.ts';\n// RFC Metadata Types - Public API\nexport type { RFC8414Metadata, RFC9728Metadata } from './lib/rfc-metadata-types.ts';\nexport { generatePKCE, type PKCEPair } from './pkce.ts';\n// Logging utilities - Public API\nexport { sanitizeForLogging, sanitizeForLoggingFormatter } from './sanitizer.ts';\n// Schemas\nexport * as schemas from './schemas/index.ts';\nexport { SessionUserAuth } from './session-auth.ts';\nexport { getErrorTemplate, getSuccessTemplate } from './templates.ts';\n\n// Public types - core interfaces that consumers use\nexport type {\n  // Account management types\n  AccountInfo,\n  // Provider interfaces\n  AuthEmailProvider,\n  AuthFlowDescriptor,\n  AuthMiddlewareWrapper,\n  CachedToken,\n  Credentials,\n  // Auth config types\n  JWTUserAuthConfig,\n  // Utility types\n  Logger,\n  McpPrompt,\n  McpTool,\n  OAuth2TokenStorageProvider,\n  SessionUserAuthConfig,\n  ToolConfig,\n  ToolHandler,\n  ToolModule,\n  UserAuthProvider,\n} from './types.ts';\n\n// Public error classes\nexport { AccountManagerError, AccountNotFoundError, AuthRequiredError, ConfigurationError, RequiresAuthenticationError } from './types.ts';\n"],"names":["AccountManagerError","AccountNotFoundError","AccountServer","AuthRequiredError","ConfigurationError","JWTUserAuth","RequiresAuthenticationError","SessionUserAuth","addAccount","createAccountKey","createLoopback","createServiceKey","createStateless","generatePKCE","getActiveAccount","getErrorTemplate","getSuccessTemplate","getToken","listAccountIds","removeAccount","sanitizeForLogging","sanitizeForLoggingFormatter","schemas","setAccountInfo","setActiveAccount","setToken"],"mappings":"AAAA;;;;;CAKC,GAED,uCAAuC;AACvC,gEAAgE;;;;;;;;;;;;QA4CvDA;eAAAA,4BAAmB;;QAAEC;eAAAA,6BAAoB;;QAtCbC;eAAAA,sBAAa;;QAsCEC;eAAAA,0BAAiB;;QAAEC;eAAAA,2BAAkB;;QAzChFC;eAAAA,sBAAW;;QAyCuEC;eAAAA,oCAA2B;;QA5B7GC;eAAAA,8BAAe;;QAffC;eAAAA,0BAAU;;QAGkCC;eAAAA,4BAAgB;;QAEYC;eAAAA,uBAAc;;QAFxBC;eAAAA,4BAAgB;;QAEUC;eAAAA,wBAAe;;QAKvGC;eAAAA,oBAAY;;QAVAC;eAAAA,gCAAgB;;QAgB5BC;eAAAA,6BAAgB;;QAAEC;eAAAA,+BAAkB;;QAhBNC;eAAAA,wBAAQ;;QAG0CC;eAAAA,0BAAc;;QAHtDC;eAAAA,6BAAa;;QAYrDC;eAAAA,+BAAkB;;QAAEC;eAAAA,wCAA2B;;QAE5CC;;;QAdoDC;eAAAA,8BAAc;;QAAEC;eAAAA,gCAAgB;;QAAEC;eAAAA,wBAAQ;;;8BAAQ;yBAEtF;0BAC+H;uBAEnC;sBAK5E;2BAEoB;gEAEvC;6BACO;2BACqB;uBA2ByE"}

package/dist/cjs/jwt-auth.d.cts

@@ -0,0 +1,53 @@
+/**
+ * JWT-based user authentication for multi-tenant deployments
+ *
+ * Extracts user ID from JWT tokens with signature and claims verification.
+ * Supports HS256, RS256, ES256 algorithms via JOSE library.
+ */
+import type { JWTUserAuthConfig, UserAuthProvider } from './types.js';
+/**
+ * JWT-based user authentication provider
+ *
+ * Verifies JWT tokens and extracts user IDs from claims.
+ * Use for multi-tenant deployments where users authenticate via JWT.
+ *
+ * @example
+ * ```typescript
+ * // HS256 with shared secret
+ * const userAuth = new JWTUserAuth({
+ *   secret: process.env.JWT_SECRET!,
+ *   issuer: 'https://auth.example.com',
+ *   audience: 'api.example.com',
+ * });
+ *
+ * // RS256 with public key
+ * const userAuth = new JWTUserAuth({
+ *   publicKey: process.env.JWT_PUBLIC_KEY!,
+ *   issuer: 'https://auth.example.com',
+ * });
+ *
+ * // RS256 with JWKS URL (dynamic key rotation)
+ * const userAuth = new JWTUserAuth({
+ *   jwksUrl: 'https://auth.example.com/.well-known/jwks.json',
+ *   issuer: 'https://auth.example.com',
+ *   audience: 'api.example.com',
+ * });
+ * ```
+ */
+export declare class JWTUserAuth implements UserAuthProvider {
+    private readonly config;
+    private readonly remoteJWKSet?;
+    constructor(config: JWTUserAuthConfig);
+    /**
+     * Extract and verify user ID from JWT token
+     *
+     * @param req - HTTP request object with Authorization header
+     * @returns User ID from verified JWT claims
+     * @throws Error if token missing, invalid, expired, or claims invalid
+     */
+    getUserId(req: unknown): Promise<string>;
+    /**
+     * Verify JWT signature and claims
+     */
+    private verifyToken;
+}

package/dist/cjs/jwt-auth.d.ts

@@ -0,0 +1,53 @@
+/**
+ * JWT-based user authentication for multi-tenant deployments
+ *
+ * Extracts user ID from JWT tokens with signature and claims verification.
+ * Supports HS256, RS256, ES256 algorithms via JOSE library.
+ */
+import type { JWTUserAuthConfig, UserAuthProvider } from './types.js';
+/**
+ * JWT-based user authentication provider
+ *
+ * Verifies JWT tokens and extracts user IDs from claims.
+ * Use for multi-tenant deployments where users authenticate via JWT.
+ *
+ * @example
+ * ```typescript
+ * // HS256 with shared secret
+ * const userAuth = new JWTUserAuth({
+ *   secret: process.env.JWT_SECRET!,
+ *   issuer: 'https://auth.example.com',
+ *   audience: 'api.example.com',
+ * });
+ *
+ * // RS256 with public key
+ * const userAuth = new JWTUserAuth({
+ *   publicKey: process.env.JWT_PUBLIC_KEY!,
+ *   issuer: 'https://auth.example.com',
+ * });
+ *
+ * // RS256 with JWKS URL (dynamic key rotation)
+ * const userAuth = new JWTUserAuth({
+ *   jwksUrl: 'https://auth.example.com/.well-known/jwks.json',
+ *   issuer: 'https://auth.example.com',
+ *   audience: 'api.example.com',
+ * });
+ * ```
+ */
+export declare class JWTUserAuth implements UserAuthProvider {
+    private readonly config;
+    private readonly remoteJWKSet?;
+    constructor(config: JWTUserAuthConfig);
+    /**
+     * Extract and verify user ID from JWT token
+     *
+     * @param req - HTTP request object with Authorization header
+     * @returns User ID from verified JWT claims
+     * @throws Error if token missing, invalid, expired, or claims invalid
+     */
+    getUserId(req: unknown): Promise<string>;
+    /**
+     * Verify JWT signature and claims
+     */
+    private verifyToken;
+}

package/dist/cjs/jwt-auth.js

@@ -0,0 +1,417 @@
+/**
+ * JWT-based user authentication for multi-tenant deployments
+ *
+ * Extracts user ID from JWT tokens with signature and claims verification.
+ * Supports HS256, RS256, ES256 algorithms via JOSE library.
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "JWTUserAuth", {
+    enumerable: true,
+    get: function() {
+        return JWTUserAuth;
+    }
+});
+var _jose = require("jose");
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        if (enumerableOnly) {
+            symbols = symbols.filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(object, sym).enumerable;
+            });
+        }
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+var JWTUserAuth = /*#__PURE__*/ function() {
+    "use strict";
+    function JWTUserAuth(config) {
+        _class_call_check(this, JWTUserAuth);
+        var _config_userIdClaim, _config_algorithms, _config_clockTolerance;
+        // Validate configuration
+        if (!config.secret && !config.publicKey && !config.jwksUrl) {
+            throw new Error('JWTUserAuth: Must provide one of: secret (HS256), publicKey (RS256/ES256), or jwksUrl');
+        }
+        if (config.secret && config.secret.length < 32) {
+            throw new Error('JWTUserAuth: secret must be at least 32 characters for HS256');
+        }
+        if ((config.secret ? 1 : 0) + (config.publicKey ? 1 : 0) + (config.jwksUrl ? 1 : 0) > 1) {
+            throw new Error('JWTUserAuth: Provide only one of: secret, publicKey, or jwksUrl');
+        }
+        // Store configuration with defaults
+        this.config = _object_spread_props(_object_spread({}, config.secret !== undefined && {
+            secret: config.secret
+        }, config.publicKey !== undefined && {
+            publicKey: config.publicKey
+        }, config.jwksUrl !== undefined && {
+            jwksUrl: config.jwksUrl
+        }, config.issuer !== undefined && {
+            issuer: config.issuer
+        }, config.audience !== undefined && {
+            audience: config.audience
+        }), {
+            userIdClaim: (_config_userIdClaim = config.userIdClaim) !== null && _config_userIdClaim !== void 0 ? _config_userIdClaim : 'sub',
+            algorithms: (_config_algorithms = config.algorithms) !== null && _config_algorithms !== void 0 ? _config_algorithms : [],
+            clockTolerance: (_config_clockTolerance = config.clockTolerance) !== null && _config_clockTolerance !== void 0 ? _config_clockTolerance : 0
+        });
+        // Create remote JWK set if using JWKS URL
+        if (config.jwksUrl) {
+            this.remoteJWKSet = (0, _jose.createRemoteJWKSet)(new URL(config.jwksUrl));
+        }
+    }
+    var _proto = JWTUserAuth.prototype;
+    /**
+   * Extract and verify user ID from JWT token
+   *
+   * @param req - HTTP request object with Authorization header
+   * @returns User ID from verified JWT claims
+   * @throws Error if token missing, invalid, expired, or claims invalid
+   */ _proto.getUserId = function getUserId(req) {
+        return _async_to_generator(function() {
+            var _httpReq_headers, httpReq, authHeader, match, token, payload, userId;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        httpReq = req;
+                        // Extract Authorization header
+                        authHeader = (_httpReq_headers = httpReq.headers) === null || _httpReq_headers === void 0 ? void 0 : _httpReq_headers.authorization;
+                        if (!authHeader) {
+                            throw new Error('JWTUserAuth: No Authorization header found');
+                        }
+                        // Parse Bearer token
+                        match = /^Bearer\s+(.+)$/i.exec(authHeader.trim());
+                        if (!match) {
+                            throw new Error('JWTUserAuth: Invalid Authorization header format (expected "Bearer <token>")');
+                        }
+                        token = match[1];
+                        if (!token) {
+                            throw new Error('JWTUserAuth: Empty JWT token');
+                        }
+                        return [
+                            4,
+                            this.verifyToken(token)
+                        ];
+                    case 1:
+                        payload = _state.sent();
+                        // Extract user ID from configured claim
+                        userId = payload[this.config.userIdClaim];
+                        if (!userId || typeof userId !== 'string') {
+                            throw new Error("JWTUserAuth: JWT missing or invalid '".concat(this.config.userIdClaim, "' claim"));
+                        }
+                        return [
+                            2,
+                            userId
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Verify JWT signature and claims
+   */ _proto.verifyToken = function verifyToken(token) {
+        return _async_to_generator(function() {
+            var options, result, secret, key, _tmp, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            11,
+                            ,
+                            12
+                        ]);
+                        // Build verification options
+                        options = _object_spread({}, this.config.issuer && {
+                            issuer: this.config.issuer
+                        }, this.config.audience && {
+                            audience: this.config.audience
+                        }, this.config.clockTolerance && {
+                            clockTolerance: this.config.clockTolerance
+                        });
+                        if (!this.config.secret) return [
+                            3,
+                            2
+                        ];
+                        // HS256 verification with shared secret
+                        secret = new TextEncoder().encode(this.config.secret);
+                        return [
+                            4,
+                            (0, _jose.jwtVerify)(token, secret, _object_spread_props(_object_spread({}, options), {
+                                algorithms: this.config.algorithms.length > 0 ? this.config.algorithms : [
+                                    'HS256'
+                                ]
+                            }))
+                        ];
+                    case 1:
+                        result = _state.sent();
+                        return [
+                            3,
+                            10
+                        ];
+                    case 2:
+                        if (!this.remoteJWKSet) return [
+                            3,
+                            4
+                        ];
+                        return [
+                            4,
+                            (0, _jose.jwtVerify)(token, this.remoteJWKSet, _object_spread_props(_object_spread({}, options), {
+                                algorithms: this.config.algorithms.length > 0 ? this.config.algorithms : [
+                                    'RS256',
+                                    'ES256'
+                                ]
+                            }))
+                        ];
+                    case 3:
+                        // RS256/ES256 verification with remote JWKS
+                        result = _state.sent();
+                        return [
+                            3,
+                            10
+                        ];
+                    case 4:
+                        if (!this.config.publicKey) return [
+                            3,
+                            9
+                        ];
+                        if (!(typeof this.config.publicKey === 'string')) return [
+                            3,
+                            6
+                        ];
+                        return [
+                            4,
+                            (0, _jose.importSPKI)(this.config.publicKey, 'RS256')
+                        ];
+                    case 5:
+                        _tmp = _state.sent();
+                        return [
+                            3,
+                            7
+                        ];
+                    case 6:
+                        _tmp = this.config.publicKey;
+                        _state.label = 7;
+                    case 7:
+                        key = _tmp;
+                        return [
+                            4,
+                            (0, _jose.jwtVerify)(token, key, _object_spread_props(_object_spread({}, options), {
+                                algorithms: this.config.algorithms.length > 0 ? this.config.algorithms : [
+                                    'RS256',
+                                    'ES256'
+                                ]
+                            }))
+                        ];
+                    case 8:
+                        result = _state.sent();
+                        return [
+                            3,
+                            10
+                        ];
+                    case 9:
+                        throw new Error('JWTUserAuth: No verification key configured');
+                    case 10:
+                        return [
+                            2,
+                            result.payload
+                        ];
+                    case 11:
+                        error = _state.sent();
+                        if (_instanceof(error, Error)) {
+                            throw new Error("JWTUserAuth: JWT verification failed: ".concat(error.message));
+                        }
+                        throw new Error('JWTUserAuth: JWT verification failed');
+                    case 12:
+                        return [
+                            2
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    return JWTUserAuth;
+}();
+/* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }

package/dist/cjs/jwt-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth/src/jwt-auth.ts"],"sourcesContent":["/**\n * JWT-based user authentication for multi-tenant deployments\n *\n * Extracts user ID from JWT tokens with signature and claims verification.\n * Supports HS256, RS256, ES256 algorithms via JOSE library.\n */\n\nimport { createRemoteJWKSet, importSPKI, type JWK, type JWTPayload, type JWTVerifyOptions, type JWTVerifyResult, jwtVerify } from 'jose';\nimport type { JWTUserAuthConfig, UserAuthProvider } from './types.ts';\n\n/**\n * HTTP request interface (subset needed for JWT auth)\n */\ninterface HttpRequest {\n  headers?: {\n    authorization?: string;\n  };\n}\n\n/**\n * JWT-based user authentication provider\n *\n * Verifies JWT tokens and extracts user IDs from claims.\n * Use for multi-tenant deployments where users authenticate via JWT.\n *\n * @example\n * ```typescript\n * // HS256 with shared secret\n * const userAuth = new JWTUserAuth({\n *   secret: process.env.JWT_SECRET!,\n *   issuer: 'https://auth.example.com',\n *   audience: 'api.example.com',\n * });\n *\n * // RS256 with public key\n * const userAuth = new JWTUserAuth({\n *   publicKey: process.env.JWT_PUBLIC_KEY!,\n *   issuer: 'https://auth.example.com',\n * });\n *\n * // RS256 with JWKS URL (dynamic key rotation)\n * const userAuth = new JWTUserAuth({\n *   jwksUrl: 'https://auth.example.com/.well-known/jwks.json',\n *   issuer: 'https://auth.example.com',\n *   audience: 'api.example.com',\n * });\n * ```\n */\nexport class JWTUserAuth implements UserAuthProvider {\n  private readonly config: {\n    secret?: string;\n    publicKey?: string | JWK;\n    jwksUrl?: string;\n    issuer?: string | string[];\n    audience?: string | string[];\n    userIdClaim: string;\n    algorithms: string[];\n    clockTolerance: number;\n  };\n  private readonly remoteJWKSet?: ReturnType<typeof createRemoteJWKSet>;\n\n  constructor(config: JWTUserAuthConfig) {\n    // Validate configuration\n    if (!config.secret && !config.publicKey && !config.jwksUrl) {\n      throw new Error('JWTUserAuth: Must provide one of: secret (HS256), publicKey (RS256/ES256), or jwksUrl');\n    }\n\n    if (config.secret && config.secret.length < 32) {\n      throw new Error('JWTUserAuth: secret must be at least 32 characters for HS256');\n    }\n\n    if ((config.secret ? 1 : 0) + (config.publicKey ? 1 : 0) + (config.jwksUrl ? 1 : 0) > 1) {\n      throw new Error('JWTUserAuth: Provide only one of: secret, publicKey, or jwksUrl');\n    }\n\n    // Store configuration with defaults\n    this.config = {\n      ...(config.secret !== undefined && { secret: config.secret }),\n      ...(config.publicKey !== undefined && { publicKey: config.publicKey }),\n      ...(config.jwksUrl !== undefined && { jwksUrl: config.jwksUrl }),\n      ...(config.issuer !== undefined && { issuer: config.issuer }),\n      ...(config.audience !== undefined && { audience: config.audience }),\n      userIdClaim: config.userIdClaim ?? 'sub',\n      algorithms: config.algorithms ?? [],\n      clockTolerance: config.clockTolerance ?? 0,\n    };\n\n    // Create remote JWK set if using JWKS URL\n    if (config.jwksUrl) {\n      this.remoteJWKSet = createRemoteJWKSet(new URL(config.jwksUrl));\n    }\n  }\n\n  /**\n   * Extract and verify user ID from JWT token\n   *\n   * @param req - HTTP request object with Authorization header\n   * @returns User ID from verified JWT claims\n   * @throws Error if token missing, invalid, expired, or claims invalid\n   */\n  async getUserId(req: unknown): Promise<string> {\n    const httpReq = req as HttpRequest;\n\n    // Extract Authorization header\n    const authHeader = httpReq.headers?.authorization;\n    if (!authHeader) {\n      throw new Error('JWTUserAuth: No Authorization header found');\n    }\n\n    // Parse Bearer token\n    const match = /^Bearer\\s+(.+)$/i.exec(authHeader.trim());\n    if (!match) {\n      throw new Error('JWTUserAuth: Invalid Authorization header format (expected \"Bearer <token>\")');\n    }\n\n    const token = match[1];\n    if (!token) {\n      throw new Error('JWTUserAuth: Empty JWT token');\n    }\n\n    // Verify JWT and extract payload\n    const payload = await this.verifyToken(token);\n\n    // Extract user ID from configured claim\n    const userId = payload[this.config.userIdClaim];\n    if (!userId || typeof userId !== 'string') {\n      throw new Error(`JWTUserAuth: JWT missing or invalid '${this.config.userIdClaim}' claim`);\n    }\n\n    return userId;\n  }\n\n  /**\n   * Verify JWT signature and claims\n   */\n  private async verifyToken(token: string): Promise<JWTPayload> {\n    try {\n      // Build verification options\n      const options: JWTVerifyOptions = {\n        ...(this.config.issuer && { issuer: this.config.issuer }),\n        ...(this.config.audience && { audience: this.config.audience }),\n        ...(this.config.clockTolerance && { clockTolerance: this.config.clockTolerance }),\n      };\n\n      // Verify with appropriate key type\n      let result: JWTVerifyResult;\n\n      if (this.config.secret) {\n        // HS256 verification with shared secret\n        const secret = new TextEncoder().encode(this.config.secret);\n        result = await jwtVerify(token, secret, {\n          ...options,\n          algorithms: this.config.algorithms.length > 0 ? this.config.algorithms : ['HS256'],\n        });\n      } else if (this.remoteJWKSet) {\n        // RS256/ES256 verification with remote JWKS\n        result = await jwtVerify(token, this.remoteJWKSet, {\n          ...options,\n          algorithms: this.config.algorithms.length > 0 ? this.config.algorithms : ['RS256', 'ES256'],\n        });\n      } else if (this.config.publicKey) {\n        // RS256/ES256 verification with provided public key\n        // If string (PEM), import it first; if JWK, use directly\n        const key = typeof this.config.publicKey === 'string' ? await importSPKI(this.config.publicKey, 'RS256') : this.config.publicKey;\n\n        result = await jwtVerify(token, key, {\n          ...options,\n          algorithms: this.config.algorithms.length > 0 ? this.config.algorithms : ['RS256', 'ES256'],\n        });\n      } else {\n        throw new Error('JWTUserAuth: No verification key configured');\n      }\n\n      return result.payload;\n    } catch (error) {\n      if (error instanceof Error) {\n        throw new Error(`JWTUserAuth: JWT verification failed: ${error.message}`);\n      }\n      throw new Error('JWTUserAuth: JWT verification failed');\n    }\n  }\n}\n"],"names":["JWTUserAuth","config","secret","publicKey","jwksUrl","Error","length","undefined","issuer","audience","userIdClaim","algorithms","clockTolerance","remoteJWKSet","createRemoteJWKSet","URL","getUserId","req","httpReq","authHeader","match","token","payload","userId","headers","authorization","exec","trim","verifyToken","options","result","key","error","TextEncoder","encode","jwtVerify","importSPKI","message"],"mappings":"AAAA;;;;;CAKC;;;;+BA2CYA;;;eAAAA;;;oBAzCqH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyC3H,IAAA,AAAMA,4BAAN;;aAAMA,YAaCC,MAAyB;gCAb1BD;YAkCMC,qBACDA,oBACIA;QAtBlB,yBAAyB;QACzB,IAAI,CAACA,OAAOC,MAAM,IAAI,CAACD,OAAOE,SAAS,IAAI,CAACF,OAAOG,OAAO,EAAE;YAC1D,MAAM,IAAIC,MAAM;QAClB;QAEA,IAAIJ,OAAOC,MAAM,IAAID,OAAOC,MAAM,CAACI,MAAM,GAAG,IAAI;YAC9C,MAAM,IAAID,MAAM;QAClB;QAEA,IAAI,AAACJ,CAAAA,OAAOC,MAAM,GAAG,IAAI,CAAA,IAAMD,CAAAA,OAAOE,SAAS,GAAG,IAAI,CAAA,IAAMF,CAAAA,OAAOG,OAAO,GAAG,IAAI,CAAA,IAAK,GAAG;YACvF,MAAM,IAAIC,MAAM;QAClB;QAEA,oCAAoC;QACpC,IAAI,CAACJ,MAAM,GAAG,wCACRA,OAAOC,MAAM,KAAKK,aAAa;YAAEL,QAAQD,OAAOC,MAAM;QAAC,GACvDD,OAAOE,SAAS,KAAKI,aAAa;YAAEJ,WAAWF,OAAOE,SAAS;QAAC,GAChEF,OAAOG,OAAO,KAAKG,aAAa;YAAEH,SAASH,OAAOG,OAAO;QAAC,GAC1DH,OAAOO,MAAM,KAAKD,aAAa;YAAEC,QAAQP,OAAOO,MAAM;QAAC,GACvDP,OAAOQ,QAAQ,KAAKF,aAAa;YAAEE,UAAUR,OAAOQ,QAAQ;QAAC;YACjEC,WAAW,GAAET,sBAAAA,OAAOS,WAAW,cAAlBT,iCAAAA,sBAAsB;YACnCU,UAAU,GAAEV,qBAAAA,OAAOU,UAAU,cAAjBV,gCAAAA,qBAAqB,EAAE;YACnCW,cAAc,GAAEX,yBAAAA,OAAOW,cAAc,cAArBX,oCAAAA,yBAAyB;;QAG3C,0CAA0C;QAC1C,IAAIA,OAAOG,OAAO,EAAE;YAClB,IAAI,CAACS,YAAY,GAAGC,IAAAA,wBAAkB,EAAC,IAAIC,IAAId,OAAOG,OAAO;QAC/D;;iBA1CSJ;IA6CX;;;;;;GAMC,GACD,OAAMgB,SA8BL,GA9BD,SAAMA,UAAUC,GAAY;;gBAIPC,kBAHbA,SAGAC,YAMAC,OAKAC,OAMAC,SAGAC;;;;wBAvBAL,UAAUD;wBAEhB,+BAA+B;wBACzBE,cAAaD,mBAAAA,QAAQM,OAAO,cAAfN,uCAAAA,iBAAiBO,aAAa;wBACjD,IAAI,CAACN,YAAY;4BACf,MAAM,IAAId,MAAM;wBAClB;wBAEA,qBAAqB;wBACfe,QAAQ,mBAAmBM,IAAI,CAACP,WAAWQ,IAAI;wBACrD,IAAI,CAACP,OAAO;4BACV,MAAM,IAAIf,MAAM;wBAClB;wBAEMgB,QAAQD,KAAK,CAAC,EAAE;wBACtB,IAAI,CAACC,OAAO;4BACV,MAAM,IAAIhB,MAAM;wBAClB;wBAGgB;;4BAAM,IAAI,CAACuB,WAAW,CAACP;;;wBAAjCC,UAAU;wBAEhB,wCAAwC;wBAClCC,SAASD,OAAO,CAAC,IAAI,CAACrB,MAAM,CAACS,WAAW,CAAC;wBAC/C,IAAI,CAACa,UAAU,OAAOA,WAAW,UAAU;4BACzC,MAAM,IAAIlB,MAAM,AAAC,wCAA+D,OAAxB,IAAI,CAACJ,MAAM,CAACS,WAAW,EAAC;wBAClF;wBAEA;;4BAAOa;;;;QACT;;IAEA;;GAEC,GACD,OAAcK,WA6Cb,GA7CD,SAAcA,YAAYP,KAAa;;gBAG7BQ,SAOFC,QAII5B,QAcA6B,WAWDC;;;;;;;;;;wBArCP,6BAA6B;wBACvBH,UAA4B,mBAC5B,IAAI,CAAC5B,MAAM,CAACO,MAAM,IAAI;4BAAEA,QAAQ,IAAI,CAACP,MAAM,CAACO,MAAM;wBAAC,GACnD,IAAI,CAACP,MAAM,CAACQ,QAAQ,IAAI;4BAAEA,UAAU,IAAI,CAACR,MAAM,CAACQ,QAAQ;wBAAC,GACzD,IAAI,CAACR,MAAM,CAACW,cAAc,IAAI;4BAAEA,gBAAgB,IAAI,CAACX,MAAM,CAACW,cAAc;wBAAC;6BAM7E,IAAI,CAACX,MAAM,CAACC,MAAM,EAAlB;;;;wBACF,wCAAwC;wBAClCA,SAAS,IAAI+B,cAAcC,MAAM,CAAC,IAAI,CAACjC,MAAM,CAACC,MAAM;wBACjD;;4BAAMiC,IAAAA,eAAS,EAACd,OAAOnB,QAAQ,wCACnC2B;gCACHlB,YAAY,IAAI,CAACV,MAAM,CAACU,UAAU,CAACL,MAAM,GAAG,IAAI,IAAI,CAACL,MAAM,CAACU,UAAU;oCAAI;;;;;wBAF5EmB,SAAS;;;;;;6BAIA,IAAI,CAACjB,YAAY,EAAjB;;;;wBAEA;;4BAAMsB,IAAAA,eAAS,EAACd,OAAO,IAAI,CAACR,YAAY,EAAE,wCAC9CgB;gCACHlB,YAAY,IAAI,CAACV,MAAM,CAACU,UAAU,CAACL,MAAM,GAAG,IAAI,IAAI,CAACL,MAAM,CAACU,UAAU;oCAAI;oCAAS;;;;;wBAHrF,4CAA4C;wBAC5CmB,SAAS;;;;;;6BAIA,IAAI,CAAC7B,MAAM,CAACE,SAAS,EAArB;;;;6BAGG,CAAA,OAAO,IAAI,CAACF,MAAM,CAACE,SAAS,KAAK,QAAO,GAAxC;;;;wBAA4C;;4BAAMiC,IAAAA,gBAAU,EAAC,IAAI,CAACnC,MAAM,CAACE,SAAS,EAAE;;;+BAAxC;;;;;;+BAAmD,IAAI,CAACF,MAAM,CAACE,SAAS;;;wBAA1H4B;wBAEG;;4BAAMI,IAAAA,eAAS,EAACd,OAAOU,KAAK,wCAChCF;gCACHlB,YAAY,IAAI,CAACV,MAAM,CAACU,UAAU,CAACL,MAAM,GAAG,IAAI,IAAI,CAACL,MAAM,CAACU,UAAU;oCAAI;oCAAS;;;;;wBAFrFmB,SAAS;;;;;;wBAKT,MAAM,IAAIzB,MAAM;;wBAGlB;;4BAAOyB,OAAOR,OAAO;;;wBACdU;wBACP,IAAIA,AAAK,YAALA,OAAiB3B,QAAO;4BAC1B,MAAM,IAAIA,MAAM,AAAC,yCAAsD,OAAd2B,MAAMK,OAAO;wBACxE;wBACA,MAAM,IAAIhC,MAAM;;;;;;;QAEpB;;WApIWL"}