@memberjunction/auth-providers 6.2.0-edge.0 → 6.2.0-edge.1

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @memberjunction/auth-providers@6.2.0-edge.0 build /home/runner/work/MJ/MJ/packages/AuthProviders
+> @memberjunction/auth-providers@6.2.0-edge.1 build /home/runner/work/MJ/MJ/packages/AuthProviders
 > tsc && tsc-alias -f
 

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # @memberjunction/auth-providers
 
+## 6.2.0-edge.1
+
+### Patch Changes
+
+- 9d4a28a: fix: cache/dispose provider and driver instances that were being silently rebuilt or leaked on every call
+
+  Memory-leak audit findings (Round 15, 2026-09-19):
+  - **`CommunicationEngine.GetProvider()`** constructed a brand-new provider instance (Twilio/Gmail/MSGraph/etc.) via `ClassFactory.CreateInstance` on every single send — including once per recipient during a bulk `SendMessages()` call. Because each provider's own SDK-client cache (`MJLruCache`) lives on the instance, this silently defeated the earlier fix that added those caches: they were rebuilt empty and thrown away on every call in production, causing sawtooth GC pressure and SDK-client/socket churn on every bulk send. `GetProvider()` now caches resolved provider instances by name, bounded by the small, admin-managed number of registered communication providers.
+  - **`FileStorageEngine.RefreshDriverCache()`** dropped every cached storage driver — including live SDK clients (S3Client, BlobServiceClient, etc.) — with no disposal, and is reachable from ordinary end-user activity (`UploadFile()` force-refreshes the whole driver cache any time a requested `storageAccountId` isn't found). `FileStorageBase` gains a `Dispose()` hook (no-op by default, since most of the storage SDKs used here expose no explicit teardown API); `AWSFileStorage` overrides it to destroy its `S3Client`, mirroring the destroy-before-reassign it already does internally on re-init. `FileStorageEngine` now disposes every cached driver before clearing the cache.
+  - **`AuthProviderFactory.register()`/`clear()`** dropped the previous `BaseAuthProvider` instance — each holding a live `https.Agent` keep-alive socket pool and `jwksClient` — with no cleanup, on every admin-triggered auth-catalog refresh. `BaseAuthProvider` now retains its HTTP agent and exposes `Dispose()` to destroy it; `IAuthProvider.Dispose()` is optional. `register()` disposes the provider it's replacing (but not when the same instance re-registers itself); `clear()` disposes every provider first.
+
+  No behavior changes to any success path. 19 new unit tests cover the caching/disposal semantics, including edge cases (failed lookups aren't cached, throwing `Dispose()` doesn't block disposing sibling drivers, same-instance re-registration isn't disposed, providers with no `Dispose()` method are tolerated).
+
+- 80905a1: Rename public class members and exported functions to PascalCase, per MJ's naming convention,
+  **without breaking a single consumer**.
+
+  Every renamed symbol keeps its old name beside the new one as a `@deprecated` stub that forwards to
+  it — a delegating method or function, a getter/setter pair for a property, and for Angular a
+  readable accessor pair for an `@Input` and a second `@Output` sharing the same `EventEmitter`, so a
+  template still binding the old name keeps receiving events. Old names still compile, still resolve,
+  and still behave identically; the deprecation tag rides through to the published `.d.ts`, so editors
+  point callers at the replacement. Where a package re-exports through an explicit `export { … }`
+  list, the new name is added alongside the old, so the correct name is actually on the public surface
+  rather than merely declared.
+
+  The rename is deliberately refused wherever a mechanical stub would not be equivalent, because
+  several of those shapes change a type contract while still compiling in the package that declares
+  them:
+  - an **optional** property or parameter property — TypeScript has no optional accessor, so a stub
+    would promote `foo?` to a required member and break every object literal that omits it;
+  - a class that is a **data shape** (no methods, or `@ObjectType`/`@InputType`) — object literals are
+    assigned to it, and an accessor stub changes what they must supply;
+  - a property whose **subclass redeclares it**, since TypeScript forbids a property overriding an
+    accessor (TS2610);
+  - a name whose PascalCase form is **already bound** in that file or class;
+  - decorated members, `get`/`set` pairs behind a decorator, generators, destructured parameters,
+    overload sets and abstract members.
+
+  **One wire-visible consequence, for version skew only.** `BaseInfo.toJSON` walks `_`-prefixed
+  backing fields and emits them through their public getter, preferring the PascalCase one. Renaming
+  the 23 field aliases in `MJCore/src/generic` therefore changes what `AllMetadata` carries:
+  `EntityInfo.spCreate` and friends now serialize as `SpCreate`. A same-version client is unaffected —
+  `copyInitData` accepts a value through a settable accessor, so either spelling lands on the right
+  field. An OLDER client against a newer server has no such path in its `copyInitData` and drops those
+  fields silently. Same-version deployments, which is the supported configuration, see no change.
+
+  Each package was verified against its own pre-change baseline rather than against zero, because
+  several packages in this repo do not typecheck cleanly to begin with. Angular packages were verified
+  with `ngc`, not `tsc`: a plain typecheck does not compile templates, and an earlier write-only
+  `@Input` alias passed `tsc` while breaking six template reads.
+
+- Updated dependencies [a3539d2]
+- Updated dependencies [41274aa]
+- Updated dependencies [a7da50b]
+- Updated dependencies [17cc774]
+- Updated dependencies [80905a1]
+  - @memberjunction/core@6.2.0-edge.1
+  - @memberjunction/global@6.2.0-edge.1
+
 ## 6.2.0-edge.0
 
 ### Patch Changes

package/dist/AuthProviderFactory.d.ts

@@ -28,14 +28,20 @@ export declare class AuthProviderFactory extends BaseSingleton<AuthProviderFacto
      * Creates an authentication provider instance based on configuration
      * Uses MJGlobal ClassFactory to instantiate the correct provider class
      */
+    static CreateProvider(config: AuthProviderConfig): IAuthProvider;
+    /** @deprecated Use {@link CreateProvider}. */
     static createProvider(config: AuthProviderConfig): IAuthProvider;
     /**
      * Registers a new authentication provider
      */
+    Register(provider: IAuthProvider): void;
+    /** @deprecated Use {@link Register}. */
     register(provider: IAuthProvider): void;
     /**
      * Gets a provider by its issuer URL
      */
+    GetByIssuer(issuer: string): IAuthProvider | undefined;
+    /** @deprecated Use {@link GetByIssuer}. */
     getByIssuer(issuer: string): IAuthProvider | undefined;
     /**
      * Gets all providers matching an issuer URL.
@@ -44,26 +50,41 @@ export declare class AuthProviderFactory extends BaseSingleton<AuthProviderFacto
      * (e.g. MJExplorer + MJCentral) share the same Auth0 domain but have
      * different audiences (client IDs).
      */
+    GetAllByIssuer(issuer: string): IAuthProvider[];
+    /** @deprecated Use {@link GetAllByIssuer}. */
     getAllByIssuer(issuer: string): IAuthProvider[];
     /**
      * Gets a provider by its name
      */
+    GetByName(name: string): IAuthProvider | undefined;
+    /** @deprecated Use {@link GetByName}. */
     getByName(name: string): IAuthProvider | undefined;
     /**
      * Gets all registered providers
      */
+    GetAllProviders(): IAuthProvider[];
+    /** @deprecated Use {@link GetAllProviders}. */
     getAllProviders(): IAuthProvider[];
     /**
      * Checks if any providers are registered
      */
+    HasProviders(): boolean;
+    /** @deprecated Use {@link HasProviders}. */
     hasProviders(): boolean;
     /**
-     * Clears all registered providers (useful for testing)
+     * Clears all registered providers (useful for testing, and called on every server boot /
+     * runtime catalog refresh — see `initializeProviders.ts`). Disposes each provider first so its
+     * HTTP agent/JWKS client's socket pool is released immediately rather than leaking until its
+     * own idle timeout.
      */
+    Clear(): void;
+    /** @deprecated Use {@link Clear}. */
     clear(): void;
     /**
      * Gets all registered provider types from the ClassFactory
      */
+    static GetRegisteredProviderTypes(): string[];
+    /** @deprecated Use {@link GetRegisteredProviderTypes}. */
     static getRegisteredProviderTypes(): string[];
     /**
      * Collects provider configurations from environment variables by asking every registered
@@ -85,6 +106,8 @@ export declare class AuthProviderFactory extends BaseSingleton<AuthProviderFacto
     /**
      * Checks if a provider type is registered
      */
+    static IsProviderTypeRegistered(type: string): boolean;
+    /** @deprecated Use {@link IsProviderTypeRegistered}. */
     static isProviderTypeRegistered(type: string): boolean;
 }
 //# sourceMappingURL=AuthProviderFactory.d.ts.map

package/dist/AuthProviderFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProviderFactory.d.ts","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAe,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,EAAY,aAAa,EAAc,MAAM,wBAAwB,CAAC;AAgB7E;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,SAAS,CAAyC;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,CAA6F;IAChH;;OAEG;IACH,OAAO,CAAC,gBAAgB,CAAiG;;IAMzH;;OAEG;IACH,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,aAAa;IAsBhE;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAiBvC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAmBtD;;;;;;OAMG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAqB/C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIlD;;OAEG;IACH,eAAe,IAAI,aAAa,EAAE;IAIlC;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,KAAK,IAAI,IAAI;IAMb;;OAEG;IACH,MAAM,CAAC,0BAA0B,IAAI,MAAM,EAAE;IAW7C;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,EAAE;IA0B1F;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CASvD"}
+{"version":3,"file":"AuthProviderFactory.d.ts","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAe,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,EAAY,aAAa,EAAc,MAAM,wBAAwB,CAAC;AAgB7E;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,SAAS,CAAyC;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,CAA6F;IAChH;;OAEG;IACH,OAAO,CAAC,gBAAgB,CAAiG;;IAMzH;;OAEG;IACH,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,aAAa;IAsBhE,8CAA8C;IAC9C,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,aAAa;IAIhE;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAyBvC,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAIvC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAmBtD,2CAA2C;IAC3C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAItD;;;;;;OAMG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAqB/C,8CAA8C;IAC9C,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE;IAI/C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIlD,yCAAyC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIlD;;OAEG;IACH,eAAe,IAAI,aAAa,EAAE;IAIlC,+CAA+C;IAC/C,eAAe,IAAI,aAAa,EAAE;IAIlC;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB,4CAA4C;IAC5C,YAAY,IAAI,OAAO;IAIvB;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAUb,qCAAqC;IACrC,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,MAAM,CAAC,0BAA0B,IAAI,MAAM,EAAE;IAW7C,0DAA0D;IAC1D,MAAM,CAAC,0BAA0B,IAAI,MAAM,EAAE;IAI7C;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,EAAE;IA0B1F;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAUtD,wDAAwD;IACxD,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CAGvD"}

package/dist/AuthProviderFactory.js

@@ -1,6 +1,6 @@
 import { LogStatusEx } from '@memberjunction/core';
 import { BaseAuthProvider } from './BaseAuthProvider.js';
-import { isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
+import { IsEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
 import { MJGlobal, BaseSingleton, MJLruCache } from '@memberjunction/global';
 // NOTE: this file deliberately contains NO list of concrete providers.
 //
@@ -46,7 +46,7 @@ export class AuthProviderFactory extends BaseSingleton {
      * Creates an authentication provider instance based on configuration
      * Uses MJGlobal ClassFactory to instantiate the correct provider class
      */
-    static createProvider(config) {
+    static CreateProvider(config) {
         try {
             // Use MJGlobal ClassFactory to create the provider instance
             // The provider type in config should match the key used in @RegisterClass
@@ -62,13 +62,24 @@ export class AuthProviderFactory extends BaseSingleton {
             throw new Error(`Failed to create authentication provider for type '${config.type}': ${message}`);
         }
     }
+    /** @deprecated Use {@link CreateProvider}. */
+    static createProvider(config) {
+        return this.CreateProvider(config);
+    }
     /**
      * Registers a new authentication provider
      */
-    register(provider) {
+    Register(provider) {
         if (!provider.validateConfig()) {
             throw new Error(`Invalid configuration for provider: ${provider.name}`);
         }
+        // Dispose the provider being replaced (if any) so its HTTP agent/JWKS client's socket pool
+        // is released immediately rather than leaking until its own idle timeout. Re-registering the
+        // SAME instance (e.g. an idempotent re-register) must not dispose it out from under itself.
+        const existing = this.providers.get(provider.name);
+        if (existing && existing !== provider) {
+            existing.Dispose?.();
+        }
         this.providers.set(provider.name, provider);
         // Clear issuer caches when registering new provider
         this.issuerCache.Clear();
@@ -78,10 +89,14 @@ export class AuthProviderFactory extends BaseSingleton {
         // server's telemetry.level) so it's reusable by any consumer of this generic package.
         LogStatusEx({ message: `Registered auth provider: ${provider.name} with issuer: ${provider.issuer}`, verboseOnly: true });
     }
+    /** @deprecated Use {@link Register}. */
+    register(provider) {
+        return this.Register(provider);
+    }
     /**
      * Gets a provider by its issuer URL
      */
-    getByIssuer(issuer) {
+    GetByIssuer(issuer) {
         // Check cache first
         const cached = this.issuerCache.Get(issuer);
         if (cached) {
@@ -97,6 +112,10 @@ export class AuthProviderFactory extends BaseSingleton {
         }
         return undefined;
     }
+    /** @deprecated Use {@link GetByIssuer}. */
+    getByIssuer(issuer) {
+        return this.GetByIssuer(issuer);
+    }
     /**
      * Gets all providers matching an issuer URL.
      * Unlike getByIssuer() which returns only the first match, this returns
@@ -104,7 +123,7 @@ export class AuthProviderFactory extends BaseSingleton {
      * (e.g. MJExplorer + MJCentral) share the same Auth0 domain but have
      * different audiences (client IDs).
      */
-    getAllByIssuer(issuer) {
+    GetAllByIssuer(issuer) {
         // Check multi-provider cache first
         const cached = this.issuerMultiCache.Get(issuer);
         if (cached) {
@@ -121,36 +140,62 @@ export class AuthProviderFactory extends BaseSingleton {
         }
         return matches;
     }
+    /** @deprecated Use {@link GetAllByIssuer}. */
+    getAllByIssuer(issuer) {
+        return this.GetAllByIssuer(issuer);
+    }
     /**
      * Gets a provider by its name
      */
-    getByName(name) {
+    GetByName(name) {
         return this.providers.get(name);
     }
+    /** @deprecated Use {@link GetByName}. */
+    getByName(name) {
+        return this.GetByName(name);
+    }
     /**
      * Gets all registered providers
      */
-    getAllProviders() {
+    GetAllProviders() {
         return Array.from(this.providers.values());
     }
+    /** @deprecated Use {@link GetAllProviders}. */
+    getAllProviders() {
+        return this.GetAllProviders();
+    }
     /**
      * Checks if any providers are registered
      */
-    hasProviders() {
+    HasProviders() {
         return this.providers.size > 0;
     }
+    /** @deprecated Use {@link HasProviders}. */
+    hasProviders() {
+        return this.HasProviders();
+    }
     /**
-     * Clears all registered providers (useful for testing)
+     * Clears all registered providers (useful for testing, and called on every server boot /
+     * runtime catalog refresh — see `initializeProviders.ts`). Disposes each provider first so its
+     * HTTP agent/JWKS client's socket pool is released immediately rather than leaking until its
+     * own idle timeout.
      */
-    clear() {
+    Clear() {
+        for (const provider of this.providers.values()) {
+            provider.Dispose?.();
+        }
         this.providers.clear();
         this.issuerCache.Clear();
         this.issuerMultiCache.Clear();
     }
+    /** @deprecated Use {@link Clear}. */
+    clear() {
+        return this.Clear();
+    }
     /**
      * Gets all registered provider types from the ClassFactory
      */
-    static getRegisteredProviderTypes() {
+    static GetRegisteredProviderTypes() {
         // Get all registrations for BaseAuthProvider from ClassFactory
         const registrations = MJGlobal.Instance.ClassFactory.GetAllRegistrations(BaseAuthProvider);
         // Extract unique keys (provider types) from registrations
@@ -160,6 +205,10 @@ export class AuthProviderFactory extends BaseSingleton {
         // Return unique provider types
         return Array.from(new Set(providerTypes));
     }
+    /** @deprecated Use {@link GetRegisteredProviderTypes}. */
+    static getRegisteredProviderTypes() {
+        return this.GetRegisteredProviderTypes();
+    }
     /**
      * Collects provider configurations from environment variables by asking every registered
      * provider class to configure itself.
@@ -181,7 +230,7 @@ export class AuthProviderFactory extends BaseSingleton {
         const configs = new Map();
         for (const registration of registrations) {
             const providerClass = registration.SubClass;
-            if (!isEnvironmentConfigurable(providerClass)) {
+            if (!IsEnvironmentConfigurable(providerClass)) {
                 continue;
             }
             try {
@@ -203,7 +252,7 @@ export class AuthProviderFactory extends BaseSingleton {
     /**
      * Checks if a provider type is registered
      */
-    static isProviderTypeRegistered(type) {
+    static IsProviderTypeRegistered(type) {
         try {
             // Try to get the registration for this specific type
             const registration = MJGlobal.Instance.ClassFactory.GetRegistration(BaseAuthProvider, type.toLowerCase());
@@ -213,5 +262,9 @@ export class AuthProviderFactory extends BaseSingleton {
             return false;
         }
     }
+    /** @deprecated Use {@link IsProviderTypeRegistered}. */
+    static isProviderTypeRegistered(type) {
+        return this.IsProviderTypeRegistered(type);
+    }
 }
 //# sourceMappingURL=AuthProviderFactory.js.map

package/dist/AuthProviderFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProviderFactory.js","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE7E,uEAAuE;AACvE,EAAE;AACF,4FAA4F;AAC5F,6FAA6F;AAC7F,8FAA8F;AAC9F,gGAAgG;AAChG,+FAA+F;AAC/F,8FAA8F;AAC9F,+DAA+D;AAC/D,EAAE;AACF,iGAAiG;AACjG,kFAAkF;AAClF,kFAAkF;AAElF;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAezE;QACE,KAAK,EAAE,CAAC;QAfF,cAAS,GAA+B,IAAI,GAAG,EAAE,CAAC;QAC1D;;;;;;WAMG;QACK,gBAAW,GAAsC,IAAI,UAAU,CAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAChH;;WAEG;QACK,qBAAgB,GAAwC,IAAI,UAAU,CAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAIzH,CAAC;IAED;;OAEG;IACI,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAA0B;QAC9C,IAAI,CAAC;YACH,4DAA4D;YAC5D,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAC5D,gBAAgB,EAChB,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EACzB,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAuB;QAC9B,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE5C,oDAAoD;QACpD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAE9B,oFAAoF;QACpF,sFAAsF;QACtF,sFAAsF;QACtF,WAAW,CAAC,EAAE,OAAO,EAAE,6BAA6B,QAAQ,CAAC,IAAI,iBAAiB,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc;QACxB,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,2BAA2B;gBAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,MAAc;QAC3B,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,0BAA0B;QAC/B,+DAA+D;QAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC3F,0DAA0D;QAC1D,MAAM,aAAa,GAAG,aAAa;aAChC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;aACnB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC;QACrE,+BAA+B;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;QACjE,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;QAEtD,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,MAAM,aAAa,GAAY,YAAY,CAAC,QAAQ,CAAC;YACrD,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9C,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBACxD,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,WAAW,CAAC;oBACV,OAAO,EAAE,kBAAkB,YAAY,CAAC,GAAG,iEAAiE,OAAO,EAAE;oBACrH,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAY;QAC1C,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1G,OAAO,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"AuthProviderFactory.js","sourceRoot":"","sources":["../src/AuthProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE7E,uEAAuE;AACvE,EAAE;AACF,4FAA4F;AAC5F,6FAA6F;AAC7F,8FAA8F;AAC9F,gGAAgG;AAChG,+FAA+F;AAC/F,8FAA8F;AAC9F,+DAA+D;AAC/D,EAAE;AACF,iGAAiG;AACjG,kFAAkF;AAClF,kFAAkF;AAElF;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAezE;QACE,KAAK,EAAE,CAAC;QAfF,cAAS,GAA+B,IAAI,GAAG,EAAE,CAAC;QAC1D;;;;;;WAMG;QACK,gBAAW,GAAsC,IAAI,UAAU,CAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAChH;;WAEG;QACK,qBAAgB,GAAwC,IAAI,UAAU,CAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAIzH,CAAC;IAED;;OAEG;IACI,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAA0B;QAC9C,IAAI,CAAC;YACH,4DAA4D;YAC5D,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAC5D,gBAAgB,EAChB,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EACzB,MAAM,CACP,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,CAAC,cAAc,CAAC,MAA0B;QAC9C,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAuB;QAC9B,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,2FAA2F;QAC3F,6FAA6F;QAC7F,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE5C,oDAAoD;QACpD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAE9B,oFAAoF;QACpF,sFAAsF;QACtF,sFAAsF;QACtF,WAAW,CAAC,EAAE,OAAO,EAAE,6BAA6B,QAAQ,CAAC,IAAI,iBAAiB,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,wCAAwC;IACxC,QAAQ,CAAC,QAAuB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc;QACxB,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,2BAA2B;gBAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,2CAA2C;IAC3C,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,MAAc;QAC3B,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8CAA8C;IAC9C,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,yCAAyC;IACzC,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,+CAA+C;IAC/C,eAAe;QACb,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,4CAA4C;IAC5C,YAAY;QACV,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK;QACH,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,qCAAqC;IACrC,KAAK;QACH,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,0BAA0B;QAC/B,+DAA+D;QAC/D,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC3F,0DAA0D;QAC1D,MAAM,aAAa,GAAG,aAAa;aAChC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;aACnB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC;QACrE,+BAA+B;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,0BAA0B;QAC/B,OAAO,IAAI,CAAC,0BAA0B,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;QACjE,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;QAEtD,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,MAAM,aAAa,GAAY,YAAY,CAAC,QAAQ,CAAC;YACrD,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9C,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,aAAa,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBACxD,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,WAAW,CAAC;oBACV,OAAO,EAAE,kBAAkB,YAAY,CAAC,GAAG,iEAAiE,OAAO,EAAE;oBACrH,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,IAAY;QAC1C,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1G,OAAO,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,MAAM,CAAC,wBAAwB,CAAC,IAAY;QAC1C,OAAO,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/BaseAuthProvider.d.ts

@@ -18,7 +18,18 @@ export declare abstract class BaseAuthProvider implements IAuthProvider {
     domain?: string;
     protected config: AuthProviderConfig;
     protected jwksClient: jwksClient.JwksClient;
+    /**
+     * The keep-alive HTTP agent backing `jwksClient`'s requests. Retained (rather than left as a
+     * constructor-local) so {@link Dispose} can release its socket pool when this provider instance
+     * is replaced or the registry is torn down — see `AuthProviderFactory.register()`/`clear()`.
+     */
+    private readonly requestAgent;
     constructor(config: AuthProviderConfig);
+    /**
+     * Destroys this provider's keep-alive HTTP agent, closing any open/idle sockets immediately
+     * instead of waiting for their own idle timeout. Safe to call more than once.
+     */
+    Dispose(): void;
     /**
      * Validates that required configuration is present
      */

package/dist/BaseAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseAuthProvider.d.ts","sourceRoot":"","sources":["../src/BaseAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,UAAU,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAInD;;;;GAIG;AACH,8BAAsB,gBAAiB,YAAW,aAAa;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACrC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;gBAEhC,MAAM,EAAE,kBAAkB;IAqCtC;;OAEG;IACH,cAAc,IAAI,OAAO;IAIzB;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAYpE;;OAEG;YACW,sBAAsB;IAuCpC;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAOtC;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;CAC5D"}
+{"version":3,"file":"BaseAuthProvider.d.ts","sourceRoot":"","sources":["../src/BaseAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,UAAU,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAInD;;;;GAIG;AACH,8BAAsB,gBAAiB,YAAW,aAAa;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACrC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;IAC5C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2B;gBAE5C,MAAM,EAAE,kBAAkB;IAqCtC;;;OAGG;IACH,OAAO,IAAI,IAAI;IAIf;;OAEG;IACH,cAAc,IAAI,OAAO;IAIzB;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAYpE;;OAEG;YACW,sBAAsB;IAuCpC;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAOtC;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY;CAC5D"}

package/dist/BaseAuthProvider.js

@@ -16,7 +16,7 @@ export class BaseAuthProvider {
         this.clientId = config.clientId;
         this.domain = config.domain;
         // Create HTTP agent with keep-alive to prevent socket hangups
-        const agent = this.jwksUri.startsWith('https')
+        this.requestAgent = this.jwksUri.startsWith('https')
             ? new https.Agent({
                 keepAlive: true,
                 keepAliveMsecs: 30000,
@@ -38,9 +38,16 @@ export class BaseAuthProvider {
             cacheMaxEntries: 5,
             cacheMaxAge: 600000, // 10 minutes
             timeout: 60000, // 60 seconds (increased from default 30s)
-            requestAgent: agent
+            requestAgent: this.requestAgent
         });
     }
+    /**
+     * Destroys this provider's keep-alive HTTP agent, closing any open/idle sockets immediately
+     * instead of waiting for their own idle timeout. Safe to call more than once.
+     */
+    Dispose() {
+        this.requestAgent.destroy();
+    }
     /**
      * Validates that required configuration is present
      */

package/dist/BaseAuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"BaseAuthProvider.js","sourceRoot":"","sources":["../src/BaseAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,UAAU,MAAM,UAAU,CAAC;AAGlC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;GAIG;AACH,MAAM,OAAgB,gBAAgB;IAYpC,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,8DAA8D;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5C,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC;gBACd,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,EAAE;gBACd,cAAc,EAAE,EAAE;gBAClB,OAAO,EAAE,KAAK;aACf,CAAC;YACJ,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;gBACb,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,EAAE;gBACd,cAAc,EAAE,EAAE;gBAClB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QAEP,sEAAsE;QACtE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI;YACX,eAAe,EAAE,CAAC;YAClB,WAAW,EAAE,MAAM,EAAE,aAAa;YAClC,OAAO,EAAE,KAAK,EAAE,0CAA0C;YAC1D,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAiB,EAAE,QAA4B;QAC3D,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC;aACzC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,MAAM,UAAU,GAAG,WAAW,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YACzE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,CAAC,IAAI,iBAAiB,EAAE,GAAG,CAAC,CAAC;YACzF,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAClC,MAAiB,EACjB,UAAkB,EAClB,cAAsB;QAEtB,IAAI,SAA4B,CAAC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAEhE,4DAA4D;gBAC5D,MAAM,gBAAgB,GACpB,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBAC5C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;oBACxC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACvC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACvC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE1C,IAAI,CAAC,gBAAgB,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAChD,MAAM,SAAS,CAAC;gBAClB,CAAC;gBAED,sDAAsD;gBACtD,MAAM,OAAO,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CACV,WAAW,OAAO,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,wBAAwB,IAAI,CAAC,IAAI,IAAI;oBAC7E,eAAe,OAAO,gBAAgB,SAAS,CAAC,OAAO,EAAE,CAC1D,CAAC;gBAEF,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAc;QAC1B,+CAA+C;QAC/C,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO,gBAAgB,KAAK,wBAAwB,CAAC;IACvD,CAAC;CAMF"}
+{"version":3,"file":"BaseAuthProvider.js","sourceRoot":"","sources":["../src/BaseAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,UAAU,MAAM,UAAU,CAAC;AAGlC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;GAIG;AACH,MAAM,OAAgB,gBAAgB;IAkBpC,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,8DAA8D;QAC9D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;YAClD,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC;gBACd,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,EAAE;gBACd,cAAc,EAAE,EAAE;gBAClB,OAAO,EAAE,KAAK;aACf,CAAC;YACJ,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;gBACb,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,EAAE;gBACd,cAAc,EAAE,EAAE;gBAClB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QAEP,sEAAsE;QACtE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI;YACX,eAAe,EAAE,CAAC;YAClB,WAAW,EAAE,MAAM,EAAE,aAAa;YAClC,OAAO,EAAE,KAAK,EAAE,0CAA0C;YAC1D,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAiB,EAAE,QAA4B;QAC3D,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC;aACzC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,MAAM,UAAU,GAAG,WAAW,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YACzE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7B,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,CAAC,IAAI,iBAAiB,EAAE,GAAG,CAAC,CAAC;YACzF,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAClC,MAAiB,EACjB,UAAkB,EAClB,cAAsB;QAEtB,IAAI,SAA4B,CAAC;QAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAEhE,4DAA4D;gBAC5D,MAAM,gBAAgB,GACpB,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBAC5C,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;oBACxC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACvC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;oBACvC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE1C,IAAI,CAAC,gBAAgB,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAChD,MAAM,SAAS,CAAC;gBAClB,CAAC;gBAED,sDAAsD;gBACtD,MAAM,OAAO,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CACV,WAAW,OAAO,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,wBAAwB,IAAI,CAAC,IAAI,IAAI;oBAC7E,eAAe,OAAO,gBAAgB,SAAS,CAAC,OAAO,EAAE,CAC1D,CAAC;gBAEF,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAc;QAC1B,+CAA+C;QAC/C,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO,gBAAgB,KAAK,wBAAwB,CAAC;IACvD,CAAC;CAMF"}

package/dist/IAuthProvider.d.ts

@@ -44,6 +44,14 @@ export interface IAuthProvider {
      * Different providers use different claim names
      */
     extractUserInfo(payload: JwtPayload): AuthUserInfo;
+    /**
+     * Releases any resources (keep-alive HTTP agent, JWKS client) this provider instance holds.
+     * Optional so implementations with nothing to release don't need a no-op override. Called by
+     * {@link AuthProviderFactory} before an existing provider is replaced (`register()`) or the
+     * registry is torn down (`clear()`), so a discarded provider's socket pool doesn't stay open
+     * until its own idle timeout.
+     */
+    Dispose?(): void;
     /**
      * Checks if a given issuer URL belongs to this provider
      */

package/dist/IAuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IAuthProvider.d.ts","sourceRoot":"","sources":["../src/IAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAsB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAExE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC;IAE1B;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAErE;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY,CAAC;IAEnD;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CACxC"}
+{"version":3,"file":"IAuthProvider.d.ts","sourceRoot":"","sources":["../src/IAuthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAsB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAExE;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC;IAE1B;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAErE;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,YAAY,CAAC;IAEnD;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,IAAI,CAAC;IAEjB;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CACxC"}

package/dist/IEnvironmentConfigurableProvider.d.ts

@@ -47,5 +47,7 @@ export interface IEnvironmentConfigurableProvider {
 /**
  * Narrows an unknown provider class to one that offers env-var configuration.
  */
+export declare function IsEnvironmentConfigurable(subject: unknown): subject is IEnvironmentConfigurableProvider;
+/** @deprecated Use {@link IsEnvironmentConfigurable}. */
 export declare function isEnvironmentConfigurable(subject: unknown): subject is IEnvironmentConfigurableProvider;
 //# sourceMappingURL=IEnvironmentConfigurableProvider.d.ts.map

package/dist/IEnvironmentConfigurableProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IEnvironmentConfigurableProvider.d.ts","sourceRoot":"","sources":["../src/IEnvironmentConfigurableProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;;;;;;;;OASG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,GAAG,IAAI,CAAC;CAC1E;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,gCAAgC,CAEvG"}
+{"version":3,"file":"IEnvironmentConfigurableProvider.d.ts","sourceRoot":"","sources":["../src/IEnvironmentConfigurableProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,gCAAgC;IAC/C;;;;;;;;;OASG;IACH,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,GAAG,IAAI,CAAC;CAC1E;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,gCAAgC,CAEvG;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,gCAAgC,CAEvG"}

package/dist/IEnvironmentConfigurableProvider.js

@@ -1,7 +1,11 @@
 /**
  * Narrows an unknown provider class to one that offers env-var configuration.
  */
-export function isEnvironmentConfigurable(subject) {
+export function IsEnvironmentConfigurable(subject) {
     return typeof subject?.ConfigFromEnvironment === 'function';
 }
+/** @deprecated Use {@link IsEnvironmentConfigurable}. */
+export function isEnvironmentConfigurable(subject) {
+    return IsEnvironmentConfigurable(subject);
+}
 //# sourceMappingURL=IEnvironmentConfigurableProvider.js.map

package/dist/IEnvironmentConfigurableProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"IEnvironmentConfigurableProvider.js","sourceRoot":"","sources":["../src/IEnvironmentConfigurableProvider.ts"],"names":[],"mappings":"AAgDA;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,OAAO,OAAQ,OAAwD,EAAE,qBAAqB,KAAK,UAAU,CAAC;AAChH,CAAC"}
+{"version":3,"file":"IEnvironmentConfigurableProvider.js","sourceRoot":"","sources":["../src/IEnvironmentConfigurableProvider.ts"],"names":[],"mappings":"AAgDA;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,OAAO,OAAQ,OAAwD,EAAE,qBAAqB,KAAK,UAAU,CAAC;AAChH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { IAuthProvider } from './IAuthProvider.js';
 export { BaseAuthProvider } from './BaseAuthProvider.js';
 export { AuthProviderFactory } from './AuthProviderFactory.js';
 export { TokenExpiredError } from './tokenExpiredError.js';
-export { type IEnvironmentConfigurableProvider, isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
+export { type IEnvironmentConfigurableProvider, IsEnvironmentConfigurable, isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
 export { MagicLinkProvider } from './providers/MagicLinkProvider.js';
 export { HostIdentityProvider, type HostAssertionVerifyResult, type HostAssertionError, } from './providers/HostIdentityProvider.js';
 export type { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,KAAK,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACzH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,qCAAqC,CAAC;AAG7C,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAM7E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,KAAK,gCAAgC,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACpJ,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,qCAAqC,CAAC;AAG7C,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAM7E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/index.js

@@ -1,7 +1,7 @@
 export { BaseAuthProvider } from './BaseAuthProvider.js';
 export { AuthProviderFactory } from './AuthProviderFactory.js';
 export { TokenExpiredError } from './tokenExpiredError.js';
-export { isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
+export { IsEnvironmentConfigurable, isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
 export { MagicLinkProvider } from './providers/MagicLinkProvider.js';
 export { HostIdentityProvider, } from './providers/HostIdentityProvider.js';
 // Concrete auth providers. These are @RegisterClass plugins resolved by key at runtime, so

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAyC,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACzH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,oBAAoB,GAGrB,MAAM,qCAAqC,CAAC;AAK7C,2FAA2F;AAC3F,sFAAsF;AACtF,yFAAyF;AACzF,6DAA6D;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAyC,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACpJ,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,oBAAoB,GAGrB,MAAM,qCAAqC,CAAC;AAK7C,2FAA2F;AAC3F,sFAAsF;AACtF,yFAAyF;AACzF,6DAA6D;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC"}

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@memberjunction/auth-providers",
   "license": "BUSL-1.1",
-  "version": "6.2.0-edge.0",
+  "version": "6.2.0-edge.1",
   "description": "Authentication provider interfaces, base classes, and implementations for MemberJunction",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {
-    "@memberjunction/core": "6.2.0-edge.0",
-    "@memberjunction/global": "6.2.0-edge.0",
+    "@memberjunction/core": "6.2.0-edge.1",
+    "@memberjunction/global": "6.2.0-edge.1",
     "graphql": "^16.12.0",
     "jsonwebtoken": "9.0.3",
     "jwks-rsa": "^3.2.2"

package/src/AuthProviderFactory.ts

@@ -1,7 +1,7 @@
 import { AuthProviderConfig, LogStatusEx } from '@memberjunction/core';
 import { IAuthProvider } from './IAuthProvider.js';
 import { BaseAuthProvider } from './BaseAuthProvider.js';
-import { isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
+import { IsEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
 import { MJGlobal, BaseSingleton, MJLruCache } from '@memberjunction/global';
 
 // NOTE: this file deliberately contains NO list of concrete providers.
@@ -52,7 +52,7 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
    * Creates an authentication provider instance based on configuration
    * Uses MJGlobal ClassFactory to instantiate the correct provider class
    */
-  static createProvider(config: AuthProviderConfig): IAuthProvider {
+  static CreateProvider(config: AuthProviderConfig): IAuthProvider {
     try {
       // Use MJGlobal ClassFactory to create the provider instance
       // The provider type in config should match the key used in @RegisterClass
@@ -74,14 +74,27 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
     }
   }
 
+  /** @deprecated Use {@link CreateProvider}. */
+  static createProvider(config: AuthProviderConfig): IAuthProvider {
+    return this.CreateProvider(config);
+  }
+
   /**
    * Registers a new authentication provider
    */
-  register(provider: IAuthProvider): void {
+  Register(provider: IAuthProvider): void {
     if (!provider.validateConfig()) {
       throw new Error(`Invalid configuration for provider: ${provider.name}`);
     }
 
+    // Dispose the provider being replaced (if any) so its HTTP agent/JWKS client's socket pool
+    // is released immediately rather than leaking until its own idle timeout. Re-registering the
+    // SAME instance (e.g. an idempotent re-register) must not dispose it out from under itself.
+    const existing = this.providers.get(provider.name);
+    if (existing && existing !== provider) {
+      existing.Dispose?.();
+    }
+
     this.providers.set(provider.name, provider);
 
     // Clear issuer caches when registering new provider
@@ -94,10 +107,15 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
     LogStatusEx({ message: `Registered auth provider: ${provider.name} with issuer: ${provider.issuer}`, verboseOnly: true });
   }
 
+  /** @deprecated Use {@link Register}. */
+  register(provider: IAuthProvider): void {
+    return this.Register(provider);
+  }
+
   /**
    * Gets a provider by its issuer URL
    */
-  getByIssuer(issuer: string): IAuthProvider | undefined {
+  GetByIssuer(issuer: string): IAuthProvider | undefined {
     // Check cache first
     const cached = this.issuerCache.Get(issuer);
     if (cached) {
@@ -116,6 +134,11 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
     return undefined;
   }
 
+  /** @deprecated Use {@link GetByIssuer}. */
+  getByIssuer(issuer: string): IAuthProvider | undefined {
+    return this.GetByIssuer(issuer);
+  }
+
   /**
    * Gets all providers matching an issuer URL.
    * Unlike getByIssuer() which returns only the first match, this returns
@@ -123,7 +146,7 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
    * (e.g. MJExplorer + MJCentral) share the same Auth0 domain but have
    * different audiences (client IDs).
    */
-  getAllByIssuer(issuer: string): IAuthProvider[] {
+  GetAllByIssuer(issuer: string): IAuthProvider[] {
     // Check multi-provider cache first
     const cached = this.issuerMultiCache.Get(issuer);
     if (cached) {
@@ -144,40 +167,72 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
     return matches;
   }
 
+  /** @deprecated Use {@link GetAllByIssuer}. */
+  getAllByIssuer(issuer: string): IAuthProvider[] {
+    return this.GetAllByIssuer(issuer);
+  }
+
   /**
    * Gets a provider by its name
    */
-  getByName(name: string): IAuthProvider | undefined {
+  GetByName(name: string): IAuthProvider | undefined {
     return this.providers.get(name);
   }
 
+  /** @deprecated Use {@link GetByName}. */
+  getByName(name: string): IAuthProvider | undefined {
+    return this.GetByName(name);
+  }
+
   /**
    * Gets all registered providers
    */
-  getAllProviders(): IAuthProvider[] {
+  GetAllProviders(): IAuthProvider[] {
     return Array.from(this.providers.values());
   }
 
+  /** @deprecated Use {@link GetAllProviders}. */
+  getAllProviders(): IAuthProvider[] {
+    return this.GetAllProviders();
+  }
+
   /**
    * Checks if any providers are registered
    */
-  hasProviders(): boolean {
+  HasProviders(): boolean {
     return this.providers.size > 0;
   }
 
+  /** @deprecated Use {@link HasProviders}. */
+  hasProviders(): boolean {
+    return this.HasProviders();
+  }
+
   /**
-   * Clears all registered providers (useful for testing)
+   * Clears all registered providers (useful for testing, and called on every server boot /
+   * runtime catalog refresh — see `initializeProviders.ts`). Disposes each provider first so its
+   * HTTP agent/JWKS client's socket pool is released immediately rather than leaking until its
+   * own idle timeout.
    */
-  clear(): void {
+  Clear(): void {
+    for (const provider of this.providers.values()) {
+      provider.Dispose?.();
+    }
+    
     this.providers.clear();
     this.issuerCache.Clear();
     this.issuerMultiCache.Clear();
   }
 
+  /** @deprecated Use {@link Clear}. */
+  clear(): void {
+    return this.Clear();
+  }
+
   /**
    * Gets all registered provider types from the ClassFactory
    */
-  static getRegisteredProviderTypes(): string[] {
+  static GetRegisteredProviderTypes(): string[] {
     // Get all registrations for BaseAuthProvider from ClassFactory
     const registrations = MJGlobal.Instance.ClassFactory.GetAllRegistrations(BaseAuthProvider);
     // Extract unique keys (provider types) from registrations
@@ -188,6 +243,11 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
     return Array.from(new Set(providerTypes));
   }
 
+  /** @deprecated Use {@link GetRegisteredProviderTypes}. */
+  static getRegisteredProviderTypes(): string[] {
+    return this.GetRegisteredProviderTypes();
+  }
+
   /**
    * Collects provider configurations from environment variables by asking every registered
    * provider class to configure itself.
@@ -210,7 +270,7 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
 
     for (const registration of registrations) {
       const providerClass: unknown = registration.SubClass;
-      if (!isEnvironmentConfigurable(providerClass)) {
+      if (!IsEnvironmentConfigurable(providerClass)) {
         continue;
       }
       try {
@@ -233,7 +293,7 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
   /**
    * Checks if a provider type is registered
    */
-  static isProviderTypeRegistered(type: string): boolean {
+  static IsProviderTypeRegistered(type: string): boolean {
     try {
       // Try to get the registration for this specific type
       const registration = MJGlobal.Instance.ClassFactory.GetRegistration(BaseAuthProvider, type.toLowerCase());
@@ -242,4 +302,9 @@ export class AuthProviderFactory extends BaseSingleton<AuthProviderFactory> {
       return false;
     }
   }
+
+  /** @deprecated Use {@link IsProviderTypeRegistered}. */
+  static isProviderTypeRegistered(type: string): boolean {
+    return this.IsProviderTypeRegistered(type);
+  }
 }

package/src/BaseAuthProvider.ts

@@ -21,6 +21,12 @@ export abstract class BaseAuthProvider implements IAuthProvider {
   domain?: string;
   protected config: AuthProviderConfig;
   protected jwksClient: jwksClient.JwksClient;
+  /**
+   * The keep-alive HTTP agent backing `jwksClient`'s requests. Retained (rather than left as a
+   * constructor-local) so {@link Dispose} can release its socket pool when this provider instance
+   * is replaced or the registry is torn down — see `AuthProviderFactory.register()`/`clear()`.
+   */
+  private readonly requestAgent: https.Agent | http.Agent;
 
   constructor(config: AuthProviderConfig) {
     this.config = config;
@@ -32,7 +38,7 @@ export abstract class BaseAuthProvider implements IAuthProvider {
     this.domain = config.domain;
 
     // Create HTTP agent with keep-alive to prevent socket hangups
-    const agent = this.jwksUri.startsWith('https')
+    this.requestAgent = this.jwksUri.startsWith('https')
       ? new https.Agent({
           keepAlive: true,
           keepAliveMsecs: 30000,
@@ -55,10 +61,18 @@ export abstract class BaseAuthProvider implements IAuthProvider {
       cacheMaxEntries: 5,
       cacheMaxAge: 600000, // 10 minutes
       timeout: 60000, // 60 seconds (increased from default 30s)
-      requestAgent: agent
+      requestAgent: this.requestAgent
     });
   }
 
+  /**
+   * Destroys this provider's keep-alive HTTP agent, closing any open/idle sockets immediately
+   * instead of waiting for their own idle timeout. Safe to call more than once.
+   */
+  Dispose(): void {
+    this.requestAgent.destroy();
+  }
+
   /**
    * Validates that required configuration is present
    */

package/src/IAuthProvider.ts

@@ -9,53 +9,62 @@ export interface IAuthProvider {
   /**
    * Unique name identifier for this provider
    */
-  name: string;
+  name: string;  // case-violation-ok-legacy-back-compat: the type is named in an exported signature, so consumers build object literals against it; an interface has no runtime carrier for a stub
 
   /**
    * The issuer URL for this provider (must match the 'iss' claim in tokens)
    */
-  issuer: string;
+  issuer: string;  // case-violation-ok-legacy-back-compat: the type is named in an exported signature, so consumers build object literals against it; an interface has no runtime carrier for a stub
 
   /**
    * The expected audience for tokens from this provider
    */
-  audience: string;
+  audience: string;  // case-violation-ok-legacy-back-compat: the type is named in an exported signature, so consumers build object literals against it; an interface has no runtime carrier for a stub
 
   /**
    * The JWKS endpoint URL for retrieving signing keys
    */
-  jwksUri: string;
+  jwksUri: string;  // case-violation-ok-legacy-back-compat: the type is named in an exported signature, so consumers build object literals against it; an interface has no runtime carrier for a stub
 
   /**
    * OAuth client ID for this provider (optional, used by OAuth proxy for upstream authentication)
    */
-  clientId?: string;
+  clientId?: string;  // case-violation-ok-legacy-back-compat: the type is named in an exported signature, so consumers build object literals against it; an interface has no runtime carrier for a stub
 
   /**
    * Provider domain, where the provider hosts its OAuth endpoints somewhere other than its
    * issuer (optional, used by the OAuth proxy). Cognito is the case that needs it: its issuer
    * is the user-pool URL, but /authorize and /token live on the hosted-UI domain.
    */
-  domain?: string;
+  domain?: string;  // case-violation-ok-legacy-back-compat: the type is named in an exported signature, so consumers build object literals against it; an interface has no runtime carrier for a stub
 
   /**
    * Validates that the provider configuration is complete and valid
    */
-  validateConfig(): boolean;
+  validateConfig(): boolean;  // case-violation-ok-legacy-back-compat: the type is named in an exported signature, so consumers build object literals against it; an interface has no runtime carrier for a stub
 
   /**
    * Gets the signing key for token verification
    */
-  getSigningKey(header: JwtHeader, callback: SigningKeyCallback): void;
+  getSigningKey(header: JwtHeader, callback: SigningKeyCallback): void;  // case-violation-ok-legacy-back-compat: the type is named in an exported signature, so consumers build object literals against it; an interface has no runtime carrier for a stub
 
   /**
    * Extracts user information from the JWT payload
    * Different providers use different claim names
    */
-  extractUserInfo(payload: JwtPayload): AuthUserInfo;
+  extractUserInfo(payload: JwtPayload): AuthUserInfo;  // case-violation-ok-legacy-back-compat: the type is named in an exported signature, so consumers build object literals against it; an interface has no runtime carrier for a stub
+
+  /**
+   * Releases any resources (keep-alive HTTP agent, JWKS client) this provider instance holds.
+   * Optional so implementations with nothing to release don't need a no-op override. Called by
+   * {@link AuthProviderFactory} before an existing provider is replaced (`register()`) or the
+   * registry is torn down (`clear()`), so a discarded provider's socket pool doesn't stay open
+   * until its own idle timeout.
+   */
+  Dispose?(): void;
 
   /**
    * Checks if a given issuer URL belongs to this provider
    */
-  matchesIssuer(issuer: string): boolean;
+  matchesIssuer(issuer: string): boolean;  // case-violation-ok-legacy-back-compat: the type is named in an exported signature, so consumers build object literals against it; an interface has no runtime carrier for a stub
 }

package/src/IEnvironmentConfigurableProvider.ts

@@ -49,6 +49,11 @@ export interface IEnvironmentConfigurableProvider {
 /**
  * Narrows an unknown provider class to one that offers env-var configuration.
  */
-export function isEnvironmentConfigurable(subject: unknown): subject is IEnvironmentConfigurableProvider {
+export function IsEnvironmentConfigurable(subject: unknown): subject is IEnvironmentConfigurableProvider {
   return typeof (subject as IEnvironmentConfigurableProvider | undefined)?.ConfigFromEnvironment === 'function';
 }
+
+/** @deprecated Use {@link IsEnvironmentConfigurable}. */
+export function isEnvironmentConfigurable(subject: unknown): subject is IEnvironmentConfigurableProvider {
+  return IsEnvironmentConfigurable(subject);
+}

package/src/__tests__/AuthProviderFactory.test.ts

@@ -103,3 +103,77 @@ describe('AuthProviderFactory cache (memory-leak fix R2-C4)', () => {
         expect(issuerMultiCache.Size).toBe(0);
     });
 });
+
+describe('AuthProviderFactory provider disposal (memory-leak audit 2026-09-19)', () => {
+    // `register()`/`clear()` used to drop the old IAuthProvider value with no disposal call.
+    // Each BaseAuthProvider instance owns a keep-alive https.Agent + jwksClient; discarding it
+    // without disposing left its socket pool open until its own 60s idle timeout, on every
+    // admin-triggered auth-catalog refresh (`refreshAuthProviders()`).
+    let factory: AuthProviderFactory;
+
+    beforeEach(() => {
+        factory = AuthProviderFactory.Instance;
+        factory.clear();
+    });
+
+    it('does not call Dispose when registering a brand-new provider name', () => {
+        const provider = makeProvider('p1', 'auth0.com');
+        const disposeSpy = vi.fn();
+        provider.Dispose = disposeSpy;
+
+        factory.register(provider);
+
+        expect(disposeSpy).not.toHaveBeenCalled();
+    });
+
+    it('disposes the outgoing provider when register() replaces an existing name', () => {
+        const oldProvider = makeProvider('p1', 'auth0.com');
+        const oldDispose = vi.fn();
+        oldProvider.Dispose = oldDispose;
+        factory.register(oldProvider);
+
+        const newProvider = makeProvider('p1', 'auth0.com');
+        const newDispose = vi.fn();
+        newProvider.Dispose = newDispose;
+        factory.register(newProvider);
+
+        expect(oldDispose).toHaveBeenCalledTimes(1);
+        expect(newDispose).not.toHaveBeenCalled();
+    });
+
+    it('does not dispose a provider that re-registers itself (same instance)', () => {
+        const provider = makeProvider('p1', 'auth0.com');
+        const disposeSpy = vi.fn();
+        provider.Dispose = disposeSpy;
+
+        factory.register(provider);
+        factory.register(provider); // idempotent re-register of the SAME instance
+
+        expect(disposeSpy).not.toHaveBeenCalled();
+    });
+
+    it('disposes every registered provider on clear()', () => {
+        const p1 = makeProvider('p1', 'auth0.com');
+        const p2 = makeProvider('p2', 'okta.com');
+        const dispose1 = vi.fn();
+        const dispose2 = vi.fn();
+        p1.Dispose = dispose1;
+        p2.Dispose = dispose2;
+        factory.register(p1);
+        factory.register(p2);
+
+        factory.clear();
+
+        expect(dispose1).toHaveBeenCalledTimes(1);
+        expect(dispose2).toHaveBeenCalledTimes(1);
+    });
+
+    it('tolerates providers with no Dispose method (optional on IAuthProvider)', () => {
+        // makeProvider() intentionally does not set Dispose - most of this file's fixtures don't.
+        expect(() => {
+            factory.register(makeProvider('p1', 'auth0.com'));
+            factory.register(makeProvider('p1', 'auth0.com')); // replaces p1, old has no Dispose
+            factory.clear();
+        }).not.toThrow();
+    });
+});

package/src/__tests__/BaseAuthProvider.test.ts

@@ -0,0 +1,81 @@
+/**
+ * Unit tests for BaseAuthProvider.Dispose() (memory-leak audit 2026-09-19, High finding #3).
+ *
+ * Each BaseAuthProvider instance owns a keep-alive https.Agent/http.Agent backing its
+ * jwksClient. Before this fix, that agent was a constructor-local variable with no way for a
+ * caller to release it, so `AuthProviderFactory.register()`/`clear()` replacing or dropping a
+ * provider left its socket pool open until the agent's own 60s idle timeout.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import type { JwtPayload } from 'jsonwebtoken';
+import https from 'https';
+import http from 'http';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider';
+
+class TestAuthProvider extends BaseAuthProvider {
+  extractUserInfo(payload: JwtPayload): AuthUserInfo {
+    return { userId: payload.sub ?? '', email: '', firstName: '', lastName: '', preferredUsername: '' };
+  }
+}
+
+function makeConfig(overrides: Partial<AuthProviderConfig> = {}): AuthProviderConfig {
+  return {
+    name: 'test-provider',
+    type: 'test',
+    issuer: 'https://example.com/',
+    audience: 'test-aud',
+    jwksUri: 'https://example.com/.well-known/jwks.json',
+    ...overrides,
+  };
+}
+
+describe('BaseAuthProvider.Dispose', () => {
+  it('destroys the https.Agent backing the jwksClient when jwksUri is https', () => {
+    const destroySpy = vi.spyOn(https.Agent.prototype, 'destroy');
+    const provider = new TestAuthProvider(makeConfig());
+    const agent = (provider as unknown as { requestAgent: https.Agent }).requestAgent;
+    expect(agent).toBeInstanceOf(https.Agent);
+
+    provider.Dispose();
+
+    expect(destroySpy).toHaveBeenCalledTimes(1);
+    expect(destroySpy.mock.instances[0]).toBe(agent);
+    destroySpy.mockRestore();
+  });
+
+  it('destroys the http.Agent when jwksUri is plain http (non-TLS test/dev endpoints)', () => {
+    const destroySpy = vi.spyOn(http.Agent.prototype, 'destroy');
+    const provider = new TestAuthProvider(makeConfig({ jwksUri: 'http://localhost:4000/.well-known/jwks.json' }));
+    const agent = (provider as unknown as { requestAgent: http.Agent }).requestAgent;
+    expect(agent).toBeInstanceOf(http.Agent);
+
+    provider.Dispose();
+
+    expect(destroySpy).toHaveBeenCalledTimes(1);
+    expect(destroySpy.mock.instances[0]).toBe(agent);
+    destroySpy.mockRestore();
+  });
+
+  it('is safe to call more than once', () => {
+    const provider = new TestAuthProvider(makeConfig());
+
+    expect(() => {
+      provider.Dispose();
+      provider.Dispose();
+    }).not.toThrow();
+  });
+
+  it("does not affect a different provider instance's agent", () => {
+    const destroySpy = vi.spyOn(https.Agent.prototype, 'destroy');
+    const providerA = new TestAuthProvider(makeConfig({ name: 'a' }));
+    const providerB = new TestAuthProvider(makeConfig({ name: 'b' }));
+    const agentB = (providerB as unknown as { requestAgent: https.Agent }).requestAgent;
+
+    providerA.Dispose();
+
+    expect(destroySpy).toHaveBeenCalledTimes(1);
+    expect(destroySpy.mock.instances[0]).not.toBe(agentB);
+    destroySpy.mockRestore();
+  });
+});

package/src/index.ts

@@ -2,7 +2,7 @@ export { IAuthProvider } from './IAuthProvider.js';
 export { BaseAuthProvider } from './BaseAuthProvider.js';
 export { AuthProviderFactory } from './AuthProviderFactory.js';
 export { TokenExpiredError } from './tokenExpiredError.js';
-export { type IEnvironmentConfigurableProvider, isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
+export { type IEnvironmentConfigurableProvider, IsEnvironmentConfigurable, isEnvironmentConfigurable } from './IEnvironmentConfigurableProvider.js';
 export { MagicLinkProvider } from './providers/MagicLinkProvider.js';
 export {
   HostIdentityProvider,