@nestjs/authentication 0.0.1

package/dist/interfaces/oidc-state-store.interface.d.ts

@@ -0,0 +1,25 @@
+import type { OidcTransaction } from './oidc.interface.js';
+/**
+ * Storage for logins in progress (PKCE verifier, nonce, return path),
+ * keyed by `state`. Implement it on your database or Redis, and register
+ * the provider with `AuthenticationStorage.registerSource({ oidcStates: this })`.
+ *
+ * `consumeOidcState()` must be one atomic get-and-delete
+ * (`DELETE … RETURNING`, `GETDEL`), so a callback is accepted once. Anyone
+ * can start a login, so the store must stay bounded: drop expired logins
+ * as new ones are saved, and cap the rest.
+ */
+export interface OidcStateStore {
+    /**
+     * Saves a new login (a fresh random `state`: a plain insert), then keeps
+     * the store bounded: deletes logins whose `expiresAt` is at or before this
+     * one's `createdAt`, and past a cap, those that expire first.
+     */
+    saveOidcState(transaction: OidcTransaction): Promise<void>;
+    /**
+     * Removes and returns the login, in one atomic step; `undefined` if there
+     * is none. Of several concurrent calls, exactly one gets the record.
+     * Expired logins may be returned: `OidcService` checks expiry.
+     */
+    consumeOidcState(state: string): Promise<OidcTransaction | undefined>;
+}

package/dist/interfaces/oidc-state-store.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/oidc.interface.d.ts

@@ -0,0 +1,84 @@
+import type { CookieAttributes } from '../session/cookies.util.js';
+import type { Duration } from './duration.interface.js';
+import type { OidcProviderConfig } from './oidc-provider.interface.js';
+export interface OidcTransaction {
+    state: string;
+    provider: string;
+    nonce?: string;
+    codeVerifier: string;
+    redirectTo?: string;
+    createdAt: Date;
+    expiresAt: Date;
+    /** Set for a link flow: the signed-in user (and their session id) who started it. */
+    link?: {
+        userId: string;
+        sessionId: string;
+    };
+}
+export interface OidcClientOptions {
+    fetch?: typeof fetch;
+    /** Clock in epoch milliseconds, for tests. */
+    now?: () => number;
+    /** How long a discovery document is trusted. Default `'1h'`. */
+    discoveryTtl?: Duration;
+    /** Leeway for ID token time claims. Default `'30s'`. */
+    clockTolerance?: Duration;
+    /** The providers' key sets: see `JwksClient`. */
+    jwks?: {
+        cacheTtl?: Duration;
+        cooldown?: Duration;
+    };
+}
+export interface OidcResolveContext {
+    /**
+     * Set when a signed-in user started the flow with `?link=true` ("connect
+     * your Google account"): attach the identity to this user, and refuse
+     * (throw, or return `null`) when it already belongs to someone else.
+     * The user's session was re-checked on the callback.
+     */
+    linkTo?: {
+        id: string;
+    };
+}
+export interface OidcOptions extends OidcClientOptions {
+    /**
+     * The public URL of your callback route, the redirect URI you register
+     * with each provider. `:provider` is replaced by the provider's name:
+     * `https://app.example.com/auth/oidc/:provider/callback`.
+     */
+    callbackUrl: string;
+    providers: Record<string, OidcProviderConfig>;
+    /** Where to land after sign-in when the login had no `redirectTo`. Default `/`. */
+    redirectAfterLogin?: string;
+    /** Lifetime of a login between the redirect to the provider and the callback. Default `'10m'`. */
+    transactionTtl?: Duration;
+    /**
+     * Attributes of the transaction cookie, `__Host-oidc_tx` (or `oidc_tx`
+     * when they rule the prefix out). `secure` defaults to `true`;
+     * `SameSite` is always `Lax`, which lets the cookie through the
+     * provider's redirect back.
+     */
+    cookie?: CookieAttributes;
+}
+/** The HTTP request of a login or callback, as Express and Fastify provide it. */
+export type OidcRequest = {
+    headers: Record<string, string | string[] | undefined>;
+    method?: string;
+};
+/**
+ * Where to send the browser: return it from a handler decorated with
+ * `@Redirect()`. `cookies` are the `Set-Cookie` values the service already
+ * set on the HTTP response; send them yourself outside an HTTP handler.
+ */
+export interface OidcRedirect {
+    url: string;
+    cookies: string[];
+}
+export interface OidcStartOptions {
+    /** A relative path to land on after signing in; anything else is ignored. */
+    redirectTo?: unknown;
+    /** Link the provider to the signed-in user ("connect your Google account") instead of signing in. */
+    link?: boolean;
+    /** The request, outside an HTTP handler (tests). Inside one, the service reads it. */
+    request?: OidcRequest;
+}

package/dist/interfaces/oidc.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/password-hasher-options.interface.d.ts

@@ -0,0 +1,17 @@
+/**
+ * scrypt parameters. The ones a stored hash names are bounded the same way,
+ * since a tampered row could otherwise demand any amount of memory: at most
+ * 1 GiB (128·N·r) and 16 times the default work (N·r·p).
+ */
+export interface PasswordHasherOptions {
+    /** log2 of the scrypt cost N, an integer from 10 to 22. Default 17 (OWASP minimum: N=2^17, r=8, p=1; ~128 MiB). */
+    logN?: number;
+    /** Block size, 1 to 32. Default 8. */
+    r?: number;
+    /** Parallelism, 1 to 16. Default 1. */
+    p?: number;
+    /** Derived key length, 16 to 64 bytes. Default 32. */
+    keyLength?: number;
+    /** Salt length, 16 to 64 bytes. Default 16. */
+    saltLength?: number;
+}

package/dist/interfaces/password-hasher-options.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/password-reset.interface.d.ts

@@ -0,0 +1,49 @@
+import type { Duration } from './duration.interface.js';
+import type { IssuedSession } from './session.interface.js';
+/** The account behind an address, as `PasswordResetHandler.findUser()` returns it. */
+export interface PasswordResetAccount {
+    id: string;
+    /**
+     * The address the account has stored. The link goes there, never to the
+     * address typed in the form: a lookup that ignores accents or dots (MySQL's
+     * default collation does) would otherwise mail `victim@example.com`'s link
+     * to whoever typed `victim@exämple.com`. A link works only while the
+     * account keeps this address.
+     */
+    email: string;
+    /**
+     * The stored password hash, or `null` for an account without a password
+     * (a reset then sets one). A link only works while this is unchanged, so
+     * any password change invalidates the links sent before it.
+     */
+    passwordHash: string | null;
+}
+/** What `PasswordResetHandler.send()` delivers. */
+export interface PasswordResetLink {
+    userId: string;
+    email: string;
+    /** `passwordReset.url` with `?token=…`. */
+    url: string;
+    expiresAt: Date;
+}
+export interface PasswordResetOptions {
+    /** Page that receives `?token=…`, asks for a new password and POSTs both, e.g. `https://app.example.com/reset-password`. */
+    url: string;
+    /** Lifetime of a link. Default `'1h'`. */
+    ttl?: Duration;
+    /** Clock in epoch milliseconds, for tests. */
+    now?: () => number;
+}
+export interface ResetPasswordOptions {
+    /**
+     * Signs the user in on this browser afterwards, through
+     * `SignInService.signIn()` (so a user with an authenticator gets a
+     * pending session). Default `false`.
+     */
+    signIn?: boolean;
+}
+export interface PasswordResetResult {
+    userId: string;
+    /** With `signIn: true`: the new session, as `SignInService.signIn()` returns it. */
+    signedIn?: IssuedSession;
+}

package/dist/interfaces/password-reset.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/refresh-token-options.interface.d.ts

@@ -0,0 +1,10 @@
+import type { Duration } from './duration.interface.js';
+export interface RefreshTokenOptions {
+    /** Lifetime of one refresh token. Default `'30d'`. */
+    ttl?: Duration;
+    /** Maximum lifetime of a family, however often it rotates. Default `'90d'`. */
+    absoluteTtl?: Duration;
+    /** Clock in epoch milliseconds, for tests. */
+    now?: () => number;
+}
+export type RefreshTokenFailure = 'invalid' | 'expired' | 'reused';

package/dist/interfaces/refresh-token-options.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/refresh-token-store.interface.d.ts

@@ -0,0 +1,61 @@
+export interface RefreshTokenRecord {
+    /** SHA-256 of the token. */
+    id: string;
+    /** Every rotation stays in the family of the original sign-in. */
+    familyId: string;
+    userId: string;
+    createdAt: Date;
+    expiresAt: Date;
+    /** The family cannot be extended past this, however often it rotates. */
+    familyExpiresAt: Date;
+    usedAt?: Date;
+    /**
+     * Claims fixed at sign-in (`amr`, `auth_time`, …) that every token of the
+     * family carries, so access tokens minted on refresh describe the same
+     * authentication: a sign-in that passed MFA stays MFA-verified.
+     */
+    claims?: Record<string, unknown>;
+}
+/**
+ * Storage for refresh tokens. Implement it on your database or Redis, and
+ * register the provider with
+ * `AuthenticationStorage.registerSource({ refreshTokens: this })`.
+ *
+ * `markRefreshTokenUsed()` is what detects a stolen token, and must be one
+ * conditional write (`UPDATE … SET used_at = ? WHERE id = ? AND used_at IS
+ * NULL`), never a read followed by a write. A family's revocation must
+ * cover tokens saved *after* it: a refresh that lost the race to a reuse
+ * may still save its successor. Each method's comment has its rule, and
+ * `authenticationStoreContract()` from `@nestjs/authentication/testing`
+ * checks them.
+ *
+ * Optional fields come back absent (`undefined`), never `null`. Times come
+ * from `TokenService`'s clock, never the store's.
+ */
+export interface RefreshTokenStore {
+    /** The token, or `undefined`. Used and expired tokens are returned too: `TokenService` checks them. */
+    getRefreshToken(id: string): Promise<RefreshTokenRecord | undefined>;
+    /**
+     * Saves a new token (a fresh random id: a plain insert). A good place to
+     * delete tokens whose `familyExpiresAt` has passed, so the store stays
+     * bounded (and with them their family's revocation, which no longer
+     * matters).
+     */
+    saveRefreshToken(record: RefreshTokenRecord): Promise<void>;
+    /**
+     * Sets `usedAt = at` iff the token exists and is unused, in one
+     * conditional write; `true` if this call did. Of several concurrent
+     * calls, exactly one gets `true`: the others are a reuse, and revoke the
+     * family.
+     */
+    markRefreshTokenUsed(id: string, at: Date): Promise<boolean>;
+    /**
+     * Revokes the family: `isRefreshTokenFamilyRevoked()` answers `true` from
+     * now on, including for tokens of the family saved later. Idempotent.
+     */
+    revokeRefreshTokenFamily(familyId: string): Promise<void>;
+    /** Whether the family was revoked (by `revokeRefreshTokenFamily()` or `revokeUserRefreshTokens()`). */
+    isRefreshTokenFamilyRevoked(familyId: string): Promise<boolean>;
+    /** Revokes every family the user has tokens in now. Families started later are not affected. */
+    revokeUserRefreshTokens(userId: string): Promise<void>;
+}

package/dist/interfaces/refresh-token-store.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/session-store.interface.d.ts

@@ -0,0 +1,53 @@
+import type { MfaState } from './authentication-result.interface.js';
+export interface SessionRecord {
+    /** SHA-256 of the cookie token. The token itself is never stored. */
+    id: string;
+    userId: string;
+    createdAt: Date;
+    /** Absolute expiry: activity never extends a session past this. */
+    expiresAt: Date;
+    /** Last activity, for the idle (sliding) timeout. */
+    lastActiveAt: Date;
+    mfa?: MfaState;
+    /** App data: user agent, IP, device name, for "your sessions" pages. */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Where sessions live. Implement it on your database or Redis, and register
+ * the provider with `AuthenticationStorage.registerSource({ sessions: this })`.
+ * Each method's comment has its rule, and `authenticationStoreContract()`
+ * from `@nestjs/authentication/testing` checks them.
+ *
+ * Optional fields come back absent (`undefined`), never `null`. Times come
+ * from `SessionService`'s clock, never the store's.
+ */
+export interface SessionStore {
+    /** The session, or `undefined`. Expired sessions may be returned: `SessionService` checks expiry. */
+    getSession(id: string): Promise<SessionRecord | undefined>;
+    /**
+     * Saves a new session (a fresh random id: a plain insert). A good place
+     * to delete sessions whose `expiresAt` has passed, so the store stays
+     * bounded.
+     */
+    createSession(record: SessionRecord): Promise<void>;
+    /**
+     * Moves `lastActiveAt` forward, **only if the session still exists** and
+     * only forward: one conditional write, `UPDATE … SET last_active_at = ?
+     * WHERE id = ? AND last_active_at < ?`, `SET … XX` in Redis. A read
+     * followed by a write lets a request that read the session before a
+     * sign-out or rotation deleted it bring it back. Changes no other field.
+     */
+    touchSession(id: string, lastActiveAt: Date): Promise<void>;
+    /**
+     * Deletes the session, and resolves whether this call deleted it: one
+     * statement (`DELETE … WHERE id = ?` and its row count, Redis `DEL` and its
+     * count), `false` when it was already gone. `SessionService.rotate()`
+     * relies on it: of a rotation and a revocation of one session (or two
+     * rotations), only one may win.
+     */
+    deleteSession(id: string): Promise<boolean>;
+    /** The user's sessions, in any order (`[]` when none), expired ones included. */
+    listUserSessions(userId: string): Promise<SessionRecord[]>;
+    /** Deletes every session of the user ("sign out everywhere"). */
+    deleteUserSessions(userId: string): Promise<void>;
+}

package/dist/interfaces/session-store.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/session.interface.d.ts

@@ -0,0 +1,50 @@
+import type { IncomingHttpHeaders } from 'node:http';
+import type { CookieAttributes } from '../session/cookies.util.js';
+import type { Duration } from './duration.interface.js';
+import type { SessionRecord } from './session-store.interface.js';
+/** The request a session is created from, as Express and Fastify both provide it. */
+export interface SessionRequest {
+    headers: IncomingHttpHeaders;
+    ip?: string;
+}
+export interface SessionOptions {
+    /**
+     * Default `__Host-sid`, or `sid` when `cookie` rules the `__Host-` prefix
+     * out (`secure: false`, a `domain`, or a `path` other than `/`).
+     */
+    cookieName?: string;
+    /** Absolute lifetime: activity never extends a session past it. Default `'7d'`. */
+    absoluteTtl?: Duration;
+    /** Idle timeout, slid by activity. Default `'1d'`. `0` disables it. */
+    idleTtl?: Duration;
+    /** Write `lastActiveAt` at most this often, which saves a write per request. Default `'1m'`. */
+    touchInterval?: Duration;
+    /**
+     * `HttpOnly` is always set. `secure` defaults to `true`, which browsers
+     * accept from `http://localhost` too; turn it off only for plain HTTP on
+     * another host.
+     */
+    cookie?: CookieAttributes;
+    /**
+     * Origins besides the application's own whose pages may use the session
+     * cookie for unsafe requests (POST, …) and sign in, e.g.
+     * `['https://app.example.com']` for a web app on another origin than the
+     * API. The same list as `app.enableCsrfProtection({ trustedOrigins })`.
+     */
+    trustedOrigins?: string[];
+    /**
+     * What each new session stores next to the user, read from the request
+     * that signs in (password, magic link, OIDC alike): a user agent, an IP
+     * address, a device name, for "where you're signed in" pages.
+     */
+    metadata?: (request: SessionRequest) => Record<string, unknown>;
+    /** Clock in epoch milliseconds, for tests. */
+    now?: () => number;
+}
+export interface IssuedSession {
+    session: SessionRecord;
+    /** The raw token. Only the `Set-Cookie` value should leave the server. */
+    token: string;
+    /** `Set-Cookie` header value. `SignInService` sets it on the HTTP response itself. */
+    cookie: string;
+}

package/dist/interfaces/session.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/sign-in-options.interface.d.ts

@@ -0,0 +1,9 @@
+export interface SignInOptions {
+    /**
+     * How the user proved who they are, recorded on the `sign-in` event:
+     * `password`, `magic-link`, `oidc:google`.
+     */
+    method?: string;
+    /** Stored with the session, over what `session.metadata` returns for the request. */
+    metadata?: Record<string, unknown>;
+}

package/dist/interfaces/sign-in-options.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/token.interface.d.ts

@@ -0,0 +1,30 @@
+export interface IssueTokensOptions {
+    /**
+     * Claims that describe the sign-in (`amr`, `auth_time`, …): this access
+     * token and every one `refresh()` mints carry them. Keep roles and other
+     * facts that can change out of them: they are fixed for the family's life.
+     * The service owns the `amr` values that mean a second factor (`mfa`,
+     * `otp`, `hwk`): it adds `mfa` itself once a code was verified, and drops
+     * them from `claims.amr` with a warning (the rest, `pwd`, `sso`, is kept).
+     */
+    claims?: Record<string, unknown>;
+    /** How the user proved who they are, recorded on the `sign-in` event: `password`, `magic-link`. */
+    method?: string;
+    /**
+     * The code the client sent for a user with a confirmed authenticator: a
+     * TOTP `code` or a `recoveryCode`. Ignored for other users.
+     */
+    secondFactor?: {
+        code?: string;
+        recoveryCode?: string;
+    };
+}
+/** What a token endpoint returns to a client that signed in. */
+export interface TokenPair {
+    /** A JWT signed with the `accessToken` options. */
+    accessToken: string;
+    /** Opaque, single use: `refresh()` exchanges it for a new pair. */
+    refreshToken: string;
+    /** Seconds until the access token expires (OAuth's `expires_in`). */
+    expiresIn: number;
+}

package/dist/interfaces/token.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/jwt/amr.util.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The `amr` values (RFC 8176) that mean a second factor was presented:
+ * `mfa` (what `TokenService` records), `otp` and `hwk`. `JwtBearerProvider`
+ * treats a token carrying one as MFA-verified, so `TokenService` never lets
+ * an app put one into a token by itself.
+ */
+export declare const MFA_AMR_VALUES: readonly string[];
+/** Whether an `amr` claim says a second factor was presented. */
+export declare function hasMfaAmr(amr: unknown): boolean;

package/dist/jwt/amr.util.js

@@ -0,0 +1,11 @@
+/**
+ * The `amr` values (RFC 8176) that mean a second factor was presented:
+ * `mfa` (what `TokenService` records), `otp` and `hwk`. `JwtBearerProvider`
+ * treats a token carrying one as MFA-verified, so `TokenService` never lets
+ * an app put one into a token by itself.
+ */
+export const MFA_AMR_VALUES = ['mfa', 'otp', 'hwk'];
+/** Whether an `amr` claim says a second factor was presented. */
+export function hasMfaAmr(amr) {
+    return Array.isArray(amr) && amr.some((method) => typeof method === 'string' && MFA_AMR_VALUES.includes(method));
+}

package/dist/jwt/in-memory-refresh-token.store.d.ts

@@ -0,0 +1,29 @@
+import type { RefreshTokenRecord, RefreshTokenStore } from '../interfaces/refresh-token-store.interface.js';
+/**
+ * Process-local store: the default when no source is registered, and a
+ * test double. Families past their absolute expiry are dropped as new
+ * tokens are written, so an app that runs for months does not grow without
+ * bound.
+ */
+export declare class InMemoryRefreshTokenStore implements RefreshTokenStore {
+    private readonly tokens;
+    private readonly revoked;
+    private sweepAt;
+    getRefreshToken(id: string): Promise<{
+        id: string;
+        familyId: string;
+        userId: string;
+        createdAt: Date;
+        expiresAt: Date;
+        familyExpiresAt: Date;
+        usedAt?: Date;
+        claims?: Record<string, unknown>;
+    } | undefined>;
+    saveRefreshToken(record: RefreshTokenRecord): Promise<void>;
+    markRefreshTokenUsed(id: string, at: Date): Promise<boolean>;
+    revokeRefreshTokenFamily(familyId: string): Promise<void>;
+    isRefreshTokenFamilyRevoked(familyId: string): Promise<boolean>;
+    revokeUserRefreshTokens(userId: string): Promise<void>;
+    /** Drops families past their absolute expiry (every token of a family shares it), and their revocation. */
+    private sweep;
+}

package/dist/jwt/in-memory-refresh-token.store.js

@@ -0,0 +1,67 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@nestjs/common';
+/**
+ * Process-local store: the default when no source is registered, and a
+ * test double. Families past their absolute expiry are dropped as new
+ * tokens are written, so an app that runs for months does not grow without
+ * bound.
+ */
+let InMemoryRefreshTokenStore = class InMemoryRefreshTokenStore {
+    constructor() {
+        this.tokens = new Map();
+        this.revoked = new Set();
+        this.sweepAt = 1_024;
+    }
+    async getRefreshToken(id) {
+        const record = this.tokens.get(id);
+        return record && { ...record };
+    }
+    async saveRefreshToken(record) {
+        this.tokens.set(record.id, { ...record });
+        // The new token's own clock, so tests with a fake one agree.
+        if (this.tokens.size >= this.sweepAt) {
+            this.sweep(record.createdAt.getTime());
+        }
+    }
+    async markRefreshTokenUsed(id, at) {
+        const record = this.tokens.get(id);
+        if (!record || record.usedAt) {
+            return false;
+        }
+        record.usedAt = at;
+        return true;
+    }
+    async revokeRefreshTokenFamily(familyId) {
+        this.revoked.add(familyId);
+    }
+    async isRefreshTokenFamilyRevoked(familyId) {
+        return this.revoked.has(familyId);
+    }
+    async revokeUserRefreshTokens(userId) {
+        for (const record of this.tokens.values()) {
+            if (record.userId === userId) {
+                this.revoked.add(record.familyId);
+            }
+        }
+    }
+    /** Drops families past their absolute expiry (every token of a family shares it), and their revocation. */
+    sweep(now) {
+        for (const [id, record] of this.tokens) {
+            if (record.familyExpiresAt.getTime() > now) {
+                continue;
+            }
+            this.tokens.delete(id);
+            this.revoked.delete(record.familyId);
+        }
+        this.sweepAt = Math.max(1_024, this.tokens.size * 2);
+    }
+};
+InMemoryRefreshTokenStore = __decorate([
+    Injectable()
+], InMemoryRefreshTokenStore);
+export { InMemoryRefreshTokenStore };

package/dist/jwt/jwks.client.d.ts

@@ -0,0 +1,34 @@
+import { KeyObject } from 'node:crypto';
+import type { JwksClientOptions } from '../interfaces/jwt-options.interface.js';
+import { type JwsHeader } from './jws.util.js';
+/**
+ * A cached JSON Web Key Set, shared by bearer-token verification and OIDC
+ * ID tokens.
+ *
+ * - Keys are cached for `cacheTtl`; an unknown `kid` triggers a refetch
+ *   (key rotation), at most once per `cooldown`.
+ * - Concurrent refreshes share one request.
+ * - A failed refresh keeps serving the previous keys. With no keys to
+ *   serve, it is an outage (a plain `Error`, so a 500, never a 401 that
+ *   would make clients drop valid tokens), retried at most once per
+ *   `cooldown`.
+ * - Keys marked `use` ≠ `sig`, with `key_ops` lacking `verify`, of
+ *   unsupported types, or whose `alg` disagrees with the token are ignored.
+ */
+export declare class JwksClient {
+    readonly uri: string;
+    private keys;
+    private fetchedAt;
+    private attemptedAt;
+    private failure?;
+    private inflight?;
+    private readonly options;
+    /** Number of network fetches, for tests and metrics. */
+    fetchCount: number;
+    constructor(uri: string, options?: JwksClientOptions);
+    getKey(header: Pick<JwsHeader, 'alg' | 'kid'>): Promise<KeyObject>;
+    private find;
+    private refresh;
+    private load;
+    private now;
+}