@rebasepro/server 0.23.0 → 0.24.1-canary.g19596ef

package/dist/{jwt-DnQHNFCl.js → jwt-CBaFc34Y.js}

@@ -2,10 +2,10 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-dW7B1o5h.js";
-import { r as logger } from "./logger-DO2PZc4i.js";
-import { a as canonicalStorageId } from "./keys-CogCQpxG.js";
-import { createPrivateKey, createPublicKey } from "crypto";
+import { i as __toESM, r as __require, t as __commonJSMin } from "./rolldown-runtime-dW7B1o5h.js";
+import { r as logger } from "./logger-Bt32sHFw.js";
+import { a as canonicalStorageId } from "./keys-COzQ2aE8.js";
+import { createPrivateKey, createPublicKey, createSecretKey } from "crypto";
 //#region src/utils/portable-crypto.ts
 /**
 * The cryptography the request path needs, on primitives every runtime has.
@@ -2386,7 +2386,7 @@ var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var validateAsymmetricKey = require_validateAsymmetricKey();
 	var PS_SUPPORTED = require_psSupported();
 	var jws = require_jws();
-	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$1, createPublicKey: createPublicKey$1 } = __require("crypto");
+	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$2, createPublicKey: createPublicKey$1 } = __require("crypto");
 	var PUB_KEY_ALGS = [
 		"RS256",
 		"RS384",
@@ -2457,7 +2457,7 @@ var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				secretOrPublicKey = createPublicKey$1(secretOrPublicKey);
 			} catch (_) {
 				try {
-					secretOrPublicKey = createSecretKey$1(typeof secretOrPublicKey === "string" ? Buffer.from(secretOrPublicKey) : secretOrPublicKey);
+					secretOrPublicKey = createSecretKey$2(typeof secretOrPublicKey === "string" ? Buffer.from(secretOrPublicKey) : secretOrPublicKey);
 				} catch (_) {
 					return done(new JsonWebTokenError("secretOrPublicKey is not valid key material"));
 				}
@@ -4015,7 +4015,7 @@ var require_sign = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var isPlainObject = require_lodash_isplainobject();
 	var isString = require_lodash_isstring();
 	var once = require_lodash_once();
-	var { KeyObject, createSecretKey, createPrivateKey: createPrivateKey$1 } = __require("crypto");
+	var { KeyObject, createSecretKey: createSecretKey$1, createPrivateKey: createPrivateKey$1 } = __require("crypto");
 	var SUPPORTED_ALGS = [
 		"RS256",
 		"RS384",
@@ -4159,7 +4159,7 @@ var require_sign = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			secretOrPrivateKey = createPrivateKey$1(secretOrPrivateKey);
 		} catch (_) {
 			try {
-				secretOrPrivateKey = createSecretKey(typeof secretOrPrivateKey === "string" ? Buffer.from(secretOrPrivateKey) : secretOrPrivateKey);
+				secretOrPrivateKey = createSecretKey$1(typeof secretOrPrivateKey === "string" ? Buffer.from(secretOrPrivateKey) : secretOrPrivateKey);
 			} catch (_) {
 				return failure(/* @__PURE__ */ new Error("secretOrPrivateKey is not valid key material"));
 			}
@@ -4258,61 +4258,8 @@ var require_jsonwebtoken = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
-//#region src/auth/jwt-crypto.ts
-var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
-/** Sign a set of claims. Rejects if the key and algorithm disagree. */
-async function signJwt(payload, key, options) {
-	return import_jsonwebtoken.default.sign(payload, key, {
-		algorithm: options.algorithm,
-		...options.expiresIn === void 0 ? {} : { expiresIn: options.expiresIn },
-		...options.keyid === void 0 ? {} : { keyid: options.keyid }
-	});
-}
-/**
-* Verify a token against one key and an explicit algorithm list, and return its
-* claims. Rejects — never returns null — when the token is not valid.
-*
-* `algorithms` has no default and must not acquire one. Letting the verifier
-* read `alg` out of the token's own header is the canonical JWT vulnerability:
-* an attacker takes a published RSA public key, HMACs a payload of their
-* choosing with it, sets `alg: HS256`, and a verifier holding that same public
-* key as "the secret" agrees. The caller decides the algorithm from the key it
-* chose, and {@link decodeProtectedHeader} exists so it can choose that key
-* without trusting anything the token asserts.
-*/
-async function verifyJwt(token, key, options) {
-	return import_jsonwebtoken.default.verify(token, key, { algorithms: options.algorithms });
-}
-/**
-* The token's unverified header — `kid` and `alg` — or an empty object.
-*
-* Unverified is the point: this is read *in order to* pick the key that will
-* verify it, so it cannot itself be verified first. Nothing but key selection
-* may depend on it, and key selection then pins the algorithm.
-*
-* Implemented here rather than via the JWT library because it is plain
-* base64url and JSON, needs no cryptography, and there is no reason for the
-* portable half of this module to wait on the non-portable half.
-*/
-function decodeProtectedHeader(token) {
-	const encoded = token.split(".")[0];
-	if (!encoded) return {};
-	try {
-		const base64 = encoded.replace(/-/g, "+").replace(/_/g, "/");
-		const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
-		const header = JSON.parse(atob(padded));
-		if (typeof header !== "object" || header === null) return {};
-		const { kid, alg } = header;
-		return {
-			...typeof kid === "string" ? { kid } : {},
-			...typeof alg === "string" ? { alg } : {}
-		};
-	} catch {
-		return {};
-	}
-}
-//#endregion
 //#region src/auth/jwt-keys.ts
+var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 /**
 * The algorithm a key type implies.
 *
@@ -4416,34 +4363,162 @@ function toJwks(keys) {
 		use: "sig"
 	})) };
 }
+/**
+* Key strings handed to the JWT library, imported once each.
+*
+* `jsonwebtoken` turns every key that is not a `KeyObject` into one on every
+* call: `createPublicKey` (verify) or `createPrivateKey` (sign) first, and
+* when that throws — as it does for every HMAC secret, which is not PEM —
+* `createSecretKey`. The failed parse and its exception were about 15 of the
+* 21 µs of each access-token verify. These are that same conversion, in the
+* same order, done once per string; `jwt-crypto.ts` hands the library the
+* `KeyObject` it produces. Here rather than there because key parsing lives
+* here (see `jwt-crypto.ts`), and so does this module's `node:crypto`.
+*
+* Keyed by the key string itself, so a rotated secret (`configureJwt`) is a
+* new entry and the old one is simply no longer asked for; bounded, oldest
+* first, so a process cycling through secrets does not keep all of them. Only
+* keys live here — never a verification result. Empty strings and anything
+* not a string pass through untouched, so `jsonwebtoken` refuses them exactly
+* as it did ("secret or public key must be provided" and the like), and so
+* does a string no conversion accepts.
+*/
+var IMPORTED_KEY_LIMIT = 16;
+var importedVerificationKeys = /* @__PURE__ */ new Map();
+var importedSigningKeys = /* @__PURE__ */ new Map();
+function importedKey(key, cache, asymmetric) {
+	if (typeof key !== "string" || key === "") return key;
+	const cached = cache.get(key);
+	if (cached) return cached;
+	let keyObject;
+	try {
+		keyObject = asymmetric(key);
+	} catch {
+		try {
+			keyObject = createSecretKey(Buffer.from(key));
+		} catch {
+			return key;
+		}
+	}
+	if (cache.size >= IMPORTED_KEY_LIMIT) {
+		const oldest = cache.keys().next();
+		if (!oldest.done) cache.delete(oldest.value);
+	}
+	cache.set(key, keyObject);
+	return keyObject;
+}
+/** A verification key, as `jsonwebtoken.verify` would import it, once per string. */
+function importedVerificationKey(key) {
+	return importedKey(key, importedVerificationKeys, createPublicKey);
+}
+/** A signing key, as `jsonwebtoken.sign` would import it, once per string. */
+function importedSigningKey(key) {
+	return importedKey(key, importedSigningKeys, createPrivateKey);
+}
+//#endregion
+//#region src/auth/jwt-crypto.ts
+/**
+* The one module in the request path that knows what signs a JWT.
+*
+* `jsonwebtoken` is built on `node:crypto` and is synchronous. Every portable
+* JWT implementation — WebCrypto directly, or `jose` on top of it — is
+* asynchronous, because `crypto.subtle` is. So the shape of the boundary
+* matters more than what is behind it right now: **these functions are async
+* and `jsonwebtoken` is confined to this file.**
+*
+* That is the expensive half of the change, and it is why it was made before
+* anything actually needed it. Swapping the implementation touches one file.
+* Going from synchronous to asynchronous verification touches every caller of
+* every function that verifies a token — which, at the time of writing, is
+* eleven call sites in `src` and about a hundred and eighty in the suite. Doing
+* that as a line item inside a runtime port, on top of everything else moving
+* at once, is how a port stalls.
+*
+* What is **not** here: key parsing. `jwt-keys.ts` turns PEM into
+* `node:crypto` `KeyObject`s, and the portable replacement for that is
+* `jose`'s `importSPKI`/`importPKCS8` — a dependency this package does not
+* carry yet. It stays recorded in `contracts/portable-core.txt` rather than
+* wrapped in something that would imply it had moved.
+*
+* ## Replacing this with jose
+*
+* Add `jose` (a lockfile change, so it happens in the primary checkout), then:
+* `signJwt` becomes `new SignJWT(payload).setProtectedHeader({ alg, kid })
+* .setExpirationTime(...).sign(key)`, `verifyJwt` becomes `jwtVerify(token,
+* key, { algorithms })`, and `decodeProtectedHeader` is already what jose's
+* function of that name does. Nothing outside this file changes — with one
+* exception worth writing down, because nothing would fail loudly:
+* **`jsonwebtoken` stamps `iat` on every token it signs and jose does not**
+* (it wants an explicit `.setIssuedAt()`). `iat` is what the revocation
+* watermark compares against — `logout`, `change-password`, `reset-password`
+* and `DELETE /auth/sessions` all stamp `tokensValidAfter` on the user, and
+* every access token issued before that mark is void. Tokens minted without
+* `iat` would verify perfectly well and simply stop being revocable.
+*
+* @module
+*/
+/** Sign a set of claims. Rejects if the key and algorithm disagree. */
+async function signJwt(payload, key, options) {
+	return import_jsonwebtoken.default.sign(payload, importedSigningKey(key), {
+		algorithm: options.algorithm,
+		...options.expiresIn === void 0 ? {} : { expiresIn: options.expiresIn },
+		...options.keyid === void 0 ? {} : { keyid: options.keyid }
+	});
+}
+/**
+* Verify a token against one key and an explicit algorithm list, and return its
+* claims. Rejects — never returns null — when the token is not valid.
+*
+* `algorithms` has no default and must not acquire one. Letting the verifier
+* read `alg` out of the token's own header is the canonical JWT vulnerability:
+* an attacker takes a published RSA public key, HMACs a payload of their
+* choosing with it, sets `alg: HS256`, and a verifier holding that same public
+* key as "the secret" agrees. The caller decides the algorithm from the key it
+* chose, and {@link decodeProtectedHeader} exists so it can choose that key
+* without trusting anything the token asserts.
+*/
+async function verifyJwt(token, key, options) {
+	return import_jsonwebtoken.default.verify(token, importedVerificationKey(key), { algorithms: options.algorithms });
+}
+/**
+* Whether a {@link verifyJwt} rejection says only that the token's `exp` has
+* passed — the routine refusal that sends a client to refresh — rather than
+* that the token is not one we signed. Here because the library decides how
+* that is spelled.
+*/
+function isExpiredJwtError(error) {
+	return error instanceof import_jsonwebtoken.default.TokenExpiredError;
+}
+/**
+* The token's unverified header — `kid` and `alg` — or an empty object.
+*
+* Unverified is the point: this is read *in order to* pick the key that will
+* verify it, so it cannot itself be verified first. Nothing but key selection
+* may depend on it, and key selection then pins the algorithm.
+*
+* Implemented here rather than via the JWT library because it is plain
+* base64url and JSON, needs no cryptography, and there is no reason for the
+* portable half of this module to wait on the non-portable half.
+*/
+function decodeProtectedHeader(token) {
+	const encoded = token.split(".")[0];
+	if (!encoded) return {};
+	try {
+		const base64 = encoded.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+		const header = JSON.parse(atob(padded));
+		if (typeof header !== "object" || header === null) return {};
+		const { kid, alg } = header;
+		return {
+			...typeof kid === "string" ? { kid } : {},
+			...typeof alg === "string" ? { alg } : {}
+		};
+	} catch {
+		return {};
+	}
+}
 //#endregion
 //#region src/auth/jwt.ts
-var jwt_exports = /* @__PURE__ */ __exportAll({
-	MAX_COOKIE_AGE_MS: () => MAX_COOKIE_AGE_MS,
-	MCP_ACCESS_PURPOSE: () => MCP_ACCESS_PURPOSE,
-	MFA_PENDING_PURPOSE: () => MFA_PENDING_PURPOSE,
-	configureJwt: () => configureJwt,
-	generateAccessToken: () => generateAccessToken,
-	generateDownloadToken: () => generateDownloadToken,
-	generateMcpAccessToken: () => generateMcpAccessToken,
-	generateMfaPendingToken: () => generateMfaPendingToken,
-	generateRefreshToken: () => generateRefreshToken,
-	getAccessTokenExpiry: () => getAccessTokenExpiry,
-	getAccessTokenExpiryMs: () => getAccessTokenExpiryMs,
-	getJwks: () => getJwks,
-	getRefreshTokenExpiry: () => getRefreshTokenExpiry,
-	getRefreshTokenTtlMs: () => getRefreshTokenTtlMs,
-	hasAsymmetricSigningKey: () => hasAsymmetricSigningKey,
-	hashRefreshToken: () => hashRefreshToken,
-	isJwtConfigured: () => isJwtConfigured,
-	parseDurationMs: () => parseDurationMs,
-	signPurposeToken: () => signPurposeToken,
-	verifyAccessToken: () => verifyAccessToken,
-	verifyDownloadToken: () => verifyDownloadToken,
-	verifyMcpAccessToken: () => verifyMcpAccessToken,
-	verifyMfaPendingToken: () => verifyMfaPendingToken,
-	verifyPurposeToken: () => verifyPurposeToken
-});
 /**
 * Claims the token's own identity owns, and which therefore never appear in
 * {@link AccessTokenPayload.claims}.
@@ -4459,6 +4534,7 @@ var RESERVED_TOKEN_CLAIMS = /* @__PURE__ */ new Set([
 	"roles",
 	"aal",
 	"isAnonymous",
+	"sid",
 	"purpose",
 	"iat",
 	"exp",
@@ -4467,7 +4543,13 @@ var RESERVED_TOKEN_CLAIMS = /* @__PURE__ */ new Set([
 	"aud",
 	"jti"
 ]);
-/** The custom half of a verified token, or nothing when there is none. */
+/**
+* The custom half of a verified token, or nothing when there is none.
+*
+* Exported for the one other place that builds a request identity's claims
+* without a token to verify — `resolveUser`, which reads what a token minted
+* now would carry — so both drop the same identity claims.
+*/
 function customClaimsOf(decoded) {
 	const claims = {};
 	for (const [key, value] of Object.entries(decoded)) {
@@ -4476,126 +4558,343 @@ function customClaimsOf(decoded) {
 	}
 	return Object.keys(claims).length > 0 ? claims : void 0;
 }
-var jwtConfig = {
-	secret: "",
-	accessExpiresIn: "1h",
-	refreshExpiresIn: "400d"
-};
+/** How long an access token lives when no lifetime is configured. */
+var DEFAULT_ACCESS_EXPIRES_IN = "1h";
+/** Secrets that are somebody's example, not a secret. */
+var WEAK_SECRETS = /* @__PURE__ */ new Set([
+	"secret",
+	"jwt-secret",
+	"jwt_secret",
+	"your-secret",
+	"your-super-secret-jwt-key-change-in-production",
+	"super-secret-jwt-key-change-in-production",
+	"change-me",
+	"changeme",
+	"password",
+	"test",
+	"mysecret",
+	"my-secret",
+	"my_secret",
+	"example-secret",
+	"please-change-me",
+	"replace-this-with-a-real-secret",
+	"default-secret",
+	"rebase_saas_jwt_secret_must_be_long_long_long_long",
+	"rebase_saas_service_key_must_be_long_long_long_long"
+]);
 /**
-* The parsed signing keys, and which one mints new access tokens.
+* Build a {@link JwtService} from a configuration, refusing one it would sign
+* badly with: a short or well-known secret, an `activeKid` no key carries, a
+* lifetime that is not one.
 *
-* Both are module state beside `jwtConfig` for the same reason it is: every
-* signing and verifying path in the server reads them through this file, and
-* there is exactly one JWT configuration per process.
-*/
-var signingKeys = [];
-var activeSigningKey = null;
-/**
-* Configure JWT settings - call this during initialization.
-* Validates the secret strength to prevent deployment with default/weak secrets.
+* Unset lifetimes take the defaults — an hour for access tokens,
+* {@link DEFAULT_REFRESH_EXPIRES_IN} for refresh tokens.
+*
+* @example
+* ```ts
+* const jwt = createJwtService({ secret: process.env.JWT_SECRET! });
+* const token = await jwt.generateAccessToken("u1", ["editor"]);
+* const payload = await jwt.verifyAccessToken(token); // { uid: "u1", roles: ["editor"], … }
+* ```
 */
-function configureJwt(config) {
-	const weakSecrets = /* @__PURE__ */ new Set([
-		"secret",
-		"jwt-secret",
-		"jwt_secret",
-		"your-secret",
-		"your-super-secret-jwt-key-change-in-production",
-		"super-secret-jwt-key-change-in-production",
-		"change-me",
-		"changeme",
-		"password",
-		"test",
-		"mysecret",
-		"my-secret",
-		"my_secret",
-		"example-secret",
-		"please-change-me",
-		"replace-this-with-a-real-secret",
-		"default-secret",
-		"rebase_saas_jwt_secret_must_be_long_long_long_long",
-		"rebase_saas_service_key_must_be_long_long_long_long"
-	]);
+function createJwtService(config) {
+	return jwtServiceFrom(checkJwtConfig(config));
+}
+function checkJwtConfig(config) {
 	if (!config.secret || config.secret.length < 32) throw new Error("JWT secret is too short. Must be at least 32 characters. Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\"");
-	if (weakSecrets.has(config.secret.toLowerCase())) throw new Error("JWT secret is a known default/weak value. Please use a strong, randomly generated secret. Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\"");
+	if (WEAK_SECRETS.has(config.secret.toLowerCase())) throw new Error("JWT secret is a known default/weak value. Please use a strong, randomly generated secret. Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\"");
 	const resolved = config.signingKeys ? resolveSigningKeys(config.signingKeys) : [];
 	let active = null;
 	if (resolved.length > 0) if (config.activeKid) {
 		active = resolved.find((key) => key.kid === config.activeKid) ?? null;
 		if (!active) throw new Error(`auth.activeKid is "${config.activeKid}", which is not among the configured signing keys (${resolved.map((k) => `"${k.kid}"`).join(", ")}). Signing with a key nobody published produces tokens no verifier can check.`);
 	} else active = resolved[0];
-	const lifetimes = {};
 	for (const key of ["accessExpiresIn", "refreshExpiresIn"]) {
 		const value = config[key];
 		if (value === void 0) continue;
 		if (parseDurationMs(value) === null) throw new Error(`auth.${key} is "${value}", which is not a lifetime. Give a positive number and a unit — "15m", "1h", "30d", "1w", "2 weeks" — in the grammar the token signer reads (vercel/ms). A bare number is refused: the signer reads it as milliseconds.`);
-		lifetimes[key] = value;
 	}
-	jwtConfig = {
-		...jwtConfig,
-		...config,
-		accessExpiresIn: lifetimes.accessExpiresIn ?? jwtConfig.accessExpiresIn,
-		refreshExpiresIn: lifetimes.refreshExpiresIn ?? jwtConfig.refreshExpiresIn
+	return {
+		secret: config.secret,
+		accessExpiresIn: config.accessExpiresIn ?? DEFAULT_ACCESS_EXPIRES_IN,
+		refreshExpiresIn: config.refreshExpiresIn ?? "30d",
+		signingKeys: resolved,
+		activeSigningKey: active
+	};
+}
+var UNCONFIGURED = {
+	secret: "",
+	accessExpiresIn: DEFAULT_ACCESS_EXPIRES_IN,
+	refreshExpiresIn: "30d",
+	signingKeys: [],
+	activeSigningKey: null
+};
+/** Fallback when `refreshExpiresIn` is unset. {@link createJwtService} refuses an unparseable one. */
+var DEFAULT_REFRESH_TTL_MS = 720 * 60 * 60 * 1e3;
+function jwtServiceFrom(state) {
+	const { secret, signingKeys, activeSigningKey } = state;
+	const requireSecret = () => {
+		if (!secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
+		return secret;
+	};
+	const getAccessTokenExpiryMs = () => parseDurationMs(state.accessExpiresIn || DEFAULT_ACCESS_EXPIRES_IN) ?? 3600 * 1e3;
+	const getRefreshTokenTtlMs = () => {
+		const duration = state.refreshExpiresIn;
+		return (duration ? parseDurationMs(duration) : null) ?? DEFAULT_REFRESH_TTL_MS;
+	};
+	return {
+		accessExpiresIn: state.accessExpiresIn,
+		refreshExpiresIn: state.refreshExpiresIn,
+		isConfigured: () => Boolean(secret),
+		hasAsymmetricSigningKey: () => activeSigningKey !== null,
+		getJwks: () => toJwks(signingKeys),
+		hmacSecret: () => secret || void 0,
+		async generateAccessToken(uid, roles, aal = "aal1", customClaims, isAnonymous = false, sessionId) {
+			const key = requireSecret();
+			const payload = {
+				...customClaims,
+				uid,
+				roles,
+				aal,
+				...isAnonymous ? { isAnonymous: true } : {},
+				...sessionId ? { sid: sessionId } : {}
+			};
+			if (activeSigningKey) return signJwt(payload, activeSigningKey.privateKey, {
+				expiresIn: state.accessExpiresIn,
+				algorithm: activeSigningKey.algorithm,
+				keyid: activeSigningKey.kid
+			});
+			return signJwt(payload, key, {
+				expiresIn: state.accessExpiresIn,
+				algorithm: "HS256"
+			});
+		},
+		async verifyAccessToken(token) {
+			const key = requireSecret();
+			try {
+				const header = decodeProtectedHeader(token);
+				const namedKey = resolveVerificationKey(signingKeys, header.kid);
+				const decoded = namedKey ? await verifyJwt(token, namedKey.publicKey, { algorithms: [namedKey.algorithm] }) : await verifyJwt(token, key, { algorithms: ["HS256"] });
+				if (decoded.purpose) {
+					logger.error("[JWT] Verification failed: a purpose-scoped token is not an access token", { purpose: decoded.purpose });
+					return null;
+				}
+				const id = decoded.uid || decoded.sub;
+				if (!id) {
+					logger.error("[JWT] Verification failed: missing id in payload", { detail: decoded });
+					return null;
+				}
+				const aal = decoded.aal === "aal1" || decoded.aal === "aal2" ? decoded.aal : "aal1";
+				return {
+					uid: id,
+					roles: decoded.roles || [],
+					aal,
+					...decoded.isAnonymous === true ? { isAnonymous: true } : {},
+					iat: decoded.iat,
+					...typeof decoded.exp === "number" ? { exp: decoded.exp } : {},
+					...typeof decoded.sid === "string" && decoded.sid ? { sid: decoded.sid } : {},
+					...(() => {
+						const claims = customClaimsOf(decoded);
+						return claims ? { claims } : {};
+					})()
+				};
+			} catch (error) {
+				if (isExpiredJwtError(error)) {
+					logger.debug("[JWT] Access token expired");
+					return null;
+				}
+				logger.error("[JWT] Verification failed", { error });
+				return null;
+			}
+		},
+		getAccessTokenExpiryMs,
+		getAccessTokenExpiry: () => Date.now() + getAccessTokenExpiryMs(),
+		getRefreshTokenTtlMs,
+		getRefreshTokenExpiry: () => new Date(Date.now() + getRefreshTokenTtlMs()),
+		async generateMfaPendingToken(uid, expiresInSeconds = 300) {
+			const key = requireSecret();
+			return signJwt({
+				purpose: MFA_PENDING_PURPOSE,
+				uid
+			}, key, {
+				expiresIn: expiresInSeconds,
+				algorithm: "HS256"
+			});
+		},
+		async verifyMfaPendingToken(token) {
+			const key = requireSecret();
+			try {
+				const decoded = await verifyJwt(token, key, { algorithms: ["HS256"] });
+				if (decoded.purpose !== "mfa-pending" || !decoded.uid) return null;
+				return {
+					uid: decoded.uid,
+					iat: typeof decoded.iat === "number" ? decoded.iat : void 0
+				};
+			} catch {
+				return null;
+			}
+		},
+		async generateDownloadToken(path, expiresInSeconds = 300, storageId, principal) {
+			const key = requireSecret();
+			return signJwt({
+				purpose: "file-read",
+				path,
+				storageId: canonicalStorageId(storageId),
+				...principal ? { rl: await downloadTokenRateLimitMark(principal) } : {}
+			}, key, {
+				expiresIn: expiresInSeconds,
+				algorithm: "HS256"
+			});
+		},
+		async verifyDownloadToken(token) {
+			const key = requireSecret();
+			try {
+				const decoded = await verifyJwt(token, key, { algorithms: ["HS256"] });
+				if (decoded && decoded.purpose === "file-read" && typeof decoded.path === "string") return {
+					purpose: "file-read",
+					path: decoded.path,
+					storageId: canonicalStorageId(typeof decoded.storageId === "string" ? decoded.storageId : null),
+					...typeof decoded.rl === "string" ? { rl: decoded.rl } : {}
+				};
+				return null;
+			} catch (error) {
+				logger.debug("[JWT] Download token verification failed", { error });
+				return null;
+			}
+		},
+		async signPurposeToken(purpose, claims, expiresInSeconds) {
+			const key = requireSecret();
+			return signJwt({
+				...claims,
+				purpose
+			}, key, {
+				expiresIn: expiresInSeconds,
+				algorithm: "HS256"
+			});
+		},
+		async verifyPurposeToken(purpose, token) {
+			const key = requireSecret();
+			if (!token) return null;
+			try {
+				const decoded = await verifyJwt(token, key, { algorithms: ["HS256"] });
+				if (!decoded || decoded.purpose !== purpose) return null;
+				return decoded;
+			} catch (error) {
+				logger.error("[JWT] Purpose token verification failed", {
+					purpose,
+					error
+				});
+				return null;
+			}
+		},
+		async generateMcpAccessToken(payload, expiresInSeconds) {
+			const key = requireSecret();
+			return signJwt({
+				purpose: MCP_ACCESS_PURPOSE,
+				uid: payload.uid,
+				roles: payload.roles,
+				scope: payload.scope,
+				clientId: payload.clientId,
+				aud: payload.aud,
+				iss: payload.iss
+			}, key, {
+				expiresIn: expiresInSeconds,
+				algorithm: "HS256"
+			});
+		},
+		async verifyMcpAccessToken(token, expectedAudience) {
+			const key = requireSecret();
+			try {
+				const decoded = await verifyJwt(token, key, { algorithms: ["HS256"] });
+				if (!decoded || decoded.purpose !== "mcp-access") return null;
+				if (typeof decoded.uid !== "string" || !decoded.uid) return null;
+				if (typeof decoded.aud !== "string" || decoded.aud !== expectedAudience) {
+					logger.error("[JWT] MCP token rejected: audience mismatch", {
+						expected: expectedAudience,
+						got: decoded.aud
+					});
+					return null;
+				}
+				return {
+					purpose: MCP_ACCESS_PURPOSE,
+					uid: decoded.uid,
+					roles: Array.isArray(decoded.roles) ? decoded.roles.map(String) : [],
+					scope: typeof decoded.scope === "string" ? decoded.scope : "",
+					clientId: typeof decoded.clientId === "string" ? decoded.clientId : "",
+					aud: decoded.aud,
+					iss: typeof decoded.iss === "string" ? decoded.iss : ""
+				};
+			} catch (error) {
+				logger.error("[JWT] MCP token verification failed", { error });
+				return null;
+			}
+		}
 	};
-	signingKeys = resolved;
-	activeSigningKey = active;
 }
 /**
-* The public keys, in JWKS form, for `/.well-known/jwks.json`.
+* The service the module-level functions below answer for.
 *
-* An empty `keys` array on a backend with no asymmetric keys configured is the
-* correct answer rather than a 404: it says "this issuer publishes none",
-* which a verifier can act on, where a 404 is indistinguishable from a
-* misconfigured URL.
+* Unconfigured until {@link configureJwt} is called or a backend is installed
+* as the process default (`initializeRebaseBackend`, `setDefaultBackend`).
+* `createRebaseBackend` never touches it: a backend it builds signs and
+* verifies with `backend.services.jwt`.
 */
-function getJwks() {
-	return toJwks(signingKeys);
-}
-/** Is this backend signing access tokens asymmetrically? */
-function hasAsymmetricSigningKey() {
-	return activeSigningKey !== null;
-}
+var processJwt = jwtServiceFrom(UNCONFIGURED);
 /**
-* Has this server been given a JWT secret?
+* Configure the process default's JWT settings — what `verifyAccessToken`,
+* `generateAccessToken` and the other module-level functions sign and verify
+* with.
 *
-* False on every backend that authenticates through an adapter — Firebase,
-* Clerk, anything with its own tokens — because nothing calls
-* {@link configureJwt} there. Signing paths still throw when it is false, since
-* asking for a token from a server that cannot mint one is a mistake worth
-* hearing about. Paths whose contract is *"tolerate the absence of auth"* must
-* ask first: `optionalAuth` crashing a request because this backend does not do
-* JWT is a 500 on a route that had already decided anonymous was acceptable.
+* Validates the secret strength to prevent deployment with default/weak
+* secrets. A lifetime left unset keeps the one already configured; a
+* configuration that fails validation leaves the previous one standing rather
+* than half-applying a new one.
 */
-function isJwtConfigured() {
-	return Boolean(jwtConfig.secret);
+function configureJwt(config) {
+	processJwt = createJwtService({
+		...config,
+		accessExpiresIn: config.accessExpiresIn ?? processJwt.accessExpiresIn,
+		refreshExpiresIn: config.refreshExpiresIn ?? processJwt.refreshExpiresIn
+	});
+}
+/** @internal See {@link defaultJwtService}. */
+function setDefaultJwtService(service) {
+	processJwt = service;
 }
 /**
-* Generate an access token (short-lived, 1 hour by default)
+* The JWT service serving this request: the backend's whose route group is
+* answering it, or the process default for a route mounted outside any
+* backend.
 */
-async function generateAccessToken(uid, roles, aal = "aal1", customClaims, isAnonymous = false) {
-	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	const payload = {
-		...customClaims,
-		uid,
-		roles,
-		aal,
-		...isAnonymous ? { isAnonymous: true } : {}
-	};
-	if (activeSigningKey) return signJwt(payload, activeSigningKey.privateKey, {
-		expiresIn: jwtConfig.accessExpiresIn,
-		algorithm: activeSigningKey.algorithm,
-		keyid: activeSigningKey.kid
-	});
-	return signJwt(payload, jwtConfig.secret, {
-		expiresIn: jwtConfig.accessExpiresIn,
-		algorithm: "HS256"
-	});
+function jwtOf(c) {
+	return c.get("services")?.jwt ?? processJwtService;
+}
+/** See {@link JwtService.getJwks}. Answers for the process default. */
+function getJwks() {
+	return processJwt.getJwks();
 }
 /**
-* Get the expiration time of an access token in milliseconds from now
+* The secret {@link configureJwt} was given, or undefined before it is called.
+* Answers for the process default — see {@link JwtService.hmacSecret}.
 */
+function configuredJwtSecret() {
+	return processJwt.hmacSecret();
+}
+/** See {@link JwtService.hasAsymmetricSigningKey}. Answers for the process default. */
+function hasAsymmetricSigningKey() {
+	return processJwt.hasAsymmetricSigningKey();
+}
+/** See {@link JwtService.isConfigured}. Answers for the process default. */
+function isJwtConfigured() {
+	return processJwt.isConfigured();
+}
+/** See {@link JwtService.generateAccessToken}. Answers for the process default. */
+async function generateAccessToken(uid, roles, aal = "aal1", customClaims, isAnonymous = false, sessionId) {
+	return processJwt.generateAccessToken(uid, roles, aal, customClaims, isAnonymous, sessionId);
+}
+/** See {@link JwtService.getAccessTokenExpiryMs}. Answers for the process default. */
 function getAccessTokenExpiryMs() {
-	return parseDurationMs(jwtConfig.accessExpiresIn || "1h") ?? 3600 * 1e3;
+	return processJwt.getAccessTokenExpiryMs();
 }
 var DURATION_UNIT_MS = {
 	ms: 1,
@@ -4649,63 +4948,17 @@ function parseDurationMs(value) {
 	const ms = parseFloat(match[1]) * unit;
 	return ms > 0 && Number.isFinite(ms) ? ms : null;
 }
-/**
-* Get the expiration timestamp for an access token
-*/
+/** See {@link JwtService.getAccessTokenExpiry}. Answers for the process default. */
 function getAccessTokenExpiry() {
-	return Date.now() + getAccessTokenExpiryMs();
+	return processJwt.getAccessTokenExpiry();
 }
-/**
-* Verify and decode an access token.
-*
-* Every token this server issues is signed with the same secret, so what a
-* token *is* comes from its claims, not from its signature. A download token
-* ({@link generateDownloadToken}) is therefore a validly-signed string that
-* must never authenticate anybody: it is scoped to one file path and handed out
-* in URLs, which is a far weaker thing to hold than a session.
-*
-* Today it is rejected below for want of an id — but only by luck, since
-* nothing stops a future download token from carrying one. So the purpose is
-* checked explicitly: a token minted for reading a file is not a token for
-* being a user.
-*/
+/** See {@link JwtService.verifyAccessToken}. Answers for the process default. */
 async function verifyAccessToken(token) {
-	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	try {
-		const header = decodeProtectedHeader(token);
-		const namedKey = resolveVerificationKey(signingKeys, header.kid);
-		const decoded = namedKey ? await verifyJwt(token, namedKey.publicKey, { algorithms: [namedKey.algorithm] }) : await verifyJwt(token, jwtConfig.secret, { algorithms: ["HS256"] });
-		if (decoded.purpose) {
-			logger.error("[JWT] Verification failed: a purpose-scoped token is not an access token", { purpose: decoded.purpose });
-			return null;
-		}
-		const id = decoded.uid || decoded.sub;
-		if (!id) {
-			logger.error("[JWT] Verification failed: missing id in payload", { detail: decoded });
-			return null;
-		}
-		const aal = decoded.aal === "aal1" || decoded.aal === "aal2" ? decoded.aal : "aal1";
-		return {
-			uid: id,
-			roles: decoded.roles || [],
-			aal,
-			...decoded.isAnonymous === true ? { isAnonymous: true } : {},
-			iat: decoded.iat,
-			...(() => {
-				const claims = customClaimsOf(decoded);
-				return claims ? { claims } : {};
-			})()
-		};
-	} catch (error) {
-		logger.error("[JWT] Verification failed", {
-			error,
-			detail: token.substring(0, 15)
-		});
-		return null;
-	}
+	return processJwt.verifyAccessToken(token);
 }
 /**
-* Generate a random refresh token (long-lived, 30 days by default)
+* Generate a random refresh token. Long-lived: 30 days by default, sliding —
+* see {@link JwtService.getRefreshTokenTtlMs}.
 */
 function generateRefreshToken() {
 	return randomHex(40);
@@ -4723,249 +4976,95 @@ function hashRefreshToken(token) {
 * what is actually enforced, which is worse than knowing the ceiling.
 */
 var MAX_COOKIE_AGE_MS = 400 * 24 * 60 * 60 * 1e3;
-/** Fallback when `refreshExpiresIn` is unset. {@link configureJwt} refuses an unparseable one. */
-var DEFAULT_REFRESH_TTL_MS = MAX_COOKIE_AGE_MS;
-/**
-* How long a refresh token is valid for, in milliseconds.
-*
-* Every rotation issues a token with a fresh TTL, so this is a sliding window:
-* a user who visits at all keeps their session indefinitely, and one who
-* disappears loses it this long after their last visit. That is what both
-* Firebase and Supabase do by default, and it is the behaviour people mean
-* when they say they expect to still be signed in.
-*/
+/** See {@link JwtService.getRefreshTokenTtlMs}. Answers for the process default. */
 function getRefreshTokenTtlMs() {
-	const duration = jwtConfig.refreshExpiresIn;
-	return (duration ? parseDurationMs(duration) : null) ?? DEFAULT_REFRESH_TTL_MS;
+	return processJwt.getRefreshTokenTtlMs();
 }
-/**
-* Calculate refresh token expiration date
-*/
+/** See {@link JwtService.getRefreshTokenExpiry}. Answers for the process default. */
 function getRefreshTokenExpiry() {
-	return new Date(Date.now() + getRefreshTokenTtlMs());
+	return processJwt.getRefreshTokenExpiry();
 }
 /**
 * The `purpose` claim carried by a credential that stands between "first factor
 * accepted" and "session issued".
 *
 * A pre-auth token is NOT a session and must never be usable as one:
-* {@link verifyAccessToken} refuses any token carrying a `purpose`, so this
-* value cannot authenticate a request no matter which route it is presented to.
-* The only thing that reads it is the MFA challenge pair, which exchanges it —
-* plus a second factor — for a real session.
+* {@link JwtService.verifyAccessToken} refuses any token carrying a `purpose`,
+* so this value cannot authenticate a request no matter which route it is
+* presented to. The only thing that reads it is the MFA challenge pair, which
+* exchanges it — plus a second factor — for a real session.
 */
 var MFA_PENDING_PURPOSE = "mfa-pending";
-/**
-* Mint the short-lived credential handed back with an `MFA_REQUIRED` response.
-*
-* Short-lived on purpose: it is the window in which a caller who has proven the
-* first factor may present the second, not a session to be carried around. Five
-* minutes matches the challenge TTL.
-*/
+/** See {@link JwtService.generateMfaPendingToken}. Answers for the process default. */
 async function generateMfaPendingToken(uid, expiresInSeconds = 300) {
-	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	return signJwt({
-		purpose: MFA_PENDING_PURPOSE,
-		uid
-	}, jwtConfig.secret, {
-		expiresIn: expiresInSeconds,
-		algorithm: "HS256"
-	});
+	return processJwt.generateMfaPendingToken(uid, expiresInSeconds);
 }
-/**
-* Verify a pre-auth token and return the user it was minted for.
-*
-* Returns `null` for anything else — including a perfectly valid *access*
-* token, which must not be interchangeable with this one in either direction.
-*
-* `iat` comes back with the uid because this token is a first factor that was
-* accepted at that instant, and a sign-out everywhere after it has to void it
-* the way it voids an access token — see `isAccessTokenRevoked`.
-*/
+/** See {@link JwtService.verifyMfaPendingToken}. Answers for the process default. */
 async function verifyMfaPendingToken(token) {
-	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	try {
-		const decoded = await verifyJwt(token, jwtConfig.secret, { algorithms: ["HS256"] });
-		if (decoded.purpose !== "mfa-pending" || !decoded.uid) return null;
-		return {
-			uid: decoded.uid,
-			iat: typeof decoded.iat === "number" ? decoded.iat : void 0
-		};
-	} catch {
-		return null;
-	}
+	return processJwt.verifyMfaPendingToken(token);
 }
-/**
-* Generate a short-lived download token scoped to a specific file path or prefix
-* *within one storage source*.
-*
-* Both halves of that scope are load-bearing. A key is only unique inside its
-* own bucket, and a project with more than one source routinely holds the same
-* key in several of them — `avatars/u1.png` in `(default)` and in `media` are
-* different objects, quite possibly with different owners. A token that names
-* only the path is therefore a grant on every source at once: authorize a read
-* on the source whose `storageAuthorize` hook says yes, then spend the token
-* against `?storageId=` pointing somewhere else.
-*
-* `storageId` is optional here only because omitting it *is* the default
-* source, which is what the overwhelming majority of deployments have. A mint
-* site that forgets to pass a named source produces a default-scoped token,
-* which fails closed at `/file/*` rather than over-granting.
-*/
-async function generateDownloadToken(path, expiresInSeconds = 300, storageId) {
-	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	return signJwt({
-		purpose: "file-read",
-		path,
-		storageId: canonicalStorageId(storageId)
-	}, jwtConfig.secret, {
-		expiresIn: expiresInSeconds,
-		algorithm: "HS256"
-	});
+/** See {@link JwtService.generateDownloadToken}. Answers for the process default. */
+async function generateDownloadToken(path, expiresInSeconds = 300, storageId, principal) {
+	return processJwt.generateDownloadToken(path, expiresInSeconds, storageId, principal);
 }
-/**
-* Verify and decode a download token.
-*
-* A token minted before `storageId` existed carries no such claim. It is read
-* as a grant on the **default source** rather than on all of them: that is the
-* fail-closed reading, and it is what such a token almost always was, since a
-* named source has to be asked for explicitly. The cost is bounded by the
-* five-minute TTL — for at most that long after a deploy, an in-flight token
-* for a *named* source is refused and the client re-fetches `/metadata`.
-*/
+/** See {@link DownloadTokenPayload.rl}. */
+async function downloadTokenRateLimitMark(principal) {
+	return (await sha256Hex(`download-token-rl:${principal}`)).slice(0, 32);
+}
+/** See {@link JwtService.verifyDownloadToken}. Answers for the process default. */
 async function verifyDownloadToken(token) {
-	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	try {
-		const decoded = await verifyJwt(token, jwtConfig.secret, { algorithms: ["HS256"] });
-		if (decoded && decoded.purpose === "file-read" && typeof decoded.path === "string") return {
-			purpose: "file-read",
-			path: decoded.path,
-			storageId: canonicalStorageId(typeof decoded.storageId === "string" ? decoded.storageId : null)
-		};
-		return null;
-	} catch (error) {
-		logger.error("[JWT] Download token verification failed", { error });
-		return null;
-	}
+	return processJwt.verifyDownloadToken(token);
 }
-/**
-* Sign a short-lived token that carries state across a redirect.
-*
-* The generalisation of the MFA-pending token: a signed blob the server hands
-* out and expects back, where the point is that the holder cannot edit it. The
-* OAuth authorize flow needs one to carry the authorization request across the
-* sign-in hop — without it, the endpoint the consent page posts to would mint a
-* code for whatever `client_id` and `redirect_uri` its caller typed, skipping
-* every check the authorize endpoint performs.
-*
-* The `purpose` is not decoration. {@link verifyAccessToken} refuses any token
-* that has one, so nothing minted here can be replayed as a session, and
-* {@link verifyPurposeToken} refuses a token whose purpose is not the one the
-* caller named — so a token minted for one hop cannot be spent on another.
-*/
+/** See {@link JwtService.signPurposeToken}. Answers for the process default. */
 async function signPurposeToken(purpose, claims, expiresInSeconds) {
-	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	return signJwt({
-		...claims,
-		purpose
-	}, jwtConfig.secret, {
-		expiresIn: expiresInSeconds,
-		algorithm: "HS256"
-	});
+	return processJwt.signPurposeToken(purpose, claims, expiresInSeconds);
 }
-/** Verify a token minted by {@link signPurposeToken}, for one named purpose. */
+/** See {@link JwtService.verifyPurposeToken}. Answers for the process default. */
 async function verifyPurposeToken(purpose, token) {
-	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	if (!token) return null;
-	try {
-		const decoded = await verifyJwt(token, jwtConfig.secret, { algorithms: ["HS256"] });
-		if (!decoded || decoded.purpose !== purpose) return null;
-		return decoded;
-	} catch (error) {
-		logger.error("[JWT] Purpose token verification failed", {
-			purpose,
-			error
-		});
-		return null;
-	}
+	return processJwt.verifyPurposeToken(purpose, token);
 }
 /** The `purpose` that marks a token as belonging to the MCP resource. */
 var MCP_ACCESS_PURPOSE = "mcp-access";
-/**
-* Mint an access token for the MCP endpoint.
-*
-* Deliberately **not** an ordinary session token, and the `purpose` claim is
-* what enforces that: {@link verifyAccessToken} refuses any token carrying one,
-* so a credential issued to a third-party MCP client — Claude, an IDE, anything
-* that completed the OAuth flow — cannot be replayed against `/api/data`,
-* `/api/admin` or the websocket. It buys exactly the one resource it names.
-*
-* That asymmetry matters more than it first looks. These tokens are handed to
-* software the user authorized but the operator never vetted, they live in that
-* software's storage, and they are the only credential in this system minted
-* for a third party. Without the purpose separation, "connect Claude to your
-* data" would silently mean "give Claude a full session".
-*
-* The audience is the canonical resource URI, and {@link verifyMcpAccessToken}
-* requires the caller to say which resource it is checking for. A token minted
-* for another Rebase project — or another path on this one — fails there.
-*
-* HS256 with the shared secret, like the download token: the authorization
-* server and the resource server are the same process, so nothing outside it
-* ever needs to verify one, and an asymmetric key here would be a second key
-* surface bought for nobody.
-*/
+/** See {@link JwtService.generateMcpAccessToken}. Answers for the process default. */
 async function generateMcpAccessToken(payload, expiresInSeconds) {
-	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	return signJwt({
-		purpose: MCP_ACCESS_PURPOSE,
-		uid: payload.uid,
-		roles: payload.roles,
-		scope: payload.scope,
-		clientId: payload.clientId,
-		aud: payload.aud,
-		iss: payload.iss
-	}, jwtConfig.secret, {
-		expiresIn: expiresInSeconds,
-		algorithm: "HS256"
-	});
+	return processJwt.generateMcpAccessToken(payload, expiresInSeconds);
 }
-/**
-* Verify an MCP access token **for a specific resource**.
-*
-* `expectedAudience` has no default. The MCP specification requires a resource
-* server to validate that a token was issued for it specifically, and a default
-* would be the thing that quietly turns that check off — the caller has to say
-* what it is, every time, so a new call site cannot forget by omission.
-*/
+/** See {@link JwtService.verifyMcpAccessToken}. Answers for the process default. */
 async function verifyMcpAccessToken(token, expectedAudience) {
-	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	try {
-		const decoded = await verifyJwt(token, jwtConfig.secret, { algorithms: ["HS256"] });
-		if (!decoded || decoded.purpose !== "mcp-access") return null;
-		if (typeof decoded.uid !== "string" || !decoded.uid) return null;
-		if (typeof decoded.aud !== "string" || decoded.aud !== expectedAudience) {
-			logger.error("[JWT] MCP token rejected: audience mismatch", {
-				expected: expectedAudience,
-				got: decoded.aud
-			});
-			return null;
-		}
-		return {
-			purpose: MCP_ACCESS_PURPOSE,
-			uid: decoded.uid,
-			roles: Array.isArray(decoded.roles) ? decoded.roles.map(String) : [],
-			scope: typeof decoded.scope === "string" ? decoded.scope : "",
-			clientId: typeof decoded.clientId === "string" ? decoded.clientId : "",
-			aud: decoded.aud,
-			iss: typeof decoded.iss === "string" ? decoded.iss : ""
-		};
-	} catch (error) {
-		logger.error("[JWT] MCP token verification failed", { error });
-		return null;
-	}
+	return processJwt.verifyMcpAccessToken(token, expectedAudience);
 }
+/**
+* The process default as a service object that follows it — every call reads
+* whatever {@link configureJwt} or `setDefaultBackend` installed last. What a
+* route built outside any backend falls back to.
+*/
+var processJwtService = {
+	get accessExpiresIn() {
+		return processJwt.accessExpiresIn;
+	},
+	get refreshExpiresIn() {
+		return processJwt.refreshExpiresIn;
+	},
+	isConfigured: isJwtConfigured,
+	hasAsymmetricSigningKey,
+	getJwks,
+	hmacSecret: configuredJwtSecret,
+	generateAccessToken,
+	verifyAccessToken,
+	getAccessTokenExpiryMs,
+	getAccessTokenExpiry,
+	getRefreshTokenTtlMs,
+	getRefreshTokenExpiry,
+	generateMfaPendingToken,
+	verifyMfaPendingToken,
+	generateDownloadToken,
+	verifyDownloadToken,
+	signPurposeToken,
+	verifyPurposeToken,
+	generateMcpAccessToken,
+	verifyMcpAccessToken
+};
 //#endregion
-export { require_jsonwebtoken as C, sha256Bytes as D, randomInt as E, sha256Hex as O, normalizePemFromEnv as S, randomHex as T, verifyAccessToken as _, generateMcpAccessToken as a, verifyMfaPendingToken as b, getAccessTokenExpiry as c, getRefreshTokenTtlMs as d, hasAsymmetricSigningKey as f, signPurposeToken as g, jwt_exports as h, generateDownloadToken as i, getJwks as l, isJwtConfigured as m, configureJwt as n, generateMfaPendingToken as o, hashRefreshToken as p, generateAccessToken as r, generateRefreshToken as s, MAX_COOKIE_AGE_MS as t, getRefreshTokenExpiry as u, verifyDownloadToken as v, constantTimeEqual as w, verifyPurposeToken as x, verifyMcpAccessToken as y };
+export { randomHex as C, sha256Hex as E, constantTimeEqual as S, sha256Bytes as T, verifyAccessToken as _, generateAccessToken as a, normalizePemFromEnv as b, getAccessTokenExpiry as c, hasAsymmetricSigningKey as d, hashRefreshToken as f, setDefaultJwtService as g, processJwtService as h, customClaimsOf as i, getJwks as l, jwtOf as m, configureJwt as n, generateDownloadToken as o, isJwtConfigured as p, createJwtService as r, generateRefreshToken as s, MAX_COOKIE_AGE_MS as t, getRefreshTokenExpiry as u, verifyDownloadToken as v, randomInt as w, require_jsonwebtoken as x, verifyJwt as y };
 
-//# sourceMappingURL=jwt-DnQHNFCl.js.map
+//# sourceMappingURL=jwt-CBaFc34Y.js.map