agentic-qe 3.3.4 → 3.4.0

package/v3/dist/adapters/a2a/auth/index.js

@@ -0,0 +1,85 @@
+/**
+ * A2A OAuth 2.0 Authentication Module
+ *
+ * Provides OAuth 2.0 authentication infrastructure for the A2A protocol:
+ * - OAuth 2.0 Provider (authorization code + client credentials flows)
+ * - Token Store (in-memory token storage with TTL)
+ * - JWT Utilities (signing, verification, decoding)
+ * - Scope Definitions (A2A core + QE domain scopes)
+ * - JWT validation middleware
+ * - OAuth 2.0 token endpoints
+ * - OpenID Connect discovery
+ *
+ * @module adapters/a2a/auth
+ * @see https://a2a-protocol.org/latest/specification/
+ * @see https://datatracker.ietf.org/doc/html/rfc6749
+ */
+// ============================================================================
+// Scopes
+// ============================================================================
+export { 
+// Core Scopes
+A2A_CORE_SCOPES, 
+// Domain Scopes
+A2A_DOMAIN_SCOPES, 
+// Combined Scopes
+A2A_SCOPES, 
+// Scope Utilities
+getScopeDescription, isValidScope, scopeHierarchy, expandScopes, validateScopes, getMissingScopes, normalizeScopes, parseScopeString, formatScopeString, 
+// Scope Categories
+getScopesByCategory, getQEDomainScopes, getCoreScopes, 
+// Default Scopes
+DEFAULT_CLIENT_SCOPES, ADMIN_SCOPES, } from './scopes.js';
+// ============================================================================
+// JWT Utilities
+// ============================================================================
+export { 
+// Error Types
+JWTError, 
+// Signing Functions
+signJWT, signAccessToken, signRefreshToken, 
+// Verification Functions
+verifyJWT, 
+// Decoding Functions
+decodeJWT, 
+// Utility Functions
+isTokenExpired, getTokenTTL, extractScopes as extractScopesFromToken, hasScope as tokenHasScope, generateTokenId, getCurrentTimestamp, } from './jwt-utils.js';
+// ============================================================================
+// Token Store
+// ============================================================================
+export { 
+// Token Store Class
+TokenStore, createTokenStore, DEFAULT_TOKEN_STORE_CONFIG, } from './token-store.js';
+// ============================================================================
+// OAuth 2.0 Provider
+// ============================================================================
+export { 
+// Provider Class
+OAuth2Provider as OAuth2ProviderImpl, createOAuth2Provider, createTestOAuth2Provider, DEFAULT_OAUTH2_CONFIG, 
+// Error Types
+OAuth2ProviderError, } from './oauth-provider.js';
+// ============================================================================
+// Middleware
+// ============================================================================
+export { 
+// Error Factory
+createOAuthError, 
+// Token Extraction
+extractBearerToken, parseScopes, 
+// JWT Middleware
+createJWTMiddleware, jwtAuthMiddleware, 
+// Scope Validation
+requireScopes, hasScope, hasAnyScope, hasAllScopes, 
+// Utility Middleware
+optionalAuth, mockAuthMiddleware, } from './middleware.js';
+// ============================================================================
+// Routes
+// ============================================================================
+export { 
+// Configuration
+DEFAULT_OAUTH_ROUTES_CONFIG, 
+// Route Factory
+getOAuthRouteDefinitions, createOAuthRoutes, 
+// Utilities
+validateRedirectUri, generateCodeChallenge, verifyCodeChallenge, } from './routes.js';
+//# sourceMappingURL=index.js.map

package/v3/dist/adapters/a2a/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/a2a/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E,OAAO;AACL,cAAc;AACd,eAAe;AAGf,gBAAgB;AAChB,iBAAiB;AAGjB,kBAAkB;AAClB,UAAU;AAGV,kBAAkB;AAClB,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,iBAAiB;AAEjB,mBAAmB;AACnB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa;AAEb,iBAAiB;AACjB,qBAAqB,EACrB,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,OAAO;AAOL,cAAc;AACd,QAAQ;AAGR,oBAAoB;AACpB,OAAO,EACP,eAAe,EACf,gBAAgB;AAEhB,yBAAyB;AACzB,SAAS;AAET,qBAAqB;AACrB,SAAS;AAET,oBAAoB;AACpB,cAAc,EACd,WAAW,EACX,aAAa,IAAI,sBAAsB,EACvC,QAAQ,IAAI,aAAa,EACzB,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAExB,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,OAAO;AACL,oBAAoB;AACpB,UAAU,EACV,gBAAgB,EAIhB,0BAA0B,GAW3B,MAAM,kBAAkB,CAAC;AAE1B,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,OAAO;AACL,iBAAiB;AACjB,cAAc,IAAI,kBAAkB,EACpC,oBAAoB,EACpB,wBAAwB,EAIxB,qBAAqB;AASrB,cAAc;AACd,mBAAmB,GAMpB,MAAM,qBAAqB,CAAC;AAE7B,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,OAAO;AAUL,gBAAgB;AAChB,gBAAgB;AAEhB,mBAAmB;AACnB,kBAAkB,EAClB,WAAW;AAEX,iBAAiB;AACjB,mBAAmB,EACnB,iBAAiB;AAEjB,mBAAmB;AACnB,aAAa,EACb,QAAQ,EACR,WAAW,EACX,YAAY;AAEZ,qBAAqB;AACrB,YAAY,EACZ,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E,OAAO;AAYL,gBAAgB;AAChB,2BAA2B;AAE3B,gBAAgB;AAChB,wBAAwB,EACxB,iBAAiB;AAEjB,YAAY;AACZ,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,aAAa,CAAC"}

package/v3/dist/adapters/a2a/auth/jwt-utils.d.ts

@@ -0,0 +1,215 @@
+/**
+ * A2A JWT Utilities
+ *
+ * Provides JWT signing, verification, and decoding using the 'jose' library.
+ * Implements standard JWT claims with A2A-specific extensions.
+ *
+ * @module adapters/a2a/auth/jwt-utils
+ */
+import * as jose from 'jose';
+/**
+ * Standard JWT payload with A2A extensions
+ */
+export interface JWTPayload {
+    /** Issuer - who issued the token */
+    readonly iss?: string;
+    /** Subject - the client/user ID */
+    readonly sub?: string;
+    /** Audience - intended recipient */
+    readonly aud?: string | string[];
+    /** Expiration time (Unix timestamp) */
+    readonly exp?: number;
+    /** Not before time (Unix timestamp) */
+    readonly nbf?: number;
+    /** Issued at time (Unix timestamp) */
+    readonly iat?: number;
+    /** JWT ID - unique identifier for the token */
+    readonly jti?: string;
+    /** OAuth 2.0 scopes (space-separated) */
+    readonly scope?: string;
+    /** Client ID for machine-to-machine auth */
+    readonly client_id?: string;
+    /** Token type (access, refresh) */
+    readonly token_type?: 'access' | 'refresh';
+    /** Additional custom claims */
+    readonly [key: string]: unknown;
+}
+/**
+ * Options for signing a JWT
+ */
+export interface SignOptions {
+    /** Algorithm to use (default: HS256) */
+    readonly algorithm?: 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512';
+    /** Token expiration in seconds (default: 3600) */
+    readonly expiresIn?: number;
+    /** Not before offset in seconds (default: 0) */
+    readonly notBefore?: number;
+    /** Issuer claim */
+    readonly issuer?: string;
+    /** Audience claim */
+    readonly audience?: string | string[];
+    /** JWT ID (auto-generated if not provided) */
+    readonly jti?: string;
+}
+/**
+ * Options for verifying a JWT
+ */
+export interface VerifyOptions {
+    /** Expected issuer */
+    readonly issuer?: string;
+    /** Expected audience */
+    readonly audience?: string | string[];
+    /** Clock tolerance in seconds (default: 0) */
+    readonly clockTolerance?: number;
+    /** Current time override for testing */
+    readonly currentTime?: Date;
+    /** Required claims */
+    readonly requiredClaims?: string[];
+}
+/**
+ * Result of JWT decoding (without verification)
+ */
+export interface DecodedJWT {
+    /** JWT header */
+    readonly header: jose.JWTHeaderParameters;
+    /** JWT payload */
+    readonly payload: JWTPayload;
+    /** Original token signature */
+    readonly signature: string;
+}
+/**
+ * JWT-related error
+ */
+export declare class JWTError extends Error {
+    readonly code: JWTErrorCode;
+    constructor(code: JWTErrorCode, message: string);
+}
+/**
+ * JWT error codes
+ */
+export type JWTErrorCode = 'TOKEN_EXPIRED' | 'TOKEN_NOT_VALID_YET' | 'INVALID_SIGNATURE' | 'INVALID_TOKEN' | 'MISSING_CLAIM' | 'INVALID_ISSUER' | 'INVALID_AUDIENCE' | 'ALGORITHM_MISMATCH';
+/**
+ * Sign a JWT with the given payload and secret
+ *
+ * @param payload - The JWT payload
+ * @param secret - The signing secret (for HMAC) or private key (for RSA/EC)
+ * @param options - Signing options
+ * @returns The signed JWT string
+ *
+ * @example
+ * ```typescript
+ * const token = await signJWT(
+ *   { sub: 'client-123', scope: 'agent:read task:create' },
+ *   'my-secret-key',
+ *   { expiresIn: 3600, issuer: 'a2a-platform' }
+ * );
+ * ```
+ */
+export declare function signJWT(payload: JWTPayload, secret: string | Uint8Array, options?: SignOptions): Promise<string>;
+/**
+ * Sign a JWT for an access token
+ *
+ * @param clientId - The client ID
+ * @param scopes - Array of granted scopes
+ * @param secret - The signing secret
+ * @param options - Additional signing options
+ * @returns The signed access token
+ */
+export declare function signAccessToken(clientId: string, scopes: string[], secret: string | Uint8Array, options?: SignOptions): Promise<string>;
+/**
+ * Sign a JWT for a refresh token
+ *
+ * @param clientId - The client ID
+ * @param scopes - Array of granted scopes
+ * @param secret - The signing secret
+ * @param options - Additional signing options
+ * @returns The signed refresh token
+ */
+export declare function signRefreshToken(clientId: string, scopes: string[], secret: string | Uint8Array, options?: SignOptions): Promise<string>;
+/**
+ * Verify a JWT and return the payload
+ *
+ * @param token - The JWT string to verify
+ * @param secret - The secret or public key for verification
+ * @param options - Verification options
+ * @returns The verified JWT payload
+ * @throws {JWTError} If verification fails
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   const payload = await verifyJWT(token, 'my-secret-key', {
+ *     issuer: 'a2a-platform',
+ *     audience: 'my-agent',
+ *   });
+ *   console.log('Client:', payload.sub);
+ *   console.log('Scopes:', payload.scope);
+ * } catch (error) {
+ *   if (error instanceof JWTError) {
+ *     console.error('JWT Error:', error.code, error.message);
+ *   }
+ * }
+ * ```
+ */
+export declare function verifyJWT(token: string, secret: string | Uint8Array, options?: VerifyOptions): Promise<JWTPayload>;
+/**
+ * Decode a JWT without verifying the signature
+ *
+ * WARNING: This does NOT verify the token! Use only for extracting
+ * information when verification is not required (e.g., reading claims
+ * before deciding which key to use for verification).
+ *
+ * @param token - The JWT string to decode
+ * @returns The decoded JWT with header, payload, and signature
+ * @throws {JWTError} If the token format is invalid
+ *
+ * @example
+ * ```typescript
+ * const decoded = decodeJWT(token);
+ * console.log('Algorithm:', decoded.header.alg);
+ * console.log('Subject:', decoded.payload.sub);
+ * ```
+ */
+export declare function decodeJWT(token: string): DecodedJWT;
+/**
+ * Check if a JWT is expired (without verification)
+ *
+ * @param token - The JWT string or decoded payload
+ * @returns True if the token is expired
+ */
+export declare function isTokenExpired(token: string | JWTPayload): boolean;
+/**
+ * Get the time until token expiration
+ *
+ * @param token - The JWT string or decoded payload
+ * @returns Seconds until expiration (negative if expired)
+ */
+export declare function getTokenTTL(token: string | JWTPayload): number;
+/**
+ * Extract scopes from a JWT
+ *
+ * @param token - The JWT string or decoded payload
+ * @returns Array of scope strings
+ */
+export declare function extractScopes(token: string | JWTPayload): string[];
+/**
+ * Check if a token has a specific scope
+ *
+ * @param token - The JWT string or decoded payload
+ * @param scope - The scope to check for
+ * @returns True if the token has the scope
+ */
+export declare function hasScope(token: string | JWTPayload, scope: string): boolean;
+/**
+ * Generate a unique token ID
+ *
+ * @returns A unique token ID (UUID v4)
+ */
+export declare function generateTokenId(): string;
+/**
+ * Get current Unix timestamp in seconds
+ *
+ * @returns Current time as Unix timestamp
+ */
+export declare function getCurrentTimestamp(): number;
+//# sourceMappingURL=jwt-utils.d.ts.map

package/v3/dist/adapters/a2a/auth/jwt-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-utils.d.ts","sourceRoot":"","sources":["../../../../src/adapters/a2a/auth/jwt-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAM7B;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,oCAAoC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,oCAAoC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEjC,uCAAuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,uCAAuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,sCAAsC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,yCAAyC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,mCAAmC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAE3C,+BAA+B;IAC/B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAE7G,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,mBAAmB;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,qBAAqB;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEtC,8CAA8C;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,sBAAsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,wBAAwB;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEtC,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAEjC,wCAAwC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAE5B,sBAAsB;IACtB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,iBAAiB;IACjB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAE1C,kBAAkB;IAClB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAE7B,+BAA+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAMD;;GAEG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAgB,IAAI,EAAE,YAAY,CAAC;gBAEvB,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM;CAShD;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,eAAe,GACf,qBAAqB,GACrB,mBAAmB,GACnB,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,CAAC;AAMzB;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAyCjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAejB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,UAAU,EAC3B,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAyDrB;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CA4BnD;AAMD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CASlE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAS9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,EAAE,CAQlE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/v3/dist/adapters/a2a/auth/jwt-utils.js

@@ -0,0 +1,314 @@
+/**
+ * A2A JWT Utilities
+ *
+ * Provides JWT signing, verification, and decoding using the 'jose' library.
+ * Implements standard JWT claims with A2A-specific extensions.
+ *
+ * @module adapters/a2a/auth/jwt-utils
+ */
+import * as jose from 'jose';
+// ============================================================================
+// JWT Error Types
+// ============================================================================
+/**
+ * JWT-related error
+ */
+export class JWTError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'JWTError';
+        this.code = code;
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, JWTError);
+        }
+    }
+}
+// ============================================================================
+// JWT Signing
+// ============================================================================
+/**
+ * Sign a JWT with the given payload and secret
+ *
+ * @param payload - The JWT payload
+ * @param secret - The signing secret (for HMAC) or private key (for RSA/EC)
+ * @param options - Signing options
+ * @returns The signed JWT string
+ *
+ * @example
+ * ```typescript
+ * const token = await signJWT(
+ *   { sub: 'client-123', scope: 'agent:read task:create' },
+ *   'my-secret-key',
+ *   { expiresIn: 3600, issuer: 'a2a-platform' }
+ * );
+ * ```
+ */
+export async function signJWT(payload, secret, options = {}) {
+    const { algorithm = 'HS256', expiresIn = 3600, notBefore = 0, issuer, audience, jti, } = options;
+    // Convert string secret to Uint8Array for jose
+    const secretKey = typeof secret === 'string'
+        ? new TextEncoder().encode(secret)
+        : secret;
+    // Build the JWT
+    let jwt = new jose.SignJWT(payload)
+        .setProtectedHeader({ alg: algorithm })
+        .setIssuedAt()
+        .setExpirationTime(`${expiresIn}s`);
+    if (notBefore > 0) {
+        jwt = jwt.setNotBefore(`${notBefore}s`);
+    }
+    if (issuer) {
+        jwt = jwt.setIssuer(issuer);
+    }
+    if (audience) {
+        jwt = jwt.setAudience(audience);
+    }
+    if (jti) {
+        jwt = jwt.setJti(jti);
+    }
+    else {
+        // Generate a unique JTI using crypto.randomUUID
+        jwt = jwt.setJti(crypto.randomUUID());
+    }
+    return jwt.sign(secretKey);
+}
+/**
+ * Sign a JWT for an access token
+ *
+ * @param clientId - The client ID
+ * @param scopes - Array of granted scopes
+ * @param secret - The signing secret
+ * @param options - Additional signing options
+ * @returns The signed access token
+ */
+export async function signAccessToken(clientId, scopes, secret, options = {}) {
+    const payload = {
+        sub: clientId,
+        client_id: clientId,
+        scope: scopes.join(' '),
+        token_type: 'access',
+    };
+    return signJWT(payload, secret, options);
+}
+/**
+ * Sign a JWT for a refresh token
+ *
+ * @param clientId - The client ID
+ * @param scopes - Array of granted scopes
+ * @param secret - The signing secret
+ * @param options - Additional signing options
+ * @returns The signed refresh token
+ */
+export async function signRefreshToken(clientId, scopes, secret, options = {}) {
+    const payload = {
+        sub: clientId,
+        client_id: clientId,
+        scope: scopes.join(' '),
+        token_type: 'refresh',
+    };
+    // Refresh tokens typically have longer expiration
+    const refreshOptions = {
+        expiresIn: 86400 * 30, // 30 days default
+        ...options,
+    };
+    return signJWT(payload, secret, refreshOptions);
+}
+// ============================================================================
+// JWT Verification
+// ============================================================================
+/**
+ * Verify a JWT and return the payload
+ *
+ * @param token - The JWT string to verify
+ * @param secret - The secret or public key for verification
+ * @param options - Verification options
+ * @returns The verified JWT payload
+ * @throws {JWTError} If verification fails
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   const payload = await verifyJWT(token, 'my-secret-key', {
+ *     issuer: 'a2a-platform',
+ *     audience: 'my-agent',
+ *   });
+ *   console.log('Client:', payload.sub);
+ *   console.log('Scopes:', payload.scope);
+ * } catch (error) {
+ *   if (error instanceof JWTError) {
+ *     console.error('JWT Error:', error.code, error.message);
+ *   }
+ * }
+ * ```
+ */
+export async function verifyJWT(token, secret, options = {}) {
+    const secretKey = typeof secret === 'string'
+        ? new TextEncoder().encode(secret)
+        : secret;
+    try {
+        const verifyOptions = {};
+        if (options.issuer) {
+            verifyOptions.issuer = options.issuer;
+        }
+        if (options.audience) {
+            verifyOptions.audience = options.audience;
+        }
+        if (options.clockTolerance !== undefined) {
+            verifyOptions.clockTolerance = options.clockTolerance;
+        }
+        if (options.currentTime) {
+            verifyOptions.currentDate = options.currentTime;
+        }
+        if (options.requiredClaims) {
+            verifyOptions.requiredClaims = options.requiredClaims;
+        }
+        const { payload } = await jose.jwtVerify(token, secretKey, verifyOptions);
+        return payload;
+    }
+    catch (error) {
+        if (error instanceof jose.errors.JWTExpired) {
+            throw new JWTError('TOKEN_EXPIRED', 'Token has expired');
+        }
+        if (error instanceof jose.errors.JWTClaimValidationFailed) {
+            if (error.message.includes('not yet valid')) {
+                throw new JWTError('TOKEN_NOT_VALID_YET', 'Token is not yet valid');
+            }
+            if (error.message.includes('issuer')) {
+                throw new JWTError('INVALID_ISSUER', 'Token issuer is invalid');
+            }
+            if (error.message.includes('audience')) {
+                throw new JWTError('INVALID_AUDIENCE', 'Token audience is invalid');
+            }
+            if (error.message.includes('required')) {
+                throw new JWTError('MISSING_CLAIM', error.message);
+            }
+        }
+        if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+            throw new JWTError('INVALID_SIGNATURE', 'Token signature is invalid');
+        }
+        if (error instanceof jose.errors.JOSEAlgNotAllowed) {
+            throw new JWTError('ALGORITHM_MISMATCH', 'Token algorithm is not allowed');
+        }
+        throw new JWTError('INVALID_TOKEN', 'Token is invalid');
+    }
+}
+// ============================================================================
+// JWT Decoding (Without Verification)
+// ============================================================================
+/**
+ * Decode a JWT without verifying the signature
+ *
+ * WARNING: This does NOT verify the token! Use only for extracting
+ * information when verification is not required (e.g., reading claims
+ * before deciding which key to use for verification).
+ *
+ * @param token - The JWT string to decode
+ * @returns The decoded JWT with header, payload, and signature
+ * @throws {JWTError} If the token format is invalid
+ *
+ * @example
+ * ```typescript
+ * const decoded = decodeJWT(token);
+ * console.log('Algorithm:', decoded.header.alg);
+ * console.log('Subject:', decoded.payload.sub);
+ * ```
+ */
+export function decodeJWT(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new JWTError('INVALID_TOKEN', 'Token must have three parts');
+        }
+        const [headerB64, payloadB64, signature] = parts;
+        // Decode header
+        const headerJson = new TextDecoder().decode(jose.base64url.decode(headerB64));
+        const header = JSON.parse(headerJson);
+        // Decode payload
+        const payloadJson = new TextDecoder().decode(jose.base64url.decode(payloadB64));
+        const payload = JSON.parse(payloadJson);
+        return {
+            header,
+            payload,
+            signature,
+        };
+    }
+    catch (error) {
+        if (error instanceof JWTError) {
+            throw error;
+        }
+        throw new JWTError('INVALID_TOKEN', 'Failed to decode token');
+    }
+}
+// ============================================================================
+// Utility Functions
+// ============================================================================
+/**
+ * Check if a JWT is expired (without verification)
+ *
+ * @param token - The JWT string or decoded payload
+ * @returns True if the token is expired
+ */
+export function isTokenExpired(token) {
+    const payload = typeof token === 'string' ? decodeJWT(token).payload : token;
+    if (!payload.exp) {
+        return false; // No expiration claim means not expired
+    }
+    const now = Math.floor(Date.now() / 1000);
+    return payload.exp < now;
+}
+/**
+ * Get the time until token expiration
+ *
+ * @param token - The JWT string or decoded payload
+ * @returns Seconds until expiration (negative if expired)
+ */
+export function getTokenTTL(token) {
+    const payload = typeof token === 'string' ? decodeJWT(token).payload : token;
+    if (!payload.exp) {
+        return Infinity;
+    }
+    const now = Math.floor(Date.now() / 1000);
+    return payload.exp - now;
+}
+/**
+ * Extract scopes from a JWT
+ *
+ * @param token - The JWT string or decoded payload
+ * @returns Array of scope strings
+ */
+export function extractScopes(token) {
+    const payload = typeof token === 'string' ? decodeJWT(token).payload : token;
+    if (!payload.scope) {
+        return [];
+    }
+    return payload.scope.trim().split(/\s+/).filter(Boolean);
+}
+/**
+ * Check if a token has a specific scope
+ *
+ * @param token - The JWT string or decoded payload
+ * @param scope - The scope to check for
+ * @returns True if the token has the scope
+ */
+export function hasScope(token, scope) {
+    const scopes = extractScopes(token);
+    return scopes.includes(scope);
+}
+/**
+ * Generate a unique token ID
+ *
+ * @returns A unique token ID (UUID v4)
+ */
+export function generateTokenId() {
+    return crypto.randomUUID();
+}
+/**
+ * Get current Unix timestamp in seconds
+ *
+ * @returns Current time as Unix timestamp
+ */
+export function getCurrentTimestamp() {
+    return Math.floor(Date.now() / 1000);
+}
+//# sourceMappingURL=jwt-utils.js.map

package/v3/dist/adapters/a2a/auth/jwt-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-utils.js","sourceRoot":"","sources":["../../../../src/adapters/a2a/auth/jwt-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAqG7B,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjB,IAAI,CAAe;IAEnC,YAAY,IAAkB,EAAE,OAAe;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAEjB,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AAeD,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAmB,EACnB,MAA2B,EAC3B,UAAuB,EAAE;IAEzB,MAAM,EACJ,SAAS,GAAG,OAAO,EACnB,SAAS,GAAG,IAAI,EAChB,SAAS,GAAG,CAAC,EACb,MAAM,EACN,QAAQ,EACR,GAAG,GACJ,GAAG,OAAO,CAAC;IAEZ,+CAA+C;IAC/C,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ;QAC1C,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC;IAEX,gBAAgB;IAChB,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAA0B,CAAC;SACnD,kBAAkB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;SACtC,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC;IAEtC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,GAAG,EAAE,CAAC;QACR,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,gDAAgD;QAChD,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,MAAgB,EAChB,MAA2B,EAC3B,UAAuB,EAAE;IAEzB,MAAM,OAAO,GAAe;QAC1B,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,UAAU,EAAE,QAAQ;KACrB,CAAC;IAEF,OAAO,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,MAAgB,EAChB,MAA2B,EAC3B,UAAuB,EAAE;IAEzB,MAAM,OAAO,GAAe;QAC1B,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,UAAU,EAAE,SAAS;KACtB,CAAC;IAEF,kDAAkD;IAClD,MAAM,cAAc,GAAgB;QAClC,SAAS,EAAE,KAAK,GAAG,EAAE,EAAE,kBAAkB;QACzC,GAAG,OAAO;KACX,CAAC;IAEF,OAAO,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,MAA2B,EAC3B,UAAyB,EAAE;IAE3B,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ;QAC1C,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC;IAEX,IAAI,CAAC;QACH,MAAM,aAAa,GAA0B,EAAE,CAAC;QAEhD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,aAAa,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,aAAa,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5C,CAAC;QAED,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,aAAa,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,aAAa,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAClD,CAAC;QAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,aAAa,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC1E,OAAO,OAAqB,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,8BAA8B,EAAE,CAAC;YAChE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YACnD,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,sCAAsC;AACtC,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAEjD,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAA6B,CAAC;QAElE,iBAAiB;QACjB,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;QAEtD,OAAO;YACL,MAAM;YACN,OAAO;YACP,SAAS;SACV,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAE7E,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,CAAC,wCAAwC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAA0B;IACpD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAE7E,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAA0B;IACtD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAE7E,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAA0B,EAAE,KAAa;IAChE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC"}