{"_id":"@agnostic-cloud/identity","name":"@agnostic-cloud/identity","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@agnostic-cloud/identity","version":"0.1.0","description":"Unified JWT/OIDC token verification with automatic JWKS caching for Google Identity Platform, AWS Cognito, Azure Entra ID, and Okta","type":"module","main":"./dist/index.cjs","module":"./dist/index.js","types":"./dist/index.d.ts","publishConfig":{"access":"public"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"build":"tsup","test":"vitest run","coverage":"vitest run --coverage","typecheck":"tsc --noEmit"},"dependencies":{"@aws-sdk/client-cognito-identity-provider":"^3.1111.0","jose":"^5.9.6"},"devDependencies":{"tsup":"^8.0.0","typescript":"^5.5.0","vitest":"^2.0.0"},"engines":{"node":"^22.18.0 || ^24.0.0 || >=26.0.0"},"gitHead":"baf870fdde8fe44bb9a36aad7e9827bbbe03858a","_id":"@agnostic-cloud/identity@0.1.0","_nodeVersion":"26.0.0","_npmVersion":"11.12.1","dist":{"integrity":"sha512-27KcxR1+ZN1hq3VE1XTwOeht5NrkgaJnTnVHknWEF3OVxPLIZxv2LX1awqGTrL5tZiycSGzFGBDM92uUmvryhQ==","shasum":"d2e7c9f47d96ae91eeea73d320176f5261ac5b5f","tarball":"https://registry.npmjs.org/@agnostic-cloud/identity/-/identity-0.1.0.tgz","fileCount":8,"unpackedSize":410758,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIH9w8IMem7RfD8LIG9RMEYfJCRPUZVM6OarI4XuaNeF7AiEA+QJKDAwCtY/YivDdApyrTsLJbeoD6AX0FFTpovFyLh0="}]},"_npmUser":{"name":"develasquez","email":"felipe.velasquezc@gmail.com"},"directories":{},"maintainers":[{"name":"develasquez","email":"felipe.velasquezc@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/identity_0.1.0_1786838273855_0.6692929063766864"},"_hasShrinkwrap":false}},"time":{"created":"2026-08-15T23:57:53.692Z","0.1.0":"2026-08-15T23:57:54.007Z","modified":"2026-08-15T23:57:54.229Z"},"maintainers":[{"name":"develasquez","email":"felipe.velasquezc@gmail.com"}],"description":"Unified JWT/OIDC token verification with automatic JWKS caching for Google Identity Platform, AWS Cognito, Azure Entra ID, and Okta","readme":"# @agnostic-cloud/identity\n\nUnified Cloud Identity, JWT & OIDC Token Verification (**Data Plane**), and User Management & Administration (**Control Plane**) across AWS Cognito, Google Cloud / Firebase Auth, Microsoft Entra ID (Azure AD), Okta, and Generic OIDC providers.\n\n## Features\n\n- **🚀 Sub-Millisecond Token Verification**: Zero cloud SDK dependencies for runtime token verification, powered by the lightweight `jose` standard library and WebCrypto.\n- **⚡ In-Memory JWKS Key Caching**: Automatic key rotation, single-flight request coalescing, and 5-second cooldown throttling to protect against cache thrashing/DoS.\n- **👥 Full User Management (`identity.admin`)**: Agnostic user creation, profile updates, password resets, suspension, activation, and directory listing across AWS, GCP, Azure, and Okta.\n- **🛡️ Hardened Security (RFC 8725)**: Immune to `alg: none`, Asymmetric-to-Symmetric Key Confusion, `jku`/`x5u` injection, multi-tenant issuer spoofing, and claim prototype pollution.\n- **🌐 Universal HTTP Middleware**: First-class support for Node.js HTTP (`IncomingMessage`), Web API (`Request`), Express, Next.js, and Cloudflare Workers.\n- **🔄 Zero-Code-Change Cloud Migration**: Switch identity providers seamlessly by simply modifying the configuration.\n\n## Installation\n\n```bash\nnpm install @agnostic-cloud/identity\n```\n\n## Quick Start\n\n### 1. Data Plane: Token Verification & HTTP Authentication\n\n```typescript\nimport { createIdentity } from '@agnostic-cloud/identity'\n\n// Initialize identity strategy (AWS Cognito example)\nconst identity = createIdentity({\n  cloud: 'aws',\n  userPoolId: 'us-east-1_example123',\n  region: 'us-east-1',\n  clientId: 'my-app-client-id',\n})\n\n// Verify raw JWT string\nconst user = await identity.verifyToken(token)\nconsole.log('User:', user.id, user.email, user.roles)\n\n// Authenticate incoming HTTP request\nexport async function GET(request: Request) {\n  const user = await identity.authenticateRequest(request, {\n    requiredRoles: ['admin'],\n  })\n  return Response.json({ message: `Hello ${user.displayName || user.email}` })\n}\n```\n\n### 2. Control Plane: User Administration (`identity.admin`)\n\n```typescript\n// Create a new user\nconst newUser = await identity.admin.createUser({\n  email: 'dev@company.com',\n  password: 'StrongPassword123!',\n  displayName: 'Dev User',\n  roles: ['engineer', 'operator'],\n})\n\n// Look up user\nconst user = await identity.admin.getUserByEmail('dev@company.com')\n\n// Update password\nawait identity.admin.updateUserPassword(user.id, 'NewStrongPassword456!')\n\n// Suspend / Disable account\nawait identity.admin.disableUser(user.id)\n\n// Delete account\nawait identity.admin.deleteUser(user.id)\n```\n\n## Providers Configuration\n\n### AWS Cognito\n```typescript\nconst identity = createIdentity({\n  cloud: 'aws',\n  userPoolId: 'us-east-1_xyz123',\n  region: 'us-east-1',\n  clientId: 'app-client-id',\n  adminConfig: {\n    credentials: { accessKeyId: '...', secretAccessKey: '...' },\n  },\n})\n```\n\n### Google Cloud / Firebase Auth\n```typescript\nconst identity = createIdentity({\n  cloud: 'gcp',\n  projectId: 'my-firebase-project',\n  flavor: 'firebase', // or 'google-oidc'\n  adminConfig: {\n    apiKey: '...', // or bearerToken\n  },\n})\n```\n\n### Microsoft Entra ID (Azure AD)\n```typescript\nconst identity = createIdentity({\n  cloud: 'azure',\n  tenantId: '00000000-0000-0000-0000-000000000000', // or 'common' for multi-tenant\n  clientId: 'api://my-api-audience',\n  adminConfig: {\n    bearerToken: '...',\n  },\n})\n```\n\n### Okta\n```typescript\nconst identity = createIdentity({\n  cloud: 'okta',\n  domain: 'dev-12345.okta.com',\n  audience: 'api://default',\n  adminConfig: {\n    apiToken: '...',\n  },\n})\n```\n\n## Error Handling\n\nAll errors extend `CloudError`:\n\n```typescript\nimport {\n  TokenExpiredError,\n  UnauthorizedError,\n  UserAlreadyExistsError,\n  UserNotFoundError,\n} from '@agnostic-cloud/identity'\n\ntry {\n  await identity.admin.createUser({ email: 'user@company.com', password: '...' })\n} catch (err) {\n  if (err instanceof UserAlreadyExistsError) {\n    console.error('Email already registered')\n  }\n}\n```\n\n## License\n\nMIT\n","readmeFilename":"README.md","_rev":"1-6584af1f961009a9bc0c261fb5e8b9b6"}