@btravstack/oauth-client 0.29.0 → 0.30.0

package/README.md

@@ -1,8 +1,8 @@
 # @btravstack/oauth-client
 
 > A `TokenSource` port for [`@btravstack/core`](../core): a bearer token so a
-> service calls another as itself, over the OAuth 2.0 client credentials
-> grant — kept per audience until shortly before it expires, one fetch shared
+> service calls another as itself or for a subject, over client credentials
+> or RFC 8693 token exchange — kept per audience until shortly before it expires, one fetch shared
 > by concurrent callers, and a static adapter for tests.
 
 📖 **[Documentation](https://btravstack.github.io/btravstack/reference/oauth-client)** ·
@@ -77,14 +77,19 @@ which is this list's one detailed home.
 
 **It decides** that discovery is lazy, so an issuer down at deploy fails the
 calls that need a token rather than the boot; that a token is reused until a
-minute before it expires; that a refusal (`TokenRefused`, with the issuer's
+minute before it expires, with fixed FIFO capacity so subject turnover stays
+bounded; that a refusal (`TokenRefused`, with the issuer's
 `error` code) and an outage (`TokenIssuerUnavailable`) are two typed errors;
 that every fetch is reported to `Observers`; and that an `oauth-client` health
-check fails while an audience's last fetch failed.
+check follows the newest-started fetch per audience and scope, even when
+responses finish out of order. Each request is snapshotted at entry so caller
+mutation cannot change its grant or poison another credential's cache.
 
 **It does not decide** what a failure means for your call — retrying belongs
-to your transport — and it does not yet mint a token on behalf of a user
-(RFC 8693 token exchange is deferred). The reasoning is in
+to your transport. On behalf of a subject, `token({ audience, onBehalfOf:
+{ token, tokenType, actor? } })` uses RFC 8693 exchange. The issuer must
+authorize delegation and mint the `act` claim; an actor credential is supplied
+when it requires one. The reasoning is in
 [`AGENTS.md`](./AGENTS.md).
 
 ## License

package/dist/index.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let node_crypto = require("node:crypto");
 let _btravstack_config = require("@btravstack/config");
 let _btravstack_core = require("@btravstack/core");
 let _btravstack_di = require("@btravstack/di");
@@ -21,9 +22,9 @@ var TokenRefused = class extends (0, unthrown.TaggedError)("TokenRefused") {};
 */
 var TokenIssuerUnavailable = class extends (0, unthrown.TaggedError)("TokenIssuerUnavailable") {};
 /**
-* The port an application depends on to call another service as itself: a
+* The port an application depends on to call another service as itself or for a subject: a
 * bearer token for an audience. `oauthClient()` provides it over the client
-* credentials grant; `staticTokenSource` is the in-process stand-in.
+* credentials grant or RFC 8693 exchange; `staticTokenSource` is the in-process stand-in.
 */
 var TokenSource = class extends (0, _btravstack_di.Port)("TokenSource") {};
 /**
@@ -44,6 +45,7 @@ const staticTokenSource = (bearer) => (0, _btravstack_di.Provider)(TokenSource)(
 * is still reused.
 */
 const SKEW_MS = 6e4;
+const CACHE_CAPACITY = 1024;
 /** The source and its health, built once, so the check reads the same fetches the callers make. */
 var TokenFetches = class extends (0, _btravstack_di.Port)("OAuthTokenFetches") {};
 const fetching = (request) => ({
@@ -73,6 +75,7 @@ const tokenFetches = (settings, observers, clock) => {
 	const cached = /* @__PURE__ */ new Map();
 	const inFlight = /* @__PURE__ */ new Map();
 	const failing = /* @__PURE__ */ new Map();
+	const latestFetch = /* @__PURE__ */ new Map();
 	const discover = () => {
 		configuration ??= (0, unthrown.fromPromise)(Promise.resolve().then(() => (0, openid_client.discovery)(new URL(settings.issuer), settings.clientId, void 0, (0, openid_client.ClientSecretBasic)(settings.clientSecret), { execute: settings.insecure ? [openid_client.allowInsecureRequests] : [] })), (cause) => new TokenIssuerUnavailable({
 			issuer: settings.issuer,
@@ -85,9 +88,19 @@ const tokenFetches = (settings, observers, clock) => {
 		});
 		return configuration;
 	};
-	const grant = (request, config) => (0, unthrown.fromPromise)((0, openid_client.clientCredentialsGrant)(config, {
+	const grant = (request, config) => (0, unthrown.fromPromise)(request.onBehalfOf === void 0 ? (0, openid_client.clientCredentialsGrant)(config, {
 		audience: request.audience,
 		...request.scope === void 0 ? {} : { scope: request.scope }
+	}) : (0, openid_client.genericGrantRequest)(config, "urn:ietf:params:oauth:grant-type:token-exchange", {
+		audience: request.audience,
+		...request.scope === void 0 ? {} : { scope: request.scope },
+		subject_token: request.onBehalfOf.token,
+		subject_token_type: request.onBehalfOf.tokenType,
+		requested_token_type: "urn:ietf:params:oauth:token-type:access_token",
+		...request.onBehalfOf.actor === void 0 ? {} : {
+			actor_token: request.onBehalfOf.actor.token,
+			actor_token_type: request.onBehalfOf.actor.tokenType
+		}
 	}), (cause) => {
 		const refusal = refusalOf(cause);
 		return refusal === void 0 ? new TokenIssuerUnavailable({
@@ -100,6 +113,9 @@ const tokenFetches = (settings, observers, clock) => {
 	});
 	const fetchToken = (key, request) => {
 		const asked = clock.now();
+		const healthKey = JSON.stringify([request.audience, request.scope ?? null]);
+		const generation = Symbol();
+		latestFetch.set(healthKey, generation);
 		const fetched = (0, _btravstack_core.observed)(observers, fetching(request), () => discover().flatMap((config) => grant(request, config))).map((response) => {
 			const lifetimeMs = (response.expires_in ?? 0) * 1e3;
 			return {
@@ -108,28 +124,57 @@ const tokenFetches = (settings, observers, clock) => {
 			};
 		}).tap((entry) => {
 			inFlight.delete(key);
-			failing.delete(key);
+			if (latestFetch.get(healthKey) === generation) {
+				latestFetch.delete(healthKey);
+				failing.delete(healthKey);
+			}
 			cached.set(key, entry);
+			if (cached.size > CACHE_CAPACITY) cached.delete(cached.keys().next().value);
 		}).tapFailure((failure) => {
 			inFlight.delete(key);
-			failing.set(key, reasonOf(request.audience, failure));
+			if (latestFetch.get(healthKey) === generation) {
+				latestFetch.delete(healthKey);
+				failing.set(healthKey, reasonOf(request.audience, failure));
+			}
 		}).map((entry) => entry.token);
 		inFlight.set(key, fetched);
 		return fetched;
 	};
 	return {
-		source: { token: (request) => {
-			const key = JSON.stringify([request.audience, request.scope ?? null]);
+		source: { token: (input) => {
+			const { audience, scope, onBehalfOf } = input;
+			const actor = onBehalfOf?.actor;
+			const request = {
+				audience,
+				...scope === void 0 ? {} : { scope },
+				...onBehalfOf === void 0 ? {} : { onBehalfOf: {
+					token: onBehalfOf.token,
+					tokenType: onBehalfOf.tokenType,
+					...actor === void 0 ? {} : { actor: {
+						token: actor.token,
+						tokenType: actor.tokenType
+					} }
+				} }
+			};
+			const key = (0, node_crypto.createHash)("sha256").update(JSON.stringify([
+				request.audience,
+				request.scope ?? null,
+				request.onBehalfOf?.token ?? null,
+				request.onBehalfOf?.tokenType ?? null,
+				request.onBehalfOf?.actor?.token ?? null,
+				request.onBehalfOf?.actor?.tokenType ?? null
+			])).digest("hex");
 			const hit = cached.get(key);
 			if (hit !== void 0 && clock.now() < hit.refreshAt) return (0, unthrown.OkAsync)(hit.token);
+			cached.delete(key);
 			return inFlight.get(key) ?? fetchToken(key, request);
 		} },
 		health: () => failing.size === 0 ? (0, unthrown.OkAsync)() : (0, unthrown.ErrAsync)(new _btravstack_core.HealthCheckFailed({ reason: [...failing.values()].join("; ") }))
 	};
 };
 /**
-* The client credentials starter: `TokenSource` over an OAuth 2.0
-* authorization server, so a service calls another as itself.
+* `TokenSource` over an OAuth 2.0 authorization server: client credentials
+* for the service itself, or RFC 8693 token exchange for a subject.
 *
 * ```ts
 * Module("Gateway")({ imports: [oauthClient()], provides: [ordersClient] });
@@ -142,14 +187,17 @@ const tokenFetches = (settings, observers, clock) => {
 * - **Discovery is lazy**: the first token asks for the issuer's metadata, and
 *   a failed discovery is asked again by the next. An authorization server
 *   down at deploy fails the calls that need a token, not the boot.
-* - **A token is kept per audience and scope** until a minute before it
+* - **A token is kept per audience, scope and subject/actor credentials** until a minute before it
 *   expires (half its lifetime, if that is shorter), and callers asking for
 *   the same one while it is being fetched share that one request. A failure
-*   is never kept.
+*   is never kept. The source keeps at most 1024 tokens, evicting the oldest
+*   insertion at capacity and removing stale entries when accessed.
+*   The complete request is snapshotted at entry, so caller mutation cannot
+*   change the credential or grant associated with its cache key.
 * - **Every fetch is reported to `Observers`** (`component: "oauth-client"`);
 *   a token served from memory reports nothing.
 * - **It contributes the `oauth-client` health check**, failing while the
-*   last fetch of any audience failed — a rotated secret and an unreachable
+*   newest-started fetch of any audience/scope pair failed — a rotated secret and an unreachable
 *   issuer both show there, where a reachability probe would see only the
 *   second.
 */

package/dist/index.d.cts

@@ -7,13 +7,24 @@ import { AsyncResult } from "unthrown";
  * What a token is asked for: the service it will be presented to, and
  * optionally the scopes it must carry (space-delimited, as OAuth spells them).
  *
- * A record rather than positional arguments, so a later field — the actor a
- * call is made on behalf of — joins it without moving anything already here.
+ * On behalf of a subject, supply its token and the RFC 8693 token type. The
+ * service still authenticates with its client credentials. An issuer using
+ * explicit delegation also takes the acting service's token in `actor`.
  */
 type TokenRequest = {
   /** The callee, as its authorization server names it: the `aud` the token is minted for. */
   readonly audience: string;
   readonly scope?: string;
+  /** A subject credential to exchange; the issuer must authorize delegation and mint the `act` claim. */
+  readonly onBehalfOf?: {
+    readonly token: string;
+    readonly tokenType: string;
+    /** The acting service's credential, where the issuer requires RFC 8693 `actor_token`. */
+    readonly actor?: {
+      readonly token: string;
+      readonly tokenType: string;
+    };
+  };
 };
 /**
  * A token to present, as `Authorization: Bearer <bearer>`.
@@ -54,9 +65,9 @@ type TokenSourceService = {
 };
 declare const TokenSource_base: import("@btravstack/di").PortClass<"TokenSource">;
 /**
- * The port an application depends on to call another service as itself: a
+ * The port an application depends on to call another service as itself or for a subject: a
  * bearer token for an audience. `oauthClient()` provides it over the client
- * credentials grant; `staticTokenSource` is the in-process stand-in.
+ * credentials grant or RFC 8693 exchange; `staticTokenSource` is the in-process stand-in.
  */
 export declare class TokenSource extends TokenSource_base<TokenSourceService> {}
 /**
@@ -88,8 +99,8 @@ type OAuthClientOptions = {
   readonly clock?: Clock | undefined;
 };
 /**
- * The client credentials starter: `TokenSource` over an OAuth 2.0
- * authorization server, so a service calls another as itself.
+ * `TokenSource` over an OAuth 2.0 authorization server: client credentials
+ * for the service itself, or RFC 8693 token exchange for a subject.
  *
  * ```ts
  * Module("Gateway")({ imports: [oauthClient()], provides: [ordersClient] });
@@ -102,14 +113,17 @@ type OAuthClientOptions = {
  * - **Discovery is lazy**: the first token asks for the issuer's metadata, and
  *   a failed discovery is asked again by the next. An authorization server
  *   down at deploy fails the calls that need a token, not the boot.
- * - **A token is kept per audience and scope** until a minute before it
+ * - **A token is kept per audience, scope and subject/actor credentials** until a minute before it
  *   expires (half its lifetime, if that is shorter), and callers asking for
  *   the same one while it is being fetched share that one request. A failure
- *   is never kept.
+ *   is never kept. The source keeps at most 1024 tokens, evicting the oldest
+ *   insertion at capacity and removing stale entries when accessed.
+ *   The complete request is snapshotted at entry, so caller mutation cannot
+ *   change the credential or grant associated with its cache key.
  * - **Every fetch is reported to `Observers`** (`component: "oauth-client"`);
  *   a token served from memory reports nothing.
  * - **It contributes the `oauth-client` health check**, failing while the
- *   last fetch of any audience failed — a rotated secret and an unreachable
+ *   newest-started fetch of any audience/scope pair failed — a rotated secret and an unreachable
  *   issuer both show there, where a reachability probe would see only the
  *   second.
  */

package/dist/index.d.mts

@@ -7,13 +7,24 @@ import { AsyncResult } from "unthrown";
  * What a token is asked for: the service it will be presented to, and
  * optionally the scopes it must carry (space-delimited, as OAuth spells them).
  *
- * A record rather than positional arguments, so a later field — the actor a
- * call is made on behalf of — joins it without moving anything already here.
+ * On behalf of a subject, supply its token and the RFC 8693 token type. The
+ * service still authenticates with its client credentials. An issuer using
+ * explicit delegation also takes the acting service's token in `actor`.
  */
 type TokenRequest = {
   /** The callee, as its authorization server names it: the `aud` the token is minted for. */
   readonly audience: string;
   readonly scope?: string;
+  /** A subject credential to exchange; the issuer must authorize delegation and mint the `act` claim. */
+  readonly onBehalfOf?: {
+    readonly token: string;
+    readonly tokenType: string;
+    /** The acting service's credential, where the issuer requires RFC 8693 `actor_token`. */
+    readonly actor?: {
+      readonly token: string;
+      readonly tokenType: string;
+    };
+  };
 };
 /**
  * A token to present, as `Authorization: Bearer <bearer>`.
@@ -54,9 +65,9 @@ type TokenSourceService = {
 };
 declare const TokenSource_base: import("@btravstack/di").PortClass<"TokenSource">;
 /**
- * The port an application depends on to call another service as itself: a
+ * The port an application depends on to call another service as itself or for a subject: a
  * bearer token for an audience. `oauthClient()` provides it over the client
- * credentials grant; `staticTokenSource` is the in-process stand-in.
+ * credentials grant or RFC 8693 exchange; `staticTokenSource` is the in-process stand-in.
  */
 export declare class TokenSource extends TokenSource_base<TokenSourceService> {}
 /**
@@ -88,8 +99,8 @@ type OAuthClientOptions = {
   readonly clock?: Clock | undefined;
 };
 /**
- * The client credentials starter: `TokenSource` over an OAuth 2.0
- * authorization server, so a service calls another as itself.
+ * `TokenSource` over an OAuth 2.0 authorization server: client credentials
+ * for the service itself, or RFC 8693 token exchange for a subject.
  *
  * ```ts
  * Module("Gateway")({ imports: [oauthClient()], provides: [ordersClient] });
@@ -102,14 +113,17 @@ type OAuthClientOptions = {
  * - **Discovery is lazy**: the first token asks for the issuer's metadata, and
  *   a failed discovery is asked again by the next. An authorization server
  *   down at deploy fails the calls that need a token, not the boot.
- * - **A token is kept per audience and scope** until a minute before it
+ * - **A token is kept per audience, scope and subject/actor credentials** until a minute before it
  *   expires (half its lifetime, if that is shorter), and callers asking for
  *   the same one while it is being fetched share that one request. A failure
- *   is never kept.
+ *   is never kept. The source keeps at most 1024 tokens, evicting the oldest
+ *   insertion at capacity and removing stale entries when accessed.
+ *   The complete request is snapshotted at entry, so caller mutation cannot
+ *   change the credential or grant associated with its cache key.
  * - **Every fetch is reported to `Observers`** (`component: "oauth-client"`);
  *   a token served from memory reports nothing.
  * - **It contributes the `oauth-client` health check**, failing while the
- *   last fetch of any audience failed — a rotated secret and an unreachable
+ *   newest-started fetch of any audience/scope pair failed — a rotated secret and an unreachable
  *   issuer both show there, where a reachability probe would see only the
  *   second.
  */

package/dist/index.mjs

@@ -1,7 +1,8 @@
+import { createHash } from "node:crypto";
 import { Config, Env, cleartext, cleartextRefused } from "@btravstack/config";
 import { HealthCheckFailed, HealthChecks, Observers, noObserverMember, observed, systemClock } from "@btravstack/core";
 import { Module, Port, Provider } from "@btravstack/di";
-import { ClientSecretBasic, ResponseBodyError, WWWAuthenticateChallengeError, allowInsecureRequests, clientCredentialsGrant, discovery } from "openid-client";
+import { ClientSecretBasic, ResponseBodyError, WWWAuthenticateChallengeError, allowInsecureRequests, clientCredentialsGrant, discovery, genericGrantRequest } from "openid-client";
 import { ErrAsync, OkAsync, TaggedError, fromPromise } from "unthrown";
 //#region src/token-source.ts
 /**
@@ -20,9 +21,9 @@ var TokenRefused = class extends TaggedError("TokenRefused") {};
 */
 var TokenIssuerUnavailable = class extends TaggedError("TokenIssuerUnavailable") {};
 /**
-* The port an application depends on to call another service as itself: a
+* The port an application depends on to call another service as itself or for a subject: a
 * bearer token for an audience. `oauthClient()` provides it over the client
-* credentials grant; `staticTokenSource` is the in-process stand-in.
+* credentials grant or RFC 8693 exchange; `staticTokenSource` is the in-process stand-in.
 */
 var TokenSource = class extends Port("TokenSource") {};
 /**
@@ -43,6 +44,7 @@ const staticTokenSource = (bearer) => Provider(TokenSource)({
 * is still reused.
 */
 const SKEW_MS = 6e4;
+const CACHE_CAPACITY = 1024;
 /** The source and its health, built once, so the check reads the same fetches the callers make. */
 var TokenFetches = class extends Port("OAuthTokenFetches") {};
 const fetching = (request) => ({
@@ -72,6 +74,7 @@ const tokenFetches = (settings, observers, clock) => {
 	const cached = /* @__PURE__ */ new Map();
 	const inFlight = /* @__PURE__ */ new Map();
 	const failing = /* @__PURE__ */ new Map();
+	const latestFetch = /* @__PURE__ */ new Map();
 	const discover = () => {
 		configuration ??= fromPromise(Promise.resolve().then(() => discovery(new URL(settings.issuer), settings.clientId, void 0, ClientSecretBasic(settings.clientSecret), { execute: settings.insecure ? [allowInsecureRequests] : [] })), (cause) => new TokenIssuerUnavailable({
 			issuer: settings.issuer,
@@ -84,9 +87,19 @@ const tokenFetches = (settings, observers, clock) => {
 		});
 		return configuration;
 	};
-	const grant = (request, config) => fromPromise(clientCredentialsGrant(config, {
+	const grant = (request, config) => fromPromise(request.onBehalfOf === void 0 ? clientCredentialsGrant(config, {
 		audience: request.audience,
 		...request.scope === void 0 ? {} : { scope: request.scope }
+	}) : genericGrantRequest(config, "urn:ietf:params:oauth:grant-type:token-exchange", {
+		audience: request.audience,
+		...request.scope === void 0 ? {} : { scope: request.scope },
+		subject_token: request.onBehalfOf.token,
+		subject_token_type: request.onBehalfOf.tokenType,
+		requested_token_type: "urn:ietf:params:oauth:token-type:access_token",
+		...request.onBehalfOf.actor === void 0 ? {} : {
+			actor_token: request.onBehalfOf.actor.token,
+			actor_token_type: request.onBehalfOf.actor.tokenType
+		}
 	}), (cause) => {
 		const refusal = refusalOf(cause);
 		return refusal === void 0 ? new TokenIssuerUnavailable({
@@ -99,6 +112,9 @@ const tokenFetches = (settings, observers, clock) => {
 	});
 	const fetchToken = (key, request) => {
 		const asked = clock.now();
+		const healthKey = JSON.stringify([request.audience, request.scope ?? null]);
+		const generation = Symbol();
+		latestFetch.set(healthKey, generation);
 		const fetched = observed(observers, fetching(request), () => discover().flatMap((config) => grant(request, config))).map((response) => {
 			const lifetimeMs = (response.expires_in ?? 0) * 1e3;
 			return {
@@ -107,28 +123,57 @@ const tokenFetches = (settings, observers, clock) => {
 			};
 		}).tap((entry) => {
 			inFlight.delete(key);
-			failing.delete(key);
+			if (latestFetch.get(healthKey) === generation) {
+				latestFetch.delete(healthKey);
+				failing.delete(healthKey);
+			}
 			cached.set(key, entry);
+			if (cached.size > CACHE_CAPACITY) cached.delete(cached.keys().next().value);
 		}).tapFailure((failure) => {
 			inFlight.delete(key);
-			failing.set(key, reasonOf(request.audience, failure));
+			if (latestFetch.get(healthKey) === generation) {
+				latestFetch.delete(healthKey);
+				failing.set(healthKey, reasonOf(request.audience, failure));
+			}
 		}).map((entry) => entry.token);
 		inFlight.set(key, fetched);
 		return fetched;
 	};
 	return {
-		source: { token: (request) => {
-			const key = JSON.stringify([request.audience, request.scope ?? null]);
+		source: { token: (input) => {
+			const { audience, scope, onBehalfOf } = input;
+			const actor = onBehalfOf?.actor;
+			const request = {
+				audience,
+				...scope === void 0 ? {} : { scope },
+				...onBehalfOf === void 0 ? {} : { onBehalfOf: {
+					token: onBehalfOf.token,
+					tokenType: onBehalfOf.tokenType,
+					...actor === void 0 ? {} : { actor: {
+						token: actor.token,
+						tokenType: actor.tokenType
+					} }
+				} }
+			};
+			const key = createHash("sha256").update(JSON.stringify([
+				request.audience,
+				request.scope ?? null,
+				request.onBehalfOf?.token ?? null,
+				request.onBehalfOf?.tokenType ?? null,
+				request.onBehalfOf?.actor?.token ?? null,
+				request.onBehalfOf?.actor?.tokenType ?? null
+			])).digest("hex");
 			const hit = cached.get(key);
 			if (hit !== void 0 && clock.now() < hit.refreshAt) return OkAsync(hit.token);
+			cached.delete(key);
 			return inFlight.get(key) ?? fetchToken(key, request);
 		} },
 		health: () => failing.size === 0 ? OkAsync() : ErrAsync(new HealthCheckFailed({ reason: [...failing.values()].join("; ") }))
 	};
 };
 /**
-* The client credentials starter: `TokenSource` over an OAuth 2.0
-* authorization server, so a service calls another as itself.
+* `TokenSource` over an OAuth 2.0 authorization server: client credentials
+* for the service itself, or RFC 8693 token exchange for a subject.
 *
 * ```ts
 * Module("Gateway")({ imports: [oauthClient()], provides: [ordersClient] });
@@ -141,14 +186,17 @@ const tokenFetches = (settings, observers, clock) => {
 * - **Discovery is lazy**: the first token asks for the issuer's metadata, and
 *   a failed discovery is asked again by the next. An authorization server
 *   down at deploy fails the calls that need a token, not the boot.
-* - **A token is kept per audience and scope** until a minute before it
+* - **A token is kept per audience, scope and subject/actor credentials** until a minute before it
 *   expires (half its lifetime, if that is shorter), and callers asking for
 *   the same one while it is being fetched share that one request. A failure
-*   is never kept.
+*   is never kept. The source keeps at most 1024 tokens, evicting the oldest
+*   insertion at capacity and removing stale entries when accessed.
+*   The complete request is snapshotted at entry, so caller mutation cannot
+*   change the credential or grant associated with its cache key.
 * - **Every fetch is reported to `Observers`** (`component: "oauth-client"`);
 *   a token served from memory reports nothing.
 * - **It contributes the `oauth-client` health check**, failing while the
-*   last fetch of any audience failed — a rotated secret and an unreachable
+*   newest-started fetch of any audience/scope pair failed — a rotated secret and an unreachable
 *   issuer both show there, where a reachability probe would see only the
 *   second.
 */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@btravstack/oauth-client",
-  "version": "0.29.0",
-  "description": "A TokenSource port for @btravstack/core: the OAuth 2.0 client credentials grant, so a service calls another as itself — cached per audience until shortly before expiry, one fetch shared by concurrent callers, and a static adapter for tests",
+  "version": "0.30.0",
+  "description": "A TokenSource port for @btravstack/core: OAuth 2.0 client credentials and RFC 8693 token exchange, so a service calls another as itself or for a subject — cached per audience until shortly before expiry, one fetch shared by concurrent callers, and a static adapter for tests",
   "keywords": [
     "client-credentials",
     "dependency-injection",
@@ -43,11 +43,11 @@
     "./package.json": "./package.json"
   },
   "devDependencies": {
-    "@btravstack/config": "0.29.0",
-    "@btravstack/core": "0.29.0",
-    "@btravstack/di": "0.29.0",
+    "@btravstack/config": "0.30.0",
+    "@btravstack/core": "0.30.0",
+    "@btravstack/di": "0.30.0",
     "@btravstack/internal-test-infra": "0.0.0",
-    "@btravstack/testing": "0.29.0",
+    "@btravstack/testing": "0.30.0",
     "@btravstack/tsconfig": "0.4.0",
     "@types/node": "26.6.4",
     "@unthrown/vitest": "5.12.0",
@@ -59,9 +59,9 @@
     "vitest": "5.0.3"
   },
   "peerDependencies": {
-    "@btravstack/config": "^0.29.0",
-    "@btravstack/core": "^0.29.0",
-    "@btravstack/di": "^0.29.0",
+    "@btravstack/config": "^0.30.0",
+    "@btravstack/core": "^0.30.0",
+    "@btravstack/di": "^0.30.0",
     "openid-client": "^6",
     "unthrown": "^5.0.0"
   },