@btravstack/oauth-client 0.38.0 → 0.39.0

package/dist/index.cjs

@@ -70,18 +70,26 @@ const refusalOf = (cause) => cause instanceof openid_client.WWWAuthenticateChall
 	description: cause.error_description
 } : void 0;
 const reasonOf = (audience, failure) => failure.tag === "Err" && failure.error._tag === "TokenRefused" ? `${audience}: refused (${failure.error.error})` : `${audience}: the issuer could not be asked`;
-const tokenFetches = (settings, observers, clock) => {
+const tokenFetches = (settings, observers, clock, transport) => {
+	const fetch = transport === void 0 ? void 0 : (url, { body, ...options }) => transport(url, {
+		...options,
+		...body === void 0 ? {} : { body }
+	});
 	let configuration;
 	const cached = /* @__PURE__ */ new Map();
 	const inFlight = /* @__PURE__ */ new Map();
 	const failing = /* @__PURE__ */ new Map();
 	const latestFetch = /* @__PURE__ */ new Map();
 	const discover = () => {
-		configuration ??= (0, unthrown.fromPromise)(Promise.resolve().then(() => (0, openid_client.discovery)(new URL(settings.issuer), settings.clientId, void 0, (0, openid_client.ClientSecretBasic)(settings.clientSecret), { execute: settings.insecure ? [openid_client.allowInsecureRequests] : [] })), (cause) => new TokenIssuerUnavailable({
+		configuration ??= (0, unthrown.fromPromise)(Promise.resolve().then(() => (0, openid_client.discovery)(new URL(settings.issuer), settings.clientId, void 0, (0, openid_client.ClientSecretBasic)(settings.clientSecret), {
+			execute: settings.insecure ? [openid_client.allowInsecureRequests] : [],
+			...fetch === void 0 ? {} : { [openid_client.customFetch]: fetch }
+		})), (cause) => new TokenIssuerUnavailable({
 			issuer: settings.issuer,
 			cause
 		})).map((config) => {
 			if (settings.insecure) (0, openid_client.allowInsecureRequests)(config);
+			if (fetch !== void 0) config[openid_client.customFetch] = fetch;
 			return config;
 		}).tapFailure(() => {
 			configuration = void 0;
@@ -224,7 +232,7 @@ const oauthClient = (options = {}) => {
 			})) : (0, unthrown.OkAsync)(tokenFetches({
 				...bound,
 				insecure
-			}, observers, clock));
+			}, observers, clock, options.fetch));
 		})
 	});
 	return (0, _btravstack_di.Module)("OAuthClient")({

package/dist/index.d.cts

@@ -97,6 +97,8 @@ type OAuthClientOptions = {
   readonly allowInsecureIssuer?: boolean;
   /** What a token's lifetime is measured against (default: the kernel's `systemClock`). */
   readonly clock?: Clock | undefined;
+  /** Application-owned fetch boundary, used for both discovery and token requests. */
+  readonly fetch?: typeof fetch;
 };
 /**
  * `TokenSource` over an OAuth 2.0 authorization server: client credentials

package/dist/index.d.mts

@@ -97,6 +97,8 @@ type OAuthClientOptions = {
   readonly allowInsecureIssuer?: boolean;
   /** What a token's lifetime is measured against (default: the kernel's `systemClock`). */
   readonly clock?: Clock | undefined;
+  /** Application-owned fetch boundary, used for both discovery and token requests. */
+  readonly fetch?: typeof fetch;
 };
 /**
  * `TokenSource` over an OAuth 2.0 authorization server: client credentials

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { Config, Env, cleartext, cleartextRefused } from "@btravstack/config";
 import { HealthCheckFailed, HealthChecks, Observers, noObserverMember, observed, systemClock } from "@btravstack/core";
 import { Module, Port, Provider } from "@btravstack/di";
-import { ClientSecretBasic, ResponseBodyError, WWWAuthenticateChallengeError, allowInsecureRequests, clientCredentialsGrant, discovery, genericGrantRequest } from "openid-client";
+import { ClientSecretBasic, ResponseBodyError, WWWAuthenticateChallengeError, allowInsecureRequests, clientCredentialsGrant, customFetch, discovery, genericGrantRequest } from "openid-client";
 import { ErrAsync, OkAsync, TaggedError, fromPromise } from "unthrown";
 //#region src/token-source.ts
 /**
@@ -69,18 +69,26 @@ const refusalOf = (cause) => cause instanceof WWWAuthenticateChallengeError ? {
 	description: cause.error_description
 } : void 0;
 const reasonOf = (audience, failure) => failure.tag === "Err" && failure.error._tag === "TokenRefused" ? `${audience}: refused (${failure.error.error})` : `${audience}: the issuer could not be asked`;
-const tokenFetches = (settings, observers, clock) => {
+const tokenFetches = (settings, observers, clock, transport) => {
+	const fetch = transport === void 0 ? void 0 : (url, { body, ...options }) => transport(url, {
+		...options,
+		...body === void 0 ? {} : { body }
+	});
 	let configuration;
 	const cached = /* @__PURE__ */ new Map();
 	const inFlight = /* @__PURE__ */ new Map();
 	const failing = /* @__PURE__ */ new Map();
 	const latestFetch = /* @__PURE__ */ new Map();
 	const discover = () => {
-		configuration ??= fromPromise(Promise.resolve().then(() => discovery(new URL(settings.issuer), settings.clientId, void 0, ClientSecretBasic(settings.clientSecret), { execute: settings.insecure ? [allowInsecureRequests] : [] })), (cause) => new TokenIssuerUnavailable({
+		configuration ??= fromPromise(Promise.resolve().then(() => discovery(new URL(settings.issuer), settings.clientId, void 0, ClientSecretBasic(settings.clientSecret), {
+			execute: settings.insecure ? [allowInsecureRequests] : [],
+			...fetch === void 0 ? {} : { [customFetch]: fetch }
+		})), (cause) => new TokenIssuerUnavailable({
 			issuer: settings.issuer,
 			cause
 		})).map((config) => {
 			if (settings.insecure) allowInsecureRequests(config);
+			if (fetch !== void 0) config[customFetch] = fetch;
 			return config;
 		}).tapFailure(() => {
 			configuration = void 0;
@@ -223,7 +231,7 @@ const oauthClient = (options = {}) => {
 			})) : OkAsync(tokenFetches({
 				...bound,
 				insecure
-			}, observers, clock));
+			}, observers, clock, options.fetch));
 		})
 	});
 	return Module("OAuthClient")({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@btravstack/oauth-client",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "A TokenSource port for @btravstack/core: OAuth 2.0 client credentials and RFC 8693 token exchange, so a service calls another as itself or for a subject — cached per audience until shortly before expiry, one fetch shared by concurrent callers, and a static adapter for tests",
   "keywords": [
     "client-credentials",
@@ -43,11 +43,11 @@
     "./package.json": "./package.json"
   },
   "devDependencies": {
-    "@btravstack/config": "0.38.0",
-    "@btravstack/core": "0.38.0",
-    "@btravstack/di": "0.38.0",
+    "@btravstack/config": "0.39.0",
+    "@btravstack/core": "0.39.0",
+    "@btravstack/di": "0.39.0",
     "@btravstack/internal-test-infra": "0.0.0",
-    "@btravstack/testing": "0.38.0",
+    "@btravstack/testing": "0.39.0",
     "@btravstack/tsconfig": "0.4.0",
     "@types/node": "26.6.5",
     "@unthrown/vitest": "5.12.1",
@@ -59,9 +59,9 @@
     "vitest": "5.0.3"
   },
   "peerDependencies": {
-    "@btravstack/config": "^0.38.0",
-    "@btravstack/core": "^0.38.0",
-    "@btravstack/di": "^0.38.0",
+    "@btravstack/config": "^0.39.0",
+    "@btravstack/core": "^0.39.0",
+    "@btravstack/di": "^0.39.0",
     "openid-client": "^6",
     "unthrown": "^5.0.0"
   },