@enterprisestandard/react 0.0.5-beta.20260115.2 → 0.0.5-beta.20260115.4

package/dist/workload.js

@@ -1,691 +0,0 @@
-import { jwtAssertionClaimsSchema, workloadTokenResponseSchema } from './types/workload-schema';
-import { must } from './utils';
-import { InMemoryWorkloadTokenStore } from './workload-token-store';
-const jwksCache = new Map();
-/**
- * Type guard to check if config is for JWT Bearer Grant mode
- */
-function isJwtBearerConfig(config) {
-    return 'workload_id' in config || 'private_key' in config;
-}
-/**
- * Type guard to check if config is for OAuth2 Client Credentials mode
- */
-function isClientCredentialsConfig(config) {
-    return 'client_id' in config || 'client_secret' in config;
-}
-/**
- * Type guard to check if config is for server-only mode (token validation only)
- */
-function isServerOnlyConfig(config) {
-    return 'jwks_uri' in config && !('workload_id' in config) && !('client_id' in config);
-}
-/**
- * Validates that the config has the required fields for at least one mode:
- * - JWT Bearer Grant (client role): workload_id + private_key
- * - Client Credentials (client role): client_id + client_secret
- * - Server-only (validation role): jwks_uri only
- */
-function validateWorkloadConfig(config) {
-    const hasJwtBearer = 'workload_id' in config && 'private_key' in config;
-    const hasClientCreds = 'client_id' in config && 'client_secret' in config;
-    const hasServerOnly = 'jwks_uri' in config;
-    if (!hasJwtBearer && !hasClientCreds && !hasServerOnly) {
-        throw new Error('Invalid WorkloadConfig: must provide either (workload_id + private_key) for JWT Bearer Grant, ' +
-            '(client_id + client_secret) for OAuth2 Client Credentials, or (jwks_uri) for server-only token validation');
-    }
-}
-/**
- * Create a workload identity authentication instance
- *
- * @param config - Workload authentication configuration
- * @returns Workload authentication interface
- *
- * @example
- * ```typescript
- * import { workload } from '@enterprisestandard/react';
- *
- * const workloadAuth = workload({
- *   token_url: 'https://auth.example.com/oauth/token',
- *   jwks_uri: 'https://auth.example.com/.well-known/jwks.json',
- *   workload_id: 'spiffe://trust-domain/ns/service',
- *   audience: 'https://auth.example.com/oauth/token',
- *   private_key: '-----BEGIN PRIVATE KEY-----...',
- *   algorithm: 'RS256',
- * });
- *
- * // Get access token
- * const token = await workloadAuth.getToken('api:read api:write');
- * ```
- */
-export function workload(config) {
-    // Apply defaults based on config type
-    // For server-only mode, we use a minimal config that only supports token validation
-    let configWithDefaults;
-    // Validate config has required fields for at least one mode, or set to undefined if missing
-    if (!config) {
-        configWithDefaults = undefined;
-    }
-    else {
-        try {
-            validateWorkloadConfig(config);
-            if (isJwtBearerConfig(config)) {
-                configWithDefaults = {
-                    ...config,
-                    token_url: must(config.token_url, "Missing 'token_url' from Workload Config"),
-                    workload_id: must(config.workload_id, "Missing 'workload_id' from Workload Config"),
-                    audience: must(config.audience, "Missing 'audience' from Workload Config"),
-                    scope: config.scope ?? '',
-                    algorithm: config.algorithm ?? 'RS256',
-                    token_lifetime: config.token_lifetime ?? 300,
-                    refresh_threshold: config.refresh_threshold ?? 60,
-                    auto_refresh: config.auto_refresh !== undefined ? config.auto_refresh : true,
-                    token_store: config.token_store ?? new InMemoryWorkloadTokenStore(),
-                };
-            }
-            else if (isClientCredentialsConfig(config)) {
-                // Client Credentials mode
-                configWithDefaults = {
-                    ...config,
-                    token_url: must(config.token_url, "Missing 'token_url' from Workload Config"),
-                    client_id: must(config.client_id, "Missing 'client_id' from Workload Config"),
-                    client_secret: must(config.client_secret, "Missing 'client_secret' from Workload Config"),
-                    scope: config.scope ?? '',
-                    token_lifetime: config.token_lifetime ?? 300,
-                    refresh_threshold: config.refresh_threshold ?? 60,
-                    auto_refresh: config.auto_refresh !== undefined ? config.auto_refresh : true,
-                    token_store: config.token_store ?? new InMemoryWorkloadTokenStore(),
-                };
-            }
-            else {
-                // Server-only mode - only token validation, no token acquisition
-                configWithDefaults = config;
-            }
-        }
-        catch {
-            // If validation fails or must() throws, set to undefined
-            configWithDefaults = undefined;
-        }
-    }
-    const initialized = true;
-    function _ensureInitialized() {
-        if (!initialized || !configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-    }
-    // ========== Utility Functions ==========
-    function generateJTI() {
-        const array = new Uint8Array(16);
-        crypto.getRandomValues(array);
-        return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join('');
-    }
-    function base64UrlEncode(data) {
-        let base64;
-        if (typeof data === 'string') {
-            base64 = btoa(data);
-        }
-        else {
-            base64 = btoa(String.fromCharCode(...data));
-        }
-        return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-    }
-    function base64UrlDecode(base64url) {
-        let base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
-        // Add padding if needed (atob requires padding)
-        while (base64.length % 4) {
-            base64 += '=';
-        }
-        return atob(base64);
-    }
-    function getAlgorithmParams(alg) {
-        if (alg.startsWith('RS')) {
-            const hash = alg === 'RS256' ? 'SHA-256' : alg === 'RS384' ? 'SHA-384' : 'SHA-512';
-            return { name: 'RSASSA-PKCS1-v1_5', hash };
-        }
-        else if (alg.startsWith('ES')) {
-            const namedCurve = alg === 'ES256' ? 'P-256' : alg === 'ES384' ? 'P-384' : 'P-521';
-            const hash = alg === 'ES256' ? 'SHA-256' : alg === 'ES384' ? 'SHA-384' : 'SHA-512';
-            return { name: 'ECDSA', namedCurve, hash };
-        }
-        throw new Error(`Unsupported algorithm: ${alg}`);
-    }
-    async function importPrivateKey(pemKey, algorithm) {
-        // Strip PEM header/footer and whitespace
-        const pemContents = pemKey
-            .replace(/-----BEGIN PRIVATE KEY-----/, '')
-            .replace(/-----END PRIVATE KEY-----/, '')
-            .replace(/\s/g, '');
-        // Decode base64 to binary
-        const binaryDer = Uint8Array.from(atob(pemContents), (c) => c.charCodeAt(0));
-        const algorithmParams = getAlgorithmParams(algorithm);
-        return crypto.subtle.importKey('pkcs8', binaryDer, algorithmParams, false, ['sign']);
-    }
-    async function signJWT(data, privateKeyPEM, algorithm) {
-        const privateKey = await importPrivateKey(privateKeyPEM, algorithm);
-        const encoder = new TextEncoder();
-        const dataBuffer = encoder.encode(data);
-        const algorithmParams = getAlgorithmParams(algorithm);
-        const signatureBuffer = await crypto.subtle.sign(algorithmParams, privateKey, dataBuffer);
-        return base64UrlEncode(new Uint8Array(signatureBuffer));
-    }
-    async function retryWithBackoff(operation, maxRetries = 3, baseDelay = 1000, maxDelay = 30000) {
-        let lastError = new Error('Placeholder Error');
-        for (let attempt = 0; attempt <= maxRetries; attempt++) {
-            try {
-                return await operation();
-            }
-            catch (error) {
-                lastError = error instanceof Error ? error : new Error(String(error));
-                // Don't retry on authentication errors (4xx)
-                if (lastError.message.includes('400') ||
-                    lastError.message.includes('401') ||
-                    lastError.message.includes('403') ||
-                    lastError.message.includes('404')) {
-                    throw lastError;
-                }
-                if (attempt < maxRetries) {
-                    // Exponential backoff with jitter
-                    const delay = Math.min(baseDelay * 2 ** attempt, maxDelay);
-                    const jitter = Math.random() * delay * 0.1;
-                    await new Promise((resolve) => setTimeout(resolve, delay + jitter));
-                }
-            }
-        }
-        throw lastError;
-    }
-    // ========== Client Methods ==========
-    async function generateJWTAssertion(scope) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        if (!isJwtBearerConfig(configWithDefaults)) {
-            throw new Error('generateJWTAssertion is only available in JWT Bearer Grant mode');
-        }
-        const cfg = configWithDefaults;
-        const now = Math.floor(Date.now() / 1000);
-        // Build JWT claims
-        const claims = {
-            iss: cfg.workload_id,
-            sub: cfg.workload_id,
-            aud: cfg.audience ?? '',
-            exp: now + cfg.token_lifetime,
-            iat: now,
-            jti: generateJTI(),
-            scope: scope ?? cfg.scope,
-        };
-        // Build JWT header
-        const header = {
-            alg: cfg.algorithm,
-            typ: 'JWT',
-            kid: cfg.key_id,
-        };
-        // Encode header and payload
-        const encodedHeader = base64UrlEncode(JSON.stringify(header));
-        const encodedPayload = base64UrlEncode(JSON.stringify(claims));
-        const signatureInput = `${encodedHeader}.${encodedPayload}`;
-        // Sign the JWT (private_key is guaranteed by isJwtBearerConfig check above)
-        // biome-ignore lint/style/noNonNullAssertion: private_key guaranteed by type guard
-        const signature = await signJWT(signatureInput, cfg.private_key, cfg.algorithm);
-        return `${signatureInput}.${signature}`;
-    }
-    async function acquireTokenJwtBearer(scope, validation) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        const cfg = configWithDefaults;
-        return retryWithBackoff(async () => {
-            const tokenUrl = cfg.token_url;
-            // Generate JWT assertion
-            const assertion = await generateJWTAssertion(scope);
-            // Build request body
-            const body = new URLSearchParams();
-            body.append('grant_type', 'urn:ietf:params:oauth:grant-type:jwt-bearer');
-            body.append('assertion', assertion);
-            if (scope)
-                body.append('scope', scope);
-            // POST to token endpoint
-            const response = await fetch(tokenUrl, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    Accept: 'application/json',
-                },
-                body: body.toString(),
-            });
-            const data = await response.json();
-            if (!response.ok) {
-                console.error('Token acquisition error:', data);
-                throw new Error(`Token acquisition failed: ${data.error || response.statusText} - ${data.error_description || ''}`.trim());
-            }
-            // Validate response using StandardSchema
-            const validator = validation?.tokenResponse ?? workloadTokenResponseSchema('builtin');
-            const result = await validator['~standard'].validate(data);
-            if ('issues' in result) {
-                console.error('Token response validation failed:', result.issues);
-                throw new Error(`Token response validation failed: ${result.issues?.map((i) => i.message).join('; ')}`);
-            }
-            // Cache token if store configured
-            if (cfg.token_store) {
-                const expiresAt = new Date(Date.now() + (result.value.expires_in ?? 300) * 1000);
-                const cachedToken = {
-                    workload_id: cfg.workload_id,
-                    access_token: result.value.access_token,
-                    token_type: result.value.token_type,
-                    scope: result.value.scope,
-                    expires_at: expiresAt,
-                    created_at: new Date(),
-                    refresh_token: result.value.refresh_token,
-                };
-                await cfg.token_store.set(cachedToken);
-            }
-            return result.value;
-        });
-    }
-    async function acquireTokenClientCredentials(scope, validation) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        const cfg = configWithDefaults;
-        return retryWithBackoff(async () => {
-            const tokenUrl = cfg.token_url;
-            // Build request body for OAuth2 Client Credentials
-            const body = new URLSearchParams();
-            body.append('grant_type', 'client_credentials');
-            body.append('client_id', cfg.client_id);
-            body.append('client_secret', cfg.client_secret);
-            if (scope)
-                body.append('scope', scope);
-            // POST to token endpoint
-            const response = await fetch(tokenUrl, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                    Accept: 'application/json',
-                },
-                body: body.toString(),
-            });
-            const data = await response.json();
-            if (!response.ok) {
-                console.error('Token acquisition error:', data);
-                throw new Error(`Token acquisition failed: ${data.error || response.statusText} - ${data.error_description || ''}`.trim());
-            }
-            // Validate response using StandardSchema
-            const validator = validation?.tokenResponse ?? workloadTokenResponseSchema('builtin');
-            const result = await validator['~standard'].validate(data);
-            if ('issues' in result) {
-                console.error('Token response validation failed:', result.issues);
-                throw new Error(`Token response validation failed: ${result.issues?.map((i) => i.message).join('; ')}`);
-            }
-            // Cache token if store configured
-            if (cfg.token_store) {
-                const expiresAt = new Date(Date.now() + (result.value.expires_in ?? 300) * 1000);
-                const cachedToken = {
-                    workload_id: cfg.client_id,
-                    access_token: result.value.access_token,
-                    token_type: result.value.token_type,
-                    scope: result.value.scope,
-                    expires_at: expiresAt,
-                    created_at: new Date(),
-                    refresh_token: result.value.refresh_token,
-                };
-                await cfg.token_store.set(cachedToken);
-            }
-            return result.value;
-        });
-    }
-    async function getToken(scope) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        // Check if in server-only mode (no client credentials configured)
-        if (isServerOnlyConfig(configWithDefaults)) {
-            throw new Error('Cannot acquire tokens: Workload is configured in server-only mode (validation only). ' +
-                'To acquire tokens, configure client_id + client_secret for OAuth2 Client Credentials, ' +
-                'or workload_id + private_key for JWT Bearer Grant.');
-        }
-        // Validate client role requirements
-        if (!configWithDefaults.token_url) {
-            throw new Error('Cannot acquire tokens: Missing token_url in WorkloadConfig. ' +
-                'Client role requires token_url to be configured in vault.');
-        }
-        if (isJwtBearerConfig(configWithDefaults)) {
-            if (!configWithDefaults.private_key) {
-                throw new Error('Cannot acquire tokens: Missing private_key in WorkloadConfig. ' +
-                    'JWT Bearer Grant client role requires private_key to be configured in vault.');
-            }
-        }
-        else if (isClientCredentialsConfig(configWithDefaults)) {
-            if (!configWithDefaults.client_secret) {
-                throw new Error('Cannot acquire tokens: Missing client_secret in WorkloadConfig. ' +
-                    'OAuth2 Client Credentials client role requires client_secret to be configured in vault.');
-            }
-        }
-        const requestedScope = scope ?? configWithDefaults.scope ?? '';
-        // Determine cache key based on config type
-        let cacheKey;
-        if (isJwtBearerConfig(configWithDefaults)) {
-            cacheKey = configWithDefaults.workload_id;
-        }
-        else if (isClientCredentialsConfig(configWithDefaults)) {
-            cacheKey = configWithDefaults.client_id;
-        }
-        else {
-            throw new Error('Invalid WorkloadConfig');
-        }
-        // Check cache if token store is configured
-        const cfg = configWithDefaults;
-        if (cfg.token_store) {
-            const cachedToken = await cfg.token_store.get(cacheKey);
-            if (cachedToken) {
-                const now = Date.now();
-                const expiresAt = cachedToken.expires_at.getTime();
-                const refreshThreshold = cfg.refresh_threshold * 1000;
-                // If token is not approaching expiry, return it
-                if (now + refreshThreshold < expiresAt) {
-                    return cachedToken.access_token;
-                }
-                // If auto-refresh is enabled and approaching expiry, refresh proactively
-                if (cfg.auto_refresh) {
-                    try {
-                        const newToken = isJwtBearerConfig(configWithDefaults)
-                            ? await acquireTokenJwtBearer(requestedScope)
-                            : await acquireTokenClientCredentials(requestedScope);
-                        return newToken.access_token;
-                    }
-                    catch (error) {
-                        // If refresh fails but token still valid, use cached token
-                        if (now < expiresAt) {
-                            console.warn('Token refresh failed, using cached token:', error);
-                            return cachedToken.access_token;
-                        }
-                        throw error;
-                    }
-                }
-            }
-        }
-        // No cache or expired - acquire new token based on mode
-        const tokenResponse = isJwtBearerConfig(configWithDefaults)
-            ? await acquireTokenJwtBearer(requestedScope)
-            : await acquireTokenClientCredentials(requestedScope);
-        return tokenResponse.access_token;
-    }
-    async function refreshToken() {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        if (isServerOnlyConfig(configWithDefaults)) {
-            throw new Error('Cannot refresh tokens: Workload is configured in server-only mode (validation only).');
-        }
-        const cfg = configWithDefaults;
-        return isJwtBearerConfig(cfg)
-            ? await acquireTokenJwtBearer(cfg.scope)
-            : await acquireTokenClientCredentials(cfg.scope);
-    }
-    async function revokeToken(token) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        try {
-            // Only attempt revocation if endpoint is configured
-            if (!configWithDefaults.revocation_endpoint) {
-                return;
-            }
-            const body = new URLSearchParams();
-            body.append('token', token);
-            body.append('token_type_hint', 'access_token');
-            // Use appropriate client identifier based on mode
-            if (isJwtBearerConfig(configWithDefaults)) {
-                const cfg = configWithDefaults;
-                body.append('client_id', cfg.workload_id);
-            }
-            else if (isClientCredentialsConfig(configWithDefaults)) {
-                const cfg = configWithDefaults;
-                body.append('client_id', cfg.client_id);
-                body.append('client_secret', cfg.client_secret);
-            }
-            const response = await fetch(configWithDefaults.revocation_endpoint, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                },
-                body: body.toString(),
-            });
-            if (!response.ok) {
-                console.warn('Token revocation failed:', response.status, response.statusText);
-            }
-            else {
-                console.log('Token revoked successfully');
-            }
-            // Also delete from cache if using token store
-            if (configWithDefaults.token_store) {
-                let cacheKey;
-                if (isJwtBearerConfig(configWithDefaults)) {
-                    cacheKey = configWithDefaults.workload_id;
-                }
-                else if (isClientCredentialsConfig(configWithDefaults)) {
-                    cacheKey = configWithDefaults.client_id;
-                }
-                else {
-                    return; // Server-only mode, no cache
-                }
-                await configWithDefaults.token_store.delete(cacheKey);
-            }
-        }
-        catch (error) {
-            console.warn('Error revoking token:', error);
-            // Don't throw - revocation is best-effort
-        }
-    }
-    // ========== Server Methods ==========
-    async function fetchJwks() {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        // configWithDefaults is the merged config from enterpriseStandard, which should include jwks_uri from vault
-        const url = configWithDefaults.jwks_uri;
-        if (!url) {
-            throw new Error('Cannot validate tokens: Missing jwks_uri in WorkloadConfig. ' +
-                'Server role requires jwks_uri to be configured in vault to fetch public keys for token validation.');
-        }
-        const cached = jwksCache.get(url);
-        if (cached)
-            return cached;
-        return retryWithBackoff(async () => {
-            const response = await fetch(url);
-            if (!response.ok)
-                throw new Error('Failed to fetch JWKS');
-            const jwks = await response.json();
-            jwksCache.set(url, jwks);
-            return jwks;
-        });
-    }
-    async function getPublicKey(kid) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        const jwks = await fetchJwks();
-        const key = jwks.keys.find((k) => k.kid === kid);
-        if (!key)
-            throw new Error('Public key not found');
-        // Use algorithm from JWK or default to RS256
-        const defaultAlg = isJwtBearerConfig(configWithDefaults)
-            ? configWithDefaults.algorithm
-            : 'RS256';
-        const algorithmParams = getAlgorithmParams(key.alg || defaultAlg);
-        return crypto.subtle.importKey('jwk', key, algorithmParams, false, ['verify']);
-    }
-    async function parseJWT(token, validation) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        try {
-            const parts = token.split('.');
-            if (parts.length !== 3)
-                throw new Error('Invalid JWT');
-            // Decode header and payload
-            const header = JSON.parse(base64UrlDecode(parts[0]));
-            const payload = JSON.parse(base64UrlDecode(parts[1]));
-            // Get public key
-            const publicKey = await getPublicKey(header.kid);
-            // Verify signature
-            const signature = parts[2];
-            const encoder = new TextEncoder();
-            const data = encoder.encode(`${parts[0]}.${parts[1]}`);
-            const signatureBytes = Uint8Array.from(base64UrlDecode(signature), (c) => c.charCodeAt(0));
-            const algorithmParams = getAlgorithmParams(header.alg);
-            const isValid = await crypto.subtle.verify(algorithmParams, publicKey, signatureBytes, data);
-            if (!isValid)
-                throw new Error('Invalid JWT signature');
-            // Validate claims using StandardSchema
-            const validator = validation?.jwtAssertionClaims ?? jwtAssertionClaimsSchema('builtin');
-            const result = await validator['~standard'].validate(payload);
-            if ('issues' in result) {
-                console.error('JWT claims validation failed:', result.issues);
-                throw new Error(`JWT claims validation failed: ${result.issues?.map((i) => i.message).join('; ')}`);
-            }
-            return result.value;
-        }
-        catch (error) {
-            console.error('Error verifying JWT:', error);
-            throw error;
-        }
-    }
-    async function validateToken(token, validation) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        try {
-            const claims = await parseJWT(token, validation);
-            // Check expiration
-            const now = Math.floor(Date.now() / 1000);
-            if (claims.exp && claims.exp < now) {
-                return { valid: false, error: 'Token expired' };
-            }
-            // Validate based on mode using type guards
-            if (isJwtBearerConfig(configWithDefaults)) {
-                // JWT Bearer Grant validation
-                if (configWithDefaults.audience && claims.aud !== configWithDefaults.audience) {
-                    return { valid: false, error: 'Invalid audience' };
-                }
-            }
-            else if (isClientCredentialsConfig(configWithDefaults)) {
-                // OAuth2 Client Credentials validation
-                if (configWithDefaults.issuer && claims.iss !== configWithDefaults.issuer) {
-                    return { valid: false, error: 'Invalid issuer' };
-                }
-                if (configWithDefaults.audience && claims.aud !== configWithDefaults.audience) {
-                    return { valid: false, error: 'Invalid audience' };
-                }
-            }
-            else {
-                // Server-only mode - validate issuer if configured
-                const serverConfig = configWithDefaults;
-                if (serverConfig.issuer && claims.iss !== serverConfig.issuer) {
-                    return { valid: false, error: 'Invalid issuer' };
-                }
-            }
-            return {
-                valid: true,
-                claims,
-                expiresAt: claims.exp ? new Date(claims.exp * 1000) : undefined,
-            };
-        }
-        catch (error) {
-            return {
-                valid: false,
-                error: error instanceof Error ? error.message : String(error),
-            };
-        }
-    }
-    async function getWorkload(request) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        // Validate server role requirements
-        if (!configWithDefaults.jwks_uri) {
-            throw new Error('Cannot validate tokens: Missing jwks_uri in WorkloadConfig. ' +
-                'Server role requires jwks_uri to be configured in vault to fetch public keys for token validation.');
-        }
-        // Extract Bearer token from Authorization header
-        const authHeader = request.headers.get('Authorization');
-        if (!authHeader || !authHeader.startsWith('Bearer ')) {
-            return undefined;
-        }
-        const token = authHeader.substring(7);
-        const result = await validateToken(token, configWithDefaults.validation);
-        if (!result.valid || !result.claims) {
-            return undefined;
-        }
-        return {
-            workload_id: result.claims.sub, // Subject is the workload identity
-            client_id: typeof result.claims.client_id === 'string' ? result.claims.client_id : undefined, // May be present in OAuth2 tokens
-            scope: result.claims.scope,
-            claims: result.claims,
-        };
-    }
-    // ========== Framework-Agnostic Handler ==========
-    async function handler(request) {
-        if (!configWithDefaults) {
-            throw new Error('Enterprise Standard Workload Manager not initialized');
-        }
-        // Read handler URLs and validation directly from config (which is now part of the instance)
-        const tokenUrl = configWithDefaults.tokenUrl;
-        const validateUrl = configWithDefaults.validateUrl;
-        const jwksUrl = configWithDefaults.jwksUrl;
-        const refreshUrl = configWithDefaults.refreshUrl;
-        const validation = configWithDefaults.validation;
-        const path = new URL(request.url).pathname;
-        // GET /api/workload/token?scope=api:read
-        if (tokenUrl === path && request.method === 'GET') {
-            const url = new URL(request.url);
-            const scope = url.searchParams.get('scope') || undefined;
-            const token = await getToken(scope);
-            return new Response(JSON.stringify({ access_token: token, token_type: 'Bearer' }), {
-                headers: [['Content-Type', 'application/json']],
-            });
-        }
-        // POST /api/workload/validate with Authorization: Bearer <token>
-        if (validateUrl === path && request.method === 'POST') {
-            const authHeader = request.headers.get('Authorization');
-            if (!authHeader || !authHeader.startsWith('Bearer ')) {
-                return new Response(JSON.stringify({ valid: false, error: 'Missing Authorization header' }), {
-                    status: 401,
-                    headers: [['Content-Type', 'application/json']],
-                });
-            }
-            const token = authHeader.substring(7);
-            const result = await validateToken(token, validation);
-            return new Response(JSON.stringify(result), {
-                status: result.valid ? 200 : 401,
-                headers: [['Content-Type', 'application/json']],
-            });
-        }
-        // GET /api/workload/jwks
-        if (jwksUrl === path && request.method === 'GET') {
-            const jwks = await fetchJwks();
-            return new Response(JSON.stringify(jwks), {
-                headers: [['Content-Type', 'application/json']],
-            });
-        }
-        // POST /api/workload/refresh
-        if (refreshUrl === path && request.method === 'POST') {
-            const tokenResponse = await refreshToken();
-            return new Response(JSON.stringify(tokenResponse), {
-                headers: [['Content-Type', 'application/json']],
-            });
-        }
-        return new Response('Not Found', { status: 404 });
-    }
-    // ========== Return Interface ==========
-    return {
-        ...(configWithDefaults ?? {}),
-        getToken,
-        refreshToken,
-        generateJWTAssertion,
-        revokeToken,
-        validateToken,
-        getWorkload,
-        parseJWT,
-        handler,
-    };
-}