@fluixi/oauth2 1.0.0-alpha.1

package/dist/server.mjs

@@ -0,0 +1,441 @@
+/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+import "./chunk-25WE6UWI.mjs";
+
+// src/server.ts
+import { createSessionCookie } from "@fluixi/session/server";
+
+// src/return-to.ts
+function safeReturnTo(candidate, options = {}) {
+  const fallback = options.fallback ?? "/";
+  if (!candidate || typeof candidate !== "string") return fallback;
+  const value = candidate.trim();
+  if (!value) return fallback;
+  if (/[\u0000-\u001f\u007f]/.test(value)) return fallback;
+  if (/^[/\\]{2}/.test(value)) return fallback;
+  if (value.startsWith("/")) return value;
+  const here = options.origin ?? (typeof location === "undefined" ? void 0 : location.origin);
+  const allowed = [here, ...options.allowedOrigins ?? []].filter(Boolean);
+  if (!allowed.length) return fallback;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return fallback;
+  }
+  if (!allowed.includes(url.origin)) return fallback;
+  if (url.protocol !== "http:" && url.protocol !== "https:") return fallback;
+  return url.toString();
+}
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/client-auth.ts
+var CANONICAL = {
+  basic: "client_secret_basic",
+  body: "client_secret_post",
+  client_secret_basic: "client_secret_basic",
+  client_secret_post: "client_secret_post",
+  private_key_jwt: "private_key_jwt",
+  none: "none"
+};
+function resolveMethod(auth) {
+  if (auth.method) return CANONICAL[auth.method] ?? "client_secret_basic";
+  if (auth.privateKey) return "private_key_jwt";
+  return auth.clientSecret ? "client_secret_basic" : "none";
+}
+async function loadJose() {
+  try {
+    return await import("./browser-ONMHX3Z3.mjs");
+  } catch {
+    throw new OAuthError(
+      "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function signAssertion(auth, endpoint) {
+  const jose = await loadJose();
+  const alg = auth.assertionAlgorithm ?? "RS256";
+  const key = await jose.importJWK(auth.privateKey, alg);
+  const kid = auth.keyId ?? auth.privateKey.kid;
+  return new jose.SignJWT({}).setProtectedHeader(kid ? { alg, kid } : { alg }).setIssuer(auth.clientId).setSubject(auth.clientId).setAudience(endpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("1m").sign(key);
+}
+async function applyClientAuth(auth, endpoint, headers, form) {
+  switch (resolveMethod(auth)) {
+    case "client_secret_basic": {
+      const pair = `${encodeURIComponent(auth.clientId)}:${encodeURIComponent(auth.clientSecret)}`;
+      headers.authorization = `Basic ${btoa(pair)}`;
+      break;
+    }
+    case "client_secret_post":
+      form.set("client_id", auth.clientId);
+      form.set("client_secret", auth.clientSecret);
+      break;
+    case "private_key_jwt":
+      form.set("client_id", auth.clientId);
+      form.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+      form.set("client_assertion", await signAssertion(auth, endpoint));
+      break;
+    case "none":
+      form.set("client_id", auth.clientId);
+      break;
+  }
+}
+
+// src/discovery.ts
+var cache = /* @__PURE__ */ new Map();
+function documentUrl(issuer) {
+  return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+async function discover(issuer, fetcher = fetch) {
+  const cached = cache.get(issuer);
+  if (cached) return cached;
+  const pending = (async () => {
+    let response;
+    try {
+      response = await fetcher(documentUrl(issuer));
+    } catch (cause) {
+      throw new OAuthError(
+        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        "discovery_unreachable"
+      );
+    }
+    if (!response.ok) {
+      throw new OAuthError(
+        `Discovery failed for ${issuer}: ${response.status}`,
+        "discovery_failed"
+      );
+    }
+    const doc = await response.json();
+    if (!doc.authorization_endpoint || !doc.token_endpoint) {
+      throw new OAuthError(
+        `${issuer} published a discovery document with no authorization or token endpoint.`,
+        "discovery_incomplete"
+      );
+    }
+    return {
+      authorization: doc.authorization_endpoint,
+      token: doc.token_endpoint,
+      userinfo: doc.userinfo_endpoint,
+      endSession: doc.end_session_endpoint,
+      jwks: doc.jwks_uri,
+      introspection: doc.introspection_endpoint,
+      revocation: doc.revocation_endpoint,
+      issuer: doc.issuer ?? issuer
+    };
+  })();
+  cache.set(issuer, pending);
+  pending.catch(() => cache.delete(issuer));
+  return pending;
+}
+
+// src/pkce.ts
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  crypto.getRandomValues(bytes);
+  return bytes;
+}
+function createVerifier() {
+  return base64url(randomBytes(32));
+}
+function createStateValue() {
+  return base64url(randomBytes(16));
+}
+async function createChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url(new Uint8Array(digest));
+}
+async function createPkcePair() {
+  const verifier = createVerifier();
+  return { verifier, challenge: await createChallenge(verifier) };
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function expiryFrom(expiresIn, now = Date.now()) {
+  const seconds = typeof expiresIn === "number" ? expiresIn : Number(expiresIn);
+  return Number.isFinite(seconds) && seconds > 0 ? now + seconds * 1e3 : void 0;
+}
+
+// src/server.ts
+function oauthRoutes(config) {
+  const base = (config.basePath ?? "/auth").replace(/\/$/, "");
+  const scopes = config.scopes ?? ["openid", "profile", "email"];
+  const cookie = createSessionCookie({
+    secret: config.cookieSecret,
+    name: config.cookieName,
+    secure: config.secureCookie
+  });
+  let endpoints = config.endpoints ?? null;
+  const resolve = async () => {
+    if (endpoints) return endpoints;
+    if (!config.issuer) {
+      throw new OAuthError("Give oauthRoutes an issuer or endpoints.", "missing_issuer");
+    }
+    endpoints = await discover(config.issuer);
+    return endpoints;
+  };
+  const json = (body, status = 200, headers = {}) => new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", ...headers }
+  });
+  const clientAuth = {
+    clientId: config.clientId,
+    // `client_secret_post` by default here, which is what this half has always sent, so
+    // an existing deployment keeps working.
+    method: config.tokenAuthMethod ?? (config.clientSecret ? "body" : "none"),
+    clientSecret: config.clientSecret,
+    privateKey: config.privateKey,
+    keyId: config.keyId,
+    assertionAlgorithm: config.assertionAlgorithm
+  };
+  async function tokenRequest(body) {
+    const { token } = await resolve();
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded"
+    };
+    const form = new URLSearchParams(body);
+    await applyClientAuth(clientAuth, token, headers, form);
+    const response = await fetch(token, { method: "POST", headers, body: form.toString() });
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      throw new OAuthError(
+        String(payload.error ?? "token_request_failed"),
+        String(payload.error ?? "token_request_failed")
+      );
+    }
+    return payload;
+  }
+  return async function middleware(request, next) {
+    const url = new URL(request.url);
+    if (!url.pathname.startsWith(`${base}/`)) return next();
+    const route = url.pathname.slice(base.length);
+    const session = async () => {
+      return cookie.read(request);
+    };
+    if (route === "/login") {
+      const { authorization } = await resolve();
+      const { verifier, challenge } = await createPkcePair();
+      const state = createStateValue();
+      const target = new URL(authorization);
+      target.searchParams.set("response_type", "code");
+      target.searchParams.set("client_id", config.clientId);
+      target.searchParams.set("redirect_uri", config.redirectUri);
+      target.searchParams.set("scope", scopes.join(" "));
+      target.searchParams.set("state", state);
+      target.searchParams.set("code_challenge", challenge);
+      target.searchParams.set("code_challenge_method", "S256");
+      const pendingCookie = await cookie.write(
+        {
+          accessToken: "",
+          pending: {
+            verifier,
+            state,
+            // Checked here rather than only at the callback, so a refused destination
+            // never reaches the cookie and cannot be read back out of it later.
+            returnTo: safeReturnTo(url.searchParams.get("returnTo"), {
+              fallback: "",
+              origin: url.origin,
+              allowedOrigins: config.allowedReturnOrigins
+            }) || void 0
+          }
+        },
+        // Ten minutes: long enough to sign in, short enough that an abandoned attempt
+        // does not sit in the browser.
+        { maxAge: 600 }
+      );
+      return new Response(null, {
+        status: 302,
+        headers: {
+          location: target.toString(),
+          "set-cookie": pendingCookie
+        }
+      });
+    }
+    if (route === "/callback") {
+      const current = await session();
+      const pending = current?.pending;
+      const error = url.searchParams.get("error");
+      if (error) return json({ error }, 400);
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      if (!code) return json({ error: "no_code" }, 400);
+      if (!pending || !state || !timingSafeEqual(pending.state, state)) {
+        return json({ error: "state_mismatch" }, 400);
+      }
+      const payload = await tokenRequest({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: config.redirectUri,
+        code_verifier: pending.verifier
+      });
+      const signedIn = await cookie.write({
+        accessToken: String(payload.access_token ?? ""),
+        refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : void 0,
+        idToken: typeof payload.id_token === "string" ? payload.id_token : void 0,
+        expiresAt: expiryFrom(payload.expires_in)
+      });
+      return new Response(null, {
+        status: 302,
+        headers: {
+          // Checked again on the way out. The cookie cannot be forged, but a value that
+          // was acceptable when the flow started should still be one when it finishes,
+          // and this is the line that actually performs the redirect.
+          location: safeReturnTo(pending.returnTo ?? config.defaultReturnTo, {
+            fallback: "/",
+            origin: url.origin,
+            allowedOrigins: config.allowedReturnOrigins
+          }),
+          "set-cookie": signedIn
+        }
+      });
+    }
+    if (route === "/refresh") {
+      const current = await session();
+      if (!current?.refreshToken) return json({ error: "no_session" }, 401);
+      const payload = await tokenRequest({
+        grant_type: "refresh_token",
+        refresh_token: current.refreshToken
+      });
+      const refreshed = await cookie.write({
+        accessToken: String(payload.access_token ?? ""),
+        // A provider that rotates refresh tokens sends a new one; one that does not
+        // expects the old one to keep working.
+        refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : current.refreshToken,
+        idToken: current.idToken,
+        expiresAt: expiryFrom(payload.expires_in)
+      });
+      return json({ ok: true }, 200, { "set-cookie": refreshed });
+    }
+    if (route === "/me") {
+      const current = await session();
+      if (!current?.accessToken) return json({ error: "no_session" }, 401);
+      const { userinfo } = await resolve();
+      if (!userinfo) return json({ error: "no_userinfo" }, 501);
+      const response = await fetch(userinfo, {
+        headers: { authorization: `Bearer ${current.accessToken}` }
+      });
+      if (!response.ok) return json({ error: "userinfo_failed" }, response.status);
+      const claims = await response.json();
+      return json(config.mapUser ? config.mapUser(claims, current.accessToken) : claims);
+    }
+    if (route === "/revoke") {
+      const current = await session();
+      const hint = url.searchParams.get("hint") === "access_token" ? "access_token" : "refresh_token";
+      const target = hint === "access_token" ? current?.accessToken : current?.refreshToken;
+      if (!target) return json({ error: "no_session" }, 401);
+      const { revocation } = await resolve().catch(() => ({ revocation: void 0 }));
+      if (!revocation) return json({ error: "no_revocation_endpoint" }, 501);
+      const headers = {
+        "content-type": "application/x-www-form-urlencoded"
+      };
+      const form = new URLSearchParams({ token: target, token_type_hint: hint });
+      await applyClientAuth(clientAuth, revocation, headers, form);
+      await fetch(revocation, { method: "POST", headers, body: form.toString() }).catch(
+        () => void 0
+      );
+      return json({ ok: true, revoked: hint });
+    }
+    if (route === "/logout") {
+      const current = await session();
+      const { endSession } = await resolve().catch(() => ({ endSession: void 0 }));
+      const { revocation } = await resolve().catch(() => ({ revocation: void 0 }));
+      if (revocation && current?.refreshToken) {
+        const headers = {
+          "content-type": "application/x-www-form-urlencoded"
+        };
+        const form = new URLSearchParams({
+          token: current.refreshToken,
+          token_type_hint: "refresh_token"
+        });
+        await applyClientAuth(clientAuth, revocation, headers, form);
+        await fetch(revocation, { method: "POST", headers, body: form.toString() }).catch(
+          () => void 0
+        );
+      }
+      const cleared = cookie.clear();
+      if (endSession && current?.idToken) {
+        const target = new URL(endSession);
+        target.searchParams.set("id_token_hint", current.idToken);
+        if (config.defaultReturnTo) {
+          target.searchParams.set("post_logout_redirect_uri", config.defaultReturnTo);
+        }
+        return new Response(null, {
+          status: 302,
+          headers: { location: target.toString(), "set-cookie": cleared }
+        });
+      }
+      return json({ ok: true }, 200, { "set-cookie": cleared });
+    }
+    return next();
+  };
+}
+function sessionLocals(config) {
+  const cookie = createSessionCookie({
+    secret: config.cookieSecret,
+    name: config.cookieName,
+    secure: config.secureCookie
+  });
+  const ttl = config.userCacheMs ?? 3e4;
+  const cache2 = /* @__PURE__ */ new Map();
+  const remember = (token, user) => {
+    if (ttl <= 0) return;
+    if (cache2.size > 500) {
+      const now = Date.now();
+      for (const [key, entry] of cache2) if (entry.until <= now) cache2.delete(key);
+      if (cache2.size > 500) cache2.delete(cache2.keys().next().value);
+    }
+    cache2.set(token, { user, until: Date.now() + ttl });
+  };
+  return async function middleware(request, next) {
+    const { getRequestLocals } = await import("@fluixi/server");
+    const locals = getRequestLocals(request);
+    const session = await cookie.read(request);
+    if (!session?.accessToken) {
+      locals.auth = { user: null, session: null };
+      return next();
+    }
+    const cached = cache2.get(session.accessToken);
+    if (cached && cached.until > Date.now()) {
+      locals.auth = { user: cached.user, session: { expiresAt: session.expiresAt } };
+      return next();
+    }
+    let user = null;
+    try {
+      const endpoints = config.endpoints ?? (config.issuer ? await discover(config.issuer) : null);
+      if (endpoints?.userinfo) {
+        const response = await fetch(endpoints.userinfo, {
+          headers: { authorization: `Bearer ${session.accessToken}` }
+        });
+        if (response.ok) {
+          const claims = await response.json();
+          user = config.mapUser ? config.mapUser(claims, session.accessToken) : claims;
+          remember(session.accessToken, user);
+        }
+      }
+    } catch {
+    }
+    locals.auth = { user, session: user ? { expiresAt: session.expiresAt } : null };
+    return next();
+  };
+}
+export {
+  oauthRoutes,
+  sessionLocals
+};

package/dist/service-client.cjs

@@ -0,0 +1,244 @@
+/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/service-client.ts
+var service_client_exports = {};
+__export(service_client_exports, {
+  createServiceClient: () => createServiceClient
+});
+module.exports = __toCommonJS(service_client_exports);
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/client-auth.ts
+var CANONICAL = {
+  basic: "client_secret_basic",
+  body: "client_secret_post",
+  client_secret_basic: "client_secret_basic",
+  client_secret_post: "client_secret_post",
+  private_key_jwt: "private_key_jwt",
+  none: "none"
+};
+function resolveMethod(auth) {
+  if (auth.method) return CANONICAL[auth.method] ?? "client_secret_basic";
+  if (auth.privateKey) return "private_key_jwt";
+  return auth.clientSecret ? "client_secret_basic" : "none";
+}
+function assertUsable(auth, who) {
+  if (!auth.clientId) throw new Error(`[fluixi/oauth2] ${who} needs a clientId.`);
+  const method = resolveMethod(auth);
+  if (method === "private_key_jwt" && !auth.privateKey) {
+    throw new Error(
+      `[fluixi/oauth2] ${who}: private_key_jwt needs \`privateKey\`, the JWK whose public half the provider holds.`
+    );
+  }
+  if ((method === "client_secret_basic" || method === "client_secret_post") && !auth.clientSecret) {
+    throw new Error(
+      `[fluixi/oauth2] ${who}: ${method} needs a \`clientSecret\`. A public client should use \`method: 'none'\`, which PKCE is what protects.`
+    );
+  }
+  return method;
+}
+async function loadJose() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function signAssertion(auth, endpoint) {
+  const jose = await loadJose();
+  const alg = auth.assertionAlgorithm ?? "RS256";
+  const key = await jose.importJWK(auth.privateKey, alg);
+  const kid = auth.keyId ?? auth.privateKey.kid;
+  return new jose.SignJWT({}).setProtectedHeader(kid ? { alg, kid } : { alg }).setIssuer(auth.clientId).setSubject(auth.clientId).setAudience(endpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("1m").sign(key);
+}
+async function applyClientAuth(auth, endpoint, headers, form) {
+  switch (resolveMethod(auth)) {
+    case "client_secret_basic": {
+      const pair = `${encodeURIComponent(auth.clientId)}:${encodeURIComponent(auth.clientSecret)}`;
+      headers.authorization = `Basic ${btoa(pair)}`;
+      break;
+    }
+    case "client_secret_post":
+      form.set("client_id", auth.clientId);
+      form.set("client_secret", auth.clientSecret);
+      break;
+    case "private_key_jwt":
+      form.set("client_id", auth.clientId);
+      form.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+      form.set("client_assertion", await signAssertion(auth, endpoint));
+      break;
+    case "none":
+      form.set("client_id", auth.clientId);
+      break;
+  }
+}
+
+// src/discovery.ts
+var cache = /* @__PURE__ */ new Map();
+function documentUrl(issuer) {
+  return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+async function discover(issuer, fetcher = fetch) {
+  const cached = cache.get(issuer);
+  if (cached) return cached;
+  const pending = (async () => {
+    let response;
+    try {
+      response = await fetcher(documentUrl(issuer));
+    } catch (cause) {
+      throw new OAuthError(
+        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        "discovery_unreachable"
+      );
+    }
+    if (!response.ok) {
+      throw new OAuthError(
+        `Discovery failed for ${issuer}: ${response.status}`,
+        "discovery_failed"
+      );
+    }
+    const doc = await response.json();
+    if (!doc.authorization_endpoint || !doc.token_endpoint) {
+      throw new OAuthError(
+        `${issuer} published a discovery document with no authorization or token endpoint.`,
+        "discovery_incomplete"
+      );
+    }
+    return {
+      authorization: doc.authorization_endpoint,
+      token: doc.token_endpoint,
+      userinfo: doc.userinfo_endpoint,
+      endSession: doc.end_session_endpoint,
+      jwks: doc.jwks_uri,
+      introspection: doc.introspection_endpoint,
+      revocation: doc.revocation_endpoint,
+      issuer: doc.issuer ?? issuer
+    };
+  })();
+  cache.set(issuer, pending);
+  pending.catch(() => cache.delete(issuer));
+  return pending;
+}
+
+// src/pkce.ts
+function expiryFrom(expiresIn, now = Date.now()) {
+  const seconds = typeof expiresIn === "number" ? expiresIn : Number(expiresIn);
+  return Number.isFinite(seconds) && seconds > 0 ? now + seconds * 1e3 : void 0;
+}
+
+// src/service-client.ts
+function createServiceClient(options) {
+  const auth = {
+    clientId: options.clientId,
+    method: options.clientAuthMethod,
+    clientSecret: options.clientSecret,
+    privateKey: options.privateKey,
+    keyId: options.keyId,
+    assertionAlgorithm: options.assertionAlgorithm
+  };
+  if (resolveMethod(auth) === "none") {
+    throw new Error(
+      "[fluixi/oauth2] createServiceClient needs credentials: a clientSecret, or private_key_jwt with a key. This grant is the credential, so it belongs on a server and never in a browser."
+    );
+  }
+  assertUsable(auth, "createServiceClient");
+  if (!options.issuer && !options.tokenEndpoint) {
+    throw new Error("[fluixi/oauth2] createServiceClient needs an issuer or a tokenEndpoint.");
+  }
+  const skew = options.refreshSkewMs ?? 3e4;
+  let cached = null;
+  let pending = null;
+  let endpoint = options.tokenEndpoint ?? null;
+  async function resolveEndpoint() {
+    if (endpoint) return endpoint;
+    const endpoints = await discover(options.issuer);
+    endpoint = endpoints.token;
+    return endpoint;
+  }
+  const stillGood = () => cached !== null && (cached.expiresAt === void 0 || cached.expiresAt - skew > Date.now());
+  async function request() {
+    const url = await resolveEndpoint();
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    };
+    const form = new URLSearchParams({ grant_type: "client_credentials", ...options.extraParams });
+    if (options.scopes?.length) form.set("scope", options.scopes.join(" "));
+    if (options.audience) form.set("audience", options.audience);
+    await applyClientAuth(auth, url, headers, form);
+    const response = await fetch(url, { method: "POST", headers, body: form.toString() });
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      const reason = [payload.error, payload.error_description].filter(Boolean).join(": ");
+      throw new OAuthError(
+        `The token endpoint refused this service: ${reason || response.status}`,
+        String(payload.error ?? "client_credentials_failed"),
+        typeof payload.error_description === "string" ? payload.error_description : void 0
+      );
+    }
+    const accessToken = String(payload.access_token ?? "");
+    if (!accessToken) {
+      throw new OAuthError("The token response carried no access_token.", "no_access_token");
+    }
+    cached = {
+      accessToken,
+      expiresAt: expiryFrom(payload.expires_in),
+      scope: typeof payload.scope === "string" ? payload.scope : void 0
+    };
+    return cached;
+  }
+  async function current() {
+    if (stillGood()) return cached;
+    pending ??= request().finally(() => {
+      pending = null;
+    });
+    return pending;
+  }
+  return {
+    current,
+    token: async () => (await current()).accessToken,
+    reset: () => {
+      cached = null;
+    }
+  };
+}