@harperfast/harper 5.2.13 → 5.3.0-beta.1

package/dist/security/authn/oidc/jwks.js

@@ -0,0 +1,261 @@
+"use strict";
+/**
+ * OIDC discovery and JWKS retrieval for trusted publishing (#2171).
+ *
+ * The issuer's signing keys are the root of trust for an exchanged token, and the endpoint that
+ * reaches them is unauthenticated — hence HTTPS only, bounded body, bounded time, and a rate limit
+ * on the refetch an unrecognized `kid` triggers, without which forged `kid`s become one outbound
+ * fetch per request.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearJwksCache = clearJwksCache;
+exports.normalizeIssuer = normalizeIssuer;
+exports.getSigningKey = getSigningKey;
+const node_crypto_1 = require("node:crypto");
+const logger_ts_1 = require("../../../utility/logging/logger.js");
+const hdbError_ts_1 = require("../../../utility/errors/hdbError.js");
+const logger = (0, logger_ts_1.loggerWithTag)('oidc-trust');
+const DISCOVERY_PATH = '/.well-known/openid-configuration';
+/** How long a fetched key set is served without revalidation. */
+const JWKS_CACHE_TTL_MS = 3_600_000;
+/** Floor between refetches triggered by an unrecognized `kid`. */
+const MIN_REFETCH_INTERVAL_MS = 60_000;
+/**
+ * How long a cached key set survives a failed refetch. Bounded, so a network blip does not break
+ * deploys but a pulled key does not stay honored forever.
+ */
+const STALE_KEY_GRACE_MS = 86_400_000;
+const FETCH_TIMEOUT_MS = 5_000;
+const MAX_RESPONSE_BYTES = 1_048_576;
+/** Asymmetric only: an `oct` key in a JWKS is the setup for algorithm confusion. */
+const SUPPORTED_KEY_TYPES = ['RSA', 'EC'];
+const issuerKeyCache = new Map();
+const inFlightLoads = new Map();
+/**
+ * When an unrecognized `kid` last drove a refetch, per issuer. Outside the cache entry on purpose:
+ * every successful fetch replaces that entry, and a rate limit that resets whenever it fires is not
+ * a rate limit. Separating them also lets a genuine key rotation be picked up on first use.
+ */
+const unknownKidRefetchAt = new Map();
+/**
+ * When a refresh for an issuer last FAILED, per issuer. Tracked separately from `fetchedAt`, which a
+ * failed fetch does not advance — so without this, every request wave arriving after the cache went
+ * stale starts discovery again and rides the same timeout before falling back to the same stale key.
+ * The exchange is unauthenticated and picks its issuer from an unverified JWT, and issuer key ids are
+ * public, so an anonymous caller could keep that cycle running for the length of an issuer outage:
+ * exactly when the stale-key grace is supposed to be absorbing load, not generating it.
+ */
+const failedRefreshAt = new Map();
+/** How long a failed refresh suppresses the next one, while a usable stale key is still on hand. */
+const FAILED_REFRESH_BACKOFF_MS = 30_000;
+/**
+ * Bumped by every clear. A fetch that was already in flight when the cache was cleared must not
+ * write its now-stale result back: clearing drops `inFlightLoads`, but the orphaned fetch still
+ * holds a reference and would repopulate the entry an operator just discarded — which for a clear
+ * issued precisely because the cached key is wrong means the re-read silently does nothing.
+ */
+let cacheGeneration = 0;
+/** Drops all cached key sets. Exported for tests and for an operator forcing a re-read. */
+function clearJwksCache() {
+    cacheGeneration++;
+    issuerKeyCache.clear();
+    inFlightLoads.clear();
+    unknownKidRefetchAt.clear();
+    failedRefreshAt.clear();
+}
+/**
+ * Canonicalizes an issuer URL. The result is both the cache key and the discovery base, so a policy
+ * stored with a trailing slash and one without must not become two entries for the same issuer.
+ */
+function normalizeIssuer(issuer) {
+    if (typeof issuer !== 'string' || issuer === '')
+        throw new hdbError_ts_1.ClientError('issuer is required');
+    let url;
+    try {
+        url = new URL(issuer);
+    }
+    catch {
+        throw new hdbError_ts_1.ClientError(`issuer is not a valid URL: ${issuer}`);
+    }
+    if (url.protocol !== 'https:')
+        throw new hdbError_ts_1.ClientError('issuer must be an https URL');
+    if (url.search !== '' || url.hash !== '')
+        throw new hdbError_ts_1.ClientError('issuer must not carry a query or fragment');
+    return url.origin + (url.pathname === '/' ? '' : url.pathname.replace(/\/$/, ''));
+}
+/**
+ * `content-length` is checked first as a cheap rejection, then the body is counted as it streams —
+ * the header is advisory, and a hostile endpoint can simply omit it.
+ */
+async function readBoundedJson(response, url) {
+    const declaredLength = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declaredLength) && declaredLength > MAX_RESPONSE_BYTES) {
+        throw new hdbError_ts_1.ServerError(`Response from ${url} exceeds ${MAX_RESPONSE_BYTES} bytes`);
+    }
+    const chunks = [];
+    let total = 0;
+    if (response.body) {
+        for await (const chunk of response.body) {
+            total += chunk.length;
+            if (total > MAX_RESPONSE_BYTES) {
+                throw new hdbError_ts_1.ServerError(`Response from ${url} exceeds ${MAX_RESPONSE_BYTES} bytes`);
+            }
+            chunks.push(Buffer.from(chunk));
+        }
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch (error) {
+        throw new hdbError_ts_1.ServerError(`Response from ${url} is not valid JSON: ${error.message}`);
+    }
+}
+async function fetchJson(url) {
+    let response;
+    try {
+        response = await fetch(url, {
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            headers: { accept: 'application/json' },
+            redirect: 'error',
+        });
+    }
+    catch (error) {
+        throw new hdbError_ts_1.ServerError(`Could not reach ${url}: ${error.message}`);
+    }
+    if (!response.ok)
+        throw new hdbError_ts_1.ServerError(`${url} responded ${response.status}`);
+    return readBoundedJson(response, url);
+}
+/**
+ * The discovery document's own `issuer` must equal the one we asked about — the spec requires it,
+ * and it stops a misdirected document from quietly re-pointing an issuer we trust.
+ */
+async function discoverJwksUri(issuer) {
+    const document = await fetchJson(issuer + DISCOVERY_PATH);
+    // Swallowed rather than propagated: normalizeIssuer raises ClientError, the wrong shape for a
+    // malformed *server* response.
+    let declaredIssuer;
+    try {
+        declaredIssuer = normalizeIssuer(document?.issuer);
+    }
+    catch {
+        declaredIssuer = undefined;
+    }
+    if (declaredIssuer !== issuer) {
+        throw new hdbError_ts_1.ServerError(`Discovery document at ${issuer} declares a different issuer`);
+    }
+    const jwksUri = document?.jwks_uri;
+    if (typeof jwksUri !== 'string' || !jwksUri.startsWith('https://')) {
+        throw new hdbError_ts_1.ServerError(`Discovery document at ${issuer} has no https jwks_uri`);
+    }
+    return jwksUri;
+}
+/**
+ * Undefined for a key we will not honor. One unusable entry must not poison the set: issuers publish
+ * keys for other purposes, and an unknown future type should degrade rather than fail the fetch.
+ */
+function toSigningKey(jwk) {
+    if (!jwk || typeof jwk !== 'object')
+        return undefined;
+    if (typeof jwk.kid !== 'string' || jwk.kid === '')
+        return undefined;
+    if (jwk.use !== undefined && jwk.use !== 'sig')
+        return undefined;
+    if (!SUPPORTED_KEY_TYPES.includes(jwk.kty))
+        return undefined;
+    try {
+        return (0, node_crypto_1.createPublicKey)({ key: jwk, format: 'jwk' });
+    }
+    catch (error) {
+        logger.warn?.(`Skipping unusable JWK ${jwk.kid}: ${error.message}`);
+        return undefined;
+    }
+}
+async function fetchIssuerKeys(issuer) {
+    // Sampled before the first await, so any clear during the fetch is detectable at the end.
+    const generation = cacheGeneration;
+    const jwksUri = await discoverJwksUri(issuer);
+    const jwks = await fetchJson(jwksUri);
+    if (!Array.isArray(jwks?.keys))
+        throw new hdbError_ts_1.ServerError(`JWKS at ${jwksUri} has no keys array`);
+    const keys = new Map();
+    for (const jwk of jwks.keys) {
+        const key = toSigningKey(jwk);
+        if (key)
+            keys.set(jwk.kid, key);
+    }
+    if (keys.size === 0)
+        throw new hdbError_ts_1.ServerError(`JWKS at ${jwksUri} contains no usable signing keys`);
+    const entry = { keys, fetchedAt: Date.now() };
+    // Still returned to the caller that asked for it — it is freshly fetched and valid — but only
+    // cached if no clear happened while this was in flight.
+    if (generation === cacheGeneration)
+        issuerKeyCache.set(issuer, entry);
+    logger.debug?.(`Loaded ${keys.size} signing key(s) for ${issuer}`);
+    return entry;
+}
+/** Loads an issuer's keys, collapsing concurrent callers onto one fetch. */
+function loadIssuerKeys(issuer) {
+    const existing = inFlightLoads.get(issuer);
+    if (existing)
+        return existing;
+    const load = fetchIssuerKeys(issuer).finally(() => inFlightLoads.delete(issuer));
+    inFlightLoads.set(issuer, load);
+    return load;
+}
+/** Resolves the public key an issuer used to sign a token, by `kid`. */
+/**
+ * `now` exists so the two time-based bounds below can be tested — the cache TTL and, more
+ * importantly, the STALE_KEY_GRACE_MS ceiling that stops a pulled key being honored forever through
+ * a prolonged outage. Reaching either otherwise needs a cache aged past an hour, and this repo bars
+ * new fake timers. Mirrors the `clockTimestamp` seam verifyIdentityToken already takes, rather than
+ * inventing a second convention. Callers in production pass nothing.
+ */
+async function getSigningKey(issuer, kid, now = Date.now()) {
+    if (typeof kid !== 'string' || kid === '')
+        throw new hdbError_ts_1.ClientError('Token has no key id', 401);
+    const normalizedIssuer = normalizeIssuer(issuer);
+    const cached = issuerKeyCache.get(normalizedIssuer);
+    if (cached && now - cached.fetchedAt < JWKS_CACHE_TTL_MS) {
+        const key = cached.keys.get(kid);
+        if (key)
+            return key;
+        // Unknown kid against a still-fresh set: refetch once, then hold the line for the window. The
+        // timestamp is recorded before the fetch so a failing issuer is rate-limited like a succeeding one.
+        if (now - (unknownKidRefetchAt.get(normalizedIssuer) ?? 0) < MIN_REFETCH_INTERVAL_MS) {
+            throw new hdbError_ts_1.ClientError('Token signing key is not recognized', 401);
+        }
+        unknownKidRefetchAt.set(normalizedIssuer, now);
+    }
+    // A usable stale key, if the cache is expired but still inside the grace window.
+    const staleKey = cached && now - cached.fetchedAt < STALE_KEY_GRACE_MS ? cached.keys.get(kid) : undefined;
+    // Skip the fetch entirely while a recent one is known to have failed. Not gated on having a stale
+    // key: the fetch is the expensive part, and the issuer we have NEVER cached is the worse case —
+    // there is nothing to fall back to, so without this every request rides the full discovery and
+    // timeout. Refusing for the backoff interval bounds what an anonymous caller can drive, at the
+    // cost of a legitimate first exchange waiting out that interval after a blip. Fails closed.
+    if (now - (failedRefreshAt.get(normalizedIssuer) ?? 0) < FAILED_REFRESH_BACKOFF_MS) {
+        if (staleKey)
+            return staleKey;
+        throw new hdbError_ts_1.ServerError(`Signing keys for ${normalizedIssuer} are temporarily unavailable; a recent refresh failed`);
+    }
+    let refreshed;
+    try {
+        refreshed = await loadIssuerKeys(normalizedIssuer);
+    }
+    catch (error) {
+        // Recorded whether or not a stale key rescues this request, so the backoff also covers the
+        // issuer whose keys we have never held.
+        failedRefreshAt.set(normalizedIssuer, now);
+        if (!staleKey)
+            throw error;
+        logger.warn?.(`Using cached signing key for ${normalizedIssuer}; refresh failed: ${error.message}`);
+        return staleKey;
+    }
+    failedRefreshAt.delete(normalizedIssuer);
+    const key = refreshed.keys.get(kid);
+    if (!key)
+        throw new hdbError_ts_1.ClientError('Token signing key is not recognized', 401);
+    return key;
+}
+//# sourceMappingURL=jwks.js.map

package/dist/security/authn/oidc/jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../../../security/authn/oidc/jwks.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AA2DH,wCAMC;AAMD,0CAWC;AA6HD,sCA6CC;AA1PD,6CAA8D;AAC9D,kEAAmE;AACnE,qEAA+E;AAE/E,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC;AAE3C,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAC3D,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,kEAAkE;AAClE,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC;;;GAGG;AACH,MAAM,kBAAkB,GAAG,UAAU,CAAC;AACtC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,oFAAoF;AACpF,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAO1C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;AACrD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA+B,CAAC;AAC7D;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;AAElD,oGAAoG;AACpG,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;;;;GAKG;AACH,IAAI,eAAe,GAAG,CAAC,CAAC;AAExB,2FAA2F;AAC3F,SAAgB,cAAc;IAC7B,eAAe,EAAE,CAAC;IAClB,cAAc,CAAC,KAAK,EAAE,CAAC;IACvB,aAAa,CAAC,KAAK,EAAE,CAAC;IACtB,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC5B,eAAe,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAAe;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,yBAAW,CAAC,oBAAoB,CAAC,CAAC;IAC7F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,yBAAW,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,yBAAW,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,yBAAW,CAAC,2CAA2C,CAAC,CAAC;IAC7G,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,GAAW;IAC7D,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,kBAAkB,EAAE,CAAC;QAC5E,MAAM,IAAI,yBAAW,CAAC,iBAAiB,GAAG,YAAY,kBAAkB,QAAQ,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,IAA4C,EAAE,CAAC;YACjF,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;gBAChC,MAAM,IAAI,yBAAW,CAAC,iBAAiB,GAAG,YAAY,kBAAkB,QAAQ,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAW,CAAC,iBAAiB,GAAG,uBAAwB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,CAAC;AACF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC7C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,QAAQ,EAAE,OAAO;SACjB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAW,CAAC,mBAAmB,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,yBAAW,CAAC,GAAG,GAAG,cAAc,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IAC1D,8FAA8F;IAC9F,+BAA+B;IAC/B,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACJ,cAAc,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACR,cAAc,GAAG,SAAS,CAAC;IAC5B,CAAC;IACD,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,yBAAW,CAAC,yBAAyB,MAAM,8BAA8B,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,yBAAW,CAAC,yBAAyB,MAAM,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAQ;IAC7B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC;QACJ,OAAO,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,EAAE,CAAC,yBAAyB,GAAG,CAAC,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc;IAC5C,0FAA0F;IAC1F,MAAM,UAAU,GAAG,eAAe,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,yBAAW,CAAC,WAAW,OAAO,oBAAoB,CAAC,CAAC;IAE9F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAW,CAAC,WAAW,OAAO,kCAAkC,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC1D,8FAA8F;IAC9F,wDAAwD;IACxD,IAAI,UAAU,KAAK,eAAe;QAAE,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,IAAI,CAAC,IAAI,uBAAuB,MAAM,EAAE,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,MAAc;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE;;;;;;GAMG;AACI,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,GAAY,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACzF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,yBAAW,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAEpD,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,8FAA8F;QAC9F,oGAAoG;QACpG,IAAI,GAAG,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,uBAAuB,EAAE,CAAC;YACtF,MAAM,IAAI,yBAAW,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,mBAAmB,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,iFAAiF;IACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1G,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,+FAA+F;IAC/F,4FAA4F;IAC5F,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACpF,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,yBAAW,CAAC,oBAAoB,gBAAgB,uDAAuD,CAAC,CAAC;IACpH,CAAC;IAED,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,2FAA2F;QAC3F,wCAAwC;QACxC,eAAe,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,CAAC,gCAAgC,gBAAgB,qBAAsB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEzC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,yBAAW,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/security/authn/oidc/providers/generic.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Fallback profile for issuers with no registered provider profile (#2171).
+ *
+ * Strict rather than permissive: the policy must pin `sub`. That is what makes workload identity work
+ * with zero provider code — a Kubernetes service-account token
+ * (`system:serviceaccount:<namespace>:<name>`), a GCP service account, and a SPIFFE SVID all carry a
+ * stable canonical subject, so pinning it identifies exactly one principal.
+ *
+ * GitHub Actions needs its own profile precisely because its `sub` is the one claim you should not
+ * pin: it varies by trigger, and its format changed for repositories created after 2026-07-15.
+ */
+import type { IdentityProviderProfile } from './index.ts';
+export declare const genericProfile: IdentityProviderProfile;

package/dist/security/authn/oidc/providers/generic.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Fallback profile for issuers with no registered provider profile (#2171).
+ *
+ * Strict rather than permissive: the policy must pin `sub`. That is what makes workload identity work
+ * with zero provider code — a Kubernetes service-account token
+ * (`system:serviceaccount:<namespace>:<name>`), a GCP service account, and a SPIFFE SVID all carry a
+ * stable canonical subject, so pinning it identifies exactly one principal.
+ *
+ * GitHub Actions needs its own profile precisely because its `sub` is the one claim you should not
+ * pin: it varies by trigger, and its format changed for repositories created after 2026-07-15.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.genericProfile = void 0;
+const hdbError_ts_1 = require("../../../../utility/errors/hdbError.js");
+exports.genericProfile = {
+    name: 'generic OIDC',
+    assertPolicyIsSpecific(policyClaims) {
+        if (policyClaims.sub === undefined) {
+            throw new hdbError_ts_1.ClientError('claims must pin `sub` for an issuer with no registered provider profile — it is the only ' +
+                'claim every OIDC issuer defines as identifying a single principal. Register a provider ' +
+                'profile if this issuer needs richer rules.');
+        }
+    },
+    // No known shared default audience; the required `sub` pin already binds the policy to one principal.
+    assertAudienceIsSpecific() { },
+    normalizeClaims(payload) {
+        return { ...payload };
+    },
+    describePrincipal(claims) {
+        return typeof claims.sub === 'string' ? claims.sub : 'unknown principal';
+    },
+};
+//# sourceMappingURL=generic.js.map

package/dist/security/authn/oidc/providers/generic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.js","sourceRoot":"","sources":["../../../../../security/authn/oidc/providers/generic.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,wEAAqE;AAIxD,QAAA,cAAc,GAA4B;IACtD,IAAI,EAAE,cAAc;IAEpB,sBAAsB,CAAC,YAA6C;QACnE,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAW,CACpB,2FAA2F;gBAC1F,yFAAyF;gBACzF,4CAA4C,CAC7C,CAAC;QACH,CAAC;IACF,CAAC;IAED,sGAAsG;IACtG,wBAAwB,KAAU,CAAC;IAEnC,eAAe,CAAC,OAAoB;QACnC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,iBAAiB,CAAC,MAAmB;QACpC,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC1E,CAAC;CACD,CAAC"}

package/dist/security/authn/oidc/providers/githubActions.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GitHub Actions provider profile (#2171).
+ *
+ * The only module that should know anything about GitHub. Its rules are deliberately stricter than
+ * npm's trusted-publishing model, and scoping them here means that strictness never constrains
+ * another issuer.
+ */
+import type { IdentityProviderProfile } from './index.ts';
+/** Returns undefined rather than guessing when the value is not a ref-qualified reference. */
+export declare function splitWorkflowPath(workflowRef: unknown): string | undefined;
+export declare const githubActionsProfile: IdentityProviderProfile;

package/dist/security/authn/oidc/providers/githubActions.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * GitHub Actions provider profile (#2171).
+ *
+ * The only module that should know anything about GitHub. Its rules are deliberately stricter than
+ * npm's trusted-publishing model, and scoping them here means that strictness never constrains
+ * another issuer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.githubActionsProfile = void 0;
+exports.splitWorkflowPath = splitWorkflowPath;
+const hdbError_ts_1 = require("../../../../utility/errors/hdbError.js");
+/**
+ * Workflow references are `<owner>/<repo>/<path>@<ref>` and the ref is always a full `refs/...` name.
+ * Splitting on `@refs/` rather than the first or last `@` is exact, because a path segment cannot
+ * contain `/` — so this cannot occur inside the path, and a branch named `release@2` cannot fool it.
+ */
+const REF_QUALIFIER = '@refs/';
+/**
+ * GitHub's default audience is the repository owner's URL, shared by every repository under that
+ * owner, so accepting it would make a token minted by any repo in the org valid here — the one
+ * mistake the audience field exists to prevent.
+ */
+const SHARED_DEFAULT_AUDIENCE = /^https:\/\/github\.com\/[^/]+\/?$/i;
+/**
+ * Structural requirements on a policy's claim set, each guarding a distinct way a policy can be
+ * accidentally broad. Satisfying none of a row's claims admits, in order: any repository, any
+ * workflow in that repository, any branch that can be pushed to it.
+ *
+ * `repository_owner` is absent from the first row on purpose — it identifies an org, not a
+ * repository, so it would admit every repo in the org. `ref_type` is absent from the third for the
+ * same shape of reason: `ref_type: tag` still admits any tag, and anyone with push access can create
+ * one. A tag-triggered release pins `environment` and leans on GitHub's environment protection.
+ *
+ * `job_workflow_ref` pins the workflow (second row) but deliberately does NOT gate the ref (third).
+ * For a reusable workflow it names the workflow that RAN, not the caller that invoked it — the
+ * caller's ref lives in `workflow_ref`/`ref`. Its `@ref` suffix therefore describes the reusable
+ * workflow's own branch, which is constant however it is called, so accepting it as a ref gate would
+ * admit any branch of any caller repository that references that reusable workflow: precisely the
+ * hole the third row exists to close.
+ *
+ * `sub` is deliberately not accepted as a pin: it varies by trigger, and its format changed for
+ * repositories created after 2026-07-15 (immutable subjects embed owner and repo ids).
+ */
+const STRUCTURAL_REQUIREMENTS = [
+    {
+        requirement: 'pin the repository',
+        claims: ['repository_id', 'repository'],
+        because: ' (repository_id is immutable and survives renames)',
+    },
+    {
+        requirement: 'pin the workflow',
+        claims: ['workflow_ref', 'workflow_path', 'job_workflow_ref', 'job_workflow_path'],
+        because: '',
+    },
+    {
+        requirement: 'gate the ref',
+        claims: ['workflow_ref', 'ref', 'environment'],
+        because: ' — otherwise any branch that can be pushed to the repository can run the workflow and mint a token',
+    },
+];
+/** Returns undefined rather than guessing when the value is not a ref-qualified reference. */
+function splitWorkflowPath(workflowRef) {
+    if (typeof workflowRef !== 'string')
+        return undefined;
+    const qualifierIndex = workflowRef.indexOf(REF_QUALIFIER);
+    return qualifierIndex === -1 ? undefined : workflowRef.slice(0, qualifierIndex);
+}
+exports.githubActionsProfile = {
+    name: 'GitHub Actions',
+    assertPolicyIsSpecific(policyClaims) {
+        const constrained = new Set(Object.keys(policyClaims));
+        for (const { requirement, claims, because } of STRUCTURAL_REQUIREMENTS) {
+            if (!claims.some((claimName) => constrained.has(claimName))) {
+                throw new hdbError_ts_1.ClientError(`claims must ${requirement} with one of: ${claims.join(', ')}${because}`);
+            }
+        }
+    },
+    assertAudienceIsSpecific(audience) {
+        if (SHARED_DEFAULT_AUDIENCE.test(audience)) {
+            throw new hdbError_ts_1.ClientError(`'audience' must identify this instance, not '${audience}' — GitHub's default audience is shared ` +
+                `by every repository under an owner, so a token minted for any of them would be accepted here. ` +
+                `Use the instance URL the CI client targets.`);
+        }
+    },
+    /**
+     * Adds `workflow_path` / `job_workflow_path` — the workflow reference with the ref removed — so a
+     * policy can pin the workflow *file* while gating the ref some other way. A tag-triggered release
+     * cannot pin `workflow_ref`, because the tag is unknown when the policy is written.
+     *
+     * A claim the token actually carries is never displaced by one we synthesized.
+     */
+    normalizeClaims(payload) {
+        const claims = { ...payload };
+        for (const [source, derived] of [
+            ['workflow_ref', 'workflow_path'],
+            ['job_workflow_ref', 'job_workflow_path'],
+        ]) {
+            const path = splitWorkflowPath(payload[source]);
+            if (path !== undefined && claims[derived] === undefined)
+                claims[derived] = path;
+        }
+        return claims;
+    },
+    /**
+     * A `pull_request_target` run executes the base repository's workflow with its secrets while a
+     * fork controls the checked-out code. A plain `pull_request` run from a fork gets no
+     * `id-token: write` and so cannot mint at all, but `pull_request_target` can — so it is denied
+     * unless a policy constrains `event_name`, which is the explicit opt-in.
+     */
+    vetoClaims(claims, policyClaims) {
+        if (claims.event_name === 'pull_request_target' && policyClaims.event_name === undefined) {
+            return 'pull_request_target is denied unless the policy constrains event_name';
+        }
+        return undefined;
+    },
+    describePrincipal(claims) {
+        return [
+            claims.repository,
+            claims.workflow_ref ?? claims.workflow_path,
+            claims.environment && `environment=${claims.environment}`,
+            claims.run_id && `run=${claims.run_id}`,
+            claims.actor && `actor=${claims.actor}`,
+        ]
+            .filter(Boolean)
+            .join(' ');
+    },
+};
+//# sourceMappingURL=githubActions.js.map

package/dist/security/authn/oidc/providers/githubActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubActions.js","sourceRoot":"","sources":["../../../../../security/authn/oidc/providers/githubActions.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AA2DH,8CAIC;AA7DD,wEAAqE;AAIrE;;;;GAIG;AACH,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,oCAAoC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,uBAAuB,GAAG;IAC/B;QACC,WAAW,EAAE,oBAAoB;QACjC,MAAM,EAAE,CAAC,eAAe,EAAE,YAAY,CAAC;QACvC,OAAO,EAAE,oDAAoD;KAC7D;IACD;QACC,WAAW,EAAE,kBAAkB;QAC/B,MAAM,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,CAAC;QAClF,OAAO,EAAE,EAAE;KACX;IACD;QACC,WAAW,EAAE,cAAc;QAC3B,MAAM,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,aAAa,CAAC;QAC9C,OAAO,EAAE,oGAAoG;KAC7G;CACD,CAAC;AAEF,8FAA8F;AAC9F,SAAgB,iBAAiB,CAAC,WAAoB;IACrD,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1D,OAAO,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AACjF,CAAC;AAEY,QAAA,oBAAoB,GAA4B;IAC5D,IAAI,EAAE,gBAAgB;IAEtB,sBAAsB,CAAC,YAA6C;QACnE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,uBAAuB,EAAE,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,yBAAW,CAAC,eAAe,WAAW,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC;YACjG,CAAC;QACF,CAAC;IACF,CAAC;IAED,wBAAwB,CAAC,QAAgB;QACxC,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,yBAAW,CACpB,gDAAgD,QAAQ,0CAA0C;gBACjG,gGAAgG;gBAChG,6CAA6C,CAC9C,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAoB;QACnC,MAAM,MAAM,GAAgB,EAAE,GAAG,OAAO,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI;YAC/B,CAAC,cAAc,EAAE,eAAe,CAAC;YACjC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;SACzC,EAAE,CAAC;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,MAAmB,EAAE,YAA6C;QAC5E,IAAI,MAAM,CAAC,UAAU,KAAK,qBAAqB,IAAI,YAAY,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1F,OAAO,uEAAuE,CAAC;QAChF,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,iBAAiB,CAAC,MAAmB;QACpC,OAAO;YACN,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,aAAa;YAC3C,MAAM,CAAC,WAAW,IAAI,eAAe,MAAM,CAAC,WAAW,EAAE;YACzD,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE;YACvC,MAAM,CAAC,KAAK,IAAI,SAAS,MAAM,CAAC,KAAK,EAAE;SACvC;aACC,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;CACD,CAAC"}

package/dist/security/authn/oidc/providers/index.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Provider profiles for OIDC trusted publishing (#2171).
+ *
+ * Everything issuer-specific lives behind this interface, resolved by normalized issuer, so the core
+ * stays generic: a new workload-identity issuer is a profile, not a change to verification, matching,
+ * or storage. Issuers with no registered profile fall back to `generic`, which is strict rather than
+ * permissive — see its `assertPolicyIsSpecific`.
+ */
+import type { ClaimConstraint, TokenClaims } from '../types.ts';
+import { genericProfile } from './generic.ts';
+import { githubActionsProfile } from './githubActions.ts';
+export interface IdentityProviderProfile {
+    /** Shown in policy-validation errors and the audit trail. */
+    name: string;
+    /**
+     * Rejects a claim set too broad to be a safe policy for this issuer. Called at write time, when
+     * the reader is an administrator who can act on the message.
+     */
+    assertPolicyIsSpecific(policyClaims: Record<string, ClaimConstraint>): void;
+    /**
+     * Rejects an audience the issuer shares across principals — the mistake that makes an audience
+     * check meaningless. A no-op for issuers with no such default.
+     */
+    assertAudienceIsSpecific(audience: string): void;
+    /** Adds issuer-specific derived claims. Must never displace a claim the token actually carries. */
+    normalizeClaims(payload: TokenClaims): TokenClaims;
+    /** One-line principal description for the audit trail. */
+    describePrincipal(claims: TokenClaims): string;
+    /**
+     * A match-time veto applied after the policy's own constraints pass, for runs this issuer should
+     * refuse unless a policy opts in explicitly. Returns a reason to deny, or undefined to allow.
+     */
+    vetoClaims?(claims: TokenClaims, policyClaims: Record<string, ClaimConstraint>): string | undefined;
+}
+/** Never returns undefined: an unregistered issuer gets the strict generic profile. */
+export declare function profileForIssuer(issuer: string): IdentityProviderProfile;
+export { genericProfile, githubActionsProfile };

package/dist/security/authn/oidc/providers/index.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * Provider profiles for OIDC trusted publishing (#2171).
+ *
+ * Everything issuer-specific lives behind this interface, resolved by normalized issuer, so the core
+ * stays generic: a new workload-identity issuer is a profile, not a change to verification, matching,
+ * or storage. Issuers with no registered profile fall back to `generic`, which is strict rather than
+ * permissive — see its `assertPolicyIsSpecific`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.githubActionsProfile = exports.genericProfile = void 0;
+exports.profileForIssuer = profileForIssuer;
+const generic_ts_1 = require("./generic.js");
+Object.defineProperty(exports, "genericProfile", { enumerable: true, get: function () { return generic_ts_1.genericProfile; } });
+const githubActions_ts_1 = require("./githubActions.js");
+Object.defineProperty(exports, "githubActionsProfile", { enumerable: true, get: function () { return githubActions_ts_1.githubActionsProfile; } });
+const PROFILES_BY_ISSUER = new Map([
+    ['https://token.actions.githubusercontent.com', githubActions_ts_1.githubActionsProfile],
+]);
+/** Never returns undefined: an unregistered issuer gets the strict generic profile. */
+function profileForIssuer(issuer) {
+    return PROFILES_BY_ISSUER.get(issuer) ?? generic_ts_1.genericProfile;
+}
+//# sourceMappingURL=index.js.map

package/dist/security/authn/oidc/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../security/authn/oidc/providers/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAwCH,4CAEC;AAvCD,6CAA8C;AAyCrC,+FAzCA,2BAAc,OAyCA;AAxCvB,yDAA0D;AAwCjC,qGAxChB,uCAAoB,OAwCgB;AAT7C,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAkC;IACnE,CAAC,6CAA6C,EAAE,uCAAoB,CAAC;CACrE,CAAC,CAAC;AAEH,uFAAuF;AACvF,SAAgB,gBAAgB,CAAC,MAAc;IAC9C,OAAO,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,2BAAc,CAAC;AACzD,CAAC"}

package/dist/security/authn/oidc/tokenExchange.d.ts

@@ -0,0 +1,12 @@
+/** Drops the memo below so a test can install a different table. Not used in production. */
+export declare function clearTokenUseTableCache(): void;
+/**
+ * Exchanges a CI identity token for a short-lived Harper operation token. Unauthenticated by design —
+ * this operation *is* the authentication, the way create_authentication_tokens is against a password.
+ */
+export declare function exchangeOidcToken(req: any): Promise<{
+    operation_token: string;
+    expires_in: number;
+    username: any;
+    policy: string;
+}>;