@keycardai/oauth 0.18.0 → 0.20.0

package/dist/cjs/server/workloadIdentity.d.ts

@@ -0,0 +1,166 @@
+import type { ApplicationCredential } from "../credentials.js";
+import type { TokenExchangeRequest } from "../tokenExchange.js";
+/**
+ * Source identifiers carried on WorkloadIdentityConfigurationError and
+ * WorkloadIdentityRuntimeError, for branching on which token source failed.
+ */
+export declare const WORKLOAD_IDENTITY_SOURCE_FILE = "file";
+export declare const WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = "gcp-metadata";
+export declare const WORKLOAD_IDENTITY_SOURCE_FLY = "fly";
+export declare const WORKLOAD_IDENTITY_SOURCE_CUSTOM = "custom";
+/**
+ * A workload identity credential or token source was misconfigured at
+ * construction: a missing or empty token file, no discovery environment
+ * variable set, a missing required audience, or an invalid source.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly");
+ * undefined when the fault is in the credential itself. The underlying cause,
+ * when any, is on `cause`.
+ */
+export declare class WorkloadIdentityConfigurationError extends Error {
+    readonly source?: string;
+    readonly cause?: unknown;
+    constructor(message: string, options?: {
+        source?: string;
+        cause?: unknown;
+    });
+}
+/**
+ * The subject token could not be obtained at request time: the token file was
+ * rotated away or emptied after construction, or the platform endpoint was
+ * unreachable. Distinct from WorkloadIdentityConfigurationError, which is a
+ * construction-time fault.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly", or
+ * "custom" for a source whose error is not one of this module's typed
+ * errors). The underlying cause, when any, is on `cause`.
+ */
+export declare class WorkloadIdentityRuntimeError extends Error {
+    readonly source?: string;
+    readonly cause?: unknown;
+    constructor(message: string, options?: {
+        source?: string;
+        cause?: unknown;
+    });
+}
+/**
+ * Supplies a platform-signed OIDC token for use as a client assertion during
+ * token exchange. The only per-platform piece of a workload identity
+ * credential: {@link FileTokenSource} covers platforms that project the token
+ * to a file (EKS, AKS, Kubernetes projected service-account tokens),
+ * {@link GCPMetadataTokenSource} covers platforms that serve it from the GCP
+ * metadata endpoint (GKE, GCE, Cloud Run), {@link FlyTokenSource} covers Fly
+ * Machines, and any bare function returning the token is accepted as a source.
+ *
+ * `identityToken` is called on every token exchange. Implementations must
+ * return the current token; platforms rotate these tokens, so returning a
+ * stale cached value risks an expired assertion.
+ */
+export interface IdentityTokenSource {
+    identityToken(): Promise<string>;
+}
+/** A bare function accepted anywhere a IdentityTokenSource is. */
+export type IdentityTokenFetcher = () => Promise<string> | string;
+export declare const DEFAULT_FILE_TOKEN_ENV_VARS: string[];
+export interface FileTokenSourceOptions {
+    /** Explicit token file path, skipping env-var discovery. */
+    tokenFilePath?: string;
+    /** An environment variable to consult first during discovery. */
+    envVarName?: string;
+}
+/** @internal Shared by FileTokenSource and the deprecated EKSWorkloadIdentity. */
+export declare function resolveTokenFilePath(discoveryEnvVars: string[], options?: FileTokenSourceOptions): string;
+/**
+ * Reads a platform-projected OIDC token from a mounted file, fresh on every
+ * call (platforms rotate projected tokens). Covers EKS pod identity, AKS
+ * workload identity, any Kubernetes projected service-account token, and CI
+ * providers that write the token to a file.
+ *
+ * When no explicit path is given, the path is discovered from the first set
+ * environment variable: the variable named by `envVarName` when given, then
+ * KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE,
+ * AWS_WEB_IDENTITY_TOKEN_FILE, and AZURE_FEDERATED_TOKEN_FILE.
+ *
+ * **Requires Node.js.** Validates at construction that the resolved file
+ * exists and is non-empty.
+ */
+export declare class FileTokenSource implements IdentityTokenSource {
+    #private;
+    constructor(options?: FileTokenSourceOptions);
+    /** Re-reads the token file and returns its trimmed contents. */
+    identityToken(): Promise<string>;
+}
+export interface GCPMetadataTokenSourceOptions {
+    /** The token audience, typically the Keycard zone URL. Required. */
+    audience: string;
+    /** Metadata server base URL override (for testing). */
+    metadataUrl?: string;
+    /** Per-call deadline in milliseconds. */
+    timeoutMs?: number;
+}
+/**
+ * Fetches an OIDC identity token for the default service account from the
+ * GCP metadata server. Covers GKE, GCE, and Cloud Run.
+ */
+export declare class GCPMetadataTokenSource implements IdentityTokenSource {
+    #private;
+    constructor(options: GCPMetadataTokenSourceOptions);
+    /** Requests a GCP-signed OIDC JWT from the metadata server. */
+    identityToken(): Promise<string>;
+}
+export interface FlyTokenSourceOptions {
+    /** The token audience claim, typically the Keycard zone URL. */
+    audience?: string;
+    /** Machines API socket path override (default /.fly/api). */
+    socketPath?: string;
+}
+/**
+ * Fetches an OIDC token from the Fly.io Machines API over the local Unix
+ * socket. Covers workloads running on Fly Machines.
+ *
+ * **Requires Node.js** (Unix domain sockets). The socket is not probed at
+ * construction; an unreachable Machines API surfaces as a
+ * WorkloadIdentityRuntimeError at the first fetch.
+ */
+export declare class FlyTokenSource implements IdentityTokenSource {
+    #private;
+    constructor(options?: FlyTokenSourceOptions);
+    /** Requests a Fly-signed OIDC JWT from the Machines API. */
+    identityToken(): Promise<string>;
+}
+export interface WorkloadIdentityOptions {
+    /**
+     * ID of the Keycard application credential this workload authenticates as,
+     * sent as the `client_id` form parameter alongside the client assertion.
+     * Token-federation application credentials are resolved by this ID, so
+     * they require it; legacy token credentials are resolved by the
+     * assertion's subject and do not use it.
+     */
+    clientId?: string;
+}
+/**
+ * Workload identity credential using a platform-signed OIDC token obtained
+ * from a {@link IdentityTokenSource}. On every token exchange it fetches the
+ * current token from the source and attaches it as a jwt-bearer client
+ * assertion. It holds no shared secret and never caches the token across
+ * requests.
+ *
+ * @example
+ * // EKS / AKS / Kubernetes projected token (path discovered from env)
+ * const credential = new WorkloadIdentity(new FileTokenSource());
+ *
+ * // GKE / GCE / Cloud Run
+ * const credential = new WorkloadIdentity(
+ *   new GCPMetadataTokenSource({ audience: "https://zone.keycard.cloud" }),
+ * );
+ *
+ * // Custom fetch
+ * const credential = new WorkloadIdentity(() => fetchMyToken());
+ */
+export declare class WorkloadIdentity implements ApplicationCredential {
+    #private;
+    constructor(source: IdentityTokenSource | IdentityTokenFetcher, options?: WorkloadIdentityOptions);
+    getAuth(): null;
+    prepareTokenExchangeRequest(subjectToken: string, resource: string): Promise<TokenExchangeRequest>;
+}
+//# sourceMappingURL=workloadIdentity.d.ts.map

package/dist/cjs/server/workloadIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workloadIdentity.d.ts","sourceRoot":"","sources":["../../../src/server/workloadIdentity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,SAAS,CAAC;AACpD,eAAO,MAAM,qCAAqC,iBAAiB,CAAC;AACpE,eAAO,MAAM,4BAA4B,QAAQ,CAAC;AAClD,eAAO,MAAM,+BAA+B,WAAW,CAAC;AAExD;;;;;;;;GAQG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAM5E;AAED;;;;;;;;;GASG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAM5E;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AAElE,eAAO,MAAM,2BAA2B,UAKvC,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,MAAM,CAeR;AA0BD;;;;;;;;;;;;;GAaG;AACH,qBAAa,eAAgB,YAAW,mBAAmB;;gBAG7C,OAAO,CAAC,EAAE,sBAAsB;IAK5C,gEAAgE;IAC1D,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAGvC;AAED,MAAM,WAAW,6BAA6B;IAC5C,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;;gBAKpD,OAAO,EAAE,6BAA6B;IAWlD,+DAA+D;IACzD,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAkCvC;AAED,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;;;GAOG;AACH,qBAAa,cAAe,YAAW,mBAAmB;;gBAI5C,OAAO,CAAC,EAAE,qBAAqB;IAK3C,4DAA4D;IACtD,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAkEvC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,qBAAqB;;gBAK1D,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,EAClD,OAAO,CAAC,EAAE,uBAAuB;IAiBnC,OAAO,IAAI,IAAI;IAIT,2BAA2B,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;CAuCjC"}

package/dist/cjs/server/workloadIdentity.js

@@ -0,0 +1,355 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _FileTokenSource_tokenFilePath, _GCPMetadataTokenSource_audience, _GCPMetadataTokenSource_metadataUrl, _GCPMetadataTokenSource_timeoutMs, _FlyTokenSource_audience, _FlyTokenSource_socketPath, _WorkloadIdentity_instances, _WorkloadIdentity_source, _WorkloadIdentity_clientId, _WorkloadIdentity_fetchIdentityToken;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadIdentity = exports.FlyTokenSource = exports.GCPMetadataTokenSource = exports.FileTokenSource = exports.DEFAULT_FILE_TOKEN_ENV_VARS = exports.WorkloadIdentityRuntimeError = exports.WorkloadIdentityConfigurationError = exports.WORKLOAD_IDENTITY_SOURCE_CUSTOM = exports.WORKLOAD_IDENTITY_SOURCE_FLY = exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = exports.WORKLOAD_IDENTITY_SOURCE_FILE = void 0;
+exports.resolveTokenFilePath = resolveTokenFilePath;
+const fs = __importStar(require("node:fs"));
+/**
+ * Source identifiers carried on WorkloadIdentityConfigurationError and
+ * WorkloadIdentityRuntimeError, for branching on which token source failed.
+ */
+exports.WORKLOAD_IDENTITY_SOURCE_FILE = "file";
+exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = "gcp-metadata";
+exports.WORKLOAD_IDENTITY_SOURCE_FLY = "fly";
+exports.WORKLOAD_IDENTITY_SOURCE_CUSTOM = "custom";
+/**
+ * A workload identity credential or token source was misconfigured at
+ * construction: a missing or empty token file, no discovery environment
+ * variable set, a missing required audience, or an invalid source.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly");
+ * undefined when the fault is in the credential itself. The underlying cause,
+ * when any, is on `cause`.
+ */
+class WorkloadIdentityConfigurationError extends Error {
+    constructor(message, options) {
+        super(message);
+        this.name = "WorkloadIdentityConfigurationError";
+        this.source = options?.source;
+        this.cause = options?.cause;
+    }
+}
+exports.WorkloadIdentityConfigurationError = WorkloadIdentityConfigurationError;
+/**
+ * The subject token could not be obtained at request time: the token file was
+ * rotated away or emptied after construction, or the platform endpoint was
+ * unreachable. Distinct from WorkloadIdentityConfigurationError, which is a
+ * construction-time fault.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly", or
+ * "custom" for a source whose error is not one of this module's typed
+ * errors). The underlying cause, when any, is on `cause`.
+ */
+class WorkloadIdentityRuntimeError extends Error {
+    constructor(message, options) {
+        super(message);
+        this.name = "WorkloadIdentityRuntimeError";
+        this.source = options?.source;
+        this.cause = options?.cause;
+    }
+}
+exports.WorkloadIdentityRuntimeError = WorkloadIdentityRuntimeError;
+exports.DEFAULT_FILE_TOKEN_ENV_VARS = [
+    "KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE",
+    "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
+    "AWS_WEB_IDENTITY_TOKEN_FILE",
+    "AZURE_FEDERATED_TOKEN_FILE",
+];
+/** @internal Shared by FileTokenSource and the deprecated EKSWorkloadIdentity. */
+function resolveTokenFilePath(discoveryEnvVars, options) {
+    if (options?.tokenFilePath) {
+        return options.tokenFilePath;
+    }
+    const envNames = options?.envVarName
+        ? [options.envVarName, ...discoveryEnvVars]
+        : discoveryEnvVars;
+    const found = envNames.find((name) => process.env[name]);
+    if (!found || !process.env[found]) {
+        throw new WorkloadIdentityConfigurationError(`Could not find token file path in environment variables; checked: ${envNames.join(", ")}`, { source: exports.WORKLOAD_IDENTITY_SOURCE_FILE });
+    }
+    return process.env[found];
+}
+function readTokenFile(tokenFilePath, errorClass) {
+    let contents;
+    try {
+        contents = fs.readFileSync(tokenFilePath, "utf-8");
+    }
+    catch (error) {
+        throw new errorClass(`Error reading token file: ${tokenFilePath}`, {
+            source: exports.WORKLOAD_IDENTITY_SOURCE_FILE,
+            cause: error,
+        });
+    }
+    const token = contents.trim();
+    if (!token) {
+        throw new errorClass(`Token file is empty: ${tokenFilePath}`, {
+            source: exports.WORKLOAD_IDENTITY_SOURCE_FILE,
+        });
+    }
+    return token;
+}
+/**
+ * Reads a platform-projected OIDC token from a mounted file, fresh on every
+ * call (platforms rotate projected tokens). Covers EKS pod identity, AKS
+ * workload identity, any Kubernetes projected service-account token, and CI
+ * providers that write the token to a file.
+ *
+ * When no explicit path is given, the path is discovered from the first set
+ * environment variable: the variable named by `envVarName` when given, then
+ * KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE,
+ * AWS_WEB_IDENTITY_TOKEN_FILE, and AZURE_FEDERATED_TOKEN_FILE.
+ *
+ * **Requires Node.js.** Validates at construction that the resolved file
+ * exists and is non-empty.
+ */
+class FileTokenSource {
+    constructor(options) {
+        _FileTokenSource_tokenFilePath.set(this, void 0);
+        __classPrivateFieldSet(this, _FileTokenSource_tokenFilePath, resolveTokenFilePath(exports.DEFAULT_FILE_TOKEN_ENV_VARS, options), "f");
+        readTokenFile(__classPrivateFieldGet(this, _FileTokenSource_tokenFilePath, "f"), WorkloadIdentityConfigurationError);
+    }
+    /** Re-reads the token file and returns its trimmed contents. */
+    async identityToken() {
+        return readTokenFile(__classPrivateFieldGet(this, _FileTokenSource_tokenFilePath, "f"), WorkloadIdentityRuntimeError);
+    }
+}
+exports.FileTokenSource = FileTokenSource;
+_FileTokenSource_tokenFilePath = new WeakMap();
+const DEFAULT_GCP_METADATA_URL = "http://metadata.google.internal";
+const DEFAULT_GCP_TIMEOUT_MS = 5000;
+const GCP_IDENTITY_PATH = "/computeMetadata/v1/instance/service-accounts/default/identity";
+/**
+ * Fetches an OIDC identity token for the default service account from the
+ * GCP metadata server. Covers GKE, GCE, and Cloud Run.
+ */
+class GCPMetadataTokenSource {
+    constructor(options) {
+        _GCPMetadataTokenSource_audience.set(this, void 0);
+        _GCPMetadataTokenSource_metadataUrl.set(this, void 0);
+        _GCPMetadataTokenSource_timeoutMs.set(this, void 0);
+        if (!options.audience || !options.audience.trim()) {
+            throw new WorkloadIdentityConfigurationError("audience must not be empty", {
+                source: exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA,
+            });
+        }
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_audience, options.audience, "f");
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_metadataUrl, (options.metadataUrl ?? DEFAULT_GCP_METADATA_URL).replace(/\/$/, ""), "f");
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_timeoutMs, options.timeoutMs ?? DEFAULT_GCP_TIMEOUT_MS, "f");
+    }
+    /** Requests a GCP-signed OIDC JWT from the metadata server. */
+    async identityToken() {
+        const url = `${__classPrivateFieldGet(this, _GCPMetadataTokenSource_metadataUrl, "f")}${GCP_IDENTITY_PATH}` +
+            `?audience=${encodeURIComponent(__classPrivateFieldGet(this, _GCPMetadataTokenSource_audience, "f"))}&format=full`;
+        let response;
+        let body;
+        try {
+            response = await fetch(url, {
+                headers: { "Metadata-Flavor": "Google" },
+                signal: AbortSignal.timeout(__classPrivateFieldGet(this, _GCPMetadataTokenSource_timeoutMs, "f")),
+            });
+            body = await response.text();
+        }
+        catch (error) {
+            throw new WorkloadIdentityRuntimeError(`Error calling metadata server at ${__classPrivateFieldGet(this, _GCPMetadataTokenSource_metadataUrl, "f")} (is this running on GCP?)`, { source: exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA, cause: error });
+        }
+        if (!response.ok) {
+            throw new WorkloadIdentityRuntimeError(`Metadata server returned status ${response.status}`, { source: exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA });
+        }
+        const token = body.trim();
+        if (!token) {
+            throw new WorkloadIdentityRuntimeError("Metadata server returned an empty token", {
+                source: exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA,
+            });
+        }
+        return token;
+    }
+}
+exports.GCPMetadataTokenSource = GCPMetadataTokenSource;
+_GCPMetadataTokenSource_audience = new WeakMap(), _GCPMetadataTokenSource_metadataUrl = new WeakMap(), _GCPMetadataTokenSource_timeoutMs = new WeakMap();
+const DEFAULT_FLY_SOCKET_PATH = "/.fly/api";
+const FLY_TOKEN_PATH = "/v1/tokens/oidc";
+const FLY_TIMEOUT_MS = 5000;
+/**
+ * Fetches an OIDC token from the Fly.io Machines API over the local Unix
+ * socket. Covers workloads running on Fly Machines.
+ *
+ * **Requires Node.js** (Unix domain sockets). The socket is not probed at
+ * construction; an unreachable Machines API surfaces as a
+ * WorkloadIdentityRuntimeError at the first fetch.
+ */
+class FlyTokenSource {
+    constructor(options) {
+        _FlyTokenSource_audience.set(this, void 0);
+        _FlyTokenSource_socketPath.set(this, void 0);
+        __classPrivateFieldSet(this, _FlyTokenSource_audience, options?.audience, "f");
+        __classPrivateFieldSet(this, _FlyTokenSource_socketPath, options?.socketPath ?? DEFAULT_FLY_SOCKET_PATH, "f");
+    }
+    /** Requests a Fly-signed OIDC JWT from the Machines API. */
+    async identityToken() {
+        const http = await Promise.resolve().then(() => __importStar(require("node:http")));
+        const payload = JSON.stringify(__classPrivateFieldGet(this, _FlyTokenSource_audience, "f") ? { aud: __classPrivateFieldGet(this, _FlyTokenSource_audience, "f") } : {});
+        return new Promise((resolve, reject) => {
+            const request = http.request({
+                socketPath: __classPrivateFieldGet(this, _FlyTokenSource_socketPath, "f"),
+                path: FLY_TOKEN_PATH,
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "Content-Length": Buffer.byteLength(payload),
+                },
+                timeout: FLY_TIMEOUT_MS,
+            }, (response) => {
+                const chunks = [];
+                response.on("data", (chunk) => chunks.push(chunk));
+                response.on("end", () => {
+                    if (response.statusCode !== 200) {
+                        reject(new WorkloadIdentityRuntimeError(`Machines API returned status ${response.statusCode}`, { source: exports.WORKLOAD_IDENTITY_SOURCE_FLY }));
+                        return;
+                    }
+                    const token = Buffer.concat(chunks).toString("utf-8").trim();
+                    if (!token) {
+                        reject(new WorkloadIdentityRuntimeError("Machines API returned an empty token", {
+                            source: exports.WORKLOAD_IDENTITY_SOURCE_FLY,
+                        }));
+                        return;
+                    }
+                    resolve(token);
+                });
+            });
+            request.on("error", (error) => {
+                if (error instanceof WorkloadIdentityRuntimeError) {
+                    reject(error);
+                    return;
+                }
+                reject(new WorkloadIdentityRuntimeError(`Error calling Machines API socket ${__classPrivateFieldGet(this, _FlyTokenSource_socketPath, "f")} (is this running on a Fly Machine?)`, { source: exports.WORKLOAD_IDENTITY_SOURCE_FLY, cause: error }));
+            });
+            request.on("timeout", () => {
+                request.destroy(new WorkloadIdentityRuntimeError(`Machines API request timed out after ${FLY_TIMEOUT_MS}ms`, { source: exports.WORKLOAD_IDENTITY_SOURCE_FLY }));
+            });
+            request.write(payload);
+            request.end();
+        });
+    }
+}
+exports.FlyTokenSource = FlyTokenSource;
+_FlyTokenSource_audience = new WeakMap(), _FlyTokenSource_socketPath = new WeakMap();
+/**
+ * Workload identity credential using a platform-signed OIDC token obtained
+ * from a {@link IdentityTokenSource}. On every token exchange it fetches the
+ * current token from the source and attaches it as a jwt-bearer client
+ * assertion. It holds no shared secret and never caches the token across
+ * requests.
+ *
+ * @example
+ * // EKS / AKS / Kubernetes projected token (path discovered from env)
+ * const credential = new WorkloadIdentity(new FileTokenSource());
+ *
+ * // GKE / GCE / Cloud Run
+ * const credential = new WorkloadIdentity(
+ *   new GCPMetadataTokenSource({ audience: "https://zone.keycard.cloud" }),
+ * );
+ *
+ * // Custom fetch
+ * const credential = new WorkloadIdentity(() => fetchMyToken());
+ */
+class WorkloadIdentity {
+    constructor(source, options) {
+        _WorkloadIdentity_instances.add(this);
+        _WorkloadIdentity_source.set(this, void 0);
+        _WorkloadIdentity_clientId.set(this, void 0);
+        if (source == null) {
+            throw new WorkloadIdentityConfigurationError("identity token source must not be null");
+        }
+        if (typeof source !== "function" &&
+            typeof source.identityToken !== "function") {
+            throw new WorkloadIdentityConfigurationError("identity token source must provide identityToken() or be a function");
+        }
+        __classPrivateFieldSet(this, _WorkloadIdentity_source, source, "f");
+        __classPrivateFieldSet(this, _WorkloadIdentity_clientId, options?.clientId, "f");
+    }
+    getAuth() {
+        return null;
+    }
+    async prepareTokenExchangeRequest(subjectToken, resource) {
+        const assertion = await __classPrivateFieldGet(this, _WorkloadIdentity_instances, "m", _WorkloadIdentity_fetchIdentityToken).call(this);
+        return {
+            subjectToken,
+            resource,
+            subjectTokenType: "urn:ietf:params:oauth:token-type:access_token",
+            clientAssertionType: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+            clientAssertion: assertion,
+            clientId: __classPrivateFieldGet(this, _WorkloadIdentity_clientId, "f"),
+        };
+    }
+}
+exports.WorkloadIdentity = WorkloadIdentity;
+_WorkloadIdentity_source = new WeakMap(), _WorkloadIdentity_clientId = new WeakMap(), _WorkloadIdentity_instances = new WeakSet(), _WorkloadIdentity_fetchIdentityToken = async function _WorkloadIdentity_fetchIdentityToken() {
+    let token;
+    try {
+        token =
+            typeof __classPrivateFieldGet(this, _WorkloadIdentity_source, "f") === "function"
+                ? await __classPrivateFieldGet(this, _WorkloadIdentity_source, "f").call(this)
+                : await __classPrivateFieldGet(this, _WorkloadIdentity_source, "f").identityToken();
+    }
+    catch (error) {
+        if (error instanceof WorkloadIdentityConfigurationError ||
+            error instanceof WorkloadIdentityRuntimeError) {
+            throw error;
+        }
+        throw new WorkloadIdentityRuntimeError("Error fetching identity token", {
+            source: exports.WORKLOAD_IDENTITY_SOURCE_CUSTOM,
+            cause: error,
+        });
+    }
+    if (typeof token !== "string" || !token.trim()) {
+        throw new WorkloadIdentityRuntimeError("Identity token source returned an empty token", {
+            source: exports.WORKLOAD_IDENTITY_SOURCE_CUSTOM,
+        });
+    }
+    return token;
+};
+//# sourceMappingURL=workloadIdentity.js.map

package/dist/cjs/server/workloadIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workloadIdentity.js","sourceRoot":"","sources":["../../../src/server/workloadIdentity.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,oDAkBC;AA7GD,4CAA8B;AAI9B;;;GAGG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC;AACvC,QAAA,qCAAqC,GAAG,cAAc,CAAC;AACvD,QAAA,4BAA4B,GAAG,KAAK,CAAC;AACrC,QAAA,+BAA+B,GAAG,QAAQ,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAa,kCAAmC,SAAQ,KAAK;IAI3D,YAAY,OAAe,EAAE,OAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;CACF;AAVD,gFAUC;AAED;;;;;;;;;GASG;AACH,MAAa,4BAA6B,SAAQ,KAAK;IAIrD,YAAY,OAAe,EAAE,OAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;CACF;AAVD,oEAUC;AAsBY,QAAA,2BAA2B,GAAG;IACzC,0CAA0C;IAC1C,wCAAwC;IACxC,6BAA6B;IAC7B,4BAA4B;CAC7B,CAAC;AASF,kFAAkF;AAClF,SAAgB,oBAAoB,CAClC,gBAA0B,EAC1B,OAAgC;IAEhC,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU;QAClC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,gBAAgB,CAAC;QAC3C,CAAC,CAAC,gBAAgB,CAAC;IACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,kCAAkC,CAC1C,qEAAqE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1F,EAAE,MAAM,EAAE,qCAA6B,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAW,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CACpB,aAAqB,EACrB,UAEuC;IAEvC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAAC,6BAA6B,aAAa,EAAE,EAAE;YACjE,MAAM,EAAE,qCAA6B;YACrC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,wBAAwB,aAAa,EAAE,EAAE;YAC5D,MAAM,EAAE,qCAA6B;SACtC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAa,eAAe;IAG1B,YAAY,OAAgC;QAF5C,iDAAuB;QAGrB,uBAAA,IAAI,kCAAkB,oBAAoB,CAAC,mCAA2B,EAAE,OAAO,CAAC,MAAA,CAAC;QACjF,aAAa,CAAC,uBAAA,IAAI,sCAAe,EAAE,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,aAAa;QACjB,OAAO,aAAa,CAAC,uBAAA,IAAI,sCAAe,EAAE,4BAA4B,CAAC,CAAC;IAC1E,CAAC;CACF;AAZD,0CAYC;;AAWD,MAAM,wBAAwB,GAAG,iCAAiC,CAAC;AACnE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F;;;GAGG;AACH,MAAa,sBAAsB;IAKjC,YAAY,OAAsC;QAJlD,mDAAkB;QAClB,sDAAqB;QACrB,oDAAmB;QAGjB,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,kCAAkC,CAAC,4BAA4B,EAAE;gBACzE,MAAM,EAAE,6CAAqC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,uBAAA,IAAI,oCAAa,OAAO,CAAC,QAAQ,MAAA,CAAC;QAClC,uBAAA,IAAI,uCAAgB,CAAC,OAAO,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,MAAA,CAAC;QACzF,uBAAA,IAAI,qCAAc,OAAO,CAAC,SAAS,IAAI,sBAAsB,MAAA,CAAC;IAChE,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GACP,GAAG,uBAAA,IAAI,2CAAa,GAAG,iBAAiB,EAAE;YAC1C,aAAa,kBAAkB,CAAC,uBAAA,IAAI,wCAAU,CAAC,cAAc,CAAC;QAEhE,IAAI,QAAkB,CAAC;QACvB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC1B,OAAO,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE;gBACxC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAA,IAAI,yCAAW,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAA4B,CACpC,oCAAoC,uBAAA,IAAI,2CAAa,4BAA4B,EACjF,EAAE,MAAM,EAAE,6CAAqC,EAAE,KAAK,EAAE,KAAK,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,4BAA4B,CACpC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,EACpD,EAAE,MAAM,EAAE,6CAAqC,EAAE,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,4BAA4B,CAAC,yCAAyC,EAAE;gBAChF,MAAM,EAAE,6CAAqC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAnDD,wDAmDC;;AASD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;;;;;;GAOG;AACH,MAAa,cAAc;IAIzB,YAAY,OAA+B;QAH3C,2CAAmB;QACnB,6CAAoB;QAGlB,uBAAA,IAAI,4BAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,8BAAe,OAAO,EAAE,UAAU,IAAI,uBAAuB,MAAA,CAAC;IACpE,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,wDAAa,WAAW,GAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAA,IAAI,gCAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,uBAAA,IAAI,gCAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE9E,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAC1B;gBACE,UAAU,EAAE,uBAAA,IAAI,kCAAY;gBAC5B,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;iBAC7C;gBACD,OAAO,EAAE,cAAc;aACxB,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3D,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACtB,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;wBAChC,MAAM,CACJ,IAAI,4BAA4B,CAC9B,gCAAgC,QAAQ,CAAC,UAAU,EAAE,EACrD,EAAE,MAAM,EAAE,oCAA4B,EAAE,CACzC,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,CACJ,IAAI,4BAA4B,CAAC,sCAAsC,EAAE;4BACvE,MAAM,EAAE,oCAA4B;yBACrC,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;oBAClD,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,MAAM,CACJ,IAAI,4BAA4B,CAC9B,qCAAqC,uBAAA,IAAI,kCAAY,sCAAsC,EAC3F,EAAE,MAAM,EAAE,oCAA4B,EAAE,KAAK,EAAE,KAAK,EAAE,CACvD,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACzB,OAAO,CAAC,OAAO,CACb,IAAI,4BAA4B,CAC9B,wCAAwC,cAAc,IAAI,EAC1D,EAAE,MAAM,EAAE,oCAA4B,EAAE,CACzC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA5ED,wCA4EC;;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,gBAAgB;IAI3B,YACE,MAAkD,EAClD,OAAiC;;QALnC,2CAAoD;QACpD,6CAAmB;QAMjB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,kCAAkC,CAAC,wCAAwC,CAAC,CAAC;QACzF,CAAC;QACD,IACE,OAAO,MAAM,KAAK,UAAU;YAC5B,OAAQ,MAA8B,CAAC,aAAa,KAAK,UAAU,EACnE,CAAC;YACD,MAAM,IAAI,kCAAkC,CAC1C,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,8BAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;IACrC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,YAAoB,EACpB,QAAgB;QAEhB,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,yEAAoB,MAAxB,IAAI,CAAsB,CAAC;QAEnD,OAAO;YACL,YAAY;YACZ,QAAQ;YACR,gBAAgB,EAAE,+CAA+C;YACjE,mBAAmB,EAAE,wDAAwD;YAC7E,eAAe,EAAE,SAAS;YAC1B,QAAQ,EAAE,uBAAA,IAAI,kCAAU;SACzB,CAAC;IACJ,CAAC;CA4BF;AArED,4CAqEC;0KA1BC,KAAK;IACH,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK;YACH,OAAO,uBAAA,IAAI,gCAAQ,KAAK,UAAU;gBAChC,CAAC,CAAC,MAAM,uBAAA,IAAI,gCAAQ,MAAZ,IAAI,CAAU;gBACtB,CAAC,CAAC,MAAM,uBAAA,IAAI,gCAAQ,CAAC,aAAa,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,kCAAkC;YACnD,KAAK,YAAY,4BAA4B,EAC7C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,4BAA4B,CAAC,+BAA+B,EAAE;YACtE,MAAM,EAAE,uCAA+B;YACvC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,4BAA4B,CAAC,+CAA+C,EAAE;YACtF,MAAM,EAAE,uCAA+B;SACxC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cjs/tokenExchange.d.ts

@@ -20,6 +20,12 @@ export interface TokenExchangeRequest {
     actorTokenType?: string;
     clientAssertion?: string;
     clientAssertionType?: string;
+    /**
+     * Names the application credential the client authenticates as, sent as
+     * the client_id form parameter. Used with assertion-based credentials that
+     * are resolved by ID rather than by the assertion's subject.
+     */
+    clientId?: string;
 }
 export interface TokenResponse {
     accessToken: string;
@@ -37,18 +43,20 @@ export interface TokenExchangeClientOptions {
     /**
      * Application credential provider. When set, takes precedence over
      * static `clientId`/`clientSecret` and resolves the per-request
-     * Authorization header from the credential's `getAuth(zoneId)`.
+     * Authorization header from the credential's `getAuth(issuer)`.
      */
     credential?: ApplicationCredential;
 }
 export interface ExchangeOptions {
-    zoneId?: string;
+    /** Zone issuer URL used to select per-zone credentials. */
+    issuer?: string;
 }
 export interface ImpersonateRequest {
     userIdentifier: string;
     resource: string;
     scope?: string;
-    zoneId?: string;
+    /** Zone issuer URL used to select per-zone credentials. */
+    issuer?: string;
 }
 export declare function deserializeTokenResponse(json: Record<string, unknown>): TokenResponse;
 export declare class TokenExchangeClient {

package/dist/cjs/tokenExchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAO9D,eAAO,MAAM,SAAS;;IAEpB;;;OAGG;;CAEK,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAyBD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,CAqBrF;AAMD,qBAAa,mBAAmB;;gBAQlB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAO1D,aAAa,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC;IA8CnB,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+BlE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAuB1C"}
+{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAO9D,eAAO,MAAM,SAAS;;IAEpB;;;OAGG;;CAEK,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA0BD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,CAqBrF;AAMD,qBAAa,mBAAmB;;gBAQlB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAO1D,aAAa,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC;IA+CnB,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+BlE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAuB1C"}

package/dist/cjs/tokenExchange.js

@@ -52,12 +52,14 @@ function serializeRequest(request) {
         params.set("client_assertion", request.clientAssertion);
     if (request.clientAssertionType)
         params.set("client_assertion_type", request.clientAssertionType);
+    if (request.clientId)
+        params.set("client_id", request.clientId);
     return params;
 }
 function deserializeTokenResponse(json) {
     const accessToken = json.access_token;
     if (typeof accessToken !== "string" || !accessToken) {
-        throw new Error("Token exchange response missing access_token");
+        throw new errors_js_1.OAuthError("invalid_response", "Token response missing access_token");
     }
     const response = {
         accessToken,
@@ -100,7 +102,7 @@ class TokenExchangeClient {
         const headers = {
             "Content-Type": "application/x-www-form-urlencoded",
         };
-        const basicAuth = __classPrivateFieldGet(this, _TokenExchangeClient_instances, "m", _TokenExchangeClient_resolveBasicAuth).call(this, options?.zoneId);
+        const basicAuth = __classPrivateFieldGet(this, _TokenExchangeClient_instances, "m", _TokenExchangeClient_resolveBasicAuth).call(this, options?.issuer);
         if (basicAuth) {
             const credentials = btoa(`${basicAuth.clientId}:${basicAuth.clientSecret}`);
             headers["Authorization"] = `Basic ${credentials}`;
@@ -129,7 +131,7 @@ class TokenExchangeClient {
                     throw e;
                 // non-JSON or no "error" key — fall through
             }
-            throw new Error(`Token exchange failed (HTTP ${response.status})`);
+            throw new errors_js_1.OAuthError("invalid_response", `Token exchange failed (HTTP ${response.status})`);
         }
         const json = await response.json();
         return deserializeTokenResponse(json);
@@ -147,7 +149,7 @@ class TokenExchangeClient {
             subjectTokenType: exports.TokenType.SUBSTITUTE_USER,
             resource: req.resource,
             scope: req.scope,
-        }, { zoneId: req.zoneId });
+        }, { issuer: req.issuer });
     }
     /**
      * Resolve the authorization server's token endpoint (discovered from metadata
@@ -159,9 +161,9 @@ class TokenExchangeClient {
     }
 }
 exports.TokenExchangeClient = TokenExchangeClient;
-_TokenExchangeClient_issuer = new WeakMap(), _TokenExchangeClient_clientId = new WeakMap(), _TokenExchangeClient_clientSecret = new WeakMap(), _TokenExchangeClient_credential = new WeakMap(), _TokenExchangeClient_tokenEndpoint = new WeakMap(), _TokenExchangeClient_discoveryPromise = new WeakMap(), _TokenExchangeClient_instances = new WeakSet(), _TokenExchangeClient_resolveBasicAuth = function _TokenExchangeClient_resolveBasicAuth(zoneId) {
+_TokenExchangeClient_issuer = new WeakMap(), _TokenExchangeClient_clientId = new WeakMap(), _TokenExchangeClient_clientSecret = new WeakMap(), _TokenExchangeClient_credential = new WeakMap(), _TokenExchangeClient_tokenEndpoint = new WeakMap(), _TokenExchangeClient_discoveryPromise = new WeakMap(), _TokenExchangeClient_instances = new WeakSet(), _TokenExchangeClient_resolveBasicAuth = function _TokenExchangeClient_resolveBasicAuth(issuer) {
     if (__classPrivateFieldGet(this, _TokenExchangeClient_credential, "f")) {
-        return __classPrivateFieldGet(this, _TokenExchangeClient_credential, "f").getAuth(zoneId);
+        return __classPrivateFieldGet(this, _TokenExchangeClient_credential, "f").getAuth(issuer);
     }
     if (__classPrivateFieldGet(this, _TokenExchangeClient_clientId, "f") && __classPrivateFieldGet(this, _TokenExchangeClient_clientSecret, "f")) {
         return { clientId: __classPrivateFieldGet(this, _TokenExchangeClient_clientId, "f"), clientSecret: __classPrivateFieldGet(this, _TokenExchangeClient_clientSecret, "f") };