@keycardai/oauth 0.18.0 → 0.20.0

package/dist/esm/server/workloadIdentity.d.ts

@@ -0,0 +1,166 @@
+import type { ApplicationCredential } from "../credentials.js";
+import type { TokenExchangeRequest } from "../tokenExchange.js";
+/**
+ * Source identifiers carried on WorkloadIdentityConfigurationError and
+ * WorkloadIdentityRuntimeError, for branching on which token source failed.
+ */
+export declare const WORKLOAD_IDENTITY_SOURCE_FILE = "file";
+export declare const WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = "gcp-metadata";
+export declare const WORKLOAD_IDENTITY_SOURCE_FLY = "fly";
+export declare const WORKLOAD_IDENTITY_SOURCE_CUSTOM = "custom";
+/**
+ * A workload identity credential or token source was misconfigured at
+ * construction: a missing or empty token file, no discovery environment
+ * variable set, a missing required audience, or an invalid source.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly");
+ * undefined when the fault is in the credential itself. The underlying cause,
+ * when any, is on `cause`.
+ */
+export declare class WorkloadIdentityConfigurationError extends Error {
+    readonly source?: string;
+    readonly cause?: unknown;
+    constructor(message: string, options?: {
+        source?: string;
+        cause?: unknown;
+    });
+}
+/**
+ * The subject token could not be obtained at request time: the token file was
+ * rotated away or emptied after construction, or the platform endpoint was
+ * unreachable. Distinct from WorkloadIdentityConfigurationError, which is a
+ * construction-time fault.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly", or
+ * "custom" for a source whose error is not one of this module's typed
+ * errors). The underlying cause, when any, is on `cause`.
+ */
+export declare class WorkloadIdentityRuntimeError extends Error {
+    readonly source?: string;
+    readonly cause?: unknown;
+    constructor(message: string, options?: {
+        source?: string;
+        cause?: unknown;
+    });
+}
+/**
+ * Supplies a platform-signed OIDC token for use as a client assertion during
+ * token exchange. The only per-platform piece of a workload identity
+ * credential: {@link FileTokenSource} covers platforms that project the token
+ * to a file (EKS, AKS, Kubernetes projected service-account tokens),
+ * {@link GCPMetadataTokenSource} covers platforms that serve it from the GCP
+ * metadata endpoint (GKE, GCE, Cloud Run), {@link FlyTokenSource} covers Fly
+ * Machines, and any bare function returning the token is accepted as a source.
+ *
+ * `identityToken` is called on every token exchange. Implementations must
+ * return the current token; platforms rotate these tokens, so returning a
+ * stale cached value risks an expired assertion.
+ */
+export interface IdentityTokenSource {
+    identityToken(): Promise<string>;
+}
+/** A bare function accepted anywhere a IdentityTokenSource is. */
+export type IdentityTokenFetcher = () => Promise<string> | string;
+export declare const DEFAULT_FILE_TOKEN_ENV_VARS: string[];
+export interface FileTokenSourceOptions {
+    /** Explicit token file path, skipping env-var discovery. */
+    tokenFilePath?: string;
+    /** An environment variable to consult first during discovery. */
+    envVarName?: string;
+}
+/** @internal Shared by FileTokenSource and the deprecated EKSWorkloadIdentity. */
+export declare function resolveTokenFilePath(discoveryEnvVars: string[], options?: FileTokenSourceOptions): string;
+/**
+ * Reads a platform-projected OIDC token from a mounted file, fresh on every
+ * call (platforms rotate projected tokens). Covers EKS pod identity, AKS
+ * workload identity, any Kubernetes projected service-account token, and CI
+ * providers that write the token to a file.
+ *
+ * When no explicit path is given, the path is discovered from the first set
+ * environment variable: the variable named by `envVarName` when given, then
+ * KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE,
+ * AWS_WEB_IDENTITY_TOKEN_FILE, and AZURE_FEDERATED_TOKEN_FILE.
+ *
+ * **Requires Node.js.** Validates at construction that the resolved file
+ * exists and is non-empty.
+ */
+export declare class FileTokenSource implements IdentityTokenSource {
+    #private;
+    constructor(options?: FileTokenSourceOptions);
+    /** Re-reads the token file and returns its trimmed contents. */
+    identityToken(): Promise<string>;
+}
+export interface GCPMetadataTokenSourceOptions {
+    /** The token audience, typically the Keycard zone URL. Required. */
+    audience: string;
+    /** Metadata server base URL override (for testing). */
+    metadataUrl?: string;
+    /** Per-call deadline in milliseconds. */
+    timeoutMs?: number;
+}
+/**
+ * Fetches an OIDC identity token for the default service account from the
+ * GCP metadata server. Covers GKE, GCE, and Cloud Run.
+ */
+export declare class GCPMetadataTokenSource implements IdentityTokenSource {
+    #private;
+    constructor(options: GCPMetadataTokenSourceOptions);
+    /** Requests a GCP-signed OIDC JWT from the metadata server. */
+    identityToken(): Promise<string>;
+}
+export interface FlyTokenSourceOptions {
+    /** The token audience claim, typically the Keycard zone URL. */
+    audience?: string;
+    /** Machines API socket path override (default /.fly/api). */
+    socketPath?: string;
+}
+/**
+ * Fetches an OIDC token from the Fly.io Machines API over the local Unix
+ * socket. Covers workloads running on Fly Machines.
+ *
+ * **Requires Node.js** (Unix domain sockets). The socket is not probed at
+ * construction; an unreachable Machines API surfaces as a
+ * WorkloadIdentityRuntimeError at the first fetch.
+ */
+export declare class FlyTokenSource implements IdentityTokenSource {
+    #private;
+    constructor(options?: FlyTokenSourceOptions);
+    /** Requests a Fly-signed OIDC JWT from the Machines API. */
+    identityToken(): Promise<string>;
+}
+export interface WorkloadIdentityOptions {
+    /**
+     * ID of the Keycard application credential this workload authenticates as,
+     * sent as the `client_id` form parameter alongside the client assertion.
+     * Token-federation application credentials are resolved by this ID, so
+     * they require it; legacy token credentials are resolved by the
+     * assertion's subject and do not use it.
+     */
+    clientId?: string;
+}
+/**
+ * Workload identity credential using a platform-signed OIDC token obtained
+ * from a {@link IdentityTokenSource}. On every token exchange it fetches the
+ * current token from the source and attaches it as a jwt-bearer client
+ * assertion. It holds no shared secret and never caches the token across
+ * requests.
+ *
+ * @example
+ * // EKS / AKS / Kubernetes projected token (path discovered from env)
+ * const credential = new WorkloadIdentity(new FileTokenSource());
+ *
+ * // GKE / GCE / Cloud Run
+ * const credential = new WorkloadIdentity(
+ *   new GCPMetadataTokenSource({ audience: "https://zone.keycard.cloud" }),
+ * );
+ *
+ * // Custom fetch
+ * const credential = new WorkloadIdentity(() => fetchMyToken());
+ */
+export declare class WorkloadIdentity implements ApplicationCredential {
+    #private;
+    constructor(source: IdentityTokenSource | IdentityTokenFetcher, options?: WorkloadIdentityOptions);
+    getAuth(): null;
+    prepareTokenExchangeRequest(subjectToken: string, resource: string): Promise<TokenExchangeRequest>;
+}
+//# sourceMappingURL=workloadIdentity.d.ts.map

package/dist/esm/server/workloadIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workloadIdentity.d.ts","sourceRoot":"","sources":["../../../src/server/workloadIdentity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,SAAS,CAAC;AACpD,eAAO,MAAM,qCAAqC,iBAAiB,CAAC;AACpE,eAAO,MAAM,4BAA4B,QAAQ,CAAC;AAClD,eAAO,MAAM,+BAA+B,WAAW,CAAC;AAExD;;;;;;;;GAQG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAM5E;AAED;;;;;;;;;GASG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAM5E;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AAElE,eAAO,MAAM,2BAA2B,UAKvC,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,MAAM,CAeR;AA0BD;;;;;;;;;;;;;GAaG;AACH,qBAAa,eAAgB,YAAW,mBAAmB;;gBAG7C,OAAO,CAAC,EAAE,sBAAsB;IAK5C,gEAAgE;IAC1D,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAGvC;AAED,MAAM,WAAW,6BAA6B;IAC5C,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;;gBAKpD,OAAO,EAAE,6BAA6B;IAWlD,+DAA+D;IACzD,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAkCvC;AAED,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;;;GAOG;AACH,qBAAa,cAAe,YAAW,mBAAmB;;gBAI5C,OAAO,CAAC,EAAE,qBAAqB;IAK3C,4DAA4D;IACtD,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAkEvC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,qBAAqB;;gBAK1D,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,EAClD,OAAO,CAAC,EAAE,uBAAuB;IAiBnC,OAAO,IAAI,IAAI;IAIT,2BAA2B,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;CAuCjC"}

package/dist/esm/server/workloadIdentity.js

@@ -0,0 +1,312 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _FileTokenSource_tokenFilePath, _GCPMetadataTokenSource_audience, _GCPMetadataTokenSource_metadataUrl, _GCPMetadataTokenSource_timeoutMs, _FlyTokenSource_audience, _FlyTokenSource_socketPath, _WorkloadIdentity_instances, _WorkloadIdentity_source, _WorkloadIdentity_clientId, _WorkloadIdentity_fetchIdentityToken;
+import * as fs from "node:fs";
+/**
+ * Source identifiers carried on WorkloadIdentityConfigurationError and
+ * WorkloadIdentityRuntimeError, for branching on which token source failed.
+ */
+export const WORKLOAD_IDENTITY_SOURCE_FILE = "file";
+export const WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = "gcp-metadata";
+export const WORKLOAD_IDENTITY_SOURCE_FLY = "fly";
+export const WORKLOAD_IDENTITY_SOURCE_CUSTOM = "custom";
+/**
+ * A workload identity credential or token source was misconfigured at
+ * construction: a missing or empty token file, no discovery environment
+ * variable set, a missing required audience, or an invalid source.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly");
+ * undefined when the fault is in the credential itself. The underlying cause,
+ * when any, is on `cause`.
+ */
+export class WorkloadIdentityConfigurationError extends Error {
+    constructor(message, options) {
+        super(message);
+        this.name = "WorkloadIdentityConfigurationError";
+        this.source = options?.source;
+        this.cause = options?.cause;
+    }
+}
+/**
+ * The subject token could not be obtained at request time: the token file was
+ * rotated away or emptied after construction, or the platform endpoint was
+ * unreachable. Distinct from WorkloadIdentityConfigurationError, which is a
+ * construction-time fault.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly", or
+ * "custom" for a source whose error is not one of this module's typed
+ * errors). The underlying cause, when any, is on `cause`.
+ */
+export class WorkloadIdentityRuntimeError extends Error {
+    constructor(message, options) {
+        super(message);
+        this.name = "WorkloadIdentityRuntimeError";
+        this.source = options?.source;
+        this.cause = options?.cause;
+    }
+}
+export const DEFAULT_FILE_TOKEN_ENV_VARS = [
+    "KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE",
+    "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
+    "AWS_WEB_IDENTITY_TOKEN_FILE",
+    "AZURE_FEDERATED_TOKEN_FILE",
+];
+/** @internal Shared by FileTokenSource and the deprecated EKSWorkloadIdentity. */
+export function resolveTokenFilePath(discoveryEnvVars, options) {
+    if (options?.tokenFilePath) {
+        return options.tokenFilePath;
+    }
+    const envNames = options?.envVarName
+        ? [options.envVarName, ...discoveryEnvVars]
+        : discoveryEnvVars;
+    const found = envNames.find((name) => process.env[name]);
+    if (!found || !process.env[found]) {
+        throw new WorkloadIdentityConfigurationError(`Could not find token file path in environment variables; checked: ${envNames.join(", ")}`, { source: WORKLOAD_IDENTITY_SOURCE_FILE });
+    }
+    return process.env[found];
+}
+function readTokenFile(tokenFilePath, errorClass) {
+    let contents;
+    try {
+        contents = fs.readFileSync(tokenFilePath, "utf-8");
+    }
+    catch (error) {
+        throw new errorClass(`Error reading token file: ${tokenFilePath}`, {
+            source: WORKLOAD_IDENTITY_SOURCE_FILE,
+            cause: error,
+        });
+    }
+    const token = contents.trim();
+    if (!token) {
+        throw new errorClass(`Token file is empty: ${tokenFilePath}`, {
+            source: WORKLOAD_IDENTITY_SOURCE_FILE,
+        });
+    }
+    return token;
+}
+/**
+ * Reads a platform-projected OIDC token from a mounted file, fresh on every
+ * call (platforms rotate projected tokens). Covers EKS pod identity, AKS
+ * workload identity, any Kubernetes projected service-account token, and CI
+ * providers that write the token to a file.
+ *
+ * When no explicit path is given, the path is discovered from the first set
+ * environment variable: the variable named by `envVarName` when given, then
+ * KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE,
+ * AWS_WEB_IDENTITY_TOKEN_FILE, and AZURE_FEDERATED_TOKEN_FILE.
+ *
+ * **Requires Node.js.** Validates at construction that the resolved file
+ * exists and is non-empty.
+ */
+export class FileTokenSource {
+    constructor(options) {
+        _FileTokenSource_tokenFilePath.set(this, void 0);
+        __classPrivateFieldSet(this, _FileTokenSource_tokenFilePath, resolveTokenFilePath(DEFAULT_FILE_TOKEN_ENV_VARS, options), "f");
+        readTokenFile(__classPrivateFieldGet(this, _FileTokenSource_tokenFilePath, "f"), WorkloadIdentityConfigurationError);
+    }
+    /** Re-reads the token file and returns its trimmed contents. */
+    async identityToken() {
+        return readTokenFile(__classPrivateFieldGet(this, _FileTokenSource_tokenFilePath, "f"), WorkloadIdentityRuntimeError);
+    }
+}
+_FileTokenSource_tokenFilePath = new WeakMap();
+const DEFAULT_GCP_METADATA_URL = "http://metadata.google.internal";
+const DEFAULT_GCP_TIMEOUT_MS = 5000;
+const GCP_IDENTITY_PATH = "/computeMetadata/v1/instance/service-accounts/default/identity";
+/**
+ * Fetches an OIDC identity token for the default service account from the
+ * GCP metadata server. Covers GKE, GCE, and Cloud Run.
+ */
+export class GCPMetadataTokenSource {
+    constructor(options) {
+        _GCPMetadataTokenSource_audience.set(this, void 0);
+        _GCPMetadataTokenSource_metadataUrl.set(this, void 0);
+        _GCPMetadataTokenSource_timeoutMs.set(this, void 0);
+        if (!options.audience || !options.audience.trim()) {
+            throw new WorkloadIdentityConfigurationError("audience must not be empty", {
+                source: WORKLOAD_IDENTITY_SOURCE_GCP_METADATA,
+            });
+        }
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_audience, options.audience, "f");
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_metadataUrl, (options.metadataUrl ?? DEFAULT_GCP_METADATA_URL).replace(/\/$/, ""), "f");
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_timeoutMs, options.timeoutMs ?? DEFAULT_GCP_TIMEOUT_MS, "f");
+    }
+    /** Requests a GCP-signed OIDC JWT from the metadata server. */
+    async identityToken() {
+        const url = `${__classPrivateFieldGet(this, _GCPMetadataTokenSource_metadataUrl, "f")}${GCP_IDENTITY_PATH}` +
+            `?audience=${encodeURIComponent(__classPrivateFieldGet(this, _GCPMetadataTokenSource_audience, "f"))}&format=full`;
+        let response;
+        let body;
+        try {
+            response = await fetch(url, {
+                headers: { "Metadata-Flavor": "Google" },
+                signal: AbortSignal.timeout(__classPrivateFieldGet(this, _GCPMetadataTokenSource_timeoutMs, "f")),
+            });
+            body = await response.text();
+        }
+        catch (error) {
+            throw new WorkloadIdentityRuntimeError(`Error calling metadata server at ${__classPrivateFieldGet(this, _GCPMetadataTokenSource_metadataUrl, "f")} (is this running on GCP?)`, { source: WORKLOAD_IDENTITY_SOURCE_GCP_METADATA, cause: error });
+        }
+        if (!response.ok) {
+            throw new WorkloadIdentityRuntimeError(`Metadata server returned status ${response.status}`, { source: WORKLOAD_IDENTITY_SOURCE_GCP_METADATA });
+        }
+        const token = body.trim();
+        if (!token) {
+            throw new WorkloadIdentityRuntimeError("Metadata server returned an empty token", {
+                source: WORKLOAD_IDENTITY_SOURCE_GCP_METADATA,
+            });
+        }
+        return token;
+    }
+}
+_GCPMetadataTokenSource_audience = new WeakMap(), _GCPMetadataTokenSource_metadataUrl = new WeakMap(), _GCPMetadataTokenSource_timeoutMs = new WeakMap();
+const DEFAULT_FLY_SOCKET_PATH = "/.fly/api";
+const FLY_TOKEN_PATH = "/v1/tokens/oidc";
+const FLY_TIMEOUT_MS = 5000;
+/**
+ * Fetches an OIDC token from the Fly.io Machines API over the local Unix
+ * socket. Covers workloads running on Fly Machines.
+ *
+ * **Requires Node.js** (Unix domain sockets). The socket is not probed at
+ * construction; an unreachable Machines API surfaces as a
+ * WorkloadIdentityRuntimeError at the first fetch.
+ */
+export class FlyTokenSource {
+    constructor(options) {
+        _FlyTokenSource_audience.set(this, void 0);
+        _FlyTokenSource_socketPath.set(this, void 0);
+        __classPrivateFieldSet(this, _FlyTokenSource_audience, options?.audience, "f");
+        __classPrivateFieldSet(this, _FlyTokenSource_socketPath, options?.socketPath ?? DEFAULT_FLY_SOCKET_PATH, "f");
+    }
+    /** Requests a Fly-signed OIDC JWT from the Machines API. */
+    async identityToken() {
+        const http = await import("node:http");
+        const payload = JSON.stringify(__classPrivateFieldGet(this, _FlyTokenSource_audience, "f") ? { aud: __classPrivateFieldGet(this, _FlyTokenSource_audience, "f") } : {});
+        return new Promise((resolve, reject) => {
+            const request = http.request({
+                socketPath: __classPrivateFieldGet(this, _FlyTokenSource_socketPath, "f"),
+                path: FLY_TOKEN_PATH,
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "Content-Length": Buffer.byteLength(payload),
+                },
+                timeout: FLY_TIMEOUT_MS,
+            }, (response) => {
+                const chunks = [];
+                response.on("data", (chunk) => chunks.push(chunk));
+                response.on("end", () => {
+                    if (response.statusCode !== 200) {
+                        reject(new WorkloadIdentityRuntimeError(`Machines API returned status ${response.statusCode}`, { source: WORKLOAD_IDENTITY_SOURCE_FLY }));
+                        return;
+                    }
+                    const token = Buffer.concat(chunks).toString("utf-8").trim();
+                    if (!token) {
+                        reject(new WorkloadIdentityRuntimeError("Machines API returned an empty token", {
+                            source: WORKLOAD_IDENTITY_SOURCE_FLY,
+                        }));
+                        return;
+                    }
+                    resolve(token);
+                });
+            });
+            request.on("error", (error) => {
+                if (error instanceof WorkloadIdentityRuntimeError) {
+                    reject(error);
+                    return;
+                }
+                reject(new WorkloadIdentityRuntimeError(`Error calling Machines API socket ${__classPrivateFieldGet(this, _FlyTokenSource_socketPath, "f")} (is this running on a Fly Machine?)`, { source: WORKLOAD_IDENTITY_SOURCE_FLY, cause: error }));
+            });
+            request.on("timeout", () => {
+                request.destroy(new WorkloadIdentityRuntimeError(`Machines API request timed out after ${FLY_TIMEOUT_MS}ms`, { source: WORKLOAD_IDENTITY_SOURCE_FLY }));
+            });
+            request.write(payload);
+            request.end();
+        });
+    }
+}
+_FlyTokenSource_audience = new WeakMap(), _FlyTokenSource_socketPath = new WeakMap();
+/**
+ * Workload identity credential using a platform-signed OIDC token obtained
+ * from a {@link IdentityTokenSource}. On every token exchange it fetches the
+ * current token from the source and attaches it as a jwt-bearer client
+ * assertion. It holds no shared secret and never caches the token across
+ * requests.
+ *
+ * @example
+ * // EKS / AKS / Kubernetes projected token (path discovered from env)
+ * const credential = new WorkloadIdentity(new FileTokenSource());
+ *
+ * // GKE / GCE / Cloud Run
+ * const credential = new WorkloadIdentity(
+ *   new GCPMetadataTokenSource({ audience: "https://zone.keycard.cloud" }),
+ * );
+ *
+ * // Custom fetch
+ * const credential = new WorkloadIdentity(() => fetchMyToken());
+ */
+export class WorkloadIdentity {
+    constructor(source, options) {
+        _WorkloadIdentity_instances.add(this);
+        _WorkloadIdentity_source.set(this, void 0);
+        _WorkloadIdentity_clientId.set(this, void 0);
+        if (source == null) {
+            throw new WorkloadIdentityConfigurationError("identity token source must not be null");
+        }
+        if (typeof source !== "function" &&
+            typeof source.identityToken !== "function") {
+            throw new WorkloadIdentityConfigurationError("identity token source must provide identityToken() or be a function");
+        }
+        __classPrivateFieldSet(this, _WorkloadIdentity_source, source, "f");
+        __classPrivateFieldSet(this, _WorkloadIdentity_clientId, options?.clientId, "f");
+    }
+    getAuth() {
+        return null;
+    }
+    async prepareTokenExchangeRequest(subjectToken, resource) {
+        const assertion = await __classPrivateFieldGet(this, _WorkloadIdentity_instances, "m", _WorkloadIdentity_fetchIdentityToken).call(this);
+        return {
+            subjectToken,
+            resource,
+            subjectTokenType: "urn:ietf:params:oauth:token-type:access_token",
+            clientAssertionType: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+            clientAssertion: assertion,
+            clientId: __classPrivateFieldGet(this, _WorkloadIdentity_clientId, "f"),
+        };
+    }
+}
+_WorkloadIdentity_source = new WeakMap(), _WorkloadIdentity_clientId = new WeakMap(), _WorkloadIdentity_instances = new WeakSet(), _WorkloadIdentity_fetchIdentityToken = async function _WorkloadIdentity_fetchIdentityToken() {
+    let token;
+    try {
+        token =
+            typeof __classPrivateFieldGet(this, _WorkloadIdentity_source, "f") === "function"
+                ? await __classPrivateFieldGet(this, _WorkloadIdentity_source, "f").call(this)
+                : await __classPrivateFieldGet(this, _WorkloadIdentity_source, "f").identityToken();
+    }
+    catch (error) {
+        if (error instanceof WorkloadIdentityConfigurationError ||
+            error instanceof WorkloadIdentityRuntimeError) {
+            throw error;
+        }
+        throw new WorkloadIdentityRuntimeError("Error fetching identity token", {
+            source: WORKLOAD_IDENTITY_SOURCE_CUSTOM,
+            cause: error,
+        });
+    }
+    if (typeof token !== "string" || !token.trim()) {
+        throw new WorkloadIdentityRuntimeError("Identity token source returned an empty token", {
+            source: WORKLOAD_IDENTITY_SOURCE_CUSTOM,
+        });
+    }
+    return token;
+};
+//# sourceMappingURL=workloadIdentity.js.map

package/dist/esm/server/workloadIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workloadIdentity.js","sourceRoot":"","sources":["../../../src/server/workloadIdentity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAI9B;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,qCAAqC,GAAG,cAAc,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAClD,MAAM,CAAC,MAAM,+BAA+B,GAAG,QAAQ,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAI3D,YAAY,OAAe,EAAE,OAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAIrD,YAAY,OAAe,EAAE,OAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;CACF;AAsBD,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,0CAA0C;IAC1C,wCAAwC;IACxC,6BAA6B;IAC7B,4BAA4B;CAC7B,CAAC;AASF,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAClC,gBAA0B,EAC1B,OAAgC;IAEhC,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU;QAClC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,gBAAgB,CAAC;QAC3C,CAAC,CAAC,gBAAgB,CAAC;IACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,kCAAkC,CAC1C,qEAAqE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1F,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAW,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CACpB,aAAqB,EACrB,UAEuC;IAEvC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAAC,6BAA6B,aAAa,EAAE,EAAE;YACjE,MAAM,EAAE,6BAA6B;YACrC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,wBAAwB,aAAa,EAAE,EAAE;YAC5D,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,eAAe;IAG1B,YAAY,OAAgC;QAF5C,iDAAuB;QAGrB,uBAAA,IAAI,kCAAkB,oBAAoB,CAAC,2BAA2B,EAAE,OAAO,CAAC,MAAA,CAAC;QACjF,aAAa,CAAC,uBAAA,IAAI,sCAAe,EAAE,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,aAAa;QACjB,OAAO,aAAa,CAAC,uBAAA,IAAI,sCAAe,EAAE,4BAA4B,CAAC,CAAC;IAC1E,CAAC;CACF;;AAWD,MAAM,wBAAwB,GAAG,iCAAiC,CAAC;AACnE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IAKjC,YAAY,OAAsC;QAJlD,mDAAkB;QAClB,sDAAqB;QACrB,oDAAmB;QAGjB,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,kCAAkC,CAAC,4BAA4B,EAAE;gBACzE,MAAM,EAAE,qCAAqC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,uBAAA,IAAI,oCAAa,OAAO,CAAC,QAAQ,MAAA,CAAC;QAClC,uBAAA,IAAI,uCAAgB,CAAC,OAAO,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,MAAA,CAAC;QACzF,uBAAA,IAAI,qCAAc,OAAO,CAAC,SAAS,IAAI,sBAAsB,MAAA,CAAC;IAChE,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GACP,GAAG,uBAAA,IAAI,2CAAa,GAAG,iBAAiB,EAAE;YAC1C,aAAa,kBAAkB,CAAC,uBAAA,IAAI,wCAAU,CAAC,cAAc,CAAC;QAEhE,IAAI,QAAkB,CAAC;QACvB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC1B,OAAO,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE;gBACxC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAA,IAAI,yCAAW,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAA4B,CACpC,oCAAoC,uBAAA,IAAI,2CAAa,4BAA4B,EACjF,EAAE,MAAM,EAAE,qCAAqC,EAAE,KAAK,EAAE,KAAK,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,4BAA4B,CACpC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,EACpD,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,4BAA4B,CAAC,yCAAyC,EAAE;gBAChF,MAAM,EAAE,qCAAqC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;;AASD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAIzB,YAAY,OAA+B;QAH3C,2CAAmB;QACnB,6CAAoB;QAGlB,uBAAA,IAAI,4BAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,8BAAe,OAAO,EAAE,UAAU,IAAI,uBAAuB,MAAA,CAAC;IACpE,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAA,IAAI,gCAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,uBAAA,IAAI,gCAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE9E,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAC1B;gBACE,UAAU,EAAE,uBAAA,IAAI,kCAAY;gBAC5B,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;iBAC7C;gBACD,OAAO,EAAE,cAAc;aACxB,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3D,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACtB,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;wBAChC,MAAM,CACJ,IAAI,4BAA4B,CAC9B,gCAAgC,QAAQ,CAAC,UAAU,EAAE,EACrD,EAAE,MAAM,EAAE,4BAA4B,EAAE,CACzC,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,CACJ,IAAI,4BAA4B,CAAC,sCAAsC,EAAE;4BACvE,MAAM,EAAE,4BAA4B;yBACrC,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;oBAClD,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,MAAM,CACJ,IAAI,4BAA4B,CAC9B,qCAAqC,uBAAA,IAAI,kCAAY,sCAAsC,EAC3F,EAAE,MAAM,EAAE,4BAA4B,EAAE,KAAK,EAAE,KAAK,EAAE,CACvD,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACzB,OAAO,CAAC,OAAO,CACb,IAAI,4BAA4B,CAC9B,wCAAwC,cAAc,IAAI,EAC1D,EAAE,MAAM,EAAE,4BAA4B,EAAE,CACzC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,gBAAgB;IAI3B,YACE,MAAkD,EAClD,OAAiC;;QALnC,2CAAoD;QACpD,6CAAmB;QAMjB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,kCAAkC,CAAC,wCAAwC,CAAC,CAAC;QACzF,CAAC;QACD,IACE,OAAO,MAAM,KAAK,UAAU;YAC5B,OAAQ,MAA8B,CAAC,aAAa,KAAK,UAAU,EACnE,CAAC;YACD,MAAM,IAAI,kCAAkC,CAC1C,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,8BAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;IACrC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,YAAoB,EACpB,QAAgB;QAEhB,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,yEAAoB,MAAxB,IAAI,CAAsB,CAAC;QAEnD,OAAO;YACL,YAAY;YACZ,QAAQ;YACR,gBAAgB,EAAE,+CAA+C;YACjE,mBAAmB,EAAE,wDAAwD;YAC7E,eAAe,EAAE,SAAS;YAC1B,QAAQ,EAAE,uBAAA,IAAI,kCAAU;SACzB,CAAC;IACJ,CAAC;CA4BF;0KA1BC,KAAK;IACH,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK;YACH,OAAO,uBAAA,IAAI,gCAAQ,KAAK,UAAU;gBAChC,CAAC,CAAC,MAAM,uBAAA,IAAI,gCAAQ,MAAZ,IAAI,CAAU;gBACtB,CAAC,CAAC,MAAM,uBAAA,IAAI,gCAAQ,CAAC,aAAa,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,kCAAkC;YACnD,KAAK,YAAY,4BAA4B,EAC7C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,4BAA4B,CAAC,+BAA+B,EAAE;YACtE,MAAM,EAAE,+BAA+B;YACvC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,4BAA4B,CAAC,+CAA+C,EAAE;YACtF,MAAM,EAAE,+BAA+B;SACxC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/esm/tokenExchange.d.ts

@@ -20,6 +20,12 @@ export interface TokenExchangeRequest {
     actorTokenType?: string;
     clientAssertion?: string;
     clientAssertionType?: string;
+    /**
+     * Names the application credential the client authenticates as, sent as
+     * the client_id form parameter. Used with assertion-based credentials that
+     * are resolved by ID rather than by the assertion's subject.
+     */
+    clientId?: string;
 }
 export interface TokenResponse {
     accessToken: string;
@@ -37,18 +43,20 @@ export interface TokenExchangeClientOptions {
     /**
      * Application credential provider. When set, takes precedence over
      * static `clientId`/`clientSecret` and resolves the per-request
-     * Authorization header from the credential's `getAuth(zoneId)`.
+     * Authorization header from the credential's `getAuth(issuer)`.
      */
     credential?: ApplicationCredential;
 }
 export interface ExchangeOptions {
-    zoneId?: string;
+    /** Zone issuer URL used to select per-zone credentials. */
+    issuer?: string;
 }
 export interface ImpersonateRequest {
     userIdentifier: string;
     resource: string;
     scope?: string;
-    zoneId?: string;
+    /** Zone issuer URL used to select per-zone credentials. */
+    issuer?: string;
 }
 export declare function deserializeTokenResponse(json: Record<string, unknown>): TokenResponse;
 export declare class TokenExchangeClient {

package/dist/esm/tokenExchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAO9D,eAAO,MAAM,SAAS;;IAEpB;;;OAGG;;CAEK,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAyBD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,CAqBrF;AAMD,qBAAa,mBAAmB;;gBAQlB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAO1D,aAAa,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC;IA8CnB,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+BlE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAuB1C"}
+{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAO9D,eAAO,MAAM,SAAS;;IAEpB;;;OAGG;;CAEK,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA0BD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,CAqBrF;AAMD,qBAAa,mBAAmB;;gBAQlB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAO1D,aAAa,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC;IA+CnB,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+BlE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAuB1C"}

package/dist/esm/tokenExchange.js

@@ -48,12 +48,14 @@ function serializeRequest(request) {
         params.set("client_assertion", request.clientAssertion);
     if (request.clientAssertionType)
         params.set("client_assertion_type", request.clientAssertionType);
+    if (request.clientId)
+        params.set("client_id", request.clientId);
     return params;
 }
 export function deserializeTokenResponse(json) {
     const accessToken = json.access_token;
     if (typeof accessToken !== "string" || !accessToken) {
-        throw new Error("Token exchange response missing access_token");
+        throw new OAuthError("invalid_response", "Token response missing access_token");
     }
     const response = {
         accessToken,
@@ -96,7 +98,7 @@ export class TokenExchangeClient {
         const headers = {
             "Content-Type": "application/x-www-form-urlencoded",
         };
-        const basicAuth = __classPrivateFieldGet(this, _TokenExchangeClient_instances, "m", _TokenExchangeClient_resolveBasicAuth).call(this, options?.zoneId);
+        const basicAuth = __classPrivateFieldGet(this, _TokenExchangeClient_instances, "m", _TokenExchangeClient_resolveBasicAuth).call(this, options?.issuer);
         if (basicAuth) {
             const credentials = btoa(`${basicAuth.clientId}:${basicAuth.clientSecret}`);
             headers["Authorization"] = `Basic ${credentials}`;
@@ -125,7 +127,7 @@ export class TokenExchangeClient {
                     throw e;
                 // non-JSON or no "error" key — fall through
             }
-            throw new Error(`Token exchange failed (HTTP ${response.status})`);
+            throw new OAuthError("invalid_response", `Token exchange failed (HTTP ${response.status})`);
         }
         const json = await response.json();
         return deserializeTokenResponse(json);
@@ -143,7 +145,7 @@ export class TokenExchangeClient {
             subjectTokenType: TokenType.SUBSTITUTE_USER,
             resource: req.resource,
             scope: req.scope,
-        }, { zoneId: req.zoneId });
+        }, { issuer: req.issuer });
     }
     /**
      * Resolve the authorization server's token endpoint (discovered from metadata
@@ -154,9 +156,9 @@ export class TokenExchangeClient {
         return __classPrivateFieldGet(this, _TokenExchangeClient_instances, "m", _TokenExchangeClient_getTokenEndpoint).call(this);
     }
 }
-_TokenExchangeClient_issuer = new WeakMap(), _TokenExchangeClient_clientId = new WeakMap(), _TokenExchangeClient_clientSecret = new WeakMap(), _TokenExchangeClient_credential = new WeakMap(), _TokenExchangeClient_tokenEndpoint = new WeakMap(), _TokenExchangeClient_discoveryPromise = new WeakMap(), _TokenExchangeClient_instances = new WeakSet(), _TokenExchangeClient_resolveBasicAuth = function _TokenExchangeClient_resolveBasicAuth(zoneId) {
+_TokenExchangeClient_issuer = new WeakMap(), _TokenExchangeClient_clientId = new WeakMap(), _TokenExchangeClient_clientSecret = new WeakMap(), _TokenExchangeClient_credential = new WeakMap(), _TokenExchangeClient_tokenEndpoint = new WeakMap(), _TokenExchangeClient_discoveryPromise = new WeakMap(), _TokenExchangeClient_instances = new WeakSet(), _TokenExchangeClient_resolveBasicAuth = function _TokenExchangeClient_resolveBasicAuth(issuer) {
     if (__classPrivateFieldGet(this, _TokenExchangeClient_credential, "f")) {
-        return __classPrivateFieldGet(this, _TokenExchangeClient_credential, "f").getAuth(zoneId);
+        return __classPrivateFieldGet(this, _TokenExchangeClient_credential, "f").getAuth(issuer);
     }
     if (__classPrivateFieldGet(this, _TokenExchangeClient_clientId, "f") && __classPrivateFieldGet(this, _TokenExchangeClient_clientSecret, "f")) {
         return { clientId: __classPrivateFieldGet(this, _TokenExchangeClient_clientId, "f"), clientSecret: __classPrivateFieldGet(this, _TokenExchangeClient_clientSecret, "f") };

package/dist/esm/tokenExchange.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,YAAY,EAAE,+CAA+C;IAC7D;;;OAGG;IACH,eAAe,EAAE,qDAAqD;CAC9D,CAAC;AAkDX,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,SAAS,gBAAgB,CAAC,OAA6B;IACrD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,IAAI,iDAAiD,CAAC,CAAC;IACjG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,gBAAgB,IAAI,+CAA+C,CAAC,CAAC;IAE9G,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,mBAAmB;QAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAElG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAA6B;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,WAAW;QACX,6EAA6E;QAC7E,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;KAC5E,CAAC;IAEF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QAAE,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACvF,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;QAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClG,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,OAAO,mBAAmB;IAQ9B,YAAY,MAAc,EAAE,OAAoC;;QAPhE,8CAAgB;QAChB,gDAAmB;QACnB,oDAAuB;QACvB,kDAAoC;QACpC,qDAAwB;QACxB,wDAAoC;QAGlC,uBAAA,IAAI,+BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,iCAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,qCAAiB,OAAO,EAAE,YAAY,MAAA,CAAC;QAC3C,uBAAA,IAAI,mCAAe,OAAO,EAAE,UAAU,MAAA,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAA6B,EAC7B,OAAyB;QAEzB,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;QACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,MAAM,SAAS,GAAG,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,EAAmB,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;gBACnE,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;oBAClC,MAAM,WAAW,GAAG,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ;wBACjE,CAAC,CAAC,SAAS,CAAC,iBAAiB;wBAC7B,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;wBACtD,CAAC,CAAC,SAAS,CAAC,SAAS;wBACrB,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,UAAU;oBAAE,MAAM,CAAC,CAAC;gBACrC,4CAA4C;YAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAC9D,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB;QACvC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,aAAa,CACvB;YACE,YAAY;YACZ,gBAAgB,EAAE,SAAS,CAAC,eAAe;YAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,EACD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAC;IACJ,CAAC;IAcD;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,OAAO,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;IAClC,CAAC;CAqBF;kbAvCG,MAA0B;IAE1B,IAAI,uBAAA,IAAI,uCAAY,EAAE,CAAC;QACrB,OAAO,uBAAA,IAAI,uCAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,uBAAA,IAAI,qCAAU,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,uBAAA,IAAI,qCAAU,EAAE,YAAY,EAAE,uBAAA,IAAI,yCAAc,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,0CAWD,KAAK;IACH,IAAI,uBAAA,IAAI,0CAAe,EAAE,CAAC;QACxB,OAAO,uBAAA,IAAI,0CAAe,CAAC;IAC7B,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,uBAAA,IAAI,6CAAkB,EAAE,CAAC;QAC5B,uBAAA,IAAI,yCAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC,uBAAA,IAAI,mCAAQ,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,uBAAA,IAAI,mCAAQ,uCAAuC,CAAC,CAAC;YAChG,CAAC;YACD,uBAAA,IAAI,sCAAkB,QAAQ,CAAC,cAAc,MAAA,CAAC;YAC9C,OAAO,uBAAA,IAAI,0CAAe,CAAC;QAC7B,CAAC,CAAC,EAAE,MAAA,CAAC;IACP,CAAC;IAED,OAAO,uBAAA,IAAI,6CAAkB,CAAC;AAChC,CAAC"}
+{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,YAAY,EAAE,+CAA+C;IAC7D;;;OAGG;IACH,eAAe,EAAE,qDAAqD;CAC9D,CAAC;AA0DX,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,SAAS,gBAAgB,CAAC,OAA6B;IACrD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,IAAI,iDAAiD,CAAC,CAAC;IACjG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,gBAAgB,IAAI,+CAA+C,CAAC,CAAC;IAE9G,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,mBAAmB;QAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEhE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAA6B;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,WAAW;QACX,6EAA6E;QAC7E,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;KAC5E,CAAC;IAEF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QAAE,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACvF,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;QAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClG,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,OAAO,mBAAmB;IAQ9B,YAAY,MAAc,EAAE,OAAoC;;QAPhE,8CAAgB;QAChB,gDAAmB;QACnB,oDAAuB;QACvB,kDAAoC;QACpC,qDAAwB;QACxB,wDAAoC;QAGlC,uBAAA,IAAI,+BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,iCAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,qCAAiB,OAAO,EAAE,YAAY,MAAA,CAAC;QAC3C,uBAAA,IAAI,mCAAe,OAAO,EAAE,UAAU,MAAA,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAA6B,EAC7B,OAAyB;QAEzB,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;QACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,MAAM,SAAS,GAAG,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,EAAmB,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;gBACnE,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;oBAClC,MAAM,WAAW,GAAG,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ;wBACjE,CAAC,CAAC,SAAS,CAAC,iBAAiB;wBAC7B,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;wBACtD,CAAC,CAAC,SAAS,CAAC,SAAS;wBACrB,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,UAAU;oBAAE,MAAM,CAAC,CAAC;gBACrC,4CAA4C;YAC9C,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,kBAAkB,EAClB,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAC9D,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB;QACvC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,aAAa,CACvB;YACE,YAAY;YACZ,gBAAgB,EAAE,SAAS,CAAC,eAAe;YAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,EACD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAC;IACJ,CAAC;IAcD;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,OAAO,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;IAClC,CAAC;CAqBF;kbAvCG,MAA0B;IAE1B,IAAI,uBAAA,IAAI,uCAAY,EAAE,CAAC;QACrB,OAAO,uBAAA,IAAI,uCAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,uBAAA,IAAI,qCAAU,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,uBAAA,IAAI,qCAAU,EAAE,YAAY,EAAE,uBAAA,IAAI,yCAAc,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,0CAWD,KAAK;IACH,IAAI,uBAAA,IAAI,0CAAe,EAAE,CAAC;QACxB,OAAO,uBAAA,IAAI,0CAAe,CAAC;IAC7B,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,uBAAA,IAAI,6CAAkB,EAAE,CAAC;QAC5B,uBAAA,IAAI,yCAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC,uBAAA,IAAI,mCAAQ,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,uBAAA,IAAI,mCAAQ,uCAAuC,CAAC,CAAC;YAChG,CAAC;YACD,uBAAA,IAAI,sCAAkB,QAAQ,CAAC,cAAc,MAAA,CAAC;YAC9C,OAAO,uBAAA,IAAI,0CAAe,CAAC;QAC7B,CAAC,CAAC,EAAE,MAAA,CAAC;IACP,CAAC;IAED,OAAO,uBAAA,IAAI,6CAAkB,CAAC;AAChC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keycardai/oauth",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "[Preview] OAuth 2.0 primitives for Keycard: JWKS keyring, JWT signing/verification, server-tier token verifier, AccessContext, ClientSecret credentials, and impersonation via RFC 8693 token exchange",
   "license": "MIT",
   "repository": {
@@ -119,7 +119,7 @@
     "@jest/globals": "^30.0.4",
     "@types/node": "^25.6.0",
     "jest": "^30.0.4",
-    "ts-jest": "^29.4.0",
+    "ts-jest": "^29.4.7",
     "typescript": "^5.8.3"
   },
   "scripts": {