@keycardai/oauth 0.19.0 → 0.20.0

package/README.md

@@ -238,6 +238,11 @@ if called in a non-Node environment.
 | `AccessToken` (type) | `@keycardai/oauth/server` | Verified token shape (`token`, `clientId`, `scopes`, `expiresAt?`, `resource?`) |
 | `AccessContext` | `@keycardai/oauth/server` | Non-throwing per-resource token container with partial-error tracking |
 | `ClientSecret` | `@keycardai/oauth/server` | Application credential provider; supports `(clientId, clientSecret)`, tuple, or `Record<zoneId, [id, secret]>` |
+| `WorkloadIdentity` | `@keycardai/oauth/server` | Application credential using a platform-signed OIDC token from a pluggable source; optional `clientId` names the Keycard application credential |
+| `FileTokenSource` | `@keycardai/oauth/server` | Token source for projected token files (EKS, AKS, Kubernetes projected tokens). **Node.js only** |
+| `GCPMetadataTokenSource` | `@keycardai/oauth/server` | Token source for the GCP metadata server (GKE, GCE, Cloud Run) |
+| `FlyTokenSource` | `@keycardai/oauth/server` | Token source for the Fly.io Machines API Unix socket. **Node.js only** |
+| `EKSWorkloadIdentity` | `@keycardai/oauth/server` | Deprecated: `WorkloadIdentity` with a `FileTokenSource` limited to EKS env discovery |
 | `ApplicationCredential` (type) | `@keycardai/oauth/credentials` | Interface for credential providers |
 
 ### Errors

package/dist/cjs/server/eksWorkloadIdentity.d.ts

@@ -1,5 +1,4 @@
-import type { ApplicationCredential } from "../credentials.js";
-import type { TokenExchangeRequest } from "../tokenExchange.js";
+import { WorkloadIdentity } from "./workloadIdentity.js";
 export interface EKSWorkloadIdentityOptions {
     tokenFilePath?: string;
     envVarName?: string;
@@ -12,11 +11,13 @@ export interface EKSWorkloadIdentityOptions {
  *
  * **Requires Node.js.** Reads the token file synchronously from the
  * filesystem at construction and exchange time.
+ *
+ * @deprecated Use {@link WorkloadIdentity} with {@link FileTokenSource},
+ * which also covers AKS and other platforms that project token files.
+ * Failures throw WorkloadIdentityConfigurationError /
+ * WorkloadIdentityRuntimeError (both Error subclasses).
  */
-export declare class EKSWorkloadIdentity implements ApplicationCredential {
-    #private;
+export declare class EKSWorkloadIdentity extends WorkloadIdentity {
     constructor(options?: EKSWorkloadIdentityOptions);
-    getAuth(): null;
-    prepareTokenExchangeRequest(subjectToken: string, resource: string): Promise<TokenExchangeRequest>;
 }
 //# sourceMappingURL=eksWorkloadIdentity.d.ts.map

package/dist/cjs/server/eksWorkloadIdentity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eksWorkloadIdentity.d.ts","sourceRoot":"","sources":["../../../src/server/eksWorkloadIdentity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAQhE,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,YAAW,qBAAqB;;gBAGnD,OAAO,CAAC,EAAE,0BAA0B;IAmBhD,OAAO,IAAI,IAAI;IAIT,2BAA2B,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;CA+BjC"}
+{"version":3,"file":"eksWorkloadIdentity.d.ts","sourceRoot":"","sources":["../../../src/server/eksWorkloadIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,gBAAgB,EACjB,MAAM,uBAAuB,CAAC;AAQ/B,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,mBAAoB,SAAQ,gBAAgB;gBAC3C,OAAO,CAAC,EAAE,0BAA0B;CAMjD"}

package/dist/cjs/server/eksWorkloadIdentity.js

@@ -1,52 +1,7 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _EKSWorkloadIdentity_instances, _EKSWorkloadIdentity_tokenFilePath, _EKSWorkloadIdentity_validateTokenFile, _EKSWorkloadIdentity_readToken;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EKSWorkloadIdentity = void 0;
-const fs = __importStar(require("node:fs"));
+const workloadIdentity_js_1 = require("./workloadIdentity.js");
 const DEFAULT_EKS_ENV_VARS = [
     "KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE",
     "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
@@ -60,58 +15,19 @@ const DEFAULT_EKS_ENV_VARS = [
  *
  * **Requires Node.js.** Reads the token file synchronously from the
  * filesystem at construction and exchange time.
+ *
+ * @deprecated Use {@link WorkloadIdentity} with {@link FileTokenSource},
+ * which also covers AKS and other platforms that project token files.
+ * Failures throw WorkloadIdentityConfigurationError /
+ * WorkloadIdentityRuntimeError (both Error subclasses).
  */
-class EKSWorkloadIdentity {
+class EKSWorkloadIdentity extends workloadIdentity_js_1.WorkloadIdentity {
     constructor(options) {
-        _EKSWorkloadIdentity_instances.add(this);
-        _EKSWorkloadIdentity_tokenFilePath.set(this, void 0);
-        if (options?.tokenFilePath) {
-            __classPrivateFieldSet(this, _EKSWorkloadIdentity_tokenFilePath, options.tokenFilePath, "f");
-        }
-        else {
-            const envNames = options?.envVarName
-                ? [options.envVarName, ...DEFAULT_EKS_ENV_VARS]
-                : DEFAULT_EKS_ENV_VARS;
-            const found = envNames.find((name) => process.env[name]);
-            if (!found || !process.env[found]) {
-                throw new Error(`EKSWorkloadIdentity: could not find token file path in environment variables. ` +
-                    `Checked: ${envNames.join(", ")}`);
-            }
-            __classPrivateFieldSet(this, _EKSWorkloadIdentity_tokenFilePath, process.env[found], "f");
-        }
-        __classPrivateFieldGet(this, _EKSWorkloadIdentity_instances, "m", _EKSWorkloadIdentity_validateTokenFile).call(this);
-    }
-    getAuth() {
-        return null;
-    }
-    async prepareTokenExchangeRequest(subjectToken, resource) {
-        return {
-            subjectToken,
-            resource,
-            subjectTokenType: "urn:ietf:params:oauth:token-type:access_token",
-            clientAssertionType: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
-            clientAssertion: __classPrivateFieldGet(this, _EKSWorkloadIdentity_instances, "m", _EKSWorkloadIdentity_readToken).call(this),
-        };
+        // Discovery limited to the EKS environment variables; FileTokenSource's
+        // default list additionally includes AZURE_FEDERATED_TOKEN_FILE.
+        const tokenFilePath = (0, workloadIdentity_js_1.resolveTokenFilePath)(DEFAULT_EKS_ENV_VARS, options);
+        super(new workloadIdentity_js_1.FileTokenSource({ tokenFilePath }));
     }
 }
 exports.EKSWorkloadIdentity = EKSWorkloadIdentity;
-_EKSWorkloadIdentity_tokenFilePath = new WeakMap(), _EKSWorkloadIdentity_instances = new WeakSet(), _EKSWorkloadIdentity_validateTokenFile = function _EKSWorkloadIdentity_validateTokenFile() {
-    try {
-        const token = fs.readFileSync(__classPrivateFieldGet(this, _EKSWorkloadIdentity_tokenFilePath, "f"), "utf-8").trim();
-        if (!token) {
-            throw new Error(`EKSWorkloadIdentity: token file is empty: ${__classPrivateFieldGet(this, _EKSWorkloadIdentity_tokenFilePath, "f")}`);
-        }
-    }
-    catch (error) {
-        if (error instanceof Error && error.message.startsWith("EKSWorkloadIdentity:"))
-            throw error;
-        throw new Error(`EKSWorkloadIdentity: error reading token file "${__classPrivateFieldGet(this, _EKSWorkloadIdentity_tokenFilePath, "f")}": ${error}`);
-    }
-}, _EKSWorkloadIdentity_readToken = function _EKSWorkloadIdentity_readToken() {
-    const token = fs.readFileSync(__classPrivateFieldGet(this, _EKSWorkloadIdentity_tokenFilePath, "f"), "utf-8").trim();
-    if (!token) {
-        throw new Error(`EKSWorkloadIdentity: token file is empty: ${__classPrivateFieldGet(this, _EKSWorkloadIdentity_tokenFilePath, "f")}`);
-    }
-    return token;
-};
 //# sourceMappingURL=eksWorkloadIdentity.js.map

package/dist/cjs/server/eksWorkloadIdentity.js.map

@@ -1 +1 @@
-{"version":3,"file":"eksWorkloadIdentity.js","sourceRoot":"","sources":["../../../src/server/eksWorkloadIdentity.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4CAA8B;AAI9B,MAAM,oBAAoB,GAAG;IAC3B,0CAA0C;IAC1C,wCAAwC;IACxC,6BAA6B;CAC9B,CAAC;AAOF;;;;;;;;GAQG;AACH,MAAa,mBAAmB;IAG9B,YAAY,OAAoC;;QAFhD,qDAAuB;QAGrB,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;YAC3B,uBAAA,IAAI,sCAAkB,OAAO,CAAC,aAAa,MAAA,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU;gBAClC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,oBAAoB,CAAC;gBAC/C,CAAC,CAAC,oBAAoB,CAAC;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,gFAAgF;oBAChF,YAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClC,CAAC;YACJ,CAAC;YACD,uBAAA,IAAI,sCAAkB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAE,MAAA,CAAC;QAC5C,CAAC;QACD,uBAAA,IAAI,8EAAmB,MAAvB,IAAI,CAAqB,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,YAAoB,EACpB,QAAgB;QAEhB,OAAO;YACL,YAAY;YACZ,QAAQ;YACR,gBAAgB,EAAE,+CAA+C;YACjE,mBAAmB,EAAE,wDAAwD;YAC7E,eAAe,EAAE,uBAAA,IAAI,sEAAW,MAAf,IAAI,CAAa;SACnC,CAAC;IACJ,CAAC;CAuBF;AA5DD,kDA4DC;;IApBG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,uBAAA,IAAI,0CAAe,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,uBAAA,IAAI,0CAAe,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5F,MAAM,IAAI,KAAK,CACb,kDAAkD,uBAAA,IAAI,0CAAe,MAAM,KAAK,EAAE,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;IAGC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,uBAAA,IAAI,0CAAe,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,uBAAA,IAAI,0CAAe,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"eksWorkloadIdentity.js","sourceRoot":"","sources":["../../../src/server/eksWorkloadIdentity.ts"],"names":[],"mappings":";;;AAAA,+DAI+B;AAE/B,MAAM,oBAAoB,GAAG;IAC3B,0CAA0C;IAC1C,wCAAwC;IACxC,6BAA6B;CAC9B,CAAC;AAOF;;;;;;;;;;;;;GAaG;AACH,MAAa,mBAAoB,SAAQ,sCAAgB;IACvD,YAAY,OAAoC;QAC9C,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,aAAa,GAAG,IAAA,0CAAoB,EAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC1E,KAAK,CAAC,IAAI,qCAAe,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;CACF;AAPD,kDAOC"}

package/dist/cjs/server/index.d.ts

@@ -11,4 +11,6 @@ export { WebIdentity } from "./webIdentity.js";
 export type { WebIdentityOptions } from "./webIdentity.js";
 export { EKSWorkloadIdentity } from "./eksWorkloadIdentity.js";
 export type { EKSWorkloadIdentityOptions } from "./eksWorkloadIdentity.js";
+export { WorkloadIdentity, FileTokenSource, GCPMetadataTokenSource, FlyTokenSource, WorkloadIdentityConfigurationError, WorkloadIdentityRuntimeError, DEFAULT_FILE_TOKEN_ENV_VARS, WORKLOAD_IDENTITY_SOURCE_FILE, WORKLOAD_IDENTITY_SOURCE_GCP_METADATA, WORKLOAD_IDENTITY_SOURCE_FLY, WORKLOAD_IDENTITY_SOURCE_CUSTOM, } from "./workloadIdentity.js";
+export type { IdentityTokenSource, IdentityTokenFetcher, WorkloadIdentityOptions, FileTokenSourceOptions, GCPMetadataTokenSourceOptions, FlyTokenSourceOptions, } from "./workloadIdentity.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC"}

package/dist/cjs/server/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EKSWorkloadIdentity = exports.WebIdentity = exports.PrivateKeyManager = exports.FilePrivateKeyStorage = exports.ClientSecret = exports.TokenVerifier = exports.AccessContext = void 0;
+exports.WORKLOAD_IDENTITY_SOURCE_CUSTOM = exports.WORKLOAD_IDENTITY_SOURCE_FLY = exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = exports.WORKLOAD_IDENTITY_SOURCE_FILE = exports.DEFAULT_FILE_TOKEN_ENV_VARS = exports.WorkloadIdentityRuntimeError = exports.WorkloadIdentityConfigurationError = exports.FlyTokenSource = exports.GCPMetadataTokenSource = exports.FileTokenSource = exports.WorkloadIdentity = exports.EKSWorkloadIdentity = exports.WebIdentity = exports.PrivateKeyManager = exports.FilePrivateKeyStorage = exports.ClientSecret = exports.TokenVerifier = exports.AccessContext = void 0;
 var accessContext_js_1 = require("./accessContext.js");
 Object.defineProperty(exports, "AccessContext", { enumerable: true, get: function () { return accessContext_js_1.AccessContext; } });
 var tokenVerifier_js_1 = require("./tokenVerifier.js");
@@ -14,4 +14,16 @@ var webIdentity_js_1 = require("./webIdentity.js");
 Object.defineProperty(exports, "WebIdentity", { enumerable: true, get: function () { return webIdentity_js_1.WebIdentity; } });
 var eksWorkloadIdentity_js_1 = require("./eksWorkloadIdentity.js");
 Object.defineProperty(exports, "EKSWorkloadIdentity", { enumerable: true, get: function () { return eksWorkloadIdentity_js_1.EKSWorkloadIdentity; } });
+var workloadIdentity_js_1 = require("./workloadIdentity.js");
+Object.defineProperty(exports, "WorkloadIdentity", { enumerable: true, get: function () { return workloadIdentity_js_1.WorkloadIdentity; } });
+Object.defineProperty(exports, "FileTokenSource", { enumerable: true, get: function () { return workloadIdentity_js_1.FileTokenSource; } });
+Object.defineProperty(exports, "GCPMetadataTokenSource", { enumerable: true, get: function () { return workloadIdentity_js_1.GCPMetadataTokenSource; } });
+Object.defineProperty(exports, "FlyTokenSource", { enumerable: true, get: function () { return workloadIdentity_js_1.FlyTokenSource; } });
+Object.defineProperty(exports, "WorkloadIdentityConfigurationError", { enumerable: true, get: function () { return workloadIdentity_js_1.WorkloadIdentityConfigurationError; } });
+Object.defineProperty(exports, "WorkloadIdentityRuntimeError", { enumerable: true, get: function () { return workloadIdentity_js_1.WorkloadIdentityRuntimeError; } });
+Object.defineProperty(exports, "DEFAULT_FILE_TOKEN_ENV_VARS", { enumerable: true, get: function () { return workloadIdentity_js_1.DEFAULT_FILE_TOKEN_ENV_VARS; } });
+Object.defineProperty(exports, "WORKLOAD_IDENTITY_SOURCE_FILE", { enumerable: true, get: function () { return workloadIdentity_js_1.WORKLOAD_IDENTITY_SOURCE_FILE; } });
+Object.defineProperty(exports, "WORKLOAD_IDENTITY_SOURCE_GCP_METADATA", { enumerable: true, get: function () { return workloadIdentity_js_1.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA; } });
+Object.defineProperty(exports, "WORKLOAD_IDENTITY_SOURCE_FLY", { enumerable: true, get: function () { return workloadIdentity_js_1.WORKLOAD_IDENTITY_SOURCE_FLY; } });
+Object.defineProperty(exports, "WORKLOAD_IDENTITY_SOURCE_CUSTOM", { enumerable: true, get: function () { return workloadIdentity_js_1.WORKLOAD_IDENTITY_SOURCE_CUSTOM; } });
 //# sourceMappingURL=index.js.map

package/dist/cjs/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":";;;AAAA,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AAGtB,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AAEtB,qDAAiD;AAAxC,+GAAA,YAAY,OAAA;AAErB,iDAA2E;AAAlE,sHAAA,qBAAqB,OAAA;AAAE,kHAAA,iBAAiB,OAAA;AAEjD,mDAA+C;AAAtC,6GAAA,WAAW,OAAA;AAEpB,mEAA+D;AAAtD,6HAAA,mBAAmB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":";;;AAAA,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AAGtB,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AAEtB,qDAAiD;AAAxC,+GAAA,YAAY,OAAA;AAErB,iDAA2E;AAAlE,sHAAA,qBAAqB,OAAA;AAAE,kHAAA,iBAAiB,OAAA;AAEjD,mDAA+C;AAAtC,6GAAA,WAAW,OAAA;AAEpB,mEAA+D;AAAtD,6HAAA,mBAAmB,OAAA;AAE5B,6DAY+B;AAX7B,uHAAA,gBAAgB,OAAA;AAChB,sHAAA,eAAe,OAAA;AACf,6HAAA,sBAAsB,OAAA;AACtB,qHAAA,cAAc,OAAA;AACd,yIAAA,kCAAkC,OAAA;AAClC,mIAAA,4BAA4B,OAAA;AAC5B,kIAAA,2BAA2B,OAAA;AAC3B,oIAAA,6BAA6B,OAAA;AAC7B,4IAAA,qCAAqC,OAAA;AACrC,mIAAA,4BAA4B,OAAA;AAC5B,sIAAA,+BAA+B,OAAA"}

package/dist/cjs/server/workloadIdentity.d.ts

@@ -0,0 +1,166 @@
+import type { ApplicationCredential } from "../credentials.js";
+import type { TokenExchangeRequest } from "../tokenExchange.js";
+/**
+ * Source identifiers carried on WorkloadIdentityConfigurationError and
+ * WorkloadIdentityRuntimeError, for branching on which token source failed.
+ */
+export declare const WORKLOAD_IDENTITY_SOURCE_FILE = "file";
+export declare const WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = "gcp-metadata";
+export declare const WORKLOAD_IDENTITY_SOURCE_FLY = "fly";
+export declare const WORKLOAD_IDENTITY_SOURCE_CUSTOM = "custom";
+/**
+ * A workload identity credential or token source was misconfigured at
+ * construction: a missing or empty token file, no discovery environment
+ * variable set, a missing required audience, or an invalid source.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly");
+ * undefined when the fault is in the credential itself. The underlying cause,
+ * when any, is on `cause`.
+ */
+export declare class WorkloadIdentityConfigurationError extends Error {
+    readonly source?: string;
+    readonly cause?: unknown;
+    constructor(message: string, options?: {
+        source?: string;
+        cause?: unknown;
+    });
+}
+/**
+ * The subject token could not be obtained at request time: the token file was
+ * rotated away or emptied after construction, or the platform endpoint was
+ * unreachable. Distinct from WorkloadIdentityConfigurationError, which is a
+ * construction-time fault.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly", or
+ * "custom" for a source whose error is not one of this module's typed
+ * errors). The underlying cause, when any, is on `cause`.
+ */
+export declare class WorkloadIdentityRuntimeError extends Error {
+    readonly source?: string;
+    readonly cause?: unknown;
+    constructor(message: string, options?: {
+        source?: string;
+        cause?: unknown;
+    });
+}
+/**
+ * Supplies a platform-signed OIDC token for use as a client assertion during
+ * token exchange. The only per-platform piece of a workload identity
+ * credential: {@link FileTokenSource} covers platforms that project the token
+ * to a file (EKS, AKS, Kubernetes projected service-account tokens),
+ * {@link GCPMetadataTokenSource} covers platforms that serve it from the GCP
+ * metadata endpoint (GKE, GCE, Cloud Run), {@link FlyTokenSource} covers Fly
+ * Machines, and any bare function returning the token is accepted as a source.
+ *
+ * `identityToken` is called on every token exchange. Implementations must
+ * return the current token; platforms rotate these tokens, so returning a
+ * stale cached value risks an expired assertion.
+ */
+export interface IdentityTokenSource {
+    identityToken(): Promise<string>;
+}
+/** A bare function accepted anywhere a IdentityTokenSource is. */
+export type IdentityTokenFetcher = () => Promise<string> | string;
+export declare const DEFAULT_FILE_TOKEN_ENV_VARS: string[];
+export interface FileTokenSourceOptions {
+    /** Explicit token file path, skipping env-var discovery. */
+    tokenFilePath?: string;
+    /** An environment variable to consult first during discovery. */
+    envVarName?: string;
+}
+/** @internal Shared by FileTokenSource and the deprecated EKSWorkloadIdentity. */
+export declare function resolveTokenFilePath(discoveryEnvVars: string[], options?: FileTokenSourceOptions): string;
+/**
+ * Reads a platform-projected OIDC token from a mounted file, fresh on every
+ * call (platforms rotate projected tokens). Covers EKS pod identity, AKS
+ * workload identity, any Kubernetes projected service-account token, and CI
+ * providers that write the token to a file.
+ *
+ * When no explicit path is given, the path is discovered from the first set
+ * environment variable: the variable named by `envVarName` when given, then
+ * KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE,
+ * AWS_WEB_IDENTITY_TOKEN_FILE, and AZURE_FEDERATED_TOKEN_FILE.
+ *
+ * **Requires Node.js.** Validates at construction that the resolved file
+ * exists and is non-empty.
+ */
+export declare class FileTokenSource implements IdentityTokenSource {
+    #private;
+    constructor(options?: FileTokenSourceOptions);
+    /** Re-reads the token file and returns its trimmed contents. */
+    identityToken(): Promise<string>;
+}
+export interface GCPMetadataTokenSourceOptions {
+    /** The token audience, typically the Keycard zone URL. Required. */
+    audience: string;
+    /** Metadata server base URL override (for testing). */
+    metadataUrl?: string;
+    /** Per-call deadline in milliseconds. */
+    timeoutMs?: number;
+}
+/**
+ * Fetches an OIDC identity token for the default service account from the
+ * GCP metadata server. Covers GKE, GCE, and Cloud Run.
+ */
+export declare class GCPMetadataTokenSource implements IdentityTokenSource {
+    #private;
+    constructor(options: GCPMetadataTokenSourceOptions);
+    /** Requests a GCP-signed OIDC JWT from the metadata server. */
+    identityToken(): Promise<string>;
+}
+export interface FlyTokenSourceOptions {
+    /** The token audience claim, typically the Keycard zone URL. */
+    audience?: string;
+    /** Machines API socket path override (default /.fly/api). */
+    socketPath?: string;
+}
+/**
+ * Fetches an OIDC token from the Fly.io Machines API over the local Unix
+ * socket. Covers workloads running on Fly Machines.
+ *
+ * **Requires Node.js** (Unix domain sockets). The socket is not probed at
+ * construction; an unreachable Machines API surfaces as a
+ * WorkloadIdentityRuntimeError at the first fetch.
+ */
+export declare class FlyTokenSource implements IdentityTokenSource {
+    #private;
+    constructor(options?: FlyTokenSourceOptions);
+    /** Requests a Fly-signed OIDC JWT from the Machines API. */
+    identityToken(): Promise<string>;
+}
+export interface WorkloadIdentityOptions {
+    /**
+     * ID of the Keycard application credential this workload authenticates as,
+     * sent as the `client_id` form parameter alongside the client assertion.
+     * Token-federation application credentials are resolved by this ID, so
+     * they require it; legacy token credentials are resolved by the
+     * assertion's subject and do not use it.
+     */
+    clientId?: string;
+}
+/**
+ * Workload identity credential using a platform-signed OIDC token obtained
+ * from a {@link IdentityTokenSource}. On every token exchange it fetches the
+ * current token from the source and attaches it as a jwt-bearer client
+ * assertion. It holds no shared secret and never caches the token across
+ * requests.
+ *
+ * @example
+ * // EKS / AKS / Kubernetes projected token (path discovered from env)
+ * const credential = new WorkloadIdentity(new FileTokenSource());
+ *
+ * // GKE / GCE / Cloud Run
+ * const credential = new WorkloadIdentity(
+ *   new GCPMetadataTokenSource({ audience: "https://zone.keycard.cloud" }),
+ * );
+ *
+ * // Custom fetch
+ * const credential = new WorkloadIdentity(() => fetchMyToken());
+ */
+export declare class WorkloadIdentity implements ApplicationCredential {
+    #private;
+    constructor(source: IdentityTokenSource | IdentityTokenFetcher, options?: WorkloadIdentityOptions);
+    getAuth(): null;
+    prepareTokenExchangeRequest(subjectToken: string, resource: string): Promise<TokenExchangeRequest>;
+}
+//# sourceMappingURL=workloadIdentity.d.ts.map

package/dist/cjs/server/workloadIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workloadIdentity.d.ts","sourceRoot":"","sources":["../../../src/server/workloadIdentity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,SAAS,CAAC;AACpD,eAAO,MAAM,qCAAqC,iBAAiB,CAAC;AACpE,eAAO,MAAM,4BAA4B,QAAQ,CAAC;AAClD,eAAO,MAAM,+BAA+B,WAAW,CAAC;AAExD;;;;;;;;GAQG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAM5E;AAED;;;;;;;;;GASG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAM5E;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AAElE,eAAO,MAAM,2BAA2B,UAKvC,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,OAAO,CAAC,EAAE,sBAAsB,GAC/B,MAAM,CAeR;AA0BD;;;;;;;;;;;;;GAaG;AACH,qBAAa,eAAgB,YAAW,mBAAmB;;gBAG7C,OAAO,CAAC,EAAE,sBAAsB;IAK5C,gEAAgE;IAC1D,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAGvC;AAED,MAAM,WAAW,6BAA6B;IAC5C,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;;gBAKpD,OAAO,EAAE,6BAA6B;IAWlD,+DAA+D;IACzD,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAkCvC;AAED,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;;;GAOG;AACH,qBAAa,cAAe,YAAW,mBAAmB;;gBAI5C,OAAO,CAAC,EAAE,qBAAqB;IAK3C,4DAA4D;IACtD,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAkEvC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,qBAAqB;;gBAK1D,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,EAClD,OAAO,CAAC,EAAE,uBAAuB;IAiBnC,OAAO,IAAI,IAAI;IAIT,2BAA2B,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;CAuCjC"}