@keycardai/oauth 0.19.0 → 0.20.0

package/dist/cjs/server/workloadIdentity.js

@@ -0,0 +1,355 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _FileTokenSource_tokenFilePath, _GCPMetadataTokenSource_audience, _GCPMetadataTokenSource_metadataUrl, _GCPMetadataTokenSource_timeoutMs, _FlyTokenSource_audience, _FlyTokenSource_socketPath, _WorkloadIdentity_instances, _WorkloadIdentity_source, _WorkloadIdentity_clientId, _WorkloadIdentity_fetchIdentityToken;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadIdentity = exports.FlyTokenSource = exports.GCPMetadataTokenSource = exports.FileTokenSource = exports.DEFAULT_FILE_TOKEN_ENV_VARS = exports.WorkloadIdentityRuntimeError = exports.WorkloadIdentityConfigurationError = exports.WORKLOAD_IDENTITY_SOURCE_CUSTOM = exports.WORKLOAD_IDENTITY_SOURCE_FLY = exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = exports.WORKLOAD_IDENTITY_SOURCE_FILE = void 0;
+exports.resolveTokenFilePath = resolveTokenFilePath;
+const fs = __importStar(require("node:fs"));
+/**
+ * Source identifiers carried on WorkloadIdentityConfigurationError and
+ * WorkloadIdentityRuntimeError, for branching on which token source failed.
+ */
+exports.WORKLOAD_IDENTITY_SOURCE_FILE = "file";
+exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = "gcp-metadata";
+exports.WORKLOAD_IDENTITY_SOURCE_FLY = "fly";
+exports.WORKLOAD_IDENTITY_SOURCE_CUSTOM = "custom";
+/**
+ * A workload identity credential or token source was misconfigured at
+ * construction: a missing or empty token file, no discovery environment
+ * variable set, a missing required audience, or an invalid source.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly");
+ * undefined when the fault is in the credential itself. The underlying cause,
+ * when any, is on `cause`.
+ */
+class WorkloadIdentityConfigurationError extends Error {
+    constructor(message, options) {
+        super(message);
+        this.name = "WorkloadIdentityConfigurationError";
+        this.source = options?.source;
+        this.cause = options?.cause;
+    }
+}
+exports.WorkloadIdentityConfigurationError = WorkloadIdentityConfigurationError;
+/**
+ * The subject token could not be obtained at request time: the token file was
+ * rotated away or emptied after construction, or the platform endpoint was
+ * unreachable. Distinct from WorkloadIdentityConfigurationError, which is a
+ * construction-time fault.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly", or
+ * "custom" for a source whose error is not one of this module's typed
+ * errors). The underlying cause, when any, is on `cause`.
+ */
+class WorkloadIdentityRuntimeError extends Error {
+    constructor(message, options) {
+        super(message);
+        this.name = "WorkloadIdentityRuntimeError";
+        this.source = options?.source;
+        this.cause = options?.cause;
+    }
+}
+exports.WorkloadIdentityRuntimeError = WorkloadIdentityRuntimeError;
+exports.DEFAULT_FILE_TOKEN_ENV_VARS = [
+    "KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE",
+    "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
+    "AWS_WEB_IDENTITY_TOKEN_FILE",
+    "AZURE_FEDERATED_TOKEN_FILE",
+];
+/** @internal Shared by FileTokenSource and the deprecated EKSWorkloadIdentity. */
+function resolveTokenFilePath(discoveryEnvVars, options) {
+    if (options?.tokenFilePath) {
+        return options.tokenFilePath;
+    }
+    const envNames = options?.envVarName
+        ? [options.envVarName, ...discoveryEnvVars]
+        : discoveryEnvVars;
+    const found = envNames.find((name) => process.env[name]);
+    if (!found || !process.env[found]) {
+        throw new WorkloadIdentityConfigurationError(`Could not find token file path in environment variables; checked: ${envNames.join(", ")}`, { source: exports.WORKLOAD_IDENTITY_SOURCE_FILE });
+    }
+    return process.env[found];
+}
+function readTokenFile(tokenFilePath, errorClass) {
+    let contents;
+    try {
+        contents = fs.readFileSync(tokenFilePath, "utf-8");
+    }
+    catch (error) {
+        throw new errorClass(`Error reading token file: ${tokenFilePath}`, {
+            source: exports.WORKLOAD_IDENTITY_SOURCE_FILE,
+            cause: error,
+        });
+    }
+    const token = contents.trim();
+    if (!token) {
+        throw new errorClass(`Token file is empty: ${tokenFilePath}`, {
+            source: exports.WORKLOAD_IDENTITY_SOURCE_FILE,
+        });
+    }
+    return token;
+}
+/**
+ * Reads a platform-projected OIDC token from a mounted file, fresh on every
+ * call (platforms rotate projected tokens). Covers EKS pod identity, AKS
+ * workload identity, any Kubernetes projected service-account token, and CI
+ * providers that write the token to a file.
+ *
+ * When no explicit path is given, the path is discovered from the first set
+ * environment variable: the variable named by `envVarName` when given, then
+ * KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE,
+ * AWS_WEB_IDENTITY_TOKEN_FILE, and AZURE_FEDERATED_TOKEN_FILE.
+ *
+ * **Requires Node.js.** Validates at construction that the resolved file
+ * exists and is non-empty.
+ */
+class FileTokenSource {
+    constructor(options) {
+        _FileTokenSource_tokenFilePath.set(this, void 0);
+        __classPrivateFieldSet(this, _FileTokenSource_tokenFilePath, resolveTokenFilePath(exports.DEFAULT_FILE_TOKEN_ENV_VARS, options), "f");
+        readTokenFile(__classPrivateFieldGet(this, _FileTokenSource_tokenFilePath, "f"), WorkloadIdentityConfigurationError);
+    }
+    /** Re-reads the token file and returns its trimmed contents. */
+    async identityToken() {
+        return readTokenFile(__classPrivateFieldGet(this, _FileTokenSource_tokenFilePath, "f"), WorkloadIdentityRuntimeError);
+    }
+}
+exports.FileTokenSource = FileTokenSource;
+_FileTokenSource_tokenFilePath = new WeakMap();
+const DEFAULT_GCP_METADATA_URL = "http://metadata.google.internal";
+const DEFAULT_GCP_TIMEOUT_MS = 5000;
+const GCP_IDENTITY_PATH = "/computeMetadata/v1/instance/service-accounts/default/identity";
+/**
+ * Fetches an OIDC identity token for the default service account from the
+ * GCP metadata server. Covers GKE, GCE, and Cloud Run.
+ */
+class GCPMetadataTokenSource {
+    constructor(options) {
+        _GCPMetadataTokenSource_audience.set(this, void 0);
+        _GCPMetadataTokenSource_metadataUrl.set(this, void 0);
+        _GCPMetadataTokenSource_timeoutMs.set(this, void 0);
+        if (!options.audience || !options.audience.trim()) {
+            throw new WorkloadIdentityConfigurationError("audience must not be empty", {
+                source: exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA,
+            });
+        }
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_audience, options.audience, "f");
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_metadataUrl, (options.metadataUrl ?? DEFAULT_GCP_METADATA_URL).replace(/\/$/, ""), "f");
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_timeoutMs, options.timeoutMs ?? DEFAULT_GCP_TIMEOUT_MS, "f");
+    }
+    /** Requests a GCP-signed OIDC JWT from the metadata server. */
+    async identityToken() {
+        const url = `${__classPrivateFieldGet(this, _GCPMetadataTokenSource_metadataUrl, "f")}${GCP_IDENTITY_PATH}` +
+            `?audience=${encodeURIComponent(__classPrivateFieldGet(this, _GCPMetadataTokenSource_audience, "f"))}&format=full`;
+        let response;
+        let body;
+        try {
+            response = await fetch(url, {
+                headers: { "Metadata-Flavor": "Google" },
+                signal: AbortSignal.timeout(__classPrivateFieldGet(this, _GCPMetadataTokenSource_timeoutMs, "f")),
+            });
+            body = await response.text();
+        }
+        catch (error) {
+            throw new WorkloadIdentityRuntimeError(`Error calling metadata server at ${__classPrivateFieldGet(this, _GCPMetadataTokenSource_metadataUrl, "f")} (is this running on GCP?)`, { source: exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA, cause: error });
+        }
+        if (!response.ok) {
+            throw new WorkloadIdentityRuntimeError(`Metadata server returned status ${response.status}`, { source: exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA });
+        }
+        const token = body.trim();
+        if (!token) {
+            throw new WorkloadIdentityRuntimeError("Metadata server returned an empty token", {
+                source: exports.WORKLOAD_IDENTITY_SOURCE_GCP_METADATA,
+            });
+        }
+        return token;
+    }
+}
+exports.GCPMetadataTokenSource = GCPMetadataTokenSource;
+_GCPMetadataTokenSource_audience = new WeakMap(), _GCPMetadataTokenSource_metadataUrl = new WeakMap(), _GCPMetadataTokenSource_timeoutMs = new WeakMap();
+const DEFAULT_FLY_SOCKET_PATH = "/.fly/api";
+const FLY_TOKEN_PATH = "/v1/tokens/oidc";
+const FLY_TIMEOUT_MS = 5000;
+/**
+ * Fetches an OIDC token from the Fly.io Machines API over the local Unix
+ * socket. Covers workloads running on Fly Machines.
+ *
+ * **Requires Node.js** (Unix domain sockets). The socket is not probed at
+ * construction; an unreachable Machines API surfaces as a
+ * WorkloadIdentityRuntimeError at the first fetch.
+ */
+class FlyTokenSource {
+    constructor(options) {
+        _FlyTokenSource_audience.set(this, void 0);
+        _FlyTokenSource_socketPath.set(this, void 0);
+        __classPrivateFieldSet(this, _FlyTokenSource_audience, options?.audience, "f");
+        __classPrivateFieldSet(this, _FlyTokenSource_socketPath, options?.socketPath ?? DEFAULT_FLY_SOCKET_PATH, "f");
+    }
+    /** Requests a Fly-signed OIDC JWT from the Machines API. */
+    async identityToken() {
+        const http = await Promise.resolve().then(() => __importStar(require("node:http")));
+        const payload = JSON.stringify(__classPrivateFieldGet(this, _FlyTokenSource_audience, "f") ? { aud: __classPrivateFieldGet(this, _FlyTokenSource_audience, "f") } : {});
+        return new Promise((resolve, reject) => {
+            const request = http.request({
+                socketPath: __classPrivateFieldGet(this, _FlyTokenSource_socketPath, "f"),
+                path: FLY_TOKEN_PATH,
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "Content-Length": Buffer.byteLength(payload),
+                },
+                timeout: FLY_TIMEOUT_MS,
+            }, (response) => {
+                const chunks = [];
+                response.on("data", (chunk) => chunks.push(chunk));
+                response.on("end", () => {
+                    if (response.statusCode !== 200) {
+                        reject(new WorkloadIdentityRuntimeError(`Machines API returned status ${response.statusCode}`, { source: exports.WORKLOAD_IDENTITY_SOURCE_FLY }));
+                        return;
+                    }
+                    const token = Buffer.concat(chunks).toString("utf-8").trim();
+                    if (!token) {
+                        reject(new WorkloadIdentityRuntimeError("Machines API returned an empty token", {
+                            source: exports.WORKLOAD_IDENTITY_SOURCE_FLY,
+                        }));
+                        return;
+                    }
+                    resolve(token);
+                });
+            });
+            request.on("error", (error) => {
+                if (error instanceof WorkloadIdentityRuntimeError) {
+                    reject(error);
+                    return;
+                }
+                reject(new WorkloadIdentityRuntimeError(`Error calling Machines API socket ${__classPrivateFieldGet(this, _FlyTokenSource_socketPath, "f")} (is this running on a Fly Machine?)`, { source: exports.WORKLOAD_IDENTITY_SOURCE_FLY, cause: error }));
+            });
+            request.on("timeout", () => {
+                request.destroy(new WorkloadIdentityRuntimeError(`Machines API request timed out after ${FLY_TIMEOUT_MS}ms`, { source: exports.WORKLOAD_IDENTITY_SOURCE_FLY }));
+            });
+            request.write(payload);
+            request.end();
+        });
+    }
+}
+exports.FlyTokenSource = FlyTokenSource;
+_FlyTokenSource_audience = new WeakMap(), _FlyTokenSource_socketPath = new WeakMap();
+/**
+ * Workload identity credential using a platform-signed OIDC token obtained
+ * from a {@link IdentityTokenSource}. On every token exchange it fetches the
+ * current token from the source and attaches it as a jwt-bearer client
+ * assertion. It holds no shared secret and never caches the token across
+ * requests.
+ *
+ * @example
+ * // EKS / AKS / Kubernetes projected token (path discovered from env)
+ * const credential = new WorkloadIdentity(new FileTokenSource());
+ *
+ * // GKE / GCE / Cloud Run
+ * const credential = new WorkloadIdentity(
+ *   new GCPMetadataTokenSource({ audience: "https://zone.keycard.cloud" }),
+ * );
+ *
+ * // Custom fetch
+ * const credential = new WorkloadIdentity(() => fetchMyToken());
+ */
+class WorkloadIdentity {
+    constructor(source, options) {
+        _WorkloadIdentity_instances.add(this);
+        _WorkloadIdentity_source.set(this, void 0);
+        _WorkloadIdentity_clientId.set(this, void 0);
+        if (source == null) {
+            throw new WorkloadIdentityConfigurationError("identity token source must not be null");
+        }
+        if (typeof source !== "function" &&
+            typeof source.identityToken !== "function") {
+            throw new WorkloadIdentityConfigurationError("identity token source must provide identityToken() or be a function");
+        }
+        __classPrivateFieldSet(this, _WorkloadIdentity_source, source, "f");
+        __classPrivateFieldSet(this, _WorkloadIdentity_clientId, options?.clientId, "f");
+    }
+    getAuth() {
+        return null;
+    }
+    async prepareTokenExchangeRequest(subjectToken, resource) {
+        const assertion = await __classPrivateFieldGet(this, _WorkloadIdentity_instances, "m", _WorkloadIdentity_fetchIdentityToken).call(this);
+        return {
+            subjectToken,
+            resource,
+            subjectTokenType: "urn:ietf:params:oauth:token-type:access_token",
+            clientAssertionType: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+            clientAssertion: assertion,
+            clientId: __classPrivateFieldGet(this, _WorkloadIdentity_clientId, "f"),
+        };
+    }
+}
+exports.WorkloadIdentity = WorkloadIdentity;
+_WorkloadIdentity_source = new WeakMap(), _WorkloadIdentity_clientId = new WeakMap(), _WorkloadIdentity_instances = new WeakSet(), _WorkloadIdentity_fetchIdentityToken = async function _WorkloadIdentity_fetchIdentityToken() {
+    let token;
+    try {
+        token =
+            typeof __classPrivateFieldGet(this, _WorkloadIdentity_source, "f") === "function"
+                ? await __classPrivateFieldGet(this, _WorkloadIdentity_source, "f").call(this)
+                : await __classPrivateFieldGet(this, _WorkloadIdentity_source, "f").identityToken();
+    }
+    catch (error) {
+        if (error instanceof WorkloadIdentityConfigurationError ||
+            error instanceof WorkloadIdentityRuntimeError) {
+            throw error;
+        }
+        throw new WorkloadIdentityRuntimeError("Error fetching identity token", {
+            source: exports.WORKLOAD_IDENTITY_SOURCE_CUSTOM,
+            cause: error,
+        });
+    }
+    if (typeof token !== "string" || !token.trim()) {
+        throw new WorkloadIdentityRuntimeError("Identity token source returned an empty token", {
+            source: exports.WORKLOAD_IDENTITY_SOURCE_CUSTOM,
+        });
+    }
+    return token;
+};
+//# sourceMappingURL=workloadIdentity.js.map

package/dist/cjs/server/workloadIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workloadIdentity.js","sourceRoot":"","sources":["../../../src/server/workloadIdentity.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,oDAkBC;AA7GD,4CAA8B;AAI9B;;;GAGG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC;AACvC,QAAA,qCAAqC,GAAG,cAAc,CAAC;AACvD,QAAA,4BAA4B,GAAG,KAAK,CAAC;AACrC,QAAA,+BAA+B,GAAG,QAAQ,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAa,kCAAmC,SAAQ,KAAK;IAI3D,YAAY,OAAe,EAAE,OAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;CACF;AAVD,gFAUC;AAED;;;;;;;;;GASG;AACH,MAAa,4BAA6B,SAAQ,KAAK;IAIrD,YAAY,OAAe,EAAE,OAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;CACF;AAVD,oEAUC;AAsBY,QAAA,2BAA2B,GAAG;IACzC,0CAA0C;IAC1C,wCAAwC;IACxC,6BAA6B;IAC7B,4BAA4B;CAC7B,CAAC;AASF,kFAAkF;AAClF,SAAgB,oBAAoB,CAClC,gBAA0B,EAC1B,OAAgC;IAEhC,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU;QAClC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,gBAAgB,CAAC;QAC3C,CAAC,CAAC,gBAAgB,CAAC;IACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,kCAAkC,CAC1C,qEAAqE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1F,EAAE,MAAM,EAAE,qCAA6B,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAW,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CACpB,aAAqB,EACrB,UAEuC;IAEvC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAAC,6BAA6B,aAAa,EAAE,EAAE;YACjE,MAAM,EAAE,qCAA6B;YACrC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,wBAAwB,aAAa,EAAE,EAAE;YAC5D,MAAM,EAAE,qCAA6B;SACtC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAa,eAAe;IAG1B,YAAY,OAAgC;QAF5C,iDAAuB;QAGrB,uBAAA,IAAI,kCAAkB,oBAAoB,CAAC,mCAA2B,EAAE,OAAO,CAAC,MAAA,CAAC;QACjF,aAAa,CAAC,uBAAA,IAAI,sCAAe,EAAE,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,aAAa;QACjB,OAAO,aAAa,CAAC,uBAAA,IAAI,sCAAe,EAAE,4BAA4B,CAAC,CAAC;IAC1E,CAAC;CACF;AAZD,0CAYC;;AAWD,MAAM,wBAAwB,GAAG,iCAAiC,CAAC;AACnE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F;;;GAGG;AACH,MAAa,sBAAsB;IAKjC,YAAY,OAAsC;QAJlD,mDAAkB;QAClB,sDAAqB;QACrB,oDAAmB;QAGjB,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,kCAAkC,CAAC,4BAA4B,EAAE;gBACzE,MAAM,EAAE,6CAAqC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,uBAAA,IAAI,oCAAa,OAAO,CAAC,QAAQ,MAAA,CAAC;QAClC,uBAAA,IAAI,uCAAgB,CAAC,OAAO,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,MAAA,CAAC;QACzF,uBAAA,IAAI,qCAAc,OAAO,CAAC,SAAS,IAAI,sBAAsB,MAAA,CAAC;IAChE,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GACP,GAAG,uBAAA,IAAI,2CAAa,GAAG,iBAAiB,EAAE;YAC1C,aAAa,kBAAkB,CAAC,uBAAA,IAAI,wCAAU,CAAC,cAAc,CAAC;QAEhE,IAAI,QAAkB,CAAC;QACvB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC1B,OAAO,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE;gBACxC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAA,IAAI,yCAAW,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAA4B,CACpC,oCAAoC,uBAAA,IAAI,2CAAa,4BAA4B,EACjF,EAAE,MAAM,EAAE,6CAAqC,EAAE,KAAK,EAAE,KAAK,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,4BAA4B,CACpC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,EACpD,EAAE,MAAM,EAAE,6CAAqC,EAAE,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,4BAA4B,CAAC,yCAAyC,EAAE;gBAChF,MAAM,EAAE,6CAAqC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAnDD,wDAmDC;;AASD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;;;;;;GAOG;AACH,MAAa,cAAc;IAIzB,YAAY,OAA+B;QAH3C,2CAAmB;QACnB,6CAAoB;QAGlB,uBAAA,IAAI,4BAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,8BAAe,OAAO,EAAE,UAAU,IAAI,uBAAuB,MAAA,CAAC;IACpE,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,wDAAa,WAAW,GAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAA,IAAI,gCAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,uBAAA,IAAI,gCAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE9E,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAC1B;gBACE,UAAU,EAAE,uBAAA,IAAI,kCAAY;gBAC5B,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;iBAC7C;gBACD,OAAO,EAAE,cAAc;aACxB,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3D,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACtB,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;wBAChC,MAAM,CACJ,IAAI,4BAA4B,CAC9B,gCAAgC,QAAQ,CAAC,UAAU,EAAE,EACrD,EAAE,MAAM,EAAE,oCAA4B,EAAE,CACzC,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,CACJ,IAAI,4BAA4B,CAAC,sCAAsC,EAAE;4BACvE,MAAM,EAAE,oCAA4B;yBACrC,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;oBAClD,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,MAAM,CACJ,IAAI,4BAA4B,CAC9B,qCAAqC,uBAAA,IAAI,kCAAY,sCAAsC,EAC3F,EAAE,MAAM,EAAE,oCAA4B,EAAE,KAAK,EAAE,KAAK,EAAE,CACvD,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACzB,OAAO,CAAC,OAAO,CACb,IAAI,4BAA4B,CAC9B,wCAAwC,cAAc,IAAI,EAC1D,EAAE,MAAM,EAAE,oCAA4B,EAAE,CACzC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA5ED,wCA4EC;;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,gBAAgB;IAI3B,YACE,MAAkD,EAClD,OAAiC;;QALnC,2CAAoD;QACpD,6CAAmB;QAMjB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,kCAAkC,CAAC,wCAAwC,CAAC,CAAC;QACzF,CAAC;QACD,IACE,OAAO,MAAM,KAAK,UAAU;YAC5B,OAAQ,MAA8B,CAAC,aAAa,KAAK,UAAU,EACnE,CAAC;YACD,MAAM,IAAI,kCAAkC,CAC1C,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,8BAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;IACrC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,YAAoB,EACpB,QAAgB;QAEhB,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,yEAAoB,MAAxB,IAAI,CAAsB,CAAC;QAEnD,OAAO;YACL,YAAY;YACZ,QAAQ;YACR,gBAAgB,EAAE,+CAA+C;YACjE,mBAAmB,EAAE,wDAAwD;YAC7E,eAAe,EAAE,SAAS;YAC1B,QAAQ,EAAE,uBAAA,IAAI,kCAAU;SACzB,CAAC;IACJ,CAAC;CA4BF;AArED,4CAqEC;0KA1BC,KAAK;IACH,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK;YACH,OAAO,uBAAA,IAAI,gCAAQ,KAAK,UAAU;gBAChC,CAAC,CAAC,MAAM,uBAAA,IAAI,gCAAQ,MAAZ,IAAI,CAAU;gBACtB,CAAC,CAAC,MAAM,uBAAA,IAAI,gCAAQ,CAAC,aAAa,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,kCAAkC;YACnD,KAAK,YAAY,4BAA4B,EAC7C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,4BAA4B,CAAC,+BAA+B,EAAE;YACtE,MAAM,EAAE,uCAA+B;YACvC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,4BAA4B,CAAC,+CAA+C,EAAE;YACtF,MAAM,EAAE,uCAA+B;SACxC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cjs/tokenExchange.d.ts

@@ -20,6 +20,12 @@ export interface TokenExchangeRequest {
     actorTokenType?: string;
     clientAssertion?: string;
     clientAssertionType?: string;
+    /**
+     * Names the application credential the client authenticates as, sent as
+     * the client_id form parameter. Used with assertion-based credentials that
+     * are resolved by ID rather than by the assertion's subject.
+     */
+    clientId?: string;
 }
 export interface TokenResponse {
     accessToken: string;

package/dist/cjs/tokenExchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAO9D,eAAO,MAAM,SAAS;;IAEpB;;;OAGG;;CAEK,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAyBD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,CAqBrF;AAMD,qBAAa,mBAAmB;;gBAQlB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAO1D,aAAa,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC;IA+CnB,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+BlE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAuB1C"}
+{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAO9D,eAAO,MAAM,SAAS;;IAEpB;;;OAGG;;CAEK,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA0BD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,CAqBrF;AAMD,qBAAa,mBAAmB;;gBAQlB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAO1D,aAAa,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC;IA+CnB,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+BlE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAuB1C"}

package/dist/cjs/tokenExchange.js

@@ -52,6 +52,8 @@ function serializeRequest(request) {
         params.set("client_assertion", request.clientAssertion);
     if (request.clientAssertionType)
         params.set("client_assertion_type", request.clientAssertionType);
+    if (request.clientId)
+        params.set("client_id", request.clientId);
     return params;
 }
 function deserializeTokenResponse(json) {

package/dist/cjs/tokenExchange.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA2FA,4DAqBC;AAhHD,iDAAkE;AAClE,2CAAyC;AAEzC,+DAAmE;AAEnE,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEnE,QAAA,SAAS,GAAG;IACvB,YAAY,EAAE,+CAA+C;IAC7D;;;OAGG;IACH,eAAe,EAAE,qDAAqD;CAC9D,CAAC;AAoDX,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,SAAS,gBAAgB,CAAC,OAA6B;IACrD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,IAAI,iDAAiD,CAAC,CAAC;IACjG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,gBAAgB,IAAI,+CAA+C,CAAC,CAAC;IAE9G,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,mBAAmB;QAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAElG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,wBAAwB,CAAC,IAA6B;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,sBAAU,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,WAAW;QACX,6EAA6E;QAC7E,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;KAC5E,CAAC;IAEF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QAAE,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACvF,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;QAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClG,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAa,mBAAmB;IAQ9B,YAAY,MAAc,EAAE,OAAoC;;QAPhE,8CAAgB;QAChB,gDAAmB;QACnB,oDAAuB;QACvB,kDAAoC;QACpC,qDAAwB;QACxB,wDAAoC;QAGlC,uBAAA,IAAI,+BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,iCAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,qCAAiB,OAAO,EAAE,YAAY,MAAA,CAAC;QAC3C,uBAAA,IAAI,mCAAe,OAAO,EAAE,UAAU,MAAA,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAA6B,EAC7B,OAAyB;QAEzB,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;QACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,MAAM,SAAS,GAAG,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,EAAmB,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;gBACnE,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;oBAClC,MAAM,WAAW,GAAG,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ;wBACjE,CAAC,CAAC,SAAS,CAAC,iBAAiB;wBAC7B,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;wBACtD,CAAC,CAAC,SAAS,CAAC,SAAS;wBACrB,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,IAAI,sBAAU,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,sBAAU;oBAAE,MAAM,CAAC,CAAC;gBACrC,4CAA4C;YAC9C,CAAC;YACD,MAAM,IAAI,sBAAU,CAClB,kBAAkB,EAClB,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAC9D,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB;QACvC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,YAAY,GAAG,IAAA,4CAAwB,EAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,aAAa,CACvB;YACE,YAAY;YACZ,gBAAgB,EAAE,iBAAS,CAAC,eAAe;YAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,EACD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAC;IACJ,CAAC;IAcD;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,OAAO,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;IAClC,CAAC;CAqBF;AA5HD,kDA4HC;kbAvCG,MAA0B;IAE1B,IAAI,uBAAA,IAAI,uCAAY,EAAE,CAAC;QACrB,OAAO,uBAAA,IAAI,uCAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,uBAAA,IAAI,qCAAU,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,uBAAA,IAAI,qCAAU,EAAE,YAAY,EAAE,uBAAA,IAAI,yCAAc,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,0CAWD,KAAK;IACH,IAAI,uBAAA,IAAI,0CAAe,EAAE,CAAC;QACxB,OAAO,uBAAA,IAAI,0CAAe,CAAC;IAC7B,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,uBAAA,IAAI,6CAAkB,EAAE,CAAC;QAC5B,uBAAA,IAAI,yCAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,QAAQ,GAAG,MAAM,IAAA,+CAAgC,EAAC,uBAAA,IAAI,mCAAQ,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,uBAAA,IAAI,mCAAQ,uCAAuC,CAAC,CAAC;YAChG,CAAC;YACD,uBAAA,IAAI,sCAAkB,QAAQ,CAAC,cAAc,MAAA,CAAC;YAC9C,OAAO,uBAAA,IAAI,0CAAe,CAAC;QAC7B,CAAC,CAAC,EAAE,MAAA,CAAC;IACP,CAAC;IAED,OAAO,uBAAA,IAAI,6CAAkB,CAAC;AAChC,CAAC"}
+{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAkGA,4DAqBC;AAvHD,iDAAkE;AAClE,2CAAyC;AAEzC,+DAAmE;AAEnE,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEnE,QAAA,SAAS,GAAG;IACvB,YAAY,EAAE,+CAA+C;IAC7D;;;OAGG;IACH,eAAe,EAAE,qDAAqD;CAC9D,CAAC;AA0DX,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,SAAS,gBAAgB,CAAC,OAA6B;IACrD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,IAAI,iDAAiD,CAAC,CAAC;IACjG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,gBAAgB,IAAI,+CAA+C,CAAC,CAAC;IAE9G,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,mBAAmB;QAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEhE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,wBAAwB,CAAC,IAA6B;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,sBAAU,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,WAAW;QACX,6EAA6E;QAC7E,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;KAC5E,CAAC;IAEF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QAAE,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACvF,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;QAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClG,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAa,mBAAmB;IAQ9B,YAAY,MAAc,EAAE,OAAoC;;QAPhE,8CAAgB;QAChB,gDAAmB;QACnB,oDAAuB;QACvB,kDAAoC;QACpC,qDAAwB;QACxB,wDAAoC;QAGlC,uBAAA,IAAI,+BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,iCAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,qCAAiB,OAAO,EAAE,YAAY,MAAA,CAAC;QAC3C,uBAAA,IAAI,mCAAe,OAAO,EAAE,UAAU,MAAA,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAA6B,EAC7B,OAAyB;QAEzB,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;QACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,MAAM,SAAS,GAAG,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,EAAmB,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;gBACnE,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;oBAClC,MAAM,WAAW,GAAG,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ;wBACjE,CAAC,CAAC,SAAS,CAAC,iBAAiB;wBAC7B,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;wBACtD,CAAC,CAAC,SAAS,CAAC,SAAS;wBACrB,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,IAAI,sBAAU,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,sBAAU;oBAAE,MAAM,CAAC,CAAC;gBACrC,4CAA4C;YAC9C,CAAC;YACD,MAAM,IAAI,sBAAU,CAClB,kBAAkB,EAClB,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAC9D,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB;QACvC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,YAAY,GAAG,IAAA,4CAAwB,EAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,aAAa,CACvB;YACE,YAAY;YACZ,gBAAgB,EAAE,iBAAS,CAAC,eAAe;YAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,EACD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAC;IACJ,CAAC;IAcD;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,OAAO,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;IAClC,CAAC;CAqBF;AA5HD,kDA4HC;kbAvCG,MAA0B;IAE1B,IAAI,uBAAA,IAAI,uCAAY,EAAE,CAAC;QACrB,OAAO,uBAAA,IAAI,uCAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,uBAAA,IAAI,qCAAU,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,uBAAA,IAAI,qCAAU,EAAE,YAAY,EAAE,uBAAA,IAAI,yCAAc,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,0CAWD,KAAK;IACH,IAAI,uBAAA,IAAI,0CAAe,EAAE,CAAC;QACxB,OAAO,uBAAA,IAAI,0CAAe,CAAC;IAC7B,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,uBAAA,IAAI,6CAAkB,EAAE,CAAC;QAC5B,uBAAA,IAAI,yCAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,QAAQ,GAAG,MAAM,IAAA,+CAAgC,EAAC,uBAAA,IAAI,mCAAQ,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,uBAAA,IAAI,mCAAQ,uCAAuC,CAAC,CAAC;YAChG,CAAC;YACD,uBAAA,IAAI,sCAAkB,QAAQ,CAAC,cAAc,MAAA,CAAC;YAC9C,OAAO,uBAAA,IAAI,0CAAe,CAAC;QAC7B,CAAC,CAAC,EAAE,MAAA,CAAC;IACP,CAAC;IAED,OAAO,uBAAA,IAAI,6CAAkB,CAAC;AAChC,CAAC"}

package/dist/esm/server/eksWorkloadIdentity.d.ts

@@ -1,5 +1,4 @@
-import type { ApplicationCredential } from "../credentials.js";
-import type { TokenExchangeRequest } from "../tokenExchange.js";
+import { WorkloadIdentity } from "./workloadIdentity.js";
 export interface EKSWorkloadIdentityOptions {
     tokenFilePath?: string;
     envVarName?: string;
@@ -12,11 +11,13 @@ export interface EKSWorkloadIdentityOptions {
  *
  * **Requires Node.js.** Reads the token file synchronously from the
  * filesystem at construction and exchange time.
+ *
+ * @deprecated Use {@link WorkloadIdentity} with {@link FileTokenSource},
+ * which also covers AKS and other platforms that project token files.
+ * Failures throw WorkloadIdentityConfigurationError /
+ * WorkloadIdentityRuntimeError (both Error subclasses).
  */
-export declare class EKSWorkloadIdentity implements ApplicationCredential {
-    #private;
+export declare class EKSWorkloadIdentity extends WorkloadIdentity {
     constructor(options?: EKSWorkloadIdentityOptions);
-    getAuth(): null;
-    prepareTokenExchangeRequest(subjectToken: string, resource: string): Promise<TokenExchangeRequest>;
 }
 //# sourceMappingURL=eksWorkloadIdentity.d.ts.map

package/dist/esm/server/eksWorkloadIdentity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eksWorkloadIdentity.d.ts","sourceRoot":"","sources":["../../../src/server/eksWorkloadIdentity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAQhE,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,YAAW,qBAAqB;;gBAGnD,OAAO,CAAC,EAAE,0BAA0B;IAmBhD,OAAO,IAAI,IAAI;IAIT,2BAA2B,CAC/B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;CA+BjC"}
+{"version":3,"file":"eksWorkloadIdentity.d.ts","sourceRoot":"","sources":["../../../src/server/eksWorkloadIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,gBAAgB,EACjB,MAAM,uBAAuB,CAAC;AAQ/B,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,mBAAoB,SAAQ,gBAAgB;gBAC3C,OAAO,CAAC,EAAE,0BAA0B;CAMjD"}

package/dist/esm/server/eksWorkloadIdentity.js

@@ -1,16 +1,4 @@
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _EKSWorkloadIdentity_instances, _EKSWorkloadIdentity_tokenFilePath, _EKSWorkloadIdentity_validateTokenFile, _EKSWorkloadIdentity_readToken;
-import * as fs from "node:fs";
+import { FileTokenSource, resolveTokenFilePath, WorkloadIdentity, } from "./workloadIdentity.js";
 const DEFAULT_EKS_ENV_VARS = [
     "KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE",
     "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
@@ -24,57 +12,18 @@ const DEFAULT_EKS_ENV_VARS = [
  *
  * **Requires Node.js.** Reads the token file synchronously from the
  * filesystem at construction and exchange time.
+ *
+ * @deprecated Use {@link WorkloadIdentity} with {@link FileTokenSource},
+ * which also covers AKS and other platforms that project token files.
+ * Failures throw WorkloadIdentityConfigurationError /
+ * WorkloadIdentityRuntimeError (both Error subclasses).
  */
-export class EKSWorkloadIdentity {
+export class EKSWorkloadIdentity extends WorkloadIdentity {
     constructor(options) {
-        _EKSWorkloadIdentity_instances.add(this);
-        _EKSWorkloadIdentity_tokenFilePath.set(this, void 0);
-        if (options?.tokenFilePath) {
-            __classPrivateFieldSet(this, _EKSWorkloadIdentity_tokenFilePath, options.tokenFilePath, "f");
-        }
-        else {
-            const envNames = options?.envVarName
-                ? [options.envVarName, ...DEFAULT_EKS_ENV_VARS]
-                : DEFAULT_EKS_ENV_VARS;
-            const found = envNames.find((name) => process.env[name]);
-            if (!found || !process.env[found]) {
-                throw new Error(`EKSWorkloadIdentity: could not find token file path in environment variables. ` +
-                    `Checked: ${envNames.join(", ")}`);
-            }
-            __classPrivateFieldSet(this, _EKSWorkloadIdentity_tokenFilePath, process.env[found], "f");
-        }
-        __classPrivateFieldGet(this, _EKSWorkloadIdentity_instances, "m", _EKSWorkloadIdentity_validateTokenFile).call(this);
-    }
-    getAuth() {
-        return null;
-    }
-    async prepareTokenExchangeRequest(subjectToken, resource) {
-        return {
-            subjectToken,
-            resource,
-            subjectTokenType: "urn:ietf:params:oauth:token-type:access_token",
-            clientAssertionType: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
-            clientAssertion: __classPrivateFieldGet(this, _EKSWorkloadIdentity_instances, "m", _EKSWorkloadIdentity_readToken).call(this),
-        };
+        // Discovery limited to the EKS environment variables; FileTokenSource's
+        // default list additionally includes AZURE_FEDERATED_TOKEN_FILE.
+        const tokenFilePath = resolveTokenFilePath(DEFAULT_EKS_ENV_VARS, options);
+        super(new FileTokenSource({ tokenFilePath }));
     }
 }
-_EKSWorkloadIdentity_tokenFilePath = new WeakMap(), _EKSWorkloadIdentity_instances = new WeakSet(), _EKSWorkloadIdentity_validateTokenFile = function _EKSWorkloadIdentity_validateTokenFile() {
-    try {
-        const token = fs.readFileSync(__classPrivateFieldGet(this, _EKSWorkloadIdentity_tokenFilePath, "f"), "utf-8").trim();
-        if (!token) {
-            throw new Error(`EKSWorkloadIdentity: token file is empty: ${__classPrivateFieldGet(this, _EKSWorkloadIdentity_tokenFilePath, "f")}`);
-        }
-    }
-    catch (error) {
-        if (error instanceof Error && error.message.startsWith("EKSWorkloadIdentity:"))
-            throw error;
-        throw new Error(`EKSWorkloadIdentity: error reading token file "${__classPrivateFieldGet(this, _EKSWorkloadIdentity_tokenFilePath, "f")}": ${error}`);
-    }
-}, _EKSWorkloadIdentity_readToken = function _EKSWorkloadIdentity_readToken() {
-    const token = fs.readFileSync(__classPrivateFieldGet(this, _EKSWorkloadIdentity_tokenFilePath, "f"), "utf-8").trim();
-    if (!token) {
-        throw new Error(`EKSWorkloadIdentity: token file is empty: ${__classPrivateFieldGet(this, _EKSWorkloadIdentity_tokenFilePath, "f")}`);
-    }
-    return token;
-};
 //# sourceMappingURL=eksWorkloadIdentity.js.map

package/dist/esm/server/eksWorkloadIdentity.js.map

@@ -1 +1 @@
-{"version":3,"file":"eksWorkloadIdentity.js","sourceRoot":"","sources":["../../../src/server/eksWorkloadIdentity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAI9B,MAAM,oBAAoB,GAAG;IAC3B,0CAA0C;IAC1C,wCAAwC;IACxC,6BAA6B;CAC9B,CAAC;AAOF;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IAG9B,YAAY,OAAoC;;QAFhD,qDAAuB;QAGrB,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;YAC3B,uBAAA,IAAI,sCAAkB,OAAO,CAAC,aAAa,MAAA,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU;gBAClC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,oBAAoB,CAAC;gBAC/C,CAAC,CAAC,oBAAoB,CAAC;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,gFAAgF;oBAChF,YAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClC,CAAC;YACJ,CAAC;YACD,uBAAA,IAAI,sCAAkB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAE,MAAA,CAAC;QAC5C,CAAC;QACD,uBAAA,IAAI,8EAAmB,MAAvB,IAAI,CAAqB,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,YAAoB,EACpB,QAAgB;QAEhB,OAAO;YACL,YAAY;YACZ,QAAQ;YACR,gBAAgB,EAAE,+CAA+C;YACjE,mBAAmB,EAAE,wDAAwD;YAC7E,eAAe,EAAE,uBAAA,IAAI,sEAAW,MAAf,IAAI,CAAa;SACnC,CAAC;IACJ,CAAC;CAuBF;;IApBG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,uBAAA,IAAI,0CAAe,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,uBAAA,IAAI,0CAAe,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5F,MAAM,IAAI,KAAK,CACb,kDAAkD,uBAAA,IAAI,0CAAe,MAAM,KAAK,EAAE,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;IAGC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,uBAAA,IAAI,0CAAe,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,uBAAA,IAAI,0CAAe,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"eksWorkloadIdentity.js","sourceRoot":"","sources":["../../../src/server/eksWorkloadIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,oBAAoB,GAAG;IAC3B,0CAA0C;IAC1C,wCAAwC;IACxC,6BAA6B;CAC9B,CAAC;AAOF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,mBAAoB,SAAQ,gBAAgB;IACvD,YAAY,OAAoC;QAC9C,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,aAAa,GAAG,oBAAoB,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC1E,KAAK,CAAC,IAAI,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/esm/server/index.d.ts

@@ -11,4 +11,6 @@ export { WebIdentity } from "./webIdentity.js";
 export type { WebIdentityOptions } from "./webIdentity.js";
 export { EKSWorkloadIdentity } from "./eksWorkloadIdentity.js";
 export type { EKSWorkloadIdentityOptions } from "./eksWorkloadIdentity.js";
+export { WorkloadIdentity, FileTokenSource, GCPMetadataTokenSource, FlyTokenSource, WorkloadIdentityConfigurationError, WorkloadIdentityRuntimeError, DEFAULT_FILE_TOKEN_ENV_VARS, WORKLOAD_IDENTITY_SOURCE_FILE, WORKLOAD_IDENTITY_SOURCE_GCP_METADATA, WORKLOAD_IDENTITY_SOURCE_FLY, WORKLOAD_IDENTITY_SOURCE_CUSTOM, } from "./workloadIdentity.js";
+export type { IdentityTokenSource, IdentityTokenFetcher, WorkloadIdentityOptions, FileTokenSourceOptions, GCPMetadataTokenSourceOptions, FlyTokenSourceOptions, } from "./workloadIdentity.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC"}

package/dist/esm/server/index.js

@@ -4,4 +4,5 @@ export { ClientSecret } from "./clientSecret.js";
 export { FilePrivateKeyStorage, PrivateKeyManager } from "./privateKey.js";
 export { WebIdentity } from "./webIdentity.js";
 export { EKSWorkloadIdentity } from "./eksWorkloadIdentity.js";
+export { WorkloadIdentity, FileTokenSource, GCPMetadataTokenSource, FlyTokenSource, WorkloadIdentityConfigurationError, WorkloadIdentityRuntimeError, DEFAULT_FILE_TOKEN_ENV_VARS, WORKLOAD_IDENTITY_SOURCE_FILE, WORKLOAD_IDENTITY_SOURCE_GCP_METADATA, WORKLOAD_IDENTITY_SOURCE_FLY, WORKLOAD_IDENTITY_SOURCE_CUSTOM, } from "./workloadIdentity.js";
 //# sourceMappingURL=index.js.map

package/dist/esm/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE3E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE3E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,qCAAqC,EACrC,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,uBAAuB,CAAC"}