@keycardai/oauth 0.19.0 → 0.21.0

package/dist/esm/server/workloadIdentity.js

@@ -0,0 +1,312 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _FileTokenSource_tokenFilePath, _GCPMetadataTokenSource_audience, _GCPMetadataTokenSource_metadataUrl, _GCPMetadataTokenSource_timeoutMs, _FlyTokenSource_audience, _FlyTokenSource_socketPath, _WorkloadIdentity_instances, _WorkloadIdentity_source, _WorkloadIdentity_clientId, _WorkloadIdentity_fetchIdentityToken;
+import * as fs from "node:fs";
+/**
+ * Source identifiers carried on WorkloadIdentityConfigurationError and
+ * WorkloadIdentityRuntimeError, for branching on which token source failed.
+ */
+export const WORKLOAD_IDENTITY_SOURCE_FILE = "file";
+export const WORKLOAD_IDENTITY_SOURCE_GCP_METADATA = "gcp-metadata";
+export const WORKLOAD_IDENTITY_SOURCE_FLY = "fly";
+export const WORKLOAD_IDENTITY_SOURCE_CUSTOM = "custom";
+/**
+ * A workload identity credential or token source was misconfigured at
+ * construction: a missing or empty token file, no discovery environment
+ * variable set, a missing required audience, or an invalid source.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly");
+ * undefined when the fault is in the credential itself. The underlying cause,
+ * when any, is on `cause`.
+ */
+export class WorkloadIdentityConfigurationError extends Error {
+    constructor(message, options) {
+        super(message);
+        this.name = "WorkloadIdentityConfigurationError";
+        this.source = options?.source;
+        this.cause = options?.cause;
+    }
+}
+/**
+ * The subject token could not be obtained at request time: the token file was
+ * rotated away or emptied after construction, or the platform endpoint was
+ * unreachable. Distinct from WorkloadIdentityConfigurationError, which is a
+ * construction-time fault.
+ *
+ * `source` identifies the token source ("file", "gcp-metadata", "fly", or
+ * "custom" for a source whose error is not one of this module's typed
+ * errors). The underlying cause, when any, is on `cause`.
+ */
+export class WorkloadIdentityRuntimeError extends Error {
+    constructor(message, options) {
+        super(message);
+        this.name = "WorkloadIdentityRuntimeError";
+        this.source = options?.source;
+        this.cause = options?.cause;
+    }
+}
+export const DEFAULT_FILE_TOKEN_ENV_VARS = [
+    "KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE",
+    "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
+    "AWS_WEB_IDENTITY_TOKEN_FILE",
+    "AZURE_FEDERATED_TOKEN_FILE",
+];
+/** @internal Shared by FileTokenSource and the deprecated EKSWorkloadIdentity. */
+export function resolveTokenFilePath(discoveryEnvVars, options) {
+    if (options?.tokenFilePath) {
+        return options.tokenFilePath;
+    }
+    const envNames = options?.envVarName
+        ? [options.envVarName, ...discoveryEnvVars]
+        : discoveryEnvVars;
+    const found = envNames.find((name) => process.env[name]);
+    if (!found || !process.env[found]) {
+        throw new WorkloadIdentityConfigurationError(`Could not find token file path in environment variables; checked: ${envNames.join(", ")}`, { source: WORKLOAD_IDENTITY_SOURCE_FILE });
+    }
+    return process.env[found];
+}
+function readTokenFile(tokenFilePath, errorClass) {
+    let contents;
+    try {
+        contents = fs.readFileSync(tokenFilePath, "utf-8");
+    }
+    catch (error) {
+        throw new errorClass(`Error reading token file: ${tokenFilePath}`, {
+            source: WORKLOAD_IDENTITY_SOURCE_FILE,
+            cause: error,
+        });
+    }
+    const token = contents.trim();
+    if (!token) {
+        throw new errorClass(`Token file is empty: ${tokenFilePath}`, {
+            source: WORKLOAD_IDENTITY_SOURCE_FILE,
+        });
+    }
+    return token;
+}
+/**
+ * Reads a platform-projected OIDC token from a mounted file, fresh on every
+ * call (platforms rotate projected tokens). Covers EKS pod identity, AKS
+ * workload identity, any Kubernetes projected service-account token, and CI
+ * providers that write the token to a file.
+ *
+ * When no explicit path is given, the path is discovered from the first set
+ * environment variable: the variable named by `envVarName` when given, then
+ * KEYCARD_EKS_WORKLOAD_IDENTITY_TOKEN_FILE, AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE,
+ * AWS_WEB_IDENTITY_TOKEN_FILE, and AZURE_FEDERATED_TOKEN_FILE.
+ *
+ * **Requires Node.js.** Validates at construction that the resolved file
+ * exists and is non-empty.
+ */
+export class FileTokenSource {
+    constructor(options) {
+        _FileTokenSource_tokenFilePath.set(this, void 0);
+        __classPrivateFieldSet(this, _FileTokenSource_tokenFilePath, resolveTokenFilePath(DEFAULT_FILE_TOKEN_ENV_VARS, options), "f");
+        readTokenFile(__classPrivateFieldGet(this, _FileTokenSource_tokenFilePath, "f"), WorkloadIdentityConfigurationError);
+    }
+    /** Re-reads the token file and returns its trimmed contents. */
+    async identityToken() {
+        return readTokenFile(__classPrivateFieldGet(this, _FileTokenSource_tokenFilePath, "f"), WorkloadIdentityRuntimeError);
+    }
+}
+_FileTokenSource_tokenFilePath = new WeakMap();
+const DEFAULT_GCP_METADATA_URL = "http://metadata.google.internal";
+const DEFAULT_GCP_TIMEOUT_MS = 5000;
+const GCP_IDENTITY_PATH = "/computeMetadata/v1/instance/service-accounts/default/identity";
+/**
+ * Fetches an OIDC identity token for the default service account from the
+ * GCP metadata server. Covers GKE, GCE, and Cloud Run.
+ */
+export class GCPMetadataTokenSource {
+    constructor(options) {
+        _GCPMetadataTokenSource_audience.set(this, void 0);
+        _GCPMetadataTokenSource_metadataUrl.set(this, void 0);
+        _GCPMetadataTokenSource_timeoutMs.set(this, void 0);
+        if (!options.audience || !options.audience.trim()) {
+            throw new WorkloadIdentityConfigurationError("audience must not be empty", {
+                source: WORKLOAD_IDENTITY_SOURCE_GCP_METADATA,
+            });
+        }
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_audience, options.audience, "f");
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_metadataUrl, (options.metadataUrl ?? DEFAULT_GCP_METADATA_URL).replace(/\/$/, ""), "f");
+        __classPrivateFieldSet(this, _GCPMetadataTokenSource_timeoutMs, options.timeoutMs ?? DEFAULT_GCP_TIMEOUT_MS, "f");
+    }
+    /** Requests a GCP-signed OIDC JWT from the metadata server. */
+    async identityToken() {
+        const url = `${__classPrivateFieldGet(this, _GCPMetadataTokenSource_metadataUrl, "f")}${GCP_IDENTITY_PATH}` +
+            `?audience=${encodeURIComponent(__classPrivateFieldGet(this, _GCPMetadataTokenSource_audience, "f"))}&format=full`;
+        let response;
+        let body;
+        try {
+            response = await fetch(url, {
+                headers: { "Metadata-Flavor": "Google" },
+                signal: AbortSignal.timeout(__classPrivateFieldGet(this, _GCPMetadataTokenSource_timeoutMs, "f")),
+            });
+            body = await response.text();
+        }
+        catch (error) {
+            throw new WorkloadIdentityRuntimeError(`Error calling metadata server at ${__classPrivateFieldGet(this, _GCPMetadataTokenSource_metadataUrl, "f")} (is this running on GCP?)`, { source: WORKLOAD_IDENTITY_SOURCE_GCP_METADATA, cause: error });
+        }
+        if (!response.ok) {
+            throw new WorkloadIdentityRuntimeError(`Metadata server returned status ${response.status}`, { source: WORKLOAD_IDENTITY_SOURCE_GCP_METADATA });
+        }
+        const token = body.trim();
+        if (!token) {
+            throw new WorkloadIdentityRuntimeError("Metadata server returned an empty token", {
+                source: WORKLOAD_IDENTITY_SOURCE_GCP_METADATA,
+            });
+        }
+        return token;
+    }
+}
+_GCPMetadataTokenSource_audience = new WeakMap(), _GCPMetadataTokenSource_metadataUrl = new WeakMap(), _GCPMetadataTokenSource_timeoutMs = new WeakMap();
+const DEFAULT_FLY_SOCKET_PATH = "/.fly/api";
+const FLY_TOKEN_PATH = "/v1/tokens/oidc";
+const FLY_TIMEOUT_MS = 5000;
+/**
+ * Fetches an OIDC token from the Fly.io Machines API over the local Unix
+ * socket. Covers workloads running on Fly Machines.
+ *
+ * **Requires Node.js** (Unix domain sockets). The socket is not probed at
+ * construction; an unreachable Machines API surfaces as a
+ * WorkloadIdentityRuntimeError at the first fetch.
+ */
+export class FlyTokenSource {
+    constructor(options) {
+        _FlyTokenSource_audience.set(this, void 0);
+        _FlyTokenSource_socketPath.set(this, void 0);
+        __classPrivateFieldSet(this, _FlyTokenSource_audience, options?.audience, "f");
+        __classPrivateFieldSet(this, _FlyTokenSource_socketPath, options?.socketPath ?? DEFAULT_FLY_SOCKET_PATH, "f");
+    }
+    /** Requests a Fly-signed OIDC JWT from the Machines API. */
+    async identityToken() {
+        const http = await import("node:http");
+        const payload = JSON.stringify(__classPrivateFieldGet(this, _FlyTokenSource_audience, "f") ? { aud: __classPrivateFieldGet(this, _FlyTokenSource_audience, "f") } : {});
+        return new Promise((resolve, reject) => {
+            const request = http.request({
+                socketPath: __classPrivateFieldGet(this, _FlyTokenSource_socketPath, "f"),
+                path: FLY_TOKEN_PATH,
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "Content-Length": Buffer.byteLength(payload),
+                },
+                timeout: FLY_TIMEOUT_MS,
+            }, (response) => {
+                const chunks = [];
+                response.on("data", (chunk) => chunks.push(chunk));
+                response.on("end", () => {
+                    if (response.statusCode !== 200) {
+                        reject(new WorkloadIdentityRuntimeError(`Machines API returned status ${response.statusCode}`, { source: WORKLOAD_IDENTITY_SOURCE_FLY }));
+                        return;
+                    }
+                    const token = Buffer.concat(chunks).toString("utf-8").trim();
+                    if (!token) {
+                        reject(new WorkloadIdentityRuntimeError("Machines API returned an empty token", {
+                            source: WORKLOAD_IDENTITY_SOURCE_FLY,
+                        }));
+                        return;
+                    }
+                    resolve(token);
+                });
+            });
+            request.on("error", (error) => {
+                if (error instanceof WorkloadIdentityRuntimeError) {
+                    reject(error);
+                    return;
+                }
+                reject(new WorkloadIdentityRuntimeError(`Error calling Machines API socket ${__classPrivateFieldGet(this, _FlyTokenSource_socketPath, "f")} (is this running on a Fly Machine?)`, { source: WORKLOAD_IDENTITY_SOURCE_FLY, cause: error }));
+            });
+            request.on("timeout", () => {
+                request.destroy(new WorkloadIdentityRuntimeError(`Machines API request timed out after ${FLY_TIMEOUT_MS}ms`, { source: WORKLOAD_IDENTITY_SOURCE_FLY }));
+            });
+            request.write(payload);
+            request.end();
+        });
+    }
+}
+_FlyTokenSource_audience = new WeakMap(), _FlyTokenSource_socketPath = new WeakMap();
+/**
+ * Workload identity credential using a platform-signed OIDC token obtained
+ * from a {@link IdentityTokenSource}. On every token exchange it fetches the
+ * current token from the source and attaches it as a jwt-bearer client
+ * assertion. It holds no shared secret and never caches the token across
+ * requests.
+ *
+ * @example
+ * // EKS / AKS / Kubernetes projected token (path discovered from env)
+ * const credential = new WorkloadIdentity(new FileTokenSource());
+ *
+ * // GKE / GCE / Cloud Run
+ * const credential = new WorkloadIdentity(
+ *   new GCPMetadataTokenSource({ audience: "https://zone.keycard.cloud" }),
+ * );
+ *
+ * // Custom fetch
+ * const credential = new WorkloadIdentity(() => fetchMyToken());
+ */
+export class WorkloadIdentity {
+    constructor(source, options) {
+        _WorkloadIdentity_instances.add(this);
+        _WorkloadIdentity_source.set(this, void 0);
+        _WorkloadIdentity_clientId.set(this, void 0);
+        if (source == null) {
+            throw new WorkloadIdentityConfigurationError("identity token source must not be null");
+        }
+        if (typeof source !== "function" &&
+            typeof source.identityToken !== "function") {
+            throw new WorkloadIdentityConfigurationError("identity token source must provide identityToken() or be a function");
+        }
+        __classPrivateFieldSet(this, _WorkloadIdentity_source, source, "f");
+        __classPrivateFieldSet(this, _WorkloadIdentity_clientId, options?.clientId, "f");
+    }
+    getAuth() {
+        return null;
+    }
+    async prepareTokenExchangeRequest(subjectToken, resource) {
+        const assertion = await __classPrivateFieldGet(this, _WorkloadIdentity_instances, "m", _WorkloadIdentity_fetchIdentityToken).call(this);
+        return {
+            subjectToken,
+            resource,
+            subjectTokenType: "urn:ietf:params:oauth:token-type:access_token",
+            clientAssertionType: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+            clientAssertion: assertion,
+            clientId: __classPrivateFieldGet(this, _WorkloadIdentity_clientId, "f"),
+        };
+    }
+}
+_WorkloadIdentity_source = new WeakMap(), _WorkloadIdentity_clientId = new WeakMap(), _WorkloadIdentity_instances = new WeakSet(), _WorkloadIdentity_fetchIdentityToken = async function _WorkloadIdentity_fetchIdentityToken() {
+    let token;
+    try {
+        token =
+            typeof __classPrivateFieldGet(this, _WorkloadIdentity_source, "f") === "function"
+                ? await __classPrivateFieldGet(this, _WorkloadIdentity_source, "f").call(this)
+                : await __classPrivateFieldGet(this, _WorkloadIdentity_source, "f").identityToken();
+    }
+    catch (error) {
+        if (error instanceof WorkloadIdentityConfigurationError ||
+            error instanceof WorkloadIdentityRuntimeError) {
+            throw error;
+        }
+        throw new WorkloadIdentityRuntimeError("Error fetching identity token", {
+            source: WORKLOAD_IDENTITY_SOURCE_CUSTOM,
+            cause: error,
+        });
+    }
+    if (typeof token !== "string" || !token.trim()) {
+        throw new WorkloadIdentityRuntimeError("Identity token source returned an empty token", {
+            source: WORKLOAD_IDENTITY_SOURCE_CUSTOM,
+        });
+    }
+    return token;
+};
+//# sourceMappingURL=workloadIdentity.js.map

package/dist/esm/server/workloadIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workloadIdentity.js","sourceRoot":"","sources":["../../../src/server/workloadIdentity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAI9B;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,qCAAqC,GAAG,cAAc,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAClD,MAAM,CAAC,MAAM,+BAA+B,GAAG,QAAQ,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAI3D,YAAY,OAAe,EAAE,OAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAIrD,YAAY,OAAe,EAAE,OAA8C;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;CACF;AAsBD,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,0CAA0C;IAC1C,wCAAwC;IACxC,6BAA6B;IAC7B,4BAA4B;CAC7B,CAAC;AASF,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAClC,gBAA0B,EAC1B,OAAgC;IAEhC,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU;QAClC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,gBAAgB,CAAC;QAC3C,CAAC,CAAC,gBAAgB,CAAC;IACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,kCAAkC,CAC1C,qEAAqE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1F,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAW,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CACpB,aAAqB,EACrB,UAEuC;IAEvC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAAC,6BAA6B,aAAa,EAAE,EAAE;YACjE,MAAM,EAAE,6BAA6B;YACrC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,wBAAwB,aAAa,EAAE,EAAE;YAC5D,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,eAAe;IAG1B,YAAY,OAAgC;QAF5C,iDAAuB;QAGrB,uBAAA,IAAI,kCAAkB,oBAAoB,CAAC,2BAA2B,EAAE,OAAO,CAAC,MAAA,CAAC;QACjF,aAAa,CAAC,uBAAA,IAAI,sCAAe,EAAE,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,aAAa;QACjB,OAAO,aAAa,CAAC,uBAAA,IAAI,sCAAe,EAAE,4BAA4B,CAAC,CAAC;IAC1E,CAAC;CACF;;AAWD,MAAM,wBAAwB,GAAG,iCAAiC,CAAC;AACnE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,iBAAiB,GAAG,gEAAgE,CAAC;AAE3F;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IAKjC,YAAY,OAAsC;QAJlD,mDAAkB;QAClB,sDAAqB;QACrB,oDAAmB;QAGjB,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,kCAAkC,CAAC,4BAA4B,EAAE;gBACzE,MAAM,EAAE,qCAAqC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,uBAAA,IAAI,oCAAa,OAAO,CAAC,QAAQ,MAAA,CAAC;QAClC,uBAAA,IAAI,uCAAgB,CAAC,OAAO,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,MAAA,CAAC;QACzF,uBAAA,IAAI,qCAAc,OAAO,CAAC,SAAS,IAAI,sBAAsB,MAAA,CAAC;IAChE,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GACP,GAAG,uBAAA,IAAI,2CAAa,GAAG,iBAAiB,EAAE;YAC1C,aAAa,kBAAkB,CAAC,uBAAA,IAAI,wCAAU,CAAC,cAAc,CAAC;QAEhE,IAAI,QAAkB,CAAC;QACvB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC1B,OAAO,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE;gBACxC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAA,IAAI,yCAAW,CAAC;aAC7C,CAAC,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAA4B,CACpC,oCAAoC,uBAAA,IAAI,2CAAa,4BAA4B,EACjF,EAAE,MAAM,EAAE,qCAAqC,EAAE,KAAK,EAAE,KAAK,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,4BAA4B,CACpC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,EACpD,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAClD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,4BAA4B,CAAC,yCAAyC,EAAE;gBAChF,MAAM,EAAE,qCAAqC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;;AASD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAIzB,YAAY,OAA+B;QAH3C,2CAAmB;QACnB,6CAAoB;QAGlB,uBAAA,IAAI,4BAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,8BAAe,OAAO,EAAE,UAAU,IAAI,uBAAuB,MAAA,CAAC;IACpE,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAA,IAAI,gCAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,uBAAA,IAAI,gCAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE9E,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAC1B;gBACE,UAAU,EAAE,uBAAA,IAAI,kCAAY;gBAC5B,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;iBAC7C;gBACD,OAAO,EAAE,cAAc;aACxB,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3D,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACtB,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;wBAChC,MAAM,CACJ,IAAI,4BAA4B,CAC9B,gCAAgC,QAAQ,CAAC,UAAU,EAAE,EACrD,EAAE,MAAM,EAAE,4BAA4B,EAAE,CACzC,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,CACJ,IAAI,4BAA4B,CAAC,sCAAsC,EAAE;4BACvE,MAAM,EAAE,4BAA4B;yBACrC,CAAC,CACH,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;oBAClD,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,MAAM,CACJ,IAAI,4BAA4B,CAC9B,qCAAqC,uBAAA,IAAI,kCAAY,sCAAsC,EAC3F,EAAE,MAAM,EAAE,4BAA4B,EAAE,KAAK,EAAE,KAAK,EAAE,CACvD,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACzB,OAAO,CAAC,OAAO,CACb,IAAI,4BAA4B,CAC9B,wCAAwC,cAAc,IAAI,EAC1D,EAAE,MAAM,EAAE,4BAA4B,EAAE,CACzC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,gBAAgB;IAI3B,YACE,MAAkD,EAClD,OAAiC;;QALnC,2CAAoD;QACpD,6CAAmB;QAMjB,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,kCAAkC,CAAC,wCAAwC,CAAC,CAAC;QACzF,CAAC;QACD,IACE,OAAO,MAAM,KAAK,UAAU;YAC5B,OAAQ,MAA8B,CAAC,aAAa,KAAK,UAAU,EACnE,CAAC;YACD,MAAM,IAAI,kCAAkC,CAC1C,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,8BAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;IACrC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,YAAoB,EACpB,QAAgB;QAEhB,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,yEAAoB,MAAxB,IAAI,CAAsB,CAAC;QAEnD,OAAO;YACL,YAAY;YACZ,QAAQ;YACR,gBAAgB,EAAE,+CAA+C;YACjE,mBAAmB,EAAE,wDAAwD;YAC7E,eAAe,EAAE,SAAS;YAC1B,QAAQ,EAAE,uBAAA,IAAI,kCAAU;SACzB,CAAC;IACJ,CAAC;CA4BF;0KA1BC,KAAK;IACH,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK;YACH,OAAO,uBAAA,IAAI,gCAAQ,KAAK,UAAU;gBAChC,CAAC,CAAC,MAAM,uBAAA,IAAI,gCAAQ,MAAZ,IAAI,CAAU;gBACtB,CAAC,CAAC,MAAM,uBAAA,IAAI,gCAAQ,CAAC,aAAa,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,kCAAkC;YACnD,KAAK,YAAY,4BAA4B,EAC7C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,4BAA4B,CAAC,+BAA+B,EAAE;YACtE,MAAM,EAAE,+BAA+B;YACvC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,4BAA4B,CAAC,+CAA+C,EAAE;YACtF,MAAM,EAAE,+BAA+B;SACxC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/esm/tokenExchange.d.ts

@@ -20,6 +20,12 @@ export interface TokenExchangeRequest {
     actorTokenType?: string;
     clientAssertion?: string;
     clientAssertionType?: string;
+    /**
+     * Names the application credential the client authenticates as, sent as
+     * the client_id form parameter. Used with assertion-based credentials that
+     * are resolved by ID rather than by the assertion's subject.
+     */
+    clientId?: string;
 }
 export interface TokenResponse {
     accessToken: string;

package/dist/esm/tokenExchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAO9D,eAAO,MAAM,SAAS;;IAEpB;;;OAGG;;CAEK,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAyBD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,CAqBrF;AAMD,qBAAa,mBAAmB;;gBAQlB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAO1D,aAAa,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC;IA+CnB,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+BlE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAuB1C"}
+{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAO9D,eAAO,MAAM,SAAS;;IAEpB;;;OAGG;;CAEK,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA0BD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,CAqBrF;AAMD,qBAAa,mBAAmB;;gBAQlB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAO1D,aAAa,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC;IA+CnB,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IA+BlE;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAuB1C"}

package/dist/esm/tokenExchange.js

@@ -48,6 +48,8 @@ function serializeRequest(request) {
         params.set("client_assertion", request.clientAssertion);
     if (request.clientAssertionType)
         params.set("client_assertion_type", request.clientAssertionType);
+    if (request.clientId)
+        params.set("client_id", request.clientId);
     return params;
 }
 export function deserializeTokenResponse(json) {

package/dist/esm/tokenExchange.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,YAAY,EAAE,+CAA+C;IAC7D;;;OAGG;IACH,eAAe,EAAE,qDAAqD;CAC9D,CAAC;AAoDX,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,SAAS,gBAAgB,CAAC,OAA6B;IACrD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,IAAI,iDAAiD,CAAC,CAAC;IACjG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,gBAAgB,IAAI,+CAA+C,CAAC,CAAC;IAE9G,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,mBAAmB;QAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAElG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAA6B;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,WAAW;QACX,6EAA6E;QAC7E,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;KAC5E,CAAC;IAEF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QAAE,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACvF,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;QAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClG,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,OAAO,mBAAmB;IAQ9B,YAAY,MAAc,EAAE,OAAoC;;QAPhE,8CAAgB;QAChB,gDAAmB;QACnB,oDAAuB;QACvB,kDAAoC;QACpC,qDAAwB;QACxB,wDAAoC;QAGlC,uBAAA,IAAI,+BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,iCAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,qCAAiB,OAAO,EAAE,YAAY,MAAA,CAAC;QAC3C,uBAAA,IAAI,mCAAe,OAAO,EAAE,UAAU,MAAA,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAA6B,EAC7B,OAAyB;QAEzB,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;QACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,MAAM,SAAS,GAAG,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,EAAmB,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;gBACnE,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;oBAClC,MAAM,WAAW,GAAG,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ;wBACjE,CAAC,CAAC,SAAS,CAAC,iBAAiB;wBAC7B,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;wBACtD,CAAC,CAAC,SAAS,CAAC,SAAS;wBACrB,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,UAAU;oBAAE,MAAM,CAAC,CAAC;gBACrC,4CAA4C;YAC9C,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,kBAAkB,EAClB,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAC9D,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB;QACvC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,aAAa,CACvB;YACE,YAAY;YACZ,gBAAgB,EAAE,SAAS,CAAC,eAAe;YAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,EACD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAC;IACJ,CAAC;IAcD;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,OAAO,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;IAClC,CAAC;CAqBF;kbAvCG,MAA0B;IAE1B,IAAI,uBAAA,IAAI,uCAAY,EAAE,CAAC;QACrB,OAAO,uBAAA,IAAI,uCAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,uBAAA,IAAI,qCAAU,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,uBAAA,IAAI,qCAAU,EAAE,YAAY,EAAE,uBAAA,IAAI,yCAAc,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,0CAWD,KAAK;IACH,IAAI,uBAAA,IAAI,0CAAe,EAAE,CAAC;QACxB,OAAO,uBAAA,IAAI,0CAAe,CAAC;IAC7B,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,uBAAA,IAAI,6CAAkB,EAAE,CAAC;QAC5B,uBAAA,IAAI,yCAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC,uBAAA,IAAI,mCAAQ,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,uBAAA,IAAI,mCAAQ,uCAAuC,CAAC,CAAC;YAChG,CAAC;YACD,uBAAA,IAAI,sCAAkB,QAAQ,CAAC,cAAc,MAAA,CAAC;YAC9C,OAAO,uBAAA,IAAI,0CAAe,CAAC;QAC7B,CAAC,CAAC,EAAE,MAAA,CAAC;IACP,CAAC;IAED,OAAO,uBAAA,IAAI,6CAAkB,CAAC;AAChC,CAAC"}
+{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,YAAY,EAAE,+CAA+C;IAC7D;;;OAGG;IACH,eAAe,EAAE,qDAAqD;CAC9D,CAAC;AA0DX,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,SAAS,gBAAgB,CAAC,OAA6B;IACrD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,IAAI,iDAAiD,CAAC,CAAC;IACjG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,gBAAgB,IAAI,+CAA+C,CAAC,CAAC;IAE9G,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,mBAAmB;QAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEhE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAA6B;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,WAAW;QACX,6EAA6E;QAC7E,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;KAC5E,CAAC;IAEF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QAAE,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACvF,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;QAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClG,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,OAAO,mBAAmB;IAQ9B,YAAY,MAAc,EAAE,OAAoC;;QAPhE,8CAAgB;QAChB,gDAAmB;QACnB,oDAAuB;QACvB,kDAAoC;QACpC,qDAAwB;QACxB,wDAAoC;QAGlC,uBAAA,IAAI,+BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,iCAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,qCAAiB,OAAO,EAAE,YAAY,MAAA,CAAC;QAC3C,uBAAA,IAAI,mCAAe,OAAO,EAAE,UAAU,MAAA,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAA6B,EAC7B,OAAyB;QAEzB,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;QACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,MAAM,SAAS,GAAG,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,EAAmB,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;gBACnE,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;oBAClC,MAAM,WAAW,GAAG,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ;wBACjE,CAAC,CAAC,SAAS,CAAC,iBAAiB;wBAC7B,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;wBACtD,CAAC,CAAC,SAAS,CAAC,SAAS;wBACrB,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,UAAU;oBAAE,MAAM,CAAC,CAAC;gBACrC,4CAA4C;YAC9C,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,kBAAkB,EAClB,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAC9D,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB;QACvC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,aAAa,CACvB;YACE,YAAY;YACZ,gBAAgB,EAAE,SAAS,CAAC,eAAe;YAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,EACD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAC;IACJ,CAAC;IAcD;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,OAAO,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;IAClC,CAAC;CAqBF;kbAvCG,MAA0B;IAE1B,IAAI,uBAAA,IAAI,uCAAY,EAAE,CAAC;QACrB,OAAO,uBAAA,IAAI,uCAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,uBAAA,IAAI,qCAAU,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,uBAAA,IAAI,qCAAU,EAAE,YAAY,EAAE,uBAAA,IAAI,yCAAc,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,0CAWD,KAAK;IACH,IAAI,uBAAA,IAAI,0CAAe,EAAE,CAAC;QACxB,OAAO,uBAAA,IAAI,0CAAe,CAAC;IAC7B,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,uBAAA,IAAI,6CAAkB,EAAE,CAAC;QAC5B,uBAAA,IAAI,yCAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC,uBAAA,IAAI,mCAAQ,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,uBAAA,IAAI,mCAAQ,uCAAuC,CAAC,CAAC;YAChG,CAAC;YACD,uBAAA,IAAI,sCAAkB,QAAQ,CAAC,cAAc,MAAA,CAAC;YAC9C,OAAO,uBAAA,IAAI,0CAAe,CAAC;QAC7B,CAAC,CAAC,EAAE,MAAA,CAAC;IACP,CAAC;IAED,OAAO,uBAAA,IAAI,6CAAkB,CAAC;AAChC,CAAC"}

package/dist/esm/userinfo.d.ts

@@ -0,0 +1,35 @@
+import { type OAuthAuthorizationServerMetadata } from "./discovery.js";
+/**
+ * Claims returned by the UserInfo endpoint (OIDC Core 1.0 §5.3).
+ *
+ * Claims are returned exactly as the provider sent them: nothing is filtered
+ * to a known set. `sub` is the only claim OIDC requires and is validated
+ * present.
+ */
+export interface UserInfoResponse {
+    sub: string;
+    /** The full claims document as returned, `sub` included. */
+    claims: Record<string, unknown>;
+}
+export interface FetchUserInfoOptions {
+    /** Pre-discovered metadata. When set, no discovery request is made. */
+    metadata?: OAuthAuthorizationServerMetadata;
+    signal?: AbortSignal;
+}
+/**
+ * Fetch the signed-in user's identity claims from the issuer's UserInfo
+ * endpoint (OIDC Core 1.0 §5.3).
+ *
+ * Keycard zone access tokens are authorization-only: identity claims such as
+ * `email` or `groups` are not in the token and live behind the issuer's
+ * `userinfo_endpoint`. The endpoint is resolved by discovery unless
+ * `options.metadata` is supplied, in which case the caller owns caching and
+ * refreshing that metadata.
+ *
+ * The access token is presented as a Bearer credential; the request carries no
+ * client authentication, because UserInfo authenticates the user, not the
+ * client. Signed (`application/jwt`) responses are not supported. Nothing is
+ * cached: caching claims per token is the caller's concern.
+ */
+export declare function fetchUserInfo(issuer: string, accessToken: string, options?: FetchUserInfoOptions): Promise<UserInfoResponse>;
+//# sourceMappingURL=userinfo.d.ts.map

package/dist/esm/userinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../src/userinfo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAGzG;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,QAAQ,CAAC,EAAE,gCAAgC,CAAC;IAC5C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AASD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CAuE3B"}

package/dist/esm/userinfo.js

@@ -0,0 +1,76 @@
+import { fetchAuthorizationServerMetadata } from "./discovery.js";
+import { HTTPError, InsufficientScopeError, InvalidTokenError, OAuthError } from "./errors.js";
+/** Extract the RFC 6750 §3 `error` code from a `WWW-Authenticate` challenge. */
+function challengeError(wwwAuthenticate) {
+    if (!wwwAuthenticate)
+        return "invalid_token";
+    const match = /error\s*=\s*"?([^",\s]+)"?/.exec(wwwAuthenticate);
+    return match ? match[1] : "invalid_token";
+}
+/**
+ * Fetch the signed-in user's identity claims from the issuer's UserInfo
+ * endpoint (OIDC Core 1.0 §5.3).
+ *
+ * Keycard zone access tokens are authorization-only: identity claims such as
+ * `email` or `groups` are not in the token and live behind the issuer's
+ * `userinfo_endpoint`. The endpoint is resolved by discovery unless
+ * `options.metadata` is supplied, in which case the caller owns caching and
+ * refreshing that metadata.
+ *
+ * The access token is presented as a Bearer credential; the request carries no
+ * client authentication, because UserInfo authenticates the user, not the
+ * client. Signed (`application/jwt`) responses are not supported. Nothing is
+ * cached: caching claims per token is the caller's concern.
+ */
+export async function fetchUserInfo(issuer, accessToken, options = {}) {
+    const metadata = options.metadata
+        ?? await fetchAuthorizationServerMetadata(issuer, { signal: options.signal });
+    if (!metadata.userinfo_endpoint) {
+        throw new Error(`Authorization server "${issuer}" does not advertise a userinfo_endpoint`);
+    }
+    const response = await fetch(metadata.userinfo_endpoint, {
+        method: "GET",
+        headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${accessToken}`,
+        },
+        signal: options.signal,
+    });
+    if (response.status === 401) {
+        const errorCode = challengeError(response.headers.get("www-authenticate"));
+        const message = `UserInfo request rejected with "${errorCode}": the access token is expired, ` +
+            "revoked, or not accepted at the UserInfo endpoint";
+        if (errorCode === "insufficient_scope") {
+            throw new InsufficientScopeError(message);
+        }
+        if (errorCode === "invalid_token") {
+            throw new InvalidTokenError(message);
+        }
+        throw new OAuthError(errorCode, message);
+    }
+    if (!response.ok) {
+        throw new HTTPError(`UserInfo request to "${metadata.userinfo_endpoint}" failed (HTTP ${response.status})`);
+    }
+    const contentType = response.headers.get("content-type") ?? "";
+    if (contentType.toLowerCase().includes("application/jwt")) {
+        throw new OAuthError("invalid_response", `Unsupported UserInfo response content type "${contentType}": signed and ` +
+            "encrypted UserInfo responses are not supported");
+    }
+    let json;
+    try {
+        json = await response.json();
+    }
+    catch {
+        throw new OAuthError("invalid_response", "Malformed JSON in UserInfo response");
+    }
+    if (!json || typeof json !== "object" || Array.isArray(json)) {
+        throw new OAuthError("invalid_response", "UserInfo response must be a JSON object of claims");
+    }
+    const claims = json;
+    const sub = claims.sub;
+    if (typeof sub !== "string" || sub.length === 0) {
+        throw new OAuthError("invalid_response", "UserInfo response must include a 'sub' claim");
+    }
+    return { sub, claims };
+}
+//# sourceMappingURL=userinfo.js.map

package/dist/esm/userinfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.js","sourceRoot":"","sources":["../../src/userinfo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAyC,MAAM,gBAAgB,CAAC;AACzG,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqB/F,gFAAgF;AAChF,SAAS,cAAc,CAAC,eAA8B;IACpD,IAAI,CAAC,eAAe;QAAE,OAAO,eAAe,CAAC;IAC7C,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,WAAmB,EACnB,UAAgC,EAAE;IAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ;WAC5B,MAAM,gCAAgC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEhF,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,0CAA0C,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE;QACvD,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3E,MAAM,OAAO,GACX,mCAAmC,SAAS,kCAAkC;YAC9E,mDAAmD,CAAC;QACtD,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,SAAS,CACjB,wBAAwB,QAAQ,CAAC,iBAAiB,kBAAkB,QAAQ,CAAC,MAAM,GAAG,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,UAAU,CAClB,kBAAkB,EAClB,+CAA+C,WAAW,gBAAgB;YAC1E,gDAAgD,CACjD,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAa,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,UAAU,CAClB,kBAAkB,EAClB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,UAAU,CAClB,kBAAkB,EAClB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC"}

package/dist/esm/webApp.d.ts

@@ -0,0 +1,78 @@
+import { type OAuthAuthorizationServerMetadata } from "./discovery.js";
+import type { TokenResponse } from "./tokenExchange.js";
+export interface BeginAuthorizationOptions {
+    clientId: string;
+    /** Registered redirect URI handled by the web application. */
+    redirectUri: string;
+    /**
+     * Protected resources the authorization is targeting. Each entry is sent as
+     * its own RFC 8707 `resource` parameter, so one authorization can cover
+     * several resources and the issued token's audience covers all of them.
+     */
+    resources?: readonly string[];
+    scopes?: readonly string[];
+    /** Pre-discovered metadata. When set, no discovery request is made. */
+    metadata?: OAuthAuthorizationServerMetadata;
+    signal?: AbortSignal;
+}
+export interface AuthorizationRedirect {
+    /** The authorization URL to redirect the user's browser to. */
+    url: string;
+    /** Generated CSRF value to store until the callback. */
+    state: string;
+    /** Generated PKCE verifier to store until the callback; never send it to the browser. */
+    codeVerifier: string;
+    /**
+     * The resources the authorization request was scoped to. They are not needed
+     * to redeem the code — the authorization server derives the issued token's
+     * audience from the code itself — but applications commonly need to know
+     * which resources a session was authorized for.
+     */
+    resources: string[];
+}
+export interface CompleteAuthorizationOptions {
+    /** Query parameters the callback route received. */
+    callbackParams: URLSearchParams | Record<string, string>;
+    /** The `state` stored at the begin step. */
+    state: string;
+    /** The `codeVerifier` stored at the begin step. */
+    codeVerifier: string;
+    clientId: string;
+    /** The same registered redirect URI used at the begin step. */
+    redirectUri: string;
+    /** Client secret for confidential clients. Public clients omit it. */
+    clientSecret?: string;
+    /** Pre-discovered metadata. When set, no discovery request is made. */
+    metadata?: OAuthAuthorizationServerMetadata;
+    signal?: AbortSignal;
+}
+/**
+ * Begin a web-app authorization-code-with-PKCE flow.
+ *
+ * For applications that own a registered redirect URI and receive the callback
+ * on their own route, where the loopback listener `authenticate()` runs is
+ * wrong. Generates the PKCE pair and a CSRF `state`, resolves the
+ * `authorization_endpoint` by discovery, and builds the authorization URL with
+ * one `resource` parameter per entry of `resources`.
+ *
+ * The SDK holds no state between begin and complete: where `state` and
+ * `codeVerifier` live between the redirect and the callback (a session, a
+ * signed cookie) is the application's concern, which is what makes the flow
+ * safe under concurrent sign-ins and multi-process servers.
+ */
+export declare function beginAuthorization(issuer: string, options: BeginAuthorizationOptions): Promise<AuthorizationRedirect>;
+/**
+ * Complete a web-app authorization-code-with-PKCE flow from the callback route.
+ *
+ * Callback validation happens before discovery or any token request: a
+ * callback carrying `error` throws `AuthorizationDeniedError`, a missing or
+ * non-matching `state` throws `StateMismatchError`, and a missing `code`
+ * throws `OAuthError("invalid_request")`.
+ *
+ * No RFC 8707 `resource` parameter is sent on the token request: the
+ * authorization server derives the issued token's audience from the
+ * authorization code, which already records the resources authorized at the
+ * begin step.
+ */
+export declare function completeAuthorization(issuer: string, options: CompleteAuthorizationOptions): Promise<TokenResponse>;
+//# sourceMappingURL=webApp.d.ts.map

package/dist/esm/webApp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webApp.d.ts","sourceRoot":"","sources":["../../src/webApp.ts"],"names":[],"mappings":"AACA,OAAO,EAAoC,KAAK,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAGzG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMxD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,gCAAgC,CAAC;IAC5C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,oDAAoD;IACpD,cAAc,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzD,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,gCAAgC,CAAC;IAC5C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,qBAAqB,CAAC,CA0BhC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,aAAa,CAAC,CAmCxB"}