@keycardai/oauth 0.3.0 → 0.4.1

package/dist/cjs/server/clientSecret.js

@@ -0,0 +1,76 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _ClientSecret_zoneCredentials, _ClientSecret_isMultiZone;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientSecret = void 0;
+const ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+const DEFAULT_ZONE = "__default__";
+class ClientSecret {
+    constructor(arg1, arg2) {
+        _ClientSecret_zoneCredentials.set(this, void 0);
+        _ClientSecret_isMultiZone.set(this, void 0);
+        __classPrivateFieldSet(this, _ClientSecret_zoneCredentials, new Map(), "f");
+        if (typeof arg1 === "string") {
+            if (typeof arg2 !== "string") {
+                throw new TypeError("ClientSecret: client_secret is required when client_id is provided as a string");
+            }
+            __classPrivateFieldGet(this, _ClientSecret_zoneCredentials, "f").set(DEFAULT_ZONE, [arg1, arg2]);
+            __classPrivateFieldSet(this, _ClientSecret_isMultiZone, false, "f");
+            return;
+        }
+        if (Array.isArray(arg1)) {
+            const [clientId, clientSecret] = arg1;
+            if (typeof clientId !== "string" || typeof clientSecret !== "string") {
+                throw new TypeError("ClientSecret: tuple must be [clientId, clientSecret]");
+            }
+            __classPrivateFieldGet(this, _ClientSecret_zoneCredentials, "f").set(DEFAULT_ZONE, [clientId, clientSecret]);
+            __classPrivateFieldSet(this, _ClientSecret_isMultiZone, false, "f");
+            return;
+        }
+        if (arg1 && typeof arg1 === "object") {
+            for (const [zoneId, tuple] of Object.entries(arg1)) {
+                if (!Array.isArray(tuple) || typeof tuple[0] !== "string" || typeof tuple[1] !== "string") {
+                    throw new TypeError(`ClientSecret: zone "${zoneId}" must map to [clientId, clientSecret]`);
+                }
+                __classPrivateFieldGet(this, _ClientSecret_zoneCredentials, "f").set(zoneId, [tuple[0], tuple[1]]);
+            }
+            if (__classPrivateFieldGet(this, _ClientSecret_zoneCredentials, "f").size === 0) {
+                throw new TypeError("ClientSecret: zone-keyed credentials must contain at least one zone");
+            }
+            __classPrivateFieldSet(this, _ClientSecret_isMultiZone, true, "f");
+            return;
+        }
+        throw new TypeError("ClientSecret: unsupported credentials shape");
+    }
+    getAuth(zoneId) {
+        if (!__classPrivateFieldGet(this, _ClientSecret_isMultiZone, "f")) {
+            const tuple = __classPrivateFieldGet(this, _ClientSecret_zoneCredentials, "f").get(DEFAULT_ZONE);
+            return tuple ? { clientId: tuple[0], clientSecret: tuple[1] } : null;
+        }
+        if (!zoneId) {
+            return null;
+        }
+        const tuple = __classPrivateFieldGet(this, _ClientSecret_zoneCredentials, "f").get(zoneId);
+        return tuple ? { clientId: tuple[0], clientSecret: tuple[1] } : null;
+    }
+    async prepareTokenExchangeRequest(subjectToken, resource) {
+        return {
+            subjectToken,
+            resource,
+            subjectTokenType: ACCESS_TOKEN_TYPE,
+        };
+    }
+}
+exports.ClientSecret = ClientSecret;
+_ClientSecret_zoneCredentials = new WeakMap(), _ClientSecret_isMultiZone = new WeakMap();
+//# sourceMappingURL=clientSecret.js.map

package/dist/cjs/server/clientSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientSecret.js","sourceRoot":"","sources":["../../../src/server/clientSecret.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAGA,MAAM,iBAAiB,GAAG,+CAA+C,CAAC;AAC1E,MAAM,YAAY,GAAG,aAAa,CAAC;AAMnC,MAAa,YAAY;IAMvB,YACE,IAAsC,EACtC,IAAa;QAPf,gDAAgD;QAChD,4CAAsB;QAQpB,uBAAA,IAAI,iCAAoB,IAAI,GAAG,EAAE,MAAA,CAAC;QAElC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,SAAS,CAAC,gFAAgF,CAAC,CAAC;YACxG,CAAC;YACD,uBAAA,IAAI,qCAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACtD,uBAAA,IAAI,6BAAgB,KAAK,MAAA,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC;YACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACrE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;YAC9E,CAAC;YACD,uBAAA,IAAI,qCAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;YAClE,uBAAA,IAAI,6BAAgB,KAAK,MAAA,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1F,MAAM,IAAI,SAAS,CAAC,uBAAuB,MAAM,wCAAwC,CAAC,CAAC;gBAC7F,CAAC;gBACD,uBAAA,IAAI,qCAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,uBAAA,IAAI,qCAAiB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,SAAS,CAAC,qEAAqE,CAAC,CAAC;YAC7F,CAAC;YACD,uBAAA,IAAI,6BAAgB,IAAI,MAAA,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,CAAC,MAAe;QACrB,IAAI,CAAC,uBAAA,IAAI,iCAAa,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,uBAAA,IAAI,qCAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACtD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,uBAAA,IAAI,qCAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC/B,YAAoB,EACpB,QAAgB;QAEhB,OAAO;YACL,YAAY;YACZ,QAAQ;YACR,gBAAgB,EAAE,iBAAiB;SACpC,CAAC;IACJ,CAAC;CACF;AAtED,oCAsEC"}

package/dist/cjs/server/index.d.ts

@@ -0,0 +1,8 @@
+export { AccessContext } from "./accessContext.js";
+export type { ErrorDetail, AccessContextStatus } from "./accessContext.js";
+export type { AccessToken } from "./accessToken.js";
+export { TokenVerifier } from "./tokenVerifier.js";
+export type { TokenVerifierOptions } from "./tokenVerifier.js";
+export { ClientSecret } from "./clientSecret.js";
+export type { ClientSecretCredentials } from "./clientSecret.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/cjs/server/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientSecret = exports.TokenVerifier = exports.AccessContext = void 0;
+var accessContext_js_1 = require("./accessContext.js");
+Object.defineProperty(exports, "AccessContext", { enumerable: true, get: function () { return accessContext_js_1.AccessContext; } });
+var tokenVerifier_js_1 = require("./tokenVerifier.js");
+Object.defineProperty(exports, "TokenVerifier", { enumerable: true, get: function () { return tokenVerifier_js_1.TokenVerifier; } });
+var clientSecret_js_1 = require("./clientSecret.js");
+Object.defineProperty(exports, "ClientSecret", { enumerable: true, get: function () { return clientSecret_js_1.ClientSecret; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":";;;AAAA,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AAGtB,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AAEtB,qDAAiD;AAAxC,+GAAA,YAAY,OAAA"}

package/dist/cjs/server/tokenVerifier.d.ts

@@ -0,0 +1,49 @@
+import { type OAuthKeyring } from "../keyring.js";
+import type { AccessToken } from "./accessToken.js";
+export interface TokenVerifierOptions {
+    /**
+     * Issuer URL for the Keycard zone, e.g. "https://zone-id.keycard.cloud" for
+     * single-zone deployments. With `enableMultiZone: true`, this is the base
+     * URL whose host gets prefixed with the per-request zoneId.
+     */
+    issuer: string;
+    /**
+     * Required scopes. When set, every value must be present in the token's
+     * `scope` claim or verification returns null.
+     */
+    requiredScopes?: readonly string[];
+    /**
+     * Allowed signing algorithms. Defaults to ["RS256"].
+     */
+    allowedAlgorithms?: readonly string[];
+    /**
+     * When true, callers can supply a per-request zoneId via verifyTokenForZone.
+     * Each zone gets its own issuer URL and audience.
+     */
+    enableMultiZone?: boolean;
+    /**
+     * Audience to validate against. A single string applies to every zone.
+     * A `Record<zoneId, audience>` selects the audience per zone; if a request
+     * arrives for a zoneId with no entry in the dict, verification fails closed
+     * (returns null) rather than silently dropping audience validation.
+     */
+    audience?: string | Record<string, string>;
+    /**
+     * Custom keyring (e.g. for testing or shared caches). When omitted,
+     * a fresh JWKSOAuthKeyring is constructed.
+     */
+    keyring?: OAuthKeyring;
+}
+export declare class TokenVerifier {
+    #private;
+    constructor(options: TokenVerifierOptions);
+    verifyToken(token: string): Promise<AccessToken | null>;
+    verifyTokenForZone(token: string, zoneId: string): Promise<AccessToken | null>;
+    /**
+     * Flushes JWKS keys and discovery results from the underlying keyring.
+     * Use after a global key rotation. No-op if the injected keyring does
+     * not expose a `clear()` method.
+     */
+    clearCache(): void;
+}
+//# sourceMappingURL=tokenVerifier.d.ts.map

package/dist/cjs/server/tokenVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenVerifier.d.ts","sourceRoot":"","sources":["../../../src/server/tokenVerifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIpD,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;OAEG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C;;;OAGG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,qBAAa,aAAa;;gBAQZ,OAAO,EAAE,oBAAoB;IAYnC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAIvD,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAOpF;;;;OAIG;IACH,UAAU,IAAI,IAAI;CA8CnB"}

package/dist/cjs/server/tokenVerifier.js

@@ -0,0 +1,118 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _TokenVerifier_instances, _TokenVerifier_issuer, _TokenVerifier_requiredScopes, _TokenVerifier_allowedAlgorithms, _TokenVerifier_enableMultiZone, _TokenVerifier_audience, _TokenVerifier_keyring, _TokenVerifier_verify, _TokenVerifier_scopesSatisfied;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenVerifier = void 0;
+const verifier_js_1 = require("../jwt/verifier.js");
+const keyring_js_1 = require("../keyring.js");
+const DEFAULT_ALLOWED_ALGORITHMS = ["RS256"];
+class TokenVerifier {
+    constructor(options) {
+        _TokenVerifier_instances.add(this);
+        _TokenVerifier_issuer.set(this, void 0);
+        _TokenVerifier_requiredScopes.set(this, void 0);
+        _TokenVerifier_allowedAlgorithms.set(this, void 0);
+        _TokenVerifier_enableMultiZone.set(this, void 0);
+        _TokenVerifier_audience.set(this, void 0);
+        _TokenVerifier_keyring.set(this, void 0);
+        if (!options.issuer) {
+            throw new Error("TokenVerifier: issuer is required");
+        }
+        __classPrivateFieldSet(this, _TokenVerifier_issuer, options.issuer, "f");
+        __classPrivateFieldSet(this, _TokenVerifier_requiredScopes, options.requiredScopes ?? [], "f");
+        __classPrivateFieldSet(this, _TokenVerifier_allowedAlgorithms, options.allowedAlgorithms ?? DEFAULT_ALLOWED_ALGORITHMS, "f");
+        __classPrivateFieldSet(this, _TokenVerifier_enableMultiZone, options.enableMultiZone ?? false, "f");
+        __classPrivateFieldSet(this, _TokenVerifier_audience, options.audience, "f");
+        __classPrivateFieldSet(this, _TokenVerifier_keyring, options.keyring ?? new keyring_js_1.JWKSOAuthKeyring(), "f");
+    }
+    async verifyToken(token) {
+        return __classPrivateFieldGet(this, _TokenVerifier_instances, "m", _TokenVerifier_verify).call(this, token, undefined);
+    }
+    async verifyTokenForZone(token, zoneId) {
+        if (!zoneId) {
+            return null;
+        }
+        return __classPrivateFieldGet(this, _TokenVerifier_instances, "m", _TokenVerifier_verify).call(this, token, zoneId);
+    }
+    /**
+     * Flushes JWKS keys and discovery results from the underlying keyring.
+     * Use after a global key rotation. No-op if the injected keyring does
+     * not expose a `clear()` method.
+     */
+    clearCache() {
+        const keyring = __classPrivateFieldGet(this, _TokenVerifier_keyring, "f");
+        keyring.clear?.();
+    }
+}
+exports.TokenVerifier = TokenVerifier;
+_TokenVerifier_issuer = new WeakMap(), _TokenVerifier_requiredScopes = new WeakMap(), _TokenVerifier_allowedAlgorithms = new WeakMap(), _TokenVerifier_enableMultiZone = new WeakMap(), _TokenVerifier_audience = new WeakMap(), _TokenVerifier_keyring = new WeakMap(), _TokenVerifier_instances = new WeakSet(), _TokenVerifier_verify = async function _TokenVerifier_verify(token, zoneId) {
+    let audience;
+    if (typeof __classPrivateFieldGet(this, _TokenVerifier_audience, "f") === "string") {
+        audience = __classPrivateFieldGet(this, _TokenVerifier_audience, "f");
+    }
+    else if (__classPrivateFieldGet(this, _TokenVerifier_audience, "f") !== undefined) {
+        if (!zoneId || !Object.prototype.hasOwnProperty.call(__classPrivateFieldGet(this, _TokenVerifier_audience, "f"), zoneId)) {
+            return null;
+        }
+        audience = __classPrivateFieldGet(this, _TokenVerifier_audience, "f")[zoneId];
+    }
+    const issuer = __classPrivateFieldGet(this, _TokenVerifier_enableMultiZone, "f") && zoneId
+        ? buildZoneScopedIssuer(__classPrivateFieldGet(this, _TokenVerifier_issuer, "f"), zoneId)
+        : __classPrivateFieldGet(this, _TokenVerifier_issuer, "f");
+    try {
+        const verifier = new verifier_js_1.JWTVerifier(__classPrivateFieldGet(this, _TokenVerifier_keyring, "f"), {
+            issuers: [issuer],
+            audiences: audience,
+            algorithms: __classPrivateFieldGet(this, _TokenVerifier_allowedAlgorithms, "f"),
+        });
+        const claims = await verifier.verify(token);
+        if (!__classPrivateFieldGet(this, _TokenVerifier_instances, "m", _TokenVerifier_scopesSatisfied).call(this, claims)) {
+            return null;
+        }
+        return toAccessToken(token, claims);
+    }
+    catch {
+        return null;
+    }
+}, _TokenVerifier_scopesSatisfied = function _TokenVerifier_scopesSatisfied(claims) {
+    if (__classPrivateFieldGet(this, _TokenVerifier_requiredScopes, "f").length === 0) {
+        return true;
+    }
+    if (typeof claims.scope !== "string") {
+        return false;
+    }
+    const tokenScopes = new Set(claims.scope.split(" ").filter(Boolean));
+    return __classPrivateFieldGet(this, _TokenVerifier_requiredScopes, "f").every((s) => tokenScopes.has(s));
+};
+function toAccessToken(token, claims) {
+    const scopes = typeof claims.scope === "string"
+        ? claims.scope.split(" ").filter(Boolean)
+        : [];
+    const resourceClaim = claims["resource"];
+    const resource = typeof resourceClaim === "string" ? resourceClaim : undefined;
+    const expiresAt = typeof claims.exp === "number" ? claims.exp : undefined;
+    // JWTVerifier validates client_id is present and a non-empty string before
+    // returning, so this assertion is load-bearing only at the type boundary.
+    return {
+        token,
+        clientId: claims.client_id,
+        scopes,
+        expiresAt,
+        resource,
+    };
+}
+function buildZoneScopedIssuer(baseIssuer, zoneId) {
+    const url = new URL(baseIssuer);
+    return `${url.protocol}//${zoneId}.${url.host}`;
+}
+//# sourceMappingURL=tokenVerifier.js.map

package/dist/cjs/server/tokenVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenVerifier.js","sourceRoot":"","sources":["../../../src/server/tokenVerifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oDAAiD;AACjD,8CAAoE;AAIpE,MAAM,0BAA0B,GAAG,CAAC,OAAO,CAAU,CAAC;AAqCtD,MAAa,aAAa;IAQxB,YAAY,OAA6B;;QAPzC,wCAAgB;QAChB,gDAAmC;QACnC,mDAAsC;QACtC,iDAA0B;QAC1B,0CAA4C;QAC5C,yCAAuB;QAGrB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,uBAAA,IAAI,yBAAW,OAAO,CAAC,MAAM,MAAA,CAAC;QAC9B,uBAAA,IAAI,iCAAmB,OAAO,CAAC,cAAc,IAAI,EAAE,MAAA,CAAC;QACpD,uBAAA,IAAI,oCAAsB,OAAO,CAAC,iBAAiB,IAAI,0BAA0B,MAAA,CAAC;QAClF,uBAAA,IAAI,kCAAoB,OAAO,CAAC,eAAe,IAAI,KAAK,MAAA,CAAC;QACzD,uBAAA,IAAI,2BAAa,OAAO,CAAC,QAAQ,MAAA,CAAC;QAClC,uBAAA,IAAI,0BAAY,OAAO,CAAC,OAAO,IAAI,IAAI,6BAAgB,EAAE,MAAA,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,uBAAA,IAAI,uDAAQ,MAAZ,IAAI,EAAS,KAAK,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,MAAc;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,uBAAA,IAAI,uDAAQ,MAAZ,IAAI,EAAS,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,MAAM,OAAO,GAAG,uBAAA,IAAI,8BAAmC,CAAC;QACxD,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,CAAC;CA2CF;AAlFD,sCAkFC;2UAzCC,KAAK,gCAAS,KAAa,EAAE,MAA0B;IACrD,IAAI,QAA4B,CAAC;IACjC,IAAI,OAAO,uBAAA,IAAI,+BAAU,KAAK,QAAQ,EAAE,CAAC;QACvC,QAAQ,GAAG,uBAAA,IAAI,+BAAU,CAAC;IAC5B,CAAC;SAAM,IAAI,uBAAA,IAAI,+BAAU,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,uBAAA,IAAI,+BAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,QAAQ,GAAG,uBAAA,IAAI,+BAAU,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,GAAG,uBAAA,IAAI,sCAAiB,IAAI,MAAM;QAC5C,CAAC,CAAC,qBAAqB,CAAC,uBAAA,IAAI,6BAAQ,EAAE,MAAM,CAAC;QAC7C,CAAC,CAAC,uBAAA,IAAI,6BAAQ,CAAC;IAEjB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,yBAAW,CAAC,uBAAA,IAAI,8BAAS,EAAE;YAC9C,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,uBAAA,IAAI,wCAAmB;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,uBAAA,IAAI,gEAAiB,MAArB,IAAI,EAAkB,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,2EAEgB,MAAiB;IAChC,IAAI,uBAAA,IAAI,qCAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,OAAO,uBAAA,IAAI,qCAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAGH,SAAS,aAAa,CAAC,KAAa,EAAE,MAAiB;IACrD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAC7C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,MAAM,CAAC,SAAmB;QACpC,MAAM;QACN,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB,EAAE,MAAc;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC"}

package/dist/cjs/tokenExchange.d.ts

@@ -1,3 +1,13 @@
+import type { ApplicationCredential } from "./credentials.js";
+export declare const TokenType: {
+    readonly ACCESS_TOKEN: "urn:ietf:params:oauth:token-type:access_token";
+    /**
+     * Vendor URN for substitute-user (impersonation) subject tokens.
+     * Recognized by the Keycard authorization server; not registered with IANA.
+     */
+    readonly SUBSTITUTE_USER: "urn:keycard:params:oauth:token-type:substitute-user";
+};
+export type TokenType = (typeof TokenType)[keyof typeof TokenType];
 export interface TokenExchangeRequest {
     grantType?: string;
     resource?: string;
@@ -22,10 +32,26 @@ export interface TokenResponse {
 export interface TokenExchangeClientOptions {
     clientId?: string;
     clientSecret?: string;
+    /**
+     * Application credential provider. When set, takes precedence over
+     * static `clientId`/`clientSecret` and resolves the per-request
+     * Authorization header from the credential's `getAuth(zoneId)`.
+     */
+    credential?: ApplicationCredential;
+}
+export interface ExchangeOptions {
+    zoneId?: string;
+}
+export interface ImpersonateRequest {
+    userIdentifier: string;
+    resource: string;
+    scope?: string;
+    zoneId?: string;
 }
 export declare class TokenExchangeClient {
     #private;
     constructor(issuerUrl: string, options?: TokenExchangeClientOptions);
-    exchangeToken(request: TokenExchangeRequest): Promise<TokenResponse>;
+    exchangeToken(request: TokenExchangeRequest, options?: ExchangeOptions): Promise<TokenResponse>;
+    impersonate(req: ImpersonateRequest): Promise<TokenResponse>;
 }
 //# sourceMappingURL=tokenExchange.d.ts.map

package/dist/cjs/tokenExchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAkDD,qBAAa,mBAAmB;;gBAOlB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAM7D,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC;CAgE3E"}
+{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAO9D,eAAO,MAAM,SAAS;;IAEpB;;;OAGG;;CAEK,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkDD,qBAAa,mBAAmB;;gBAQlB,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;IAO7D,aAAa,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC;IA8CnB,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;CAkDnE"}

package/dist/cjs/tokenExchange.js

@@ -10,11 +10,23 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _TokenExchangeClient_instances, _TokenExchangeClient_issuerUrl, _TokenExchangeClient_clientId, _TokenExchangeClient_clientSecret, _TokenExchangeClient_tokenEndpoint, _TokenExchangeClient_discoveryPromise, _TokenExchangeClient_getTokenEndpoint;
+var _TokenExchangeClient_instances, _TokenExchangeClient_issuerUrl, _TokenExchangeClient_clientId, _TokenExchangeClient_clientSecret, _TokenExchangeClient_credential, _TokenExchangeClient_tokenEndpoint, _TokenExchangeClient_discoveryPromise, _TokenExchangeClient_resolveBasicAuth, _TokenExchangeClient_getTokenEndpoint;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenExchangeClient = void 0;
+exports.TokenExchangeClient = exports.TokenType = void 0;
 const discovery_js_1 = require("./discovery.js");
 const errors_js_1 = require("./errors.js");
+const substituteUser_js_1 = require("./jwt/substituteUser.js");
+// =============================================================================
+// Token Exchange Types (RFC 8693)
+// =============================================================================
+exports.TokenType = {
+    ACCESS_TOKEN: "urn:ietf:params:oauth:token-type:access_token",
+    /**
+     * Vendor URN for substitute-user (impersonation) subject tokens.
+     * Recognized by the Keycard authorization server; not registered with IANA.
+     */
+    SUBSTITUTE_USER: "urn:keycard:params:oauth:token-type:substitute-user",
+};
 // =============================================================================
 // Wire format helpers (camelCase <-> snake_case at the boundary)
 // =============================================================================
@@ -70,20 +82,23 @@ class TokenExchangeClient {
         _TokenExchangeClient_issuerUrl.set(this, void 0);
         _TokenExchangeClient_clientId.set(this, void 0);
         _TokenExchangeClient_clientSecret.set(this, void 0);
+        _TokenExchangeClient_credential.set(this, void 0);
         _TokenExchangeClient_tokenEndpoint.set(this, void 0);
         _TokenExchangeClient_discoveryPromise.set(this, void 0);
         __classPrivateFieldSet(this, _TokenExchangeClient_issuerUrl, issuerUrl, "f");
         __classPrivateFieldSet(this, _TokenExchangeClient_clientId, options?.clientId, "f");
         __classPrivateFieldSet(this, _TokenExchangeClient_clientSecret, options?.clientSecret, "f");
+        __classPrivateFieldSet(this, _TokenExchangeClient_credential, options?.credential, "f");
     }
-    async exchangeToken(request) {
+    async exchangeToken(request, options) {
         const tokenEndpoint = await __classPrivateFieldGet(this, _TokenExchangeClient_instances, "m", _TokenExchangeClient_getTokenEndpoint).call(this);
         const body = serializeRequest(request);
         const headers = {
             "Content-Type": "application/x-www-form-urlencoded",
         };
-        if (__classPrivateFieldGet(this, _TokenExchangeClient_clientId, "f") && __classPrivateFieldGet(this, _TokenExchangeClient_clientSecret, "f")) {
-            const credentials = btoa(`${__classPrivateFieldGet(this, _TokenExchangeClient_clientId, "f")}:${__classPrivateFieldGet(this, _TokenExchangeClient_clientSecret, "f")}`);
+        const basicAuth = __classPrivateFieldGet(this, _TokenExchangeClient_instances, "m", _TokenExchangeClient_resolveBasicAuth).call(this, options?.zoneId);
+        if (basicAuth) {
+            const credentials = btoa(`${basicAuth.clientId}:${basicAuth.clientSecret}`);
             headers["Authorization"] = `Basic ${credentials}`;
         }
         const response = await fetch(tokenEndpoint, {
@@ -115,9 +130,32 @@ class TokenExchangeClient {
         const json = await response.json();
         return deserializeResponse(json);
     }
+    async impersonate(req) {
+        if (!req.userIdentifier) {
+            throw new Error("impersonate: userIdentifier is required");
+        }
+        if (!req.resource) {
+            throw new Error("impersonate: resource is required");
+        }
+        const subjectToken = (0, substituteUser_js_1.buildSubstituteUserToken)(req.userIdentifier);
+        return this.exchangeToken({
+            subjectToken,
+            subjectTokenType: exports.TokenType.SUBSTITUTE_USER,
+            resource: req.resource,
+            scope: req.scope,
+        }, { zoneId: req.zoneId });
+    }
 }
 exports.TokenExchangeClient = TokenExchangeClient;
-_TokenExchangeClient_issuerUrl = new WeakMap(), _TokenExchangeClient_clientId = new WeakMap(), _TokenExchangeClient_clientSecret = new WeakMap(), _TokenExchangeClient_tokenEndpoint = new WeakMap(), _TokenExchangeClient_discoveryPromise = new WeakMap(), _TokenExchangeClient_instances = new WeakSet(), _TokenExchangeClient_getTokenEndpoint = async function _TokenExchangeClient_getTokenEndpoint() {
+_TokenExchangeClient_issuerUrl = new WeakMap(), _TokenExchangeClient_clientId = new WeakMap(), _TokenExchangeClient_clientSecret = new WeakMap(), _TokenExchangeClient_credential = new WeakMap(), _TokenExchangeClient_tokenEndpoint = new WeakMap(), _TokenExchangeClient_discoveryPromise = new WeakMap(), _TokenExchangeClient_instances = new WeakSet(), _TokenExchangeClient_resolveBasicAuth = function _TokenExchangeClient_resolveBasicAuth(zoneId) {
+    if (__classPrivateFieldGet(this, _TokenExchangeClient_credential, "f")) {
+        return __classPrivateFieldGet(this, _TokenExchangeClient_credential, "f").getAuth(zoneId);
+    }
+    if (__classPrivateFieldGet(this, _TokenExchangeClient_clientId, "f") && __classPrivateFieldGet(this, _TokenExchangeClient_clientSecret, "f")) {
+        return { clientId: __classPrivateFieldGet(this, _TokenExchangeClient_clientId, "f"), clientSecret: __classPrivateFieldGet(this, _TokenExchangeClient_clientSecret, "f") };
+    }
+    return null;
+}, _TokenExchangeClient_getTokenEndpoint = async function _TokenExchangeClient_getTokenEndpoint() {
     if (__classPrivateFieldGet(this, _TokenExchangeClient_tokenEndpoint, "f")) {
         return __classPrivateFieldGet(this, _TokenExchangeClient_tokenEndpoint, "f");
     }

package/dist/cjs/tokenExchange.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,iDAAkE;AAClE,2CAAyC;AAkCzC,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,SAAS,gBAAgB,CAAC,OAA6B;IACrD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,IAAI,iDAAiD,CAAC,CAAC;IACjG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,gBAAgB,IAAI,+CAA+C,CAAC,CAAC;IAE9G,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,mBAAmB;QAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAElG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA6B;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,WAAW;QACX,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;KAC5E,CAAC;IAEF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QAAE,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACvF,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;QAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClG,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAa,mBAAmB;IAO9B,YAAY,SAAiB,EAAE,OAAoC;;QANnE,iDAAmB;QACnB,gDAAmB;QACnB,oDAAuB;QACvB,qDAAwB;QACxB,wDAAoC;QAGlC,uBAAA,IAAI,kCAAc,SAAS,MAAA,CAAC;QAC5B,uBAAA,IAAI,iCAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,qCAAiB,OAAO,EAAE,YAAY,MAAA,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAA6B;QAC/C,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;QACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,IAAI,uBAAA,IAAI,qCAAU,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,uBAAA,IAAI,qCAAU,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;gBACnE,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;oBAClC,MAAM,WAAW,GAAG,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ;wBACjE,CAAC,CAAC,SAAS,CAAC,iBAAiB;wBAC7B,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;wBACtD,CAAC,CAAC,SAAS,CAAC,SAAS;wBACrB,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,IAAI,sBAAU,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,sBAAU;oBAAE,MAAM,CAAC,CAAC;gBACrC,4CAA4C;YAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAC9D,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;CAqBF;AA7ED,kDA6EC;qVAnBC,KAAK;IACH,IAAI,uBAAA,IAAI,0CAAe,EAAE,CAAC;QACxB,OAAO,uBAAA,IAAI,0CAAe,CAAC;IAC7B,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,uBAAA,IAAI,6CAAkB,EAAE,CAAC;QAC5B,uBAAA,IAAI,yCAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,QAAQ,GAAG,MAAM,IAAA,+CAAgC,EAAC,uBAAA,IAAI,sCAAW,CAAC,CAAC;YACzE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,uBAAA,IAAI,sCAAW,uCAAuC,CAAC,CAAC;YACnG,CAAC;YACD,uBAAA,IAAI,sCAAkB,QAAQ,CAAC,cAAc,MAAA,CAAC;YAC9C,OAAO,uBAAA,IAAI,0CAAe,CAAC;QAC7B,CAAC,CAAC,EAAE,MAAA,CAAC;IACP,CAAC;IAED,OAAO,uBAAA,IAAI,6CAAkB,CAAC;AAChC,CAAC"}
+{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../src/tokenExchange.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,iDAAkE;AAClE,2CAAyC;AAEzC,+DAAmE;AAEnE,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEnE,QAAA,SAAS,GAAG;IACvB,YAAY,EAAE,+CAA+C;IAC7D;;;OAGG;IACH,eAAe,EAAE,qDAAqD;CAC9D,CAAC;AAgDX,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,SAAS,gBAAgB,CAAC,OAA6B;IACrD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,IAAI,iDAAiD,CAAC,CAAC;IACjG,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC,gBAAgB,IAAI,+CAA+C,CAAC,CAAC;IAE9G,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,mBAAmB;QAAE,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAElG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA6B;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACtC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAkB;QAC9B,WAAW;QACX,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;KAC5E,CAAC;IAEF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;QAAE,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACvF,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;QAAE,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClG,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAa,mBAAmB;IAQ9B,YAAY,SAAiB,EAAE,OAAoC;;QAPnE,iDAAmB;QACnB,gDAAmB;QACnB,oDAAuB;QACvB,kDAAoC;QACpC,qDAAwB;QACxB,wDAAoC;QAGlC,uBAAA,IAAI,kCAAc,SAAS,MAAA,CAAC;QAC5B,uBAAA,IAAI,iCAAa,OAAO,EAAE,QAAQ,MAAA,CAAC;QACnC,uBAAA,IAAI,qCAAiB,OAAO,EAAE,YAAY,MAAA,CAAC;QAC3C,uBAAA,IAAI,mCAAe,OAAO,EAAE,UAAU,MAAA,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAA6B,EAC7B,OAAyB;QAEzB,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,CAAoB,CAAC;QACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;SACpD,CAAC;QAEF,MAAM,SAAS,GAAG,uBAAA,IAAI,6EAAkB,MAAtB,IAAI,EAAmB,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;gBACnE,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACxC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;oBAClC,MAAM,WAAW,GAAG,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ;wBACjE,CAAC,CAAC,SAAS,CAAC,iBAAiB;wBAC7B,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;wBACtD,CAAC,CAAC,SAAS,CAAC,SAAS;wBACrB,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,IAAI,sBAAU,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,sBAAU;oBAAE,MAAM,CAAC,CAAC;gBACrC,4CAA4C;YAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAC9D,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB;QACvC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,YAAY,GAAG,IAAA,4CAAwB,EAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,aAAa,CACvB;YACE,YAAY;YACZ,gBAAgB,EAAE,iBAAS,CAAC,eAAe;YAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,EACD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAC;IACJ,CAAC;CAiCF;AAlHD,kDAkHC;qbA9BG,MAA0B;IAE1B,IAAI,uBAAA,IAAI,uCAAY,EAAE,CAAC;QACrB,OAAO,uBAAA,IAAI,uCAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,uBAAA,IAAI,qCAAU,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC;QACzC,OAAO,EAAE,QAAQ,EAAE,uBAAA,IAAI,qCAAU,EAAE,YAAY,EAAE,uBAAA,IAAI,yCAAc,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,0CAED,KAAK;IACH,IAAI,uBAAA,IAAI,0CAAe,EAAE,CAAC;QACxB,OAAO,uBAAA,IAAI,0CAAe,CAAC;IAC7B,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,uBAAA,IAAI,6CAAkB,EAAE,CAAC;QAC5B,uBAAA,IAAI,yCAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,QAAQ,GAAG,MAAM,IAAA,+CAAgC,EAAC,uBAAA,IAAI,sCAAW,CAAC,CAAC;YACzE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,yBAAyB,uBAAA,IAAI,sCAAW,uCAAuC,CAAC,CAAC;YACnG,CAAC;YACD,uBAAA,IAAI,sCAAkB,QAAQ,CAAC,cAAc,MAAA,CAAC;YAC9C,OAAO,uBAAA,IAAI,0CAAe,CAAC;QAC7B,CAAC,CAAC,EAAE,MAAA,CAAC;IACP,CAAC;IAED,OAAO,uBAAA,IAAI,6CAAkB,CAAC;AAChC,CAAC"}

package/dist/esm/credentials.d.ts

@@ -4,15 +4,19 @@ import type { TokenExchangeRequest } from "./tokenExchange.js";
  *
  * Implementations live in downstream packages (@keycardai/mcp, @keycardai/cloudflare)
  * because they depend on platform-specific APIs (Node.js fs, Cloudflare Workers, etc.).
+ *
+ * The optional `zoneId` parameter routes per-zone credentials in multi-zone deployments.
+ * Implementations that ignore the zone (single-zone) are accepted by the interface.
  */
 export interface ApplicationCredential {
-    getAuth(): {
+    getAuth(zoneId?: string): {
         clientId: string;
         clientSecret: string;
     } | null;
     prepareTokenExchangeRequest(subjectToken: string, resource: string, options?: {
         tokenEndpoint?: string;
         authInfo?: Record<string, string>;
+        zoneId?: string;
     }): Promise<TokenExchangeRequest>;
 }
 //# sourceMappingURL=credentials.d.ts.map

package/dist/esm/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7D,2BAA2B,CACzB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GACtE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,2BAA2B,CACzB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACvF,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC"}

package/dist/esm/errors.d.ts

@@ -16,4 +16,27 @@ export declare class InvalidTokenError extends OAuthError {
 export declare class InsufficientScopeError extends OAuthError {
     constructor(message: string, errorUri?: string);
 }
+export type ErrorDetail = {
+    message: string;
+    code?: string;
+    description?: string;
+    rawError?: string;
+};
+export type ResourceAccessErrorType = "global_error" | "resource_error" | "missing_token";
+export interface ResourceAccessErrorOptions {
+    resource?: string;
+    errorType?: ResourceAccessErrorType;
+    availableResources?: readonly string[];
+    errorDetails?: ErrorDetail | null;
+}
+export declare class ResourceAccessError extends Error {
+    readonly resource?: string;
+    readonly errorType?: ResourceAccessErrorType;
+    readonly availableResources?: readonly string[];
+    readonly errorDetails: ErrorDetail | null;
+    constructor(message?: string, options?: ResourceAccessErrorOptions);
+}
+export declare class AuthProviderConfigurationError extends Error {
+    constructor(message?: string);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/esm/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAU,SAAQ,KAAK;gBAEhC,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,eAAgB,SAAQ,SAAS;CAC7C;AAED,qBAAa,iBAAkB,SAAQ,SAAS;CAC/C;AAED,qBAAa,UAAW,SAAQ,KAAK;aAEjB,SAAS,EAAE,MAAM;aAEjB,QAAQ,CAAC,EAAE,MAAM;gBAFjB,SAAS,EAAE,MAAM,EACjC,OAAO,EAAE,MAAM,EACC,QAAQ,CAAC,EAAE,MAAM,YAAA;CAIpC;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;CAG/C;AAED,qBAAa,sBAAuB,SAAQ,UAAU;gBACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;CAG/C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAU,SAAQ,KAAK;gBAEhC,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,eAAgB,SAAQ,SAAS;CAC7C;AAED,qBAAa,iBAAkB,SAAQ,SAAS;CAC/C;AAED,qBAAa,UAAW,SAAQ,KAAK;aAEjB,SAAS,EAAE,MAAM;aAEjB,QAAQ,CAAC,EAAE,MAAM;gBAFjB,SAAS,EAAE,MAAM,EACjC,OAAO,EAAE,MAAM,EACC,QAAQ,CAAC,EAAE,MAAM,YAAA;CAIpC;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;CAG/C;AAED,qBAAa,sBAAuB,SAAQ,UAAU;gBACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;CAG/C;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,cAAc,GACd,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,YAAY,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACnC;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,WAAW,GAAG,IAAI,CAAC;gBAE9B,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,0BAA0B;CAQnE;AA4BD,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,OAAO,CAAC,EAAE,MAAM;CAI7B"}

package/dist/esm/errors.js

@@ -24,4 +24,43 @@ export class InsufficientScopeError extends OAuthError {
         super("insufficient_scope", message, errorUri);
     }
 }
+export class ResourceAccessError extends Error {
+    constructor(message, options) {
+        super(message ?? buildResourceAccessMessage(options));
+        this.name = "ResourceAccessError";
+        this.resource = options?.resource;
+        this.errorType = options?.errorType;
+        this.availableResources = options?.availableResources;
+        this.errorDetails = options?.errorDetails ?? null;
+    }
+}
+function buildResourceAccessMessage(options) {
+    if (!options?.errorType) {
+        return "Resource access denied or token not available";
+    }
+    const { resource, errorType, availableResources, errorDetails } = options;
+    const label = resource ? `'${resource}'` : "resource";
+    switch (errorType) {
+        case "global_error": {
+            const inner = errorDetails?.message ?? "Unknown global error";
+            return `Cannot access resource ${label}: global authentication error. ${inner}`;
+        }
+        case "resource_error": {
+            const inner = errorDetails?.message ?? "Unknown resource error";
+            return `Cannot access resource ${label}: ${inner}`;
+        }
+        case "missing_token": {
+            const list = availableResources && availableResources.length > 0
+                ? ` Available: ${availableResources.join(", ")}.`
+                : "";
+            return `No access token available for resource ${label}.${list}`;
+        }
+    }
+}
+export class AuthProviderConfigurationError extends Error {
+    constructor(message) {
+        super(message ?? "AuthProvider configuration is invalid");
+        this.name = "AuthProviderConfigurationError";
+    }
+}
 //# sourceMappingURL=errors.js.map

package/dist/esm/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YACE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,SAAS;CAC7C;AAED,MAAM,OAAO,iBAAkB,SAAQ,SAAS;CAC/C;AAED,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YACkB,SAAiB,EACjC,OAAe,EACC,QAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,cAAS,GAAT,SAAS,CAAQ;QAEjB,aAAQ,GAAR,QAAQ,CAAS;IAGnC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IACpD,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YACE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,SAAS;CAC7C;AAED,MAAM,OAAO,iBAAkB,SAAQ,SAAS;CAC/C;AAED,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YACkB,SAAiB,EACjC,OAAe,EACC,QAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,cAAS,GAAT,SAAS,CAAQ;QAEjB,aAAQ,GAAR,QAAQ,CAAS;IAGnC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IACpD,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;CACF;AAqBD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAM5C,YAAY,OAAgB,EAAE,OAAoC;QAChE,KAAK,CAAC,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;QACpC,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QACtD,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;IACpD,CAAC;CACF;AAED,SAAS,0BAA0B,CAAC,OAAoC;IACtE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;QACxB,OAAO,+CAA+C,CAAC;IACzD,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;IAEtD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,KAAK,GAAG,YAAY,EAAE,OAAO,IAAI,sBAAsB,CAAC;YAC9D,OAAO,0BAA0B,KAAK,kCAAkC,KAAK,EAAE,CAAC;QAClF,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,YAAY,EAAE,OAAO,IAAI,wBAAwB,CAAC;YAChE,OAAO,0BAA0B,KAAK,KAAK,KAAK,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,IAAI,GACR,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC;gBACjD,CAAC,CAAC,eAAe,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACjD,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,0CAA0C,KAAK,IAAI,IAAI,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,uCAAuC,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF"}

package/dist/esm/index.d.ts

@@ -3,11 +3,14 @@ export { JWKSOAuthKeyring } from "./keyring.js";
 export { default as base64url } from "./base64url.js";
 export { fetchAuthorizationServerMetadata } from "./discovery.js";
 export type { OAuthAuthorizationServerMetadata } from "./discovery.js";
-export { HTTPError, BadRequestError, UnauthorizedError, OAuthError, InvalidTokenError, InsufficientScopeError } from "./errors.js";
+export { HTTPError, BadRequestError, UnauthorizedError, OAuthError, InvalidTokenError, InsufficientScopeError, ResourceAccessError, AuthProviderConfigurationError, } from "./errors.js";
 export { JWTSigner } from "./jwt/signer.js";
 export type { JWTClaims } from "./jwt/signer.js";
 export { JWTVerifier } from "./jwt/verifier.js";
-export { TokenExchangeClient } from "./tokenExchange.js";
-export type { TokenExchangeRequest, TokenResponse, TokenExchangeClientOptions } from "./tokenExchange.js";
+export { buildSubstituteUserToken } from "./jwt/substituteUser.js";
+export { TokenExchangeClient, TokenType } from "./tokenExchange.js";
+export type { TokenExchangeRequest, TokenResponse, TokenExchangeClientOptions, ExchangeOptions, ImpersonateRequest, } from "./tokenExchange.js";
 export type { ApplicationCredential } from "./credentials.js";
+export { AccessContext, TokenVerifier, ClientSecret } from "./server/index.js";
+export type { ErrorDetail, AccessContextStatus, AccessToken, TokenVerifierOptions, ClientSecretCredentials, } from "./server/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACnI,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAC1G,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,0BAA0B,EAC1B,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC"}

package/dist/esm/index.js

@@ -1,8 +1,10 @@
 export { JWKSOAuthKeyring } from "./keyring.js";
 export { default as base64url } from "./base64url.js";
 export { fetchAuthorizationServerMetadata } from "./discovery.js";
-export { HTTPError, BadRequestError, UnauthorizedError, OAuthError, InvalidTokenError, InsufficientScopeError } from "./errors.js";
+export { HTTPError, BadRequestError, UnauthorizedError, OAuthError, InvalidTokenError, InsufficientScopeError, ResourceAccessError, AuthProviderConfigurationError, } from "./errors.js";
 export { JWTSigner } from "./jwt/signer.js";
 export { JWTVerifier } from "./jwt/verifier.js";
-export { TokenExchangeClient } from "./tokenExchange.js";
+export { buildSubstituteUserToken } from "./jwt/substituteUser.js";
+export { TokenExchangeClient, TokenType } from "./tokenExchange.js";
+export { AccessContext, TokenVerifier, ClientSecret } from "./server/index.js";
 //# sourceMappingURL=index.js.map