@naylence/runtime 0.3.4 → 0.3.5-test.1

package/dist/cjs/src/naylence/fame/security/auth/oauth2-client-credentials-token-provider.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2ClientCredentialsTokenProvider = void 0;
+const logging_js_1 = require("../../util/logging.js");
+const credential_provider_js_1 = require("../credential/credential-provider.js");
+const logger = (0, logging_js_1.getLogger)('naylence.fame.security.auth.oauth2_client_credentials_token_provider');
+function normalizeOptions(raw) {
+    const camel = raw;
+    const snake = raw;
+    const tokenUrlCandidate = camel.tokenUrl ?? snake.token_url;
+    const tokenUrl = typeof tokenUrlCandidate === 'string' && tokenUrlCandidate.trim().length > 0
+        ? tokenUrlCandidate.trim()
+        : undefined;
+    if (!tokenUrl) {
+        throw new Error('OAuth2 token URL must be provided');
+    }
+    const clientIdProvider = camel.clientIdProvider ??
+        snake.client_id_provider;
+    if (!clientIdProvider) {
+        throw new Error('OAuth2 client ID provider must be supplied');
+    }
+    const clientSecretProvider = camel.clientSecretProvider ??
+        snake.client_secret_provider;
+    if (!clientSecretProvider) {
+        throw new Error('OAuth2 client secret provider must be supplied');
+    }
+    const scopesCandidate = camel.scopes ?? snake.scopes ?? snake.scope;
+    let scopes;
+    if (Array.isArray(scopesCandidate)) {
+        scopes = scopesCandidate
+            .map((scope) => (typeof scope === 'string' ? scope.trim() : ''))
+            .filter((scope) => scope.length > 0);
+    }
+    else if (typeof scopesCandidate === 'string') {
+        scopes = scopesCandidate
+            .split(/[\s,]+/)
+            .map((scope) => scope.trim())
+            .filter((scope) => scope.length > 0);
+    }
+    const audienceCandidate = camel.audience ?? snake.audience ?? snake.aud;
+    const audience = typeof audienceCandidate === 'string' && audienceCandidate.trim().length > 0
+        ? audienceCandidate.trim()
+        : undefined;
+    const fetchImplCandidate = camel.fetchImpl ?? snake.fetch_impl;
+    const fetchImpl = typeof fetchImplCandidate === 'function'
+        ? fetchImplCandidate
+        : undefined;
+    const clockSkewCandidate = camel.clockSkewSeconds ?? snake.clock_skew_seconds;
+    const clockSkewSeconds = typeof clockSkewCandidate === 'number' &&
+        Number.isFinite(clockSkewCandidate)
+        ? clockSkewCandidate
+        : undefined;
+    return {
+        tokenUrl,
+        clientIdProvider,
+        clientSecretProvider,
+        ...(scopes ? { scopes } : {}),
+        ...(audience ? { audience } : {}),
+        ...(fetchImpl ? { fetchImpl } : {}),
+        ...(clockSkewSeconds !== undefined ? { clockSkewSeconds } : {}),
+    };
+}
+const DEFAULT_EXPIRY_SECONDS = 3600;
+const DEFAULT_CLOCK_SKEW_SECONDS = 30;
+class OAuth2ClientCredentialsTokenProvider {
+    constructor(rawOptions) {
+        const options = normalizeOptions(rawOptions);
+        this.options = options;
+    }
+    async getToken() {
+        if (this.cachedToken && this.isTokenFresh(this.cachedToken)) {
+            logger.debug('using_cached_oauth2_token', {
+                token_url: this.options.tokenUrl,
+            });
+            return { ...this.cachedToken };
+        }
+        this.cachedToken = await this.fetchNewToken();
+        return { ...this.cachedToken };
+    }
+    isTokenFresh(token) {
+        if (typeof token.expiresAt !== 'number') {
+            return true;
+        }
+        const clockSkew = this.options.clockSkewSeconds ?? DEFAULT_CLOCK_SKEW_SECONDS;
+        return token.expiresAt - clockSkew * 1000 > Date.now();
+    }
+    async fetchNewToken() {
+        const fetchImpl = this.resolveFetch();
+        const clientId = (0, credential_provider_js_1.credentialToString)(await this.options.clientIdProvider.get());
+        if (!clientId) {
+            throw new Error('OAuth2 client ID provider returned empty value');
+        }
+        const clientSecret = (0, credential_provider_js_1.credentialToString)(await this.options.clientSecretProvider.get());
+        if (!clientSecret) {
+            throw new Error('OAuth2 client secret provider returned empty value');
+        }
+        const params = new URLSearchParams();
+        params.set('grant_type', 'client_credentials');
+        params.set('client_id', clientId);
+        params.set('client_secret', clientSecret);
+        if (this.options.scopes && this.options.scopes.length > 0) {
+            params.set('scope', this.options.scopes.join(' '));
+        }
+        if (this.options.audience) {
+            params.set('audience', this.options.audience);
+        }
+        const response = await fetchImpl(this.options.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: params.toString(),
+        });
+        if (!response.ok) {
+            const errorBody = await response.text().catch(() => '<unavailable>');
+            throw new Error(`OAuth2 token request failed: ${response.status} ${response.statusText} - ${errorBody}`);
+        }
+        const payload = (await response.json());
+        const accessToken = typeof payload.access_token === 'string'
+            ? payload.access_token
+            : undefined;
+        if (!accessToken) {
+            throw new Error('OAuth2 token response did not include access_token');
+        }
+        const expiresInSeconds = this.resolveExpiresIn(payload);
+        const expiresAt = Date.now() + expiresInSeconds * 1000;
+        logger.debug('oauth2_token_fetched', {
+            token_url: this.options.tokenUrl,
+            scopes: this.options.scopes,
+            audience: this.options.audience,
+            expires_in: expiresInSeconds,
+        });
+        return {
+            value: accessToken,
+            expiresAt,
+        };
+    }
+    resolveFetch() {
+        if (this.options.fetchImpl) {
+            return this.options.fetchImpl;
+        }
+        if (typeof fetch === 'function') {
+            return fetch.bind(globalThis);
+        }
+        throw new Error('Global fetch implementation is not available. Provide fetchImpl in options.');
+    }
+    resolveExpiresIn(payload) {
+        const expiresInCandidate = payload.expires_in ?? payload.expires;
+        if (typeof expiresInCandidate === 'number' &&
+            Number.isFinite(expiresInCandidate)) {
+            return Math.max(1, Math.floor(expiresInCandidate));
+        }
+        return DEFAULT_EXPIRY_SECONDS;
+    }
+}
+exports.OAuth2ClientCredentialsTokenProvider = OAuth2ClientCredentialsTokenProvider;
+//# sourceMappingURL=oauth2-client-credentials-token-provider.js.map

package/dist/cjs/src/naylence/fame/security/auth/oauth2-client-credentials-token-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-client-credentials-token-provider.js","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/oauth2-client-credentials-token-provider.ts"],"names":[],"mappings":";;;AAAA,sDAAkD;AAClD,iFAG8C;AAI9C,MAAM,MAAM,GAAG,IAAA,sBAAS,EACtB,sEAAsE,CACvE,CAAC;AA+BF,SAAS,gBAAgB,CACvB,GAA0E;IAE1E,MAAM,KAAK,GAAG,GAAkD,CAAC;IACjE,MAAM,KAAK,GAAG,GAA8C,CAAC;IAE7D,MAAM,iBAAiB,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC;IAC5D,MAAM,QAAQ,GACZ,OAAO,iBAAiB,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1E,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACrB,KAAK,CAAC,kBAAqD,CAAC;IAC/D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,oBAAoB,GACxB,KAAK,CAAC,oBAAoB;QACzB,KAAK,CAAC,sBAAyD,CAAC;IACnE,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC;IACpE,IAAI,MAA4B,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,eAAe;aACrB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC/D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC/C,MAAM,GAAG,eAAe;aACrB,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC;IACxE,MAAM,QAAQ,GACZ,OAAO,iBAAiB,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1E,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,kBAAkB,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC;IAC/D,MAAM,SAAS,GACb,OAAO,kBAAkB,KAAK,UAAU;QACtC,CAAC,CAAE,kBAAgC;QACnC,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,kBAAkB,GAAG,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,kBAAkB,CAAC;IAC9E,MAAM,gBAAgB,GACpB,OAAO,kBAAkB,KAAK,QAAQ;QACtC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACjC,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,QAAQ;QACR,gBAAgB;QAChB,oBAAoB;QACpB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAWD,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC,MAAa,oCAAoC;IAI/C,YACE,UAE2B;QAE3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAE7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBACxC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;aACjC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAEO,YAAY,CAAC,KAAY;QAC/B,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GACb,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QAC9D,OAAO,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEtC,MAAM,QAAQ,GAAG,IAAA,2CAAkB,EACjC,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAC1C,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,2CAAkB,EACrC,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAC9C,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAE1C,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,SAAS,EAAE,CACxF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC/D,MAAM,WAAW,GACf,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;YACtC,CAAC,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;QAEvD,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;YACnC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,UAAU,EAAE,gBAAgB;SAC7B,CAAC,CAAC;QAEH,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,SAAS;SACV,CAAC;IACJ,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAChC,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAc,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,OAA4B;QACnD,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;QACjE,IACE,OAAO,kBAAkB,KAAK,QAAQ;YACtC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACnC,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,sBAAsB,CAAC;IAChC,CAAC;CACF;AAnID,oFAmIC"}

package/dist/cjs/src/naylence/fame/security/auth/query-param-auth-injection-strategy-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-param-auth-injection-strategy-factory.js","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/query-param-auth-injection-strategy-factory.ts"],"names":[],"mappings":";;;AACA,6FAI8C;AAC9C,qGAA2F;AAmB9E,QAAA,YAAY,GAAG;IAC1B,IAAI,EAAE,8EAAyC;IAC/C,GAAG,EAAE,gBAAgB;CACb,CAAC;AAEX,MAAa,sCAAuC,SAAQ,iEAAmE;IAA/H;;QACkB,SAAI,GAAG,gBAAgB,CAAC;IAW1C,CAAC;IATQ,KAAK,CAAC,MAAM,CACjB,MAGQ;QAER,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,IAAI,wEAA+B,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;CACF;AAZD,wFAYC;AAED,SAAS,eAAe,CACtB,MAGQ;IAER,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,SAAS,GAAG,MACO,CAAC;IAC1B,MAAM,IAAI,GAAG,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,8EAA8E,IAAI,IAAI,WAAW,GAAG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,cAAc,CAAC;IAC1E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAClB,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,KAAK,CAAC;IACjE,MAAM,SAAS,GACb,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACpE,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE;QACvB,CAAC,CAAC,OAAO,CAAC;IAEd,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,aAAa;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,kBAAe,sCAAsC,CAAC"}

package/dist/cjs/src/naylence/fame/security/auth/query-param-auth-injection-strategy.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QueryParamAuthInjectionStrategy = void 0;
+const token_provider_factory_js_1 = require("./token-provider-factory.js");
+function normalizeOptions(options) {
+    if (!options || typeof options !== 'object') {
+        throw new TypeError('QueryParamAuthInjectionStrategy options must be an object');
+    }
+    const candidate = options;
+    const type = typeof candidate.type === 'string' ? candidate.type : 'QueryParamAuth';
+    if (type !== 'QueryParamAuth') {
+        throw new Error(`QueryParamAuthInjectionStrategy expects type "QueryParamAuth", got "${type ?? 'undefined'}"`);
+    }
+    const tokenProvider = candidate.tokenProvider ?? candidate.token_provider ?? null;
+    if (!tokenProvider) {
+        throw new Error('QueryParamAuthInjectionStrategy requires a tokenProvider configuration');
+    }
+    const paramCandidate = candidate.paramName ?? candidate.param_name ?? candidate.param;
+    const paramName = typeof paramCandidate === 'string' && paramCandidate.trim().length > 0
+        ? paramCandidate.trim()
+        : 'token';
+    return {
+        tokenProvider,
+        paramName,
+    };
+}
+class QueryParamAuthInjectionStrategy {
+    constructor(options) {
+        this.options = normalizeOptions(options);
+    }
+    async apply(_connector) {
+        // Query parameter strategies modify the URL at connection time only
+    }
+    async modifyUrl(url) {
+        const provider = await token_provider_factory_js_1.TokenProviderFactory.createTokenProvider(this.options.tokenProvider);
+        const token = await provider.getToken();
+        const [basePart, hashPart] = url.split('#', 2);
+        const [pathPart, queryPart] = basePart.split('?', 2);
+        const params = new URLSearchParams(queryPart ?? '');
+        params.set(this.options.paramName, token.value);
+        const queryString = params.toString();
+        const rebuilt = queryString.length > 0 ? `${pathPart}?${queryString}` : pathPart;
+        return hashPart ? `${rebuilt}#${hashPart}` : rebuilt;
+    }
+    async cleanup() {
+        // Nothing to clean up for query parameter injection
+    }
+}
+exports.QueryParamAuthInjectionStrategy = QueryParamAuthInjectionStrategy;
+//# sourceMappingURL=query-param-auth-injection-strategy.js.map

package/dist/cjs/src/naylence/fame/security/auth/query-param-auth-injection-strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-param-auth-injection-strategy.js","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/query-param-auth-injection-strategy.ts"],"names":[],"mappings":";;;AAEA,2EAAmE;AAkBnE,SAAS,gBAAgB,CACvB,OAAkE;IAElE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CACjB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OACO,CAAC;IAC1B,MAAM,IAAI,GACR,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACzE,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,uEAAuE,IAAI,IAAI,WAAW,GAAG,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GACjB,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,cAAc,IAAI,IAAI,CAAC;IAC9D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAClB,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,KAAK,CAAC;IACjE,MAAM,SAAS,GACb,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACpE,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE;QACvB,CAAC,CAAC,OAAO,CAAC;IAEd,OAAO;QACL,aAAa;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAa,+BAA+B;IAG1C,YAAmB,OAA+C;QAChE,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,UAAmB;QACpC,oEAAoE;IACtE,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,GAAW;QAChC,MAAM,QAAQ,GAAG,MAAM,gDAAoB,CAAC,mBAAmB,CAC7D,IAAI,CAAC,OAAO,CAAC,aAAa,CAC3B,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAExC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAEhD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,OAAO,GACX,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,oDAAoD;IACtD,CAAC;CACF;AA/BD,0EA+BC"}

package/dist/cjs/src/naylence/fame/security/auth/shared-secret-authorizer-factory.js

@@ -0,0 +1,90 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharedSecretAuthorizerFactory = exports.FACTORY_META = void 0;
+const lazy_import_js_1 = require("../../util/lazy-import.js");
+const authorizer_factory_js_1 = require("./authorizer-factory.js");
+const credential_provider_factory_js_1 = require("../credential/credential-provider-factory.js");
+const secret_source_js_1 = require("../credential/secret-source.js");
+let sharedSecretAuthorizerModulePromise = null;
+async function getSharedSecretAuthorizerModule() {
+    if (!sharedSecretAuthorizerModulePromise) {
+        sharedSecretAuthorizerModulePromise = (0, lazy_import_js_1.safeImport)(() => Promise.resolve().then(() => __importStar(require('./shared-secret-authorizer.js'))), 'shared-secret-authorizer');
+    }
+    return sharedSecretAuthorizerModulePromise;
+}
+function normalizeConfig(config) {
+    if (!config) {
+        throw new Error('SharedSecretAuthorizer requires configuration');
+    }
+    const source = config;
+    const record = source;
+    let secretSource = source.secret;
+    if (secretSource === undefined && record.secret_provider !== undefined) {
+        secretSource = record.secret_provider;
+    }
+    if (secretSource === undefined && record.secret_source !== undefined) {
+        secretSource = record.secret_source;
+    }
+    if (secretSource === undefined &&
+        record.secret_provider_config !== undefined) {
+        secretSource = record.secret_provider_config;
+    }
+    if (secretSource === undefined) {
+        secretSource = 'env://SHARED_SECRET';
+    }
+    return {
+        secretConfig: (0, secret_source_js_1.normalizeSecretSource)(secretSource),
+    };
+}
+exports.FACTORY_META = {
+    base: authorizer_factory_js_1.AUTHORIZER_FACTORY_BASE_TYPE,
+    key: 'SharedSecretAuthorizer',
+};
+class SharedSecretAuthorizerFactory extends authorizer_factory_js_1.AuthorizerFactory {
+    constructor() {
+        super(...arguments);
+        this.type = 'SharedSecretAuthorizer';
+    }
+    async create(config) {
+        const normalized = normalizeConfig(config);
+        const credentialProvider = await credential_provider_factory_js_1.CredentialProviderFactory.createCredentialProvider(normalized.secretConfig);
+        const { SharedSecretAuthorizer } = await getSharedSecretAuthorizerModule();
+        return new SharedSecretAuthorizer(credentialProvider);
+    }
+}
+exports.SharedSecretAuthorizerFactory = SharedSecretAuthorizerFactory;
+exports.default = SharedSecretAuthorizerFactory;
+//# sourceMappingURL=shared-secret-authorizer-factory.js.map

package/dist/cjs/src/naylence/fame/security/auth/shared-secret-authorizer-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-secret-authorizer-factory.js","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/shared-secret-authorizer-factory.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8DAAuD;AAEvD,mEAIiC;AACjC,iGAGsD;AACtD,qEAGwC;AAcxC,IAAI,mCAAmC,GACrC,IAAI,CAAC;AAEP,KAAK,UAAU,+BAA+B;IAC5C,IAAI,CAAC,mCAAmC,EAAE,CAAC;QACzC,mCAAmC,GAAG,IAAA,2BAAU,EAC9C,GAAG,EAAE,mDAAQ,+BAA+B,GAAC,EAC7C,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IAED,OAAO,mCAAmC,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CACtB,MAAsE;IAEtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,MACU,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAiC,CAAC;IAEjD,IAAI,YAAY,GAAG,MAAM,CAAC,MAAsC,CAAC;IACjE,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvE,YAAY,GAAG,MAAM,CAAC,eAAmC,CAAC;IAC5D,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACrE,YAAY,GAAG,MAAM,CAAC,aAAiC,CAAC;IAC1D,CAAC;IACD,IACE,YAAY,KAAK,SAAS;QAC1B,MAAM,CAAC,sBAAsB,KAAK,SAAS,EAC3C,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,sBAA0C,CAAC;IACnE,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,YAAY,GAAG,qBAAqB,CAAC;IACvC,CAAC;IAED,OAAO;QACL,YAAY,EAAE,IAAA,wCAAqB,EAAC,YAAY,CAAC;KAClD,CAAC;AACJ,CAAC;AAEY,QAAA,YAAY,GAAG;IAC1B,IAAI,EAAE,oDAA4B;IAClC,GAAG,EAAE,wBAAwB;CACrB,CAAC;AAEX,MAAa,6BAA8B,SAAQ,yCAA+C;IAAlG;;QACkB,SAAI,GAAG,wBAAwB,CAAC;IAgBlD,CAAC;IAdQ,KAAK,CAAC,MAAM,CACjB,MAAsE;QAEtE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAE3C,MAAM,kBAAkB,GACtB,MAAM,0DAAyB,CAAC,wBAAwB,CACtD,UAAU,CAAC,YAAY,CACxB,CAAC;QAEJ,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,+BAA+B,EAAE,CAAC;QAE3E,OAAO,IAAI,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;CACF;AAjBD,sEAiBC;AAED,kBAAe,6BAA6B,CAAC"}

package/dist/cjs/src/naylence/fame/security/auth/shared-secret-authorizer.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharedSecretAuthorizer = void 0;
+const core_1 = require("@naylence/core");
+const credential_provider_js_1 = require("../credential/credential-provider.js");
+function isCredentialProvider(value) {
+    return Boolean(value &&
+        typeof value === 'object' &&
+        typeof value.get === 'function');
+}
+function normalizeOptions(input) {
+    if (isCredentialProvider(input)) {
+        return { credentialProvider: input };
+    }
+    const candidate = input;
+    const credentialProviderCandidate = candidate.credentialProvider ?? candidate.credential_provider;
+    if (!isCredentialProvider(credentialProviderCandidate)) {
+        throw new Error('SharedSecretAuthorizer requires a credentialProvider option');
+    }
+    const principalCandidateRaw = candidate.principal ??
+        (typeof candidate.principal_id === 'string'
+            ? candidate.principal_id
+            : typeof candidate.principal_name === 'string'
+                ? candidate.principal_name
+                : undefined);
+    const principalCandidate = typeof principalCandidateRaw === 'string'
+        ? principalCandidateRaw.trim()
+        : undefined;
+    return {
+        credentialProvider: credentialProviderCandidate,
+        ...(principalCandidate && principalCandidate.length > 0
+            ? { principal: principalCandidate }
+            : {}),
+    };
+}
+function decodeCredentials(credentials) {
+    if (typeof TextDecoder !== 'undefined') {
+        return new TextDecoder().decode(credentials);
+    }
+    if (typeof Buffer !== 'undefined') {
+        return Buffer.from(credentials).toString('utf-8');
+    }
+    throw new Error('Unable to decode credential bytes without TextDecoder support');
+}
+function normalizeToken(credentials) {
+    const raw = typeof credentials === 'string'
+        ? credentials
+        : decodeCredentials(credentials);
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        return undefined;
+    }
+    if (trimmed.toLowerCase().startsWith('bearer ')) {
+        const candidate = trimmed.slice(7).trim();
+        return candidate.length > 0 ? candidate : undefined;
+    }
+    return trimmed;
+}
+function isAuthorizationContext(value) {
+    return Boolean(value &&
+        typeof value === 'object' &&
+        'authenticated' in value &&
+        typeof value.authenticated === 'boolean');
+}
+class SharedSecretAuthorizer {
+    constructor(options) {
+        const normalized = normalizeOptions(options);
+        this.credentialProvider = normalized.credentialProvider;
+        this.principal = normalized.principal ?? 'shared_secret_user';
+    }
+    async authenticate(credentials) {
+        const expectedSecret = (0, credential_provider_js_1.credentialToString)(await this.credentialProvider.get());
+        if (!expectedSecret) {
+            throw new Error('Shared secret not configured');
+        }
+        const token = normalizeToken(credentials);
+        if (!token) {
+            return undefined;
+        }
+        if (token !== expectedSecret) {
+            return undefined;
+        }
+        return (0, core_1.createAuthorizationContext)({
+            authenticated: true,
+            principal: this.principal,
+            authMethod: 'shared_secret',
+        });
+    }
+    async authorize(_node, _envelope, context) {
+        let authContext;
+        if (!context) {
+            authContext = undefined;
+        }
+        else if (isAuthorizationContext(context)) {
+            authContext = context;
+        }
+        else {
+            authContext = context.security?.authorization;
+        }
+        if (!authContext || !authContext.authenticated) {
+            return undefined;
+        }
+        if (authContext.authorized) {
+            return authContext;
+        }
+        return (0, core_1.createAuthorizationContext)({
+            ...authContext,
+            authorized: true,
+            authMethod: authContext.authMethod ?? 'shared_secret',
+        });
+    }
+    async validateNodeAttachRequest(node, frame, authContext) {
+        if (!authContext || !authContext.authenticated) {
+            return undefined;
+        }
+        const claims = { ...(authContext.claims ?? {}) };
+        claims.sub = claims.sub ?? frame.systemId;
+        claims.aud = claims.aud ?? node.id;
+        claims.instance_id = claims.instance_id ?? frame.instanceId;
+        if (frame.assignedPath) {
+            claims.assigned_path = frame.assignedPath;
+        }
+        if (Array.isArray(frame.capabilities)) {
+            claims.accepted_capabilities = [...frame.capabilities];
+        }
+        if (Array.isArray(frame.acceptedLogicals)) {
+            claims.accepted_logicals = [...frame.acceptedLogicals];
+        }
+        return (0, core_1.createAuthorizationContext)({
+            ...authContext,
+            claims,
+            authorized: true,
+            authMethod: authContext.authMethod ?? 'shared_secret',
+            principal: authContext.principal ?? frame.systemId,
+        });
+    }
+}
+exports.SharedSecretAuthorizer = SharedSecretAuthorizer;
+//# sourceMappingURL=shared-secret-authorizer.js.map

package/dist/cjs/src/naylence/fame/security/auth/shared-secret-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-secret-authorizer.js","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/shared-secret-authorizer.ts"],"names":[],"mappings":";;;AAMA,yCAA4D;AAE5D,iFAG8C;AAe9C,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,OAAO,CACZ,KAAK;QACH,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,GAAG,KAAK,UAAU,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAyC;IAEzC,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,KACO,CAAC;IAE1B,MAAM,2BAA2B,GAC/B,SAAS,CAAC,kBAAkB,IAAI,SAAS,CAAC,mBAAmB,CAAC;IAEhE,IAAI,CAAC,oBAAoB,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,qBAAqB,GACzB,SAAS,CAAC,SAAS;QACnB,CAAC,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ;YACzC,CAAC,CAAC,SAAS,CAAC,YAAY;YACxB,CAAC,CAAC,OAAO,SAAS,CAAC,cAAc,KAAK,QAAQ;gBAC5C,CAAC,CAAC,SAAS,CAAC,cAAc;gBAC1B,CAAC,CAAC,SAAS,CAAC,CAAC;IACnB,MAAM,kBAAkB,GACtB,OAAO,qBAAqB,KAAK,QAAQ;QACvC,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,kBAAkB,EAAE,2BAA2B;QAC/C,GAAG,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE;YACnC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAuB;IAChD,IAAI,OAAO,WAAW,KAAK,WAAW,EAAE,CAAC;QACvC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,WAAgC;IACtD,MAAM,GAAG,GACP,OAAO,WAAW,KAAK,QAAQ;QAC7B,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,OAAO,CACZ,KAAK;QACH,OAAO,KAAK,KAAK,QAAQ;QACzB,eAAe,IAAK,KAAiC;QACrD,OAAQ,KAAiC,CAAC,aAAa,KAAK,SAAS,CACxE,CAAC;AACJ,CAAC;AAED,MAAa,sBAAsB;IAIjC,YAAY,OAA2C;QACrD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,oBAAoB,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,WAAgC;QAEhC,MAAM,cAAc,GAAG,IAAA,2CAAkB,EACvC,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CACpC,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAA,iCAA0B,EAAC;YAChC,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,eAAe;SAC5B,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,KAAe,EACf,SAAuB,EACvB,OAAoD;QAEpD,IAAI,WAA6C,CAAC;QAElD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;aAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;YAC3B,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,OAAO,IAAA,iCAA0B,EAAC;YAChC,GAAG,WAAW;YACd,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,eAAe;SACtD,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,yBAAyB,CACpC,IAAc,EACd,KAAsB,EACtB,WAAkC;QAElC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC,EAA6B,CAAC;QAE5E,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC;QAC1C,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC;QAE5D,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;QAC5C,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,qBAAqB,GAAG,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,iBAAiB,GAAG,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAA,iCAA0B,EAAC;YAChC,GAAG,WAAW;YACd,MAAM;YACN,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,eAAe;YACrD,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ;SACnD,CAAC,CAAC;IACL,CAAC;CACF;AAtGD,wDAsGC"}

package/dist/cjs/src/naylence/fame/security/auth/shared-secret-token-provider-factory.js

@@ -0,0 +1,90 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharedSecretTokenProviderFactory = exports.FACTORY_META = void 0;
+const lazy_import_js_1 = require("../../util/lazy-import.js");
+const credential_provider_factory_js_1 = require("../credential/credential-provider-factory.js");
+const secret_source_js_1 = require("../credential/secret-source.js");
+const token_provider_factory_js_1 = require("./token-provider-factory.js");
+let sharedSecretTokenProviderModulePromise = null;
+async function getSharedSecretTokenProviderModule() {
+    if (!sharedSecretTokenProviderModulePromise) {
+        sharedSecretTokenProviderModulePromise = (0, lazy_import_js_1.safeImport)(() => Promise.resolve().then(() => __importStar(require('./shared-secret-token-provider.js'))), 'shared-secret-token-provider');
+    }
+    return sharedSecretTokenProviderModulePromise;
+}
+function normalizeConfig(config) {
+    if (!config) {
+        throw new Error('SharedSecretTokenProvider requires configuration');
+    }
+    const candidate = config;
+    const record = candidate;
+    let secretSource = candidate.secret;
+    if (secretSource === undefined && record.secret_provider !== undefined) {
+        secretSource = record.secret_provider;
+    }
+    if (secretSource === undefined && record.secret_source !== undefined) {
+        secretSource = record.secret_source;
+    }
+    if (secretSource === undefined &&
+        record.secret_provider_config !== undefined) {
+        secretSource = record.secret_provider_config;
+    }
+    if (secretSource === undefined) {
+        secretSource = 'env://SHARED_SECRET';
+    }
+    return {
+        secretConfig: (0, secret_source_js_1.normalizeSecretSource)(secretSource),
+    };
+}
+exports.FACTORY_META = {
+    base: token_provider_factory_js_1.TOKEN_PROVIDER_FACTORY_BASE_TYPE,
+    key: 'SharedSecretTokenProvider',
+};
+class SharedSecretTokenProviderFactory extends token_provider_factory_js_1.TokenProviderFactory {
+    constructor() {
+        super(...arguments);
+        this.type = 'SharedSecretTokenProvider';
+    }
+    async create(config) {
+        const normalized = normalizeConfig(config);
+        const credentialProvider = await credential_provider_factory_js_1.CredentialProviderFactory.createCredentialProvider(normalized.secretConfig);
+        const { SharedSecretTokenProvider } = await getSharedSecretTokenProviderModule();
+        return new SharedSecretTokenProvider(credentialProvider);
+    }
+}
+exports.SharedSecretTokenProviderFactory = SharedSecretTokenProviderFactory;
+exports.default = SharedSecretTokenProviderFactory;
+//# sourceMappingURL=shared-secret-token-provider-factory.js.map

package/dist/cjs/src/naylence/fame/security/auth/shared-secret-token-provider-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-secret-token-provider-factory.js","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/shared-secret-token-provider-factory.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8DAAuD;AAEvD,iGAGsD;AACtD,qEAGwC;AAExC,2EAIqC;AAcrC,IAAI,sCAAsC,GACxC,IAAI,CAAC;AAEP,KAAK,UAAU,kCAAkC;IAC/C,IAAI,CAAC,sCAAsC,EAAE,CAAC;QAC5C,sCAAsC,GAAG,IAAA,2BAAU,EACjD,GAAG,EAAE,mDAAQ,mCAAmC,GAAC,EACjD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,OAAO,sCAAsC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CACtB,MAAyE;IAEzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,MACO,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAoC,CAAC;IAEpD,IAAI,YAAY,GAAG,SAAS,CAAC,MAAsC,CAAC;IACpE,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvE,YAAY,GAAG,MAAM,CAAC,eAAmC,CAAC;IAC5D,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACrE,YAAY,GAAG,MAAM,CAAC,aAAiC,CAAC;IAC1D,CAAC;IACD,IACE,YAAY,KAAK,SAAS;QAC1B,MAAM,CAAC,sBAAsB,KAAK,SAAS,EAC3C,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,sBAA0C,CAAC;IACnE,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,YAAY,GAAG,qBAAqB,CAAC;IACvC,CAAC;IAED,OAAO;QACL,YAAY,EAAE,IAAA,wCAAqB,EAAC,YAAY,CAAC;KAClD,CAAC;AACJ,CAAC;AAEY,QAAA,YAAY,GAAG;IAC1B,IAAI,EAAE,4DAAgC;IACtC,GAAG,EAAE,2BAA2B;CACxB,CAAC;AAEX,MAAa,gCAAiC,SAAQ,gDAAqD;IAA3G;;QACkB,SAAI,GAAG,2BAA2B,CAAC;IAkBrD,CAAC;IAhBQ,KAAK,CAAC,MAAM,CACjB,MAAyE;QAEzE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,kBAAkB,GACtB,MAAM,0DAAyB,CAAC,wBAAwB,CACtD,UAAU,CAAC,YAAY,CACxB,CAAC;QAEJ,MAAM,EAAE,yBAAyB,EAAE,GACjC,MAAM,kCAAkC,EAAE,CAAC;QAE7C,OAAO,IAAI,yBAAyB,CAClC,kBAAwC,CACzC,CAAC;IACJ,CAAC;CACF;AAnBD,4EAmBC;AAED,kBAAe,gCAAgC,CAAC"}

package/dist/cjs/src/naylence/fame/security/auth/shared-secret-token-provider.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharedSecretTokenProvider = void 0;
+const credential_provider_js_1 = require("../credential/credential-provider.js");
+const ONE_DAY_MS = 24 * 60 * 60 * 1000;
+const FAR_FUTURE_MS = ONE_DAY_MS * 365 * 100;
+class SharedSecretTokenProvider {
+    constructor(options) {
+        let credentialProvider;
+        if (options &&
+            typeof options === 'object' &&
+            'credentialProvider' in options) {
+            credentialProvider = options.credentialProvider;
+        }
+        else if (options &&
+            typeof options === 'object' &&
+            'credential_provider' in options) {
+            credentialProvider = options.credential_provider;
+        }
+        if (!credentialProvider) {
+            if (options &&
+                typeof options === 'object' &&
+                'get' in options &&
+                typeof options.get === 'function') {
+                credentialProvider = options;
+            }
+            else {
+                throw new Error('SharedSecretTokenProvider requires a credentialProvider option');
+            }
+        }
+        this.credentialProvider = credentialProvider;
+    }
+    async getToken() {
+        const rawValue = await this.credentialProvider.get();
+        const value = (0, credential_provider_js_1.credentialToString)(rawValue) ?? '';
+        return {
+            value,
+            expiresAt: Date.now() + FAR_FUTURE_MS,
+        };
+    }
+}
+exports.SharedSecretTokenProvider = SharedSecretTokenProvider;
+//# sourceMappingURL=shared-secret-token-provider.js.map

package/dist/cjs/src/naylence/fame/security/auth/shared-secret-token-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-secret-token-provider.js","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/shared-secret-token-provider.ts"],"names":[],"mappings":";;;AAAA,iFAG8C;AAI9C,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,aAAa,GAAG,UAAU,GAAG,GAAG,GAAG,GAAG,CAAC;AAE7C,MAAa,yBAAyB;IAGpC,YACE,OAI2B;QAE3B,IAAI,kBAAkD,CAAC;QAEvD,IACE,OAAO;YACP,OAAO,OAAO,KAAK,QAAQ;YAC3B,oBAAoB,IAAI,OAAO,EAC/B,CAAC;YACD,kBAAkB,GAChB,OACD,CAAC,kBAAkB,CAAC;QACvB,CAAC;aAAM,IACL,OAAO;YACP,OAAO,OAAO,KAAK,QAAQ;YAC3B,qBAAqB,IAAI,OAAO,EAChC,CAAC;YACD,kBAAkB,GAChB,OACD,CAAC,mBAAmB,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,IACE,OAAO;gBACP,OAAO,OAAO,KAAK,QAAQ;gBAC3B,KAAK,IAAI,OAAO;gBAChB,OAAQ,OAA8B,CAAC,GAAG,KAAK,UAAU,EACzD,CAAC;gBACD,kBAAkB,GAAG,OAA6B,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,IAAA,2CAAkB,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjD,OAAO;YACL,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa;SACtC,CAAC;IACJ,CAAC;CACF;AAxDD,8DAwDC"}