@noodleseed/one 0.99.0 → 0.100.0

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store.js

@@ -0,0 +1,349 @@
+import { randomUUID } from 'node:crypto';
+import { validateSlug } from '../store/validate.js';
+import { validatePublicJwk, } from './service-principal-credentials.js';
+export class InMemoryServicePrincipalStore {
+    #principals = new Map();
+    #grants = new Map();
+    #credentials = new Map();
+    #assertionJtis = new Map();
+    #now;
+    constructor(options = {}) {
+        this.#now = options.now ?? (() => new Date());
+    }
+    async createPrincipal(input) {
+        const now = currentServicePrincipalTimestamp(this.#now);
+        const record = {
+            principalId: `spn_${randomUUID()}`,
+            org: validateSlug('org', input.org),
+            name: validateServicePrincipalDisplayName('service-principal name', input.name),
+            status: 'active',
+            createdBySubject: validateServicePrincipalActor(input.actorSubject),
+            createdAt: now,
+            updatedAt: now,
+        };
+        this.#principals.set(record.principalId, record);
+        return clone(record);
+    }
+    async listPrincipals(org) {
+        const normalizedOrg = validateSlug('org', org);
+        return [...this.#principals.values()]
+            .filter((record) => record.org === normalizedOrg)
+            .sort((left, right) => left.principalId.localeCompare(right.principalId))
+            .map(clone);
+    }
+    async getPrincipal(input) {
+        const principal = this.#ownedPrincipal(input, false);
+        if (principal === undefined)
+            return undefined;
+        return {
+            principal: clone(principal),
+            grants: [...this.#grants.values()]
+                .filter((grant) => grant.principalId === principal.principalId)
+                .sort((left, right) => left.grantId.localeCompare(right.grantId))
+                .map(clone),
+            credentials: [...this.#credentials.values()]
+                .filter((credential) => credential.principalId === principal.principalId)
+                .sort((left, right) => left.credentialId.localeCompare(right.credentialId))
+                .map(publicServicePrincipalCredential),
+        };
+    }
+    async revokePrincipal(input) {
+        validateServicePrincipalActor(input.actorSubject);
+        const principal = this.#ownedPrincipal(input, false);
+        if (principal === undefined)
+            return false;
+        if (principal.status === 'revoked')
+            return true;
+        const now = currentServicePrincipalTimestamp(this.#now);
+        this.#principals.set(principal.principalId, {
+            ...principal,
+            status: 'revoked',
+            updatedAt: now,
+            revokedAt: now,
+            revokedBySubject: input.actorSubject,
+        });
+        return true;
+    }
+    async createGrant(input) {
+        const principal = this.#requireActivePrincipal(input);
+        const app = validateSlug('app', input.app);
+        const environment = validateSlug('env', input.environment);
+        if ([...this.#grants.values()].some((grant) => grant.principalId === principal.principalId &&
+            grant.app === app &&
+            grant.environment === environment &&
+            grant.status === 'active')) {
+            throw new Error('service principal already has an active grant for this app and environment');
+        }
+        const now = currentServicePrincipalTimestamp(this.#now);
+        const record = {
+            grantId: `spg_${randomUUID()}`,
+            principalId: principal.principalId,
+            org: principal.org,
+            app,
+            environment,
+            scopes: normalizeServicePrincipalScopes(input.scopes),
+            status: 'active',
+            createdBySubject: validateServicePrincipalActor(input.actorSubject),
+            createdAt: now,
+            updatedAt: now,
+        };
+        this.#grants.set(record.grantId, record);
+        return clone(record);
+    }
+    async revokeGrant(input) {
+        validateServicePrincipalActor(input.actorSubject);
+        const principal = this.#ownedPrincipal(input, true);
+        const grant = this.#grants.get(input.grantId);
+        if (principal === undefined ||
+            grant === undefined ||
+            grant.principalId !== principal.principalId) {
+            return false;
+        }
+        if (grant.status === 'revoked')
+            return true;
+        const now = currentServicePrincipalTimestamp(this.#now);
+        this.#grants.set(grant.grantId, {
+            ...grant,
+            status: 'revoked',
+            updatedAt: now,
+            revokedAt: now,
+            revokedBySubject: input.actorSubject,
+        });
+        return true;
+    }
+    async createCredential(input) {
+        const principal = this.#requireActivePrincipal(input);
+        const nowDate = currentServicePrincipalDate(this.#now);
+        const activeOfKind = [...this.#credentials.values()].filter((credential) => credential.principalId === principal.principalId &&
+            credential.kind === input.kind &&
+            servicePrincipalCredentialIsActive(credential, nowDate.getTime()));
+        if (activeOfKind.length >= 5) {
+            throw new Error(`service principal may have at most five active ${input.kind} credentials`);
+        }
+        const createdAt = nowDate.toISOString();
+        const expiresAt = normalizeServicePrincipalExpiry(input.expiresAt, nowDate);
+        const base = {
+            credentialId: `spc_${randomUUID()}`,
+            principalId: principal.principalId,
+            label: validateServicePrincipalDisplayName('credential label', input.label),
+            status: 'active',
+            createdBySubject: validateServicePrincipalActor(input.actorSubject),
+            createdAt,
+            updatedAt: createdAt,
+            ...(expiresAt === undefined ? {} : { expiresAt }),
+        };
+        let stored;
+        if (input.kind === 'client_secret') {
+            stored = {
+                ...base,
+                kind: 'client_secret',
+                secretDigest: validateServicePrincipalSecretDigest(input.secretDigest),
+            };
+        }
+        else {
+            const validated = await validatePublicJwk(input.publicJwk, input.algorithm);
+            const kid = validated.publicJwk.kid;
+            stored = {
+                ...base,
+                kind: 'public_jwk',
+                algorithm: validated.algorithm,
+                publicJwk: validated.publicJwk,
+                ...(typeof kid === 'string' ? { kid } : {}),
+            };
+        }
+        this.#credentials.set(stored.credentialId, stored);
+        return publicServicePrincipalCredential(stored);
+    }
+    async revokeCredential(input) {
+        validateServicePrincipalActor(input.actorSubject);
+        const principal = this.#ownedPrincipal(input, true);
+        const credential = this.#credentials.get(input.credentialId);
+        if (principal === undefined ||
+            credential === undefined ||
+            credential.principalId !== principal.principalId) {
+            return false;
+        }
+        if (credential.status === 'revoked')
+            return true;
+        const now = currentServicePrincipalTimestamp(this.#now);
+        this.#credentials.set(credential.credentialId, {
+            ...credential,
+            status: 'revoked',
+            updatedAt: now,
+            revokedAt: now,
+            revokedBySubject: input.actorSubject,
+        });
+        return true;
+    }
+    async loadActiveClient(clientId, now) {
+        const principal = this.#principals.get(clientId);
+        if (principal === undefined || principal.status !== 'active')
+            return undefined;
+        validateServicePrincipalEpoch('authorization time', now);
+        return {
+            principal: clone(principal),
+            grants: [...this.#grants.values()]
+                .filter((grant) => grant.principalId === clientId && grant.status === 'active')
+                .map(clone),
+            credentials: [...this.#credentials.values()]
+                .filter((credential) => credential.principalId === clientId &&
+                servicePrincipalCredentialIsActive(credential, now))
+                .map(clone),
+        };
+    }
+    async validateAccessBinding(input) {
+        validateServicePrincipalEpoch('authorization time', input.now);
+        const principal = this.#principals.get(input.principalId);
+        const grant = this.#grants.get(input.grantId);
+        const credential = this.#credentials.get(input.credentialId);
+        return (principal?.status === 'active' &&
+            principal.org === input.org &&
+            grant?.status === 'active' &&
+            grant.principalId === principal.principalId &&
+            grant.org === input.org &&
+            grant.app === input.app &&
+            grant.environment === input.environment &&
+            credential !== undefined &&
+            credential.principalId === principal.principalId &&
+            servicePrincipalCredentialIsActive(credential, input.now));
+    }
+    async consumeAssertionJti(input) {
+        validateServicePrincipalEpoch('assertion time', input.now);
+        validateServicePrincipalEpoch('assertion expiry', input.expiresAt);
+        if (input.expiresAt <= input.now)
+            throw new Error('assertion expiry must be in the future');
+        if (input.jti.length < 1 || input.jti.length > 200) {
+            throw new Error('assertion jti must be between 1 and 200 characters');
+        }
+        if (!this.#credentials.has(input.credentialId)) {
+            throw new Error('assertion credential does not exist');
+        }
+        for (const [key, expiresAt] of this.#assertionJtis) {
+            if (expiresAt <= input.now)
+                this.#assertionJtis.delete(key);
+        }
+        const key = `${input.credentialId}\u0000${input.jti}`;
+        if (this.#assertionJtis.has(key))
+            return false;
+        this.#assertionJtis.set(key, input.expiresAt);
+        return true;
+    }
+    #ownedPrincipal(input, strict) {
+        const org = validateSlug('org', input.org);
+        const principal = this.#principals.get(input.principalId);
+        if (principal === undefined || principal.org === org)
+            return principal;
+        if (strict)
+            throw new Error('service principal belongs to a different organization');
+        return undefined;
+    }
+    #requireActivePrincipal(input) {
+        const principal = this.#ownedPrincipal(input, true);
+        if (principal === undefined)
+            throw new Error('service principal does not exist');
+        if (principal.status !== 'active')
+            throw new Error('service principal is revoked');
+        return principal;
+    }
+}
+export function publicServicePrincipalCredential(credential) {
+    const { credentialId, principalId, kind, label, status, createdBySubject, createdAt, updatedAt } = credential;
+    const lifecycle = {
+        credentialId,
+        principalId,
+        kind,
+        label,
+        status,
+        createdBySubject,
+        createdAt,
+        updatedAt,
+        ...(credential.expiresAt === undefined ? {} : { expiresAt: credential.expiresAt }),
+        ...(credential.revokedAt === undefined
+            ? {}
+            : {
+                revokedAt: credential.revokedAt,
+                ...(credential.revokedBySubject === undefined
+                    ? {}
+                    : { revokedBySubject: credential.revokedBySubject }),
+            }),
+    };
+    return credential.kind === 'public_jwk'
+        ? {
+            ...lifecycle,
+            kind: 'public_jwk',
+            algorithm: credential.algorithm,
+            ...(credential.kid === undefined ? {} : { kid: credential.kid }),
+        }
+        : { ...lifecycle, kind: 'client_secret' };
+}
+export function normalizeServicePrincipalScopes(values) {
+    const normalized = [...new Set(values.map(validateScope))].sort();
+    if (normalized.length > 64)
+        throw new Error('service-principal grant supports at most 64 scopes');
+    return Object.freeze(normalized);
+}
+function validateScope(value) {
+    const normalized = value.trim();
+    if (normalized.length < 1 ||
+        normalized.length > 128 ||
+        !/^[\x21\x23-\x5b\x5d-\x7e]+$/.test(normalized)) {
+        throw new Error('service-principal scope must be one valid 1-128 character OAuth scope token');
+    }
+    return normalized;
+}
+export function validateServicePrincipalDisplayName(label, value) {
+    const normalized = value.trim();
+    if (normalized.length < 1 || normalized.length > 80 || hasAsciiControlCharacters(normalized)) {
+        throw new Error(`${label} must be between 1 and 80 printable characters`);
+    }
+    return normalized;
+}
+export function validateServicePrincipalActor(value) {
+    if (value.length < 1 || value.length > 512 || hasAsciiControlCharacters(value)) {
+        throw new Error('invalid service-principal actor');
+    }
+    return value;
+}
+export function validateServicePrincipalSecretDigest(value) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(value) || Buffer.from(value, 'base64url').length !== 32) {
+        throw new Error('service-principal secret digest must be a SHA-256 base64url value');
+    }
+    return value;
+}
+export function normalizeServicePrincipalExpiry(value, now) {
+    if (value === undefined)
+        return undefined;
+    const parsed = new Date(value);
+    if (!Number.isFinite(parsed.getTime()) || parsed.getTime() <= now.getTime()) {
+        throw new Error('service-principal credential expiresAt must be a future ISO timestamp');
+    }
+    return parsed.toISOString();
+}
+export function servicePrincipalCredentialIsActive(credential, now) {
+    return (credential.status === 'active' &&
+        (credential.expiresAt === undefined || Date.parse(credential.expiresAt) > now));
+}
+export function currentServicePrincipalDate(now) {
+    const value = now();
+    if (!Number.isFinite(value.getTime()))
+        throw new Error('service-principal store clock is invalid');
+    return value;
+}
+export function currentServicePrincipalTimestamp(now) {
+    return currentServicePrincipalDate(now).toISOString();
+}
+export function validateServicePrincipalEpoch(label, value) {
+    if (!Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
+        throw new Error(`${label} must be a non-negative integer epoch millisecond`);
+    }
+}
+function hasAsciiControlCharacters(value) {
+    return [...value].some((character) => {
+        const code = character.charCodeAt(0);
+        return code <= 0x1f || code === 0x7f;
+    });
+}
+function clone(value) {
+    return structuredClone(value);
+}
+//# sourceMappingURL=service-principal-store.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-store.js","sourceRoot":"","sources":["../../src/oauth/service-principal-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAEL,iBAAiB,GAClB,MAAM,oCAAoC,CAAC;AAkK5C,MAAM,OAAO,6BAA6B;IAC/B,WAAW,GAAG,IAAI,GAAG,EAAkC,CAAC;IACxD,OAAO,GAAG,IAAI,GAAG,EAAuC,CAAC;IACzD,YAAY,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,CAAa;IAE1B,YAAY,UAAyC,EAAE;QACrD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAkC;QACtD,MAAM,GAAG,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAA2B;YACrC,WAAW,EAAE,OAAO,UAAU,EAAE,EAAE;YAClC,GAAG,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;YACnC,IAAI,EAAE,mCAAmC,CAAC,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC;YAC/E,MAAM,EAAE,QAAQ;YAChB,gBAAgB,EAAE,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC;YACnE,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,aAAa,CAAC;aAChD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;aACxE,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAmB;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;YAC3B,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;iBAC/B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAAC;iBAC9D,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;iBAChE,GAAG,CAAC,KAAK,CAAC;YACb,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;iBACzC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAAC;iBACxE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;iBAC1E,GAAG,CAAC,gCAAgC,CAAC;SACzC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAwB;QAC5C,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,GAAG,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,GAAG,SAAS;YACZ,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,KAAK,CAAC,YAAY;SACrC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3D,IACE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC7B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YAC3C,KAAK,CAAC,GAAG,KAAK,GAAG;YACjB,KAAK,CAAC,WAAW,KAAK,WAAW;YACjC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAC5B,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAAgC;YAC1C,OAAO,EAAE,OAAO,UAAU,EAAE,EAAE;YAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG;YACH,WAAW;YACX,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC;YACrD,MAAM,EAAE,QAAQ;YAChB,gBAAgB,EAAE,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC;YACnE,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAoB;QACpC,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,IACE,SAAS,KAAK,SAAS;YACvB,KAAK,KAAK,SAAS;YACnB,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE;YAC9B,GAAG,KAAK;YACR,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,KAAK,CAAC,YAAY;SACrC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,KAAkC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CACzD,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YAChD,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAC9B,kCAAkC,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;QACF,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,+BAA+B,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG;YACX,YAAY,EAAE,OAAO,UAAU,EAAE,EAAE;YACnC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,KAAK,EAAE,mCAAmC,CAAC,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC;YAC3E,MAAM,EAAE,QAAiB;YACzB,gBAAgB,EAAE,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC;YACnE,SAAS;YACT,SAAS,EAAE,SAAS;YACpB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;SAClD,CAAC;QACF,IAAI,MAAwB,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnC,MAAM,GAAG;gBACP,GAAG,IAAI;gBACP,IAAI,EAAE,eAAe;gBACrB,YAAY,EAAE,oCAAoC,CAAC,KAAK,CAAC,YAAY,CAAC;aACvE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5E,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC;YACpC,MAAM,GAAG;gBACP,GAAG,IAAI;gBACP,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAyB;QAC9C,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7D,IACE,SAAS,KAAK,SAAS;YACvB,UAAU,KAAK,SAAS;YACxB,UAAU,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,EAChD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,GAAG,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE;YAC7C,GAAG,UAAU;YACb,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,gBAAgB,EAAE,KAAK,CAAC,YAAY;SACrC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,GAAW;QAEX,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC/E,6BAA6B,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;YAC3B,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;iBAC/B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;iBAC9E,GAAG,CAAC,KAAK,CAAC;YACb,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;iBACzC,MAAM,CACL,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,WAAW,KAAK,QAAQ;gBACnC,kCAAkC,CAAC,UAAU,EAAE,GAAG,CAAC,CACtD;iBACA,GAAG,CAAC,KAAK,CAAC;SACd,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAAoC;QAC9D,6BAA6B,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7D,OAAO,CACL,SAAS,EAAE,MAAM,KAAK,QAAQ;YAC9B,SAAS,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;YAC3B,KAAK,EAAE,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YAC3C,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;YACvB,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;YACvB,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YACvC,UAAU,KAAK,SAAS;YACxB,UAAU,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YAChD,kCAAkC,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAC1D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAwB;QAChD,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,6BAA6B,CAAC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5F,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACnD,IAAI,SAAS,IAAI,KAAK,CAAC,GAAG;gBAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,YAAY,SAAS,KAAK,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe,CAAC,KAAmB,EAAE,MAAe;QAClD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACvE,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACrF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,uBAAuB,CAAC,KAAmB;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjF,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,gCAAgC,CAC9C,UAA4C;IAE5C,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,GAC9F,UAAU,CAAC;IACb,MAAM,SAAS,GAAG;QAChB,YAAY;QACZ,WAAW;QACX,IAAI;QACJ,KAAK;QACL,MAAM;QACN,gBAAgB;QAChB,SAAS;QACT,SAAS;QACT,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;QAClF,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,GAAG,CAAC,UAAU,CAAC,gBAAgB,KAAK,SAAS;oBAC3C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,EAAE,CAAC;aACvD,CAAC;KACP,CAAC;IACF,OAAO,UAAU,CAAC,IAAI,KAAK,YAAY;QACrC,CAAC,CAAC;YACE,GAAG,SAAS;YACZ,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;SACjE;QACH,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAyB;IACvE,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IACE,UAAU,CAAC,MAAM,GAAG,CAAC;QACrB,UAAU,CAAC,MAAM,GAAG,GAAG;QACvB,CAAC,6BAA6B,CAAC,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAa,EAAE,KAAa;IAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gDAAgD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAa;IACzD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAAa;IAChE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAyB,EACzB,GAAS;IAET,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,UAA4C,EAC5C,GAAW;IAEX,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,QAAQ;QAC9B,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAe;IACzD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,GAAe;IAC9D,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAa,EAAE,KAAa;IACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mDAAmD,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAI,KAAQ;IACxB,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-token-handler.d.ts

@@ -0,0 +1,20 @@
+import type { AuditSink } from '@noodle-borg/module';
+import type { Request, Response } from 'express';
+import type { ServerRegistry } from '../registry.js';
+import { type ServicePrincipalResourceRouting } from './service-principal-resource.js';
+import type { ServicePrincipalRuntime } from './service-principal-store.js';
+import type { IssueServicePrincipalAccessTokenInput } from './service-principal-token-issuer.js';
+export interface ServicePrincipalTokenIssuer {
+    readonly issuer: string;
+    nowSeconds(): number;
+    issueServicePrincipalAccessToken(input: IssueServicePrincipalAccessTokenInput): Promise<string>;
+}
+export interface ServicePrincipalTokenHandlerOptions {
+    readonly runtime: ServicePrincipalRuntime;
+    readonly registry: () => ServerRegistry | undefined;
+    readonly routing: ServicePrincipalResourceRouting;
+    readonly audit?: AuditSink;
+}
+/** Handle only the OAuth client_credentials grant; the caller owns grant-type dispatch. */
+export declare function handleServicePrincipalToken(req: Request, res: Response, issuer: ServicePrincipalTokenIssuer, options: ServicePrincipalTokenHandlerOptions): Promise<void>;
+//# sourceMappingURL=service-principal-token-handler.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-token-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-token-handler.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-token-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAMrD,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAGV,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAIjG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,UAAU,IAAI,MAAM,CAAC;IACrB,gCAAgC,CAAC,KAAK,EAAE,qCAAqC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjG;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,2FAA2F;AAC3F,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE,2BAA2B,EACnC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,IAAI,CAAC,CAwIf"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-token-handler.js

@@ -0,0 +1,175 @@
+import { authenticateServicePrincipalClient, ServicePrincipalClientAuthError, } from './service-principal-client-auth.js';
+import { resolveServicePrincipalResource, } from './service-principal-resource.js';
+const TEN_MINUTES = 600;
+/** Handle only the OAuth client_credentials grant; the caller owns grant-type dispatch. */
+export async function handleServicePrincipalToken(req, res, issuer, options) {
+    noStore(res);
+    if (!options.runtime.ready) {
+        oauthError(res, 503, 'temporarily_unavailable', 'service-principal authentication is unavailable');
+        return;
+    }
+    const nowSeconds = issuer.nowSeconds();
+    let client;
+    try {
+        const authorization = authorizationHeaders(req);
+        client = await authenticateServicePrincipalClient({ body: body(req), ...(authorization === undefined ? {} : { authorization }) }, options.runtime.store, `${issuer.issuer.replace(/\/+$/, '')}/token`, nowSeconds);
+    }
+    catch (error) {
+        if (error instanceof ServicePrincipalClientAuthError) {
+            res.setHeader('WWW-Authenticate', 'Basic realm="token"');
+            oauthError(res, 401, error.oauthError, error.message);
+            return;
+        }
+        oauthError(res, 401, 'invalid_client', 'invalid client authentication');
+        return;
+    }
+    const resource = oneRequiredString(body(req).resource);
+    if (resource === undefined) {
+        oauthError(res, 400, 'invalid_request', 'exactly one resource parameter is required');
+        return;
+    }
+    const registry = options.registry();
+    if (registry === undefined) {
+        oauthError(res, 400, 'invalid_target', 'requested resource is unavailable');
+        return;
+    }
+    let resolved;
+    try {
+        resolved = await resolveServicePrincipalResource(resource, registry, options.routing);
+    }
+    catch {
+        oauthError(res, 400, 'invalid_target', 'requested resource is unavailable');
+        return;
+    }
+    if (resolved === undefined || resolved.tenant.org !== client.org) {
+        oauthError(res, 400, 'invalid_target', 'requested resource is unavailable');
+        return;
+    }
+    let activeClient;
+    try {
+        activeClient = await options.runtime.store.loadActiveClient(client.principalId, nowSeconds * 1000);
+    }
+    catch {
+        oauthError(res, 401, 'invalid_client', 'invalid client authentication');
+        return;
+    }
+    const grant = matchingGrant(activeClient?.grants ?? [], resolved.tenant);
+    if (grant === undefined) {
+        oauthError(res, 400, 'invalid_target', 'requested resource is unavailable');
+        return;
+    }
+    const scopes = requestedScopes(body(req).scope, grant.scopes);
+    if (scopes === undefined) {
+        oauthError(res, 400, 'invalid_scope', 'requested scope is invalid');
+        return;
+    }
+    try {
+        const bindingIsLive = await options.runtime.store.validateAccessBinding({
+            principalId: client.principalId,
+            grantId: grant.grantId,
+            credentialId: client.credentialId,
+            org: resolved.tenant.org,
+            app: resolved.tenant.app,
+            environment: resolved.tenant.env,
+            now: nowSeconds * 1000,
+        });
+        if (!bindingIsLive) {
+            oauthError(res, 401, 'invalid_client', 'invalid client authentication');
+            return;
+        }
+        if (client.assertion !== undefined) {
+            const consumed = await options.runtime.store.consumeAssertionJti({
+                credentialId: client.credentialId,
+                jti: client.assertion.jti,
+                expiresAt: client.assertion.expiresAt * 1000,
+                now: nowSeconds * 1000,
+            });
+            if (!consumed) {
+                oauthError(res, 401, 'invalid_client', 'invalid client authentication');
+                return;
+            }
+        }
+        const scope = scopes.join(' ');
+        const accessToken = await issuer.issueServicePrincipalAccessToken({
+            principalId: client.principalId,
+            resource: resolved.resource,
+            ...(scope.length === 0 ? {} : { scope }),
+            grantId: grant.grantId,
+            credentialId: client.credentialId,
+            ttlSeconds: TEN_MINUTES,
+        });
+        await options.audit?.emit({
+            eventType: 'service_principal.token.issued',
+            org: resolved.tenant.org,
+            app: resolved.tenant.app,
+            env: resolved.tenant.env,
+            ...(resolved.deploymentId === undefined ? {} : { deploymentId: resolved.deploymentId }),
+            actorSubject: client.principalId,
+            decision: 'allow',
+            status: 200,
+            details: {
+                principalId: client.principalId,
+                grantId: grant.grantId,
+                credentialId: client.credentialId,
+            },
+        });
+        res.status(200).json({
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: TEN_MINUTES,
+            ...(scope.length === 0 ? {} : { scope }),
+        });
+    }
+    catch {
+        oauthError(res, 401, 'invalid_client', 'invalid client authentication');
+    }
+}
+function body(req) {
+    return req.body !== null && typeof req.body === 'object'
+        ? req.body
+        : {};
+}
+function authorizationHeaders(req) {
+    const values = [];
+    for (let index = 0; index < req.rawHeaders.length; index += 2) {
+        if (req.rawHeaders[index]?.toLowerCase() === 'authorization') {
+            const value = req.rawHeaders[index + 1];
+            if (value !== undefined)
+                values.push(value);
+        }
+    }
+    if (values.length === 0)
+        return undefined;
+    return values.length === 1 ? values[0] : values;
+}
+function oneRequiredString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function matchingGrant(grants, tenant) {
+    return grants.find((grant) => grant.status === 'active' &&
+        grant.org === tenant.org &&
+        grant.app === tenant.app &&
+        grant.environment === tenant.env);
+}
+function requestedScopes(value, ceiling) {
+    if (value === undefined)
+        return ceiling;
+    if (typeof value !== 'string' || value.length === 0)
+        return undefined;
+    const scopes = value.split(' ');
+    if (scopes.length > 64 ||
+        scopes.some((scope) => scope.length < 1 || scope.length > 128 || !/^[\x21\x23-\x5b\x5d-\x7e]+$/.test(scope)) ||
+        new Set(scopes).size !== scopes.length) {
+        return undefined;
+    }
+    const allowed = new Set(ceiling);
+    return scopes.every((scope) => allowed.has(scope)) ? [...scopes].sort() : undefined;
+}
+function noStore(res) {
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Pragma', 'no-cache');
+}
+function oauthError(res, status, error, description) {
+    res.status(status).json({ error, error_description: description });
+}
+//# sourceMappingURL=service-principal-token-handler.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-token-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-token-handler.js","sourceRoot":"","sources":["../../src/oauth/service-principal-token-handler.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,kCAAkC,EAClC,+BAA+B,GAEhC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,+BAA+B,GAEhC,MAAM,iCAAiC,CAAC;AAQzC,MAAM,WAAW,GAAG,GAAG,CAAC;AAexB,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,GAAY,EACZ,GAAa,EACb,MAAmC,EACnC,OAA4C;IAE5C,OAAO,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3B,UAAU,CACR,GAAG,EACH,GAAG,EACH,yBAAyB,EACzB,iDAAiD,CAClD,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACvC,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,GAAG,MAAM,kCAAkC,CAC/C,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,EAC9E,OAAO,CAAC,OAAO,CAAC,KAAK,EACrB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,EAC5C,UAAU,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;YACzD,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,IAAI,QAAsD,CAAC;IAC3D,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,+BAA+B,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QACjE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,IAAI,YAAsD,CAAC;IAC3D,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CACzD,MAAM,CAAC,WAAW,EAClB,UAAU,GAAG,IAAI,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,YAAY,EAAE,MAAM,IAAI,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC;YACtE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;YACxB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;YACxB,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;YAChC,GAAG,EAAE,UAAU,GAAG,IAAI;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;gBAC/D,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,GAAG,IAAI;gBAC5C,GAAG,EAAE,UAAU,GAAG,IAAI;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC;YAChE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,WAAW;SACxB,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;YACxB,SAAS,EAAE,gCAAgC;YAC3C,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;YACxB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;YACxB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;YACxB,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;YACvF,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC;SACF,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,WAAW;YACvB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,GAAY;IACxB,OAAO,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAE,GAAG,CAAC,IAAgC;QACvC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACxC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,aAAa,CACpB,MAA8C,EAC9C,MAA4E;IAE5E,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,KAAK,QAAQ;QACzB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QACxB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QACxB,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,GAAG,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,OAA0B;IAE1B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IACE,MAAM,CAAC,MAAM,GAAG,EAAE;QAClB,MAAM,CAAC,IAAI,CACT,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CACvF;QACD,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EACtC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED,SAAS,OAAO,CAAC,GAAa;IAC5B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,GAAa,EAAE,MAAc,EAAE,KAAa,EAAE,WAAmB;IACnF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-token-issuer.d.ts

@@ -0,0 +1,12 @@
+import type { SigningKeyProvider } from '@noodle-borg/auth';
+export interface IssueServicePrincipalAccessTokenInput {
+    readonly principalId: string;
+    readonly resource: string;
+    readonly scope?: string;
+    readonly grantId: string;
+    readonly credentialId: string;
+    readonly ttlSeconds: number;
+}
+/** Mint one service-marked token while keeping private lifecycle bindings out of the public caller. */
+export declare function issueServicePrincipalAccessToken(signer: SigningKeyProvider, issuer: string, input: IssueServicePrincipalAccessTokenInput): Promise<string>;
+//# sourceMappingURL=service-principal-token-issuer.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-token-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-token-issuer.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,uGAAuG;AACvG,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,MAAM,CAAC,CAgBjB"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-token-issuer.js

@@ -0,0 +1,20 @@
+import { mintOAuthAccessToken } from './token-issuer.js';
+/** Mint one service-marked token while keeping private lifecycle bindings out of the public caller. */
+export function issueServicePrincipalAccessToken(signer, issuer, input) {
+    return mintOAuthAccessToken({
+        signer,
+        issuer,
+        ttlSeconds: input.ttlSeconds,
+        identity: {
+            ownerSubject: input.principalId,
+            resource: input.resource,
+            ...(input.scope === undefined ? {} : { scope: input.scope }),
+            roles: [],
+            identityKind: 'service',
+            oauthClientId: input.principalId,
+            servicePrincipalGrantId: input.grantId,
+            servicePrincipalCredentialId: input.credentialId,
+        },
+    });
+}
+//# sourceMappingURL=service-principal-token-issuer.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-token-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-token-issuer.js","sourceRoot":"","sources":["../../src/oauth/service-principal-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAWzD,uGAAuG;AACvG,MAAM,UAAU,gCAAgC,CAC9C,MAA0B,EAC1B,MAAc,EACd,KAA4C;IAE5C,OAAO,oBAAoB,CAAC;QAC1B,MAAM;QACN,MAAM;QACN,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE;YACR,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5D,KAAK,EAAE,EAAE;YACT,YAAY,EAAE,SAAS;YACvB,aAAa,EAAE,KAAK,CAAC,WAAW;YAChC,uBAAuB,EAAE,KAAK,CAAC,OAAO;YACtC,4BAA4B,EAAE,KAAK,CAAC,YAAY;SACjD;KACF,CAAC,CAAC;AACL,CAAC"}