@ratelkey/burrow-sdk 0.1.0 → 0.2.0

package/README.md

@@ -2,20 +2,10 @@
 
 Read secrets from a self-hosted [RatelKey](https://ratelkey.com) Burrow with a machine identity.
 
-This is the Node.js SDK. It lives under `tools/SDKs/<language>/`, one directory per language; each SDK is a
-standalone, independently-published artifact that speaks the same signed machine data-plane protocol. Its API
-mirrors the Kotlin/JVM SDK one-for-one, so a Burrow reads the same way in either language.
-
-## What it does
-
-A machine authenticates to a Burrow with a per-request **Ed25519 signature** — no session, no long-lived
-bearer token. The private key is generated on the machine during bootstrap and never leaves it. This SDK
-signs each read the same way the `ratel` CLI does, so a machine bootstrapped once works with both.
-
 - Single and structured secrets, and individual fields of a structured secret.
-- The machine's own access map (which projects/environments it can read).
-- Trust-on-first-use certificate pinning for the default self-signed Burrow (shared pin store with the CLI),
-  or standard CA trust for a Burrow on a real domain.
+- The machine's own access map (`listProjects`, `listSecrets`).
+- Certificate pinning, or standard CA trust (`TlsMode`).
+- An OIDC token instead of a key (`Burrow.oidc`).
 
 ## Requirements
 
@@ -24,9 +14,8 @@ signs each read the same way the `ratel` CLI does, so a machine bootstrapped onc
 
 ## Bootstrap a machine
 
-From the Burrow dashboard, open **Machines → Add machine** and run the one-line install on the target host.
-It generates the keypair locally, registers the public key, and writes the identity to
-`~/.burrow/burrows/<slug>/identity.json`. Grant the machine access to the projects/environments it needs.
+From the Burrow dashboard, **Machines → Add machine**, and run the install it gives you on the target host.
+The identity lands at `~/.burrow/burrows/<slug>/identity.json`.
 
 ## Quick start
 
@@ -49,8 +38,6 @@ const [user, pass] = db.getFields("username", "password");    // in order — de
 for (const p of await burrow.listProjects()) console.log(`${p.project}: ${p.categories}`);
 ```
 
-Resolving the identity and loading its key are synchronous; only the reads themselves are async.
-
 Point it at a specific identity by selector or path:
 
 ```ts
@@ -70,21 +57,20 @@ const burrow = Burrow.connect({
 });
 ```
 
-## Certificate trust
+## OIDC
+
+```ts
+const burrow = Burrow.oidc({
+  burrowUrl: "https://burrow.example.com",
+  fingerprint: process.env.BURROW_FINGERPRINT, // omit for a publicly-trusted certificate
+});
 
-Burrows serve HTTPS self-signed by default, so the SDK pins the Burrow's **public key** rather than
-disabling verification. The key, not the certificate: a Burrow that adds a custom domain or renews its
-certificate is still the same Burrow, and pinning the certificate would refuse it.
+const apiKey = (await burrow.getSecret("payments/prod/API_KEY")).value;
+```
 
-- `TlsMode.Pinned` (default) — trust-on-first-use; pins on first contact, refuses a changed key. Kept beside
-  that Burrow's identity at `~/.burrow/burrows/<slug>/known_cert`, shared with the CLI.
-- `TlsMode.PinnedTo("aa:bb:…")` — pin to a known fingerprint (the SHA-256 the Burrow shows in its network
-  settings). No first-use trust.
-- `TlsMode.SystemTrust` — standard CA + hostname verification, for a Burrow on a custom domain or Let's
-  Encrypt.
+`audience` defaults to `burrowUrl`. GitHub Actions currently requires `permissions: id-token: write`.
 
-The handshake completes and the pin is checked before the HTTP request is written, so a mismatched
-certificate never sees the signed request.
+## Certificate trust
 
 ```ts
 import { Burrow, TlsMode } from "@ratelkey/burrow-sdk";
@@ -92,6 +78,10 @@ import { Burrow, TlsMode } from "@ratelkey/burrow-sdk";
 const burrow = Burrow(null, { tls: TlsMode.SystemTrust });
 ```
 
+- `TlsMode.Pinned` (default) — trust-on-first-use, stored at `~/.burrow/burrows/<slug>/known_cert`.
+- `TlsMode.PinnedTo("aa:bb:…")` — a fixed fingerprint (from the Burrow's network settings).
+- `TlsMode.SystemTrust` — CA + hostname verification, for a Burrow on a custom domain or Let's Encrypt.
+
 ## Errors
 
 Every failure is a `BurrowException`: `BurrowAuthException` (401), `BurrowForbiddenException` (403, no grant),

package/dist/cjs/Auth.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcAuthorizer = exports.SignedAuthorizer = void 0;
+const Oidc_js_1 = require("./Oidc.js");
+const Signer_js_1 = require("./Signer.js");
+/** Signs each request with the machine's Ed25519 key. */
+class SignedAuthorizer {
+    machineId;
+    key;
+    clientTag;
+    now;
+    constructor(machineId, key, clientTag, now = Date.now) {
+        this.machineId = machineId;
+        this.key = key;
+        this.clientTag = clientTag;
+        this.now = now;
+    }
+    authorize(action, resource) {
+        return Promise.resolve(Signer_js_1.MachineSigner.sign(this.machineId, this.key, action, resource, this.clientTag, this.now()));
+    }
+}
+exports.SignedAuthorizer = SignedAuthorizer;
+/** Mints a provider OIDC token per request and sends it as a bearer. No key; the Burrow identifies the machine
+ *  from the token's claims. */
+class OidcAuthorizer {
+    audience;
+    clientTag;
+    machineId = "";
+    constructor(audience, clientTag) {
+        this.audience = audience;
+        this.clientTag = clientTag;
+    }
+    async authorize() {
+        const token = await (0, Oidc_js_1.mintOidcToken)(this.audience);
+        return { Authorization: `Bearer ${token}`, "Ratel-Client": this.clientTag };
+    }
+}
+exports.OidcAuthorizer = OidcAuthorizer;
+//# sourceMappingURL=Auth.js.map

package/dist/cjs/Auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.js","sourceRoot":"","sources":["../../src/Auth.ts"],"names":[],"mappings":";;;AACA,uCAA0C;AAC1C,2CAA4C;AAc5C,yDAAyD;AACzD,MAAa,gBAAgB;IAEhB;IACQ;IACA;IACA;IAJnB,YACW,SAAiB,EACT,GAAc,EACd,SAAiB,EACjB,MAAoB,IAAI,CAAC,GAAG;QAHpC,cAAS,GAAT,SAAS,CAAQ;QACT,QAAG,GAAH,GAAG,CAAW;QACd,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,SAAS,CAAC,MAAc,EAAE,QAAkB;QAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,yBAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrH,CAAC;CACF;AAXD,4CAWC;AAED;+BAC+B;AAC/B,MAAa,cAAc;IAGI;IAAmC;IAFvD,SAAS,GAAG,EAAE,CAAC;IAExB,YAA6B,QAAgB,EAAmB,SAAiB;QAApD,aAAQ,GAAR,QAAQ,CAAQ;QAAmB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAErF,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,MAAM,IAAA,uBAAa,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9E,CAAC;CACF;AATD,wCASC"}

package/dist/cjs/Burrow.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Burrow = exports.DEFAULT_CLIENT_TAG = exports.SDK_VERSION = void 0;
+const Auth_js_1 = require("./Auth.js");
 const BurrowClient_js_1 = require("./BurrowClient.js");
 const Identity_js_1 = require("./Identity.js");
 const Tls_js_1 = require("./Tls.js");
@@ -16,7 +17,8 @@ exports.DEFAULT_CLIENT_TAG = `ratel-sdk-node/${exports.SDK_VERSION}`;
  */
 function open(target, options = {}) {
     const id = Identity_js_1.Identities.select(target);
-    return new BurrowClient_js_1.DefaultBurrowClient(id.burrowUrl, id.machineId, id.loadPrivateKey(), options.clientTag ?? exports.DEFAULT_CLIENT_TAG, options.tls ?? Tls_js_1.TlsMode.Pinned, id.directory);
+    const clientTag = options.clientTag ?? exports.DEFAULT_CLIENT_TAG;
+    return new BurrowClient_js_1.DefaultBurrowClient(id.burrowUrl, new Auth_js_1.SignedAuthorizer(id.machineId, id.loadPrivateKey(), clientTag), options.tls ?? Tls_js_1.TlsMode.Pinned, id.directory);
 }
 /**
  * Connect with an explicit identity — for an app that manages its own key material rather than reading the
@@ -24,7 +26,21 @@ function open(target, options = {}) {
  */
 function connect(options) {
     const key = (0, Identity_js_1.parseEd25519PrivateKey)(options.privateKeyPem, "provided PEM");
-    return new BurrowClient_js_1.DefaultBurrowClient(options.burrowUrl, options.machineId, key, options.clientTag ?? exports.DEFAULT_CLIENT_TAG, options.tls ?? Tls_js_1.TlsMode.Pinned, options.pinStoreDir ?? null);
+    const clientTag = options.clientTag ?? exports.DEFAULT_CLIENT_TAG;
+    return new BurrowClient_js_1.DefaultBurrowClient(options.burrowUrl, new Auth_js_1.SignedAuthorizer(options.machineId, key, clientTag), options.tls ?? Tls_js_1.TlsMode.Pinned, options.pinStoreDir ?? null);
 }
-exports.Burrow = Object.assign(open, { DEFAULT_CLIENT_TAG: exports.DEFAULT_CLIENT_TAG, connect });
+/**
+ * Connect with OIDC — for a CI workflow (GitHub Actions today) that reads secrets with no key. Each call
+ * mints a fresh provider token for {@link OidcConnectOptions.audience} and sends it as a bearer; the Burrow
+ * verifies it against the machine's trust policy. There is no key and nothing written to disk.
+ *
+ * TLS defaults to {@link OidcConnectOptions.fingerprint} when given (pin the burrow's public key, from its
+ * Network settings) and otherwise to system trust — trust-on-first-use is useless on an ephemeral runner.
+ */
+function oidc(options) {
+    const clientTag = options.clientTag ?? exports.DEFAULT_CLIENT_TAG;
+    const tls = options.tls ?? (options.fingerprint ? Tls_js_1.TlsMode.PinnedTo(options.fingerprint) : Tls_js_1.TlsMode.SystemTrust);
+    return new BurrowClient_js_1.DefaultBurrowClient(options.burrowUrl, new Auth_js_1.OidcAuthorizer(options.audience ?? options.burrowUrl, clientTag), tls, null);
+}
+exports.Burrow = Object.assign(open, { DEFAULT_CLIENT_TAG: exports.DEFAULT_CLIENT_TAG, connect, oidc });
 //# sourceMappingURL=Burrow.js.map

package/dist/cjs/Burrow.js.map

@@ -1 +1 @@
-{"version":3,"file":"Burrow.js","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":";;;AAAA,uDAA2E;AAC3E,+CAAmE;AACnE,qCAAmC;AAEnC,2FAA2F;AAC9E,QAAA,WAAW,GAAG,OAAO,CAAC;AAEnC,4GAA4G;AAC/F,QAAA,kBAAkB,GAAG,kBAAkB,mBAAW,EAAE,CAAC;AA2BlE;;;;;GAKG;AACH,SAAS,IAAI,CAAC,MAAsB,EAAE,UAAyB,EAAE;IAC/D,MAAM,EAAE,GAAG,wBAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,qCAAmB,CAC5B,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,cAAc,EAAE,EACnB,OAAO,CAAC,SAAS,IAAI,0BAAkB,EACvC,OAAO,CAAC,GAAG,IAAI,gBAAO,CAAC,MAAM,EAC7B,EAAE,CAAC,SAAS,CACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,OAAuB;IACtC,MAAM,GAAG,GAAG,IAAA,oCAAsB,EAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,qCAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,EACjB,GAAG,EACH,OAAO,CAAC,SAAS,IAAI,0BAAkB,EACvC,OAAO,CAAC,GAAG,IAAI,gBAAO,CAAC,MAAM,EAC7B,OAAO,CAAC,WAAW,IAAI,IAAI,CAC5B,CAAC;AACJ,CAAC;AAiCY,QAAA,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAlB,0BAAkB,EAAE,OAAO,EAAE,CAAC,CAAC"}
+{"version":3,"file":"Burrow.js","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":";;;AAAA,uCAA6D;AAC7D,uDAA2E;AAC3E,+CAAmE;AACnE,qCAAmC;AAEnC,2FAA2F;AAC9E,QAAA,WAAW,GAAG,OAAO,CAAC;AAEnC,4GAA4G;AAC/F,QAAA,kBAAkB,GAAG,kBAAkB,mBAAW,EAAE,CAAC;AAuClE;;;;;GAKG;AACH,SAAS,IAAI,CAAC,MAAsB,EAAE,UAAyB,EAAE;IAC/D,MAAM,EAAE,GAAG,wBAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,0BAAkB,CAAC;IAC1D,OAAO,IAAI,qCAAmB,CAC5B,EAAE,CAAC,SAAS,EACZ,IAAI,0BAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,SAAS,CAAC,EAClE,OAAO,CAAC,GAAG,IAAI,gBAAO,CAAC,MAAM,EAC7B,EAAE,CAAC,SAAS,CACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,OAAuB;IACtC,MAAM,GAAG,GAAG,IAAA,oCAAsB,EAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,0BAAkB,CAAC;IAC1D,OAAO,IAAI,qCAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,IAAI,0BAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EACvD,OAAO,CAAC,GAAG,IAAI,gBAAO,CAAC,MAAM,EAC7B,OAAO,CAAC,WAAW,IAAI,IAAI,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,IAAI,CAAC,OAA2B;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,0BAAkB,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAO,CAAC,WAAW,CAAC,CAAC;IAC/G,OAAO,IAAI,qCAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,IAAI,wBAAc,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EACpE,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAoCY,QAAA,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAlB,0BAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/cjs/BurrowClient.js

@@ -3,24 +3,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DefaultBurrowClient = void 0;
 const Errors_js_1 = require("./Errors.js");
 const Model_js_1 = require("./Model.js");
-const Signer_js_1 = require("./Signer.js");
 const Transport_js_1 = require("./Transport.js");
-/** The default {@link BurrowClient}: signs each request and talks to the Burrow over the pinned transport. */
+/** The default {@link BurrowClient}: authenticates each request via its {@link Authorizer} and talks to the
+ *  Burrow over the pinned transport. */
 class DefaultBurrowClient {
     burrowUrl;
-    machineId;
-    key;
-    clientTag;
-    now;
+    authorizer;
     transport;
-    constructor(burrowUrl, machineId, key, clientTag, tls, 
+    machineId;
+    constructor(burrowUrl, authorizer, tls, 
     /** Where this Burrow's pinned key is kept — its identity directory. Null for a caller that has none. */
-    pinStoreDir, now = Date.now) {
+    pinStoreDir) {
         this.burrowUrl = burrowUrl;
-        this.machineId = machineId;
-        this.key = key;
-        this.clientTag = clientTag;
-        this.now = now;
+        this.authorizer = authorizer;
+        this.machineId = authorizer.machineId;
         this.transport = new Transport_js_1.Transport(burrowUrl, tls, pinStoreDir);
     }
     async getSecret(coordinate) {
@@ -51,8 +47,8 @@ class DefaultBurrowClient {
             return new Model_js_1.ProjectAccess(typeof o["project"] === "string" ? o["project"] : "", Array.isArray(categories) ? categories.filter((c) => typeof c === "string") : []);
         });
     }
-    signedGet(action, resource, path) {
-        const headers = Signer_js_1.MachineSigner.sign(this.machineId, this.key, action, resource, this.clientTag, this.now());
+    async signedGet(action, resource, path) {
+        const headers = await this.authorizer.authorize(action, resource);
         return this.transport.get(path, headers);
     }
 }

package/dist/cjs/BurrowClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"BurrowClient.js","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":";;;AACA,2CAAuD;AACvD,yCAAuF;AACvF,2CAA4C;AAE5C,iDAA2C;AA2B3C,8GAA8G;AAC9G,MAAa,mBAAmB;IAInB;IACA;IACQ;IACA;IAIA;IAVF,SAAS,CAAY;IAEtC,YACW,SAAiB,EACjB,SAAiB,EACT,GAAc,EACd,SAAiB,EAClC,GAAY;IACZ,wGAAwG;IACxG,WAA0B,EACT,MAAoB,IAAI,CAAC,GAAG;QAPpC,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAQ;QACT,QAAG,GAAH,GAAG,CAAW;QACd,cAAS,GAAT,SAAS,CAAQ;QAIjB,QAAG,GAAH,GAAG,CAAyB;QAE7C,IAAI,CAAC,SAAS,GAAG,IAAI,wBAAS,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,2BAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,SAAS,CAAC,8DAA8D,UAAU,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,aAAa,EACb,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,IAAI,wBAAa,CACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;QAChE,MAAM,OAAO,GAAG,yBAAa,CAAC,IAAI,CAChC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EACR,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AA/DD,kDA+DC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,iBAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,iBAAM,CAAC,MAAM,CAClB,IAAI,EACJ,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,oCAAwB,CAChC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,oCAAwB,CAAC,kDAAkD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAC"}
+{"version":3,"file":"BurrowClient.js","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":";;;AACA,2CAAuD;AACvD,yCAAuF;AAEvF,iDAA2C;AA4B3C;wCACwC;AACxC,MAAa,mBAAmB;IAKnB;IACQ;IALF,SAAS,CAAY;IAC7B,SAAS,CAAS;IAE3B,YACW,SAAiB,EACT,UAAsB,EACvC,GAAY;IACZ,wGAAwG;IACxG,WAA0B;QAJjB,cAAS,GAAT,SAAS,CAAQ;QACT,eAAU,GAAV,UAAU,CAAY;QAKvC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,IAAI,wBAAS,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,2BAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,SAAS,CAAC,8DAA8D,UAAU,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,aAAa,EACb,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,IAAI,wBAAa,CACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAvDD,kDAuDC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,iBAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,iBAAM,CAAC,MAAM,CAClB,IAAI,EACJ,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,oCAAwB,CAChC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,oCAAwB,CAAC,kDAAkD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAC"}

package/dist/cjs/Oidc.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oidcProviderDetected = oidcProviderDetected;
+exports.mintOidcToken = mintOidcToken;
+const Errors_js_1 = require("./Errors.js");
+/**
+ * Mints a provider OIDC token for the machine data plane — the CI path, where the client holds no key and
+ * proves itself with a short-lived token its provider signs. GitHub Actions is the provider today.
+ *
+ * The token's audience must be the value the Burrow's trust policy requires; the Burrow verifies the token's
+ * signature against the provider's keys and matches its claims (repository, workflow, environment) to that
+ * policy. Nothing here is a secret at rest: the token lives for minutes and is minted per request.
+ */
+/** Whether this process can mint an OIDC token right now (GitHub Actions with `id-token: write`). */
+function oidcProviderDetected() {
+    return ((process.env["ACTIONS_ID_TOKEN_REQUEST_URL"]?.length ?? 0) > 0 &&
+        (process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"]?.length ?? 0) > 0);
+}
+/** Request a token for `audience` from the detected provider. Throws if no provider is available. */
+async function mintOidcToken(audience) {
+    const requestUrl = process.env["ACTIONS_ID_TOKEN_REQUEST_URL"];
+    const requestToken = process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"];
+    if (!requestUrl || !requestToken) {
+        throw new Errors_js_1.BurrowAuthException("no OIDC provider detected. In GitHub Actions the workflow needs 'permissions: id-token: write' " +
+            "(which sets ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN)");
+    }
+    const url = new URL(requestUrl);
+    if (audience.length > 0)
+        url.searchParams.set("audience", audience);
+    let response;
+    try {
+        // GitHub's token service, publicly trusted — ordinary TLS verification applies.
+        response = await fetch(url, {
+            headers: { Authorization: `Bearer ${requestToken}`, Accept: "application/json" },
+        });
+    }
+    catch (e) {
+        throw new Errors_js_1.BurrowAuthException(`requesting an OIDC token from the provider: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
+    }
+    if (!response.ok) {
+        throw new Errors_js_1.BurrowAuthException(`the OIDC token request failed (HTTP ${response.status})`);
+    }
+    const body = (await response.json().catch(() => ({})));
+    if (typeof body.value !== "string" || body.value.length === 0) {
+        throw new Errors_js_1.BurrowAuthException("the OIDC provider returned no token");
+    }
+    return body.value;
+}
+//# sourceMappingURL=Oidc.js.map

package/dist/cjs/Oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Oidc.js","sourceRoot":"","sources":["../../src/Oidc.ts"],"names":[],"mappings":";;AAYA,oDAKC;AAGD,sCA6BC;AAjDD,2CAAkD;AAElD;;;;;;;GAOG;AAEH,qGAAqG;AACrG,SAAgB,oBAAoB;IAClC,OAAO,CACL,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC9D,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,qGAAqG;AAC9F,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,+BAAmB,CAC3B,iGAAiG;YAC/F,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEpE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,gFAAgF;QAChF,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,+BAAmB,CAAC,+CAA+C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,+BAAmB,CAAC,uCAAuC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwB,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,+BAAmB,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC"}

package/dist/esm/Auth.d.ts

@@ -0,0 +1,31 @@
+import type { KeyObject } from "node:crypto";
+/**
+ * Produces the auth headers for one machine-plane request. Two implementations: {@link SignedAuthorizer} (an
+ * Ed25519 key signs each request) and {@link OidcAuthorizer} (a provider-minted bearer token). The client
+ * doesn't care which — it awaits `authorize` and hands the headers to the transport.
+ */
+export interface Authorizer {
+    /** The machine id, when known client-side. Empty for OIDC, where the Burrow resolves it from the token. */
+    readonly machineId: string;
+    /** Headers for the request. `resource` is the signed operation's coordinates (Ed25519 only). */
+    authorize(action: string, resource: string[]): Promise<Record<string, string>>;
+}
+/** Signs each request with the machine's Ed25519 key. */
+export declare class SignedAuthorizer implements Authorizer {
+    readonly machineId: string;
+    private readonly key;
+    private readonly clientTag;
+    private readonly now;
+    constructor(machineId: string, key: KeyObject, clientTag: string, now?: () => number);
+    authorize(action: string, resource: string[]): Promise<Record<string, string>>;
+}
+/** Mints a provider OIDC token per request and sends it as a bearer. No key; the Burrow identifies the machine
+ *  from the token's claims. */
+export declare class OidcAuthorizer implements Authorizer {
+    private readonly audience;
+    private readonly clientTag;
+    readonly machineId = "";
+    constructor(audience: string, clientTag: string);
+    authorize(): Promise<Record<string, string>>;
+}
+//# sourceMappingURL=Auth.d.ts.map

package/dist/esm/Auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.d.ts","sourceRoot":"","sources":["../../src/Auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,2GAA2G;IAC3G,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gGAAgG;IAChG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChF;AAED,yDAAyD;AACzD,qBAAa,gBAAiB,YAAW,UAAU;IAE/C,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHX,SAAS,EAAE,MAAM,EACT,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAG/E;AAED;+BAC+B;AAC/B,qBAAa,cAAe,YAAW,UAAU;IAGnC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;IAFzE,QAAQ,CAAC,SAAS,MAAM;gBAEK,QAAQ,EAAE,MAAM,EAAmB,SAAS,EAAE,MAAM;IAE3E,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAInD"}

package/dist/esm/Auth.js

@@ -0,0 +1,34 @@
+import { mintOidcToken } from "./Oidc.js";
+import { MachineSigner } from "./Signer.js";
+/** Signs each request with the machine's Ed25519 key. */
+export class SignedAuthorizer {
+    machineId;
+    key;
+    clientTag;
+    now;
+    constructor(machineId, key, clientTag, now = Date.now) {
+        this.machineId = machineId;
+        this.key = key;
+        this.clientTag = clientTag;
+        this.now = now;
+    }
+    authorize(action, resource) {
+        return Promise.resolve(MachineSigner.sign(this.machineId, this.key, action, resource, this.clientTag, this.now()));
+    }
+}
+/** Mints a provider OIDC token per request and sends it as a bearer. No key; the Burrow identifies the machine
+ *  from the token's claims. */
+export class OidcAuthorizer {
+    audience;
+    clientTag;
+    machineId = "";
+    constructor(audience, clientTag) {
+        this.audience = audience;
+        this.clientTag = clientTag;
+    }
+    async authorize() {
+        const token = await mintOidcToken(this.audience);
+        return { Authorization: `Bearer ${token}`, "Ratel-Client": this.clientTag };
+    }
+}
+//# sourceMappingURL=Auth.js.map

package/dist/esm/Auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.js","sourceRoot":"","sources":["../../src/Auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAc5C,yDAAyD;AACzD,MAAM,OAAO,gBAAgB;IAEhB;IACQ;IACA;IACA;IAJnB,YACW,SAAiB,EACT,GAAc,EACd,SAAiB,EACjB,MAAoB,IAAI,CAAC,GAAG;QAHpC,cAAS,GAAT,SAAS,CAAQ;QACT,QAAG,GAAH,GAAG,CAAW;QACd,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,SAAS,CAAC,MAAc,EAAE,QAAkB;QAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrH,CAAC;CACF;AAED;+BAC+B;AAC/B,MAAM,OAAO,cAAc;IAGI;IAAmC;IAFvD,SAAS,GAAG,EAAE,CAAC;IAExB,YAA6B,QAAgB,EAAmB,SAAiB;QAApD,aAAQ,GAAR,QAAQ,CAAQ;QAAmB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAErF,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/dist/esm/Burrow.d.ts

@@ -27,6 +27,17 @@ export interface ConnectOptions extends BurrowOptions {
      */
     pinStoreDir?: string;
 }
+/** Options for {@link Burrow.oidc} — a CI workflow reading secrets with no key. */
+export interface OidcConnectOptions extends BurrowOptions {
+    burrowUrl: string;
+    /** The token audience the Burrow requires. Defaults to `burrowUrl`. */
+    audience?: string;
+    /**
+     * The Burrow's public-key fingerprint to pin (from its Network settings). Omit when the Burrow serves a
+     * publicly-trusted certificate. Ignored when `tls` is set explicitly.
+     */
+    fingerprint?: string;
+}
 /**
  * Entry point for reading secrets from a Burrow with a machine identity.
  *
@@ -54,6 +65,8 @@ export interface BurrowFactory {
     readonly DEFAULT_CLIENT_TAG: string;
     /** Connect with an explicit identity rather than one discovered under `~/.burrow`. */
     connect(options: ConnectOptions): BurrowClient;
+    /** Connect with OIDC — a CI workflow reading secrets with no key (GitHub Actions today). */
+    oidc(options: OidcConnectOptions): BurrowClient;
 }
 export declare const Burrow: BurrowFactory;
 //# sourceMappingURL=Burrow.d.ts.map

package/dist/esm/Burrow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Burrow.d.ts","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,2FAA2F;AAC3F,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,4GAA4G;AAC5G,eAAO,MAAM,kBAAkB,yBAAkC,CAAC;AAElE,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,oGAAoG;IACpG,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+FAA+F;AAC/F,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAoCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,aAAa;IAC5B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IAEhE,4GAA4G;IAC5G,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC,sFAAsF;IACtF,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,CAAC;CAChD;AAED,eAAO,MAAM,MAAM,EAAE,aAAoE,CAAC"}
+{"version":3,"file":"Burrow.d.ts","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,mBAAmB,CAAC;AAE3E,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,2FAA2F;AAC3F,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,4GAA4G;AAC5G,eAAO,MAAM,kBAAkB,yBAAkC,CAAC;AAElE,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,oGAAoG;IACpG,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+FAA+F;AAC/F,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAqDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,aAAa;IAC5B,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IAEhE,4GAA4G;IAC5G,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC,sFAAsF;IACtF,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,CAAC;IAE/C,4FAA4F;IAC5F,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,YAAY,CAAC;CACjD;AAED,eAAO,MAAM,MAAM,EAAE,aAA0E,CAAC"}

package/dist/esm/Burrow.js

@@ -1,3 +1,4 @@
+import { OidcAuthorizer, SignedAuthorizer } from "./Auth.js";
 import { DefaultBurrowClient } from "./BurrowClient.js";
 import { Identities, parseEd25519PrivateKey } from "./Identity.js";
 import { TlsMode } from "./Tls.js";
@@ -13,7 +14,8 @@ export const DEFAULT_CLIENT_TAG = `ratel-sdk-node/${SDK_VERSION}`;
  */
 function open(target, options = {}) {
     const id = Identities.select(target);
-    return new DefaultBurrowClient(id.burrowUrl, id.machineId, id.loadPrivateKey(), options.clientTag ?? DEFAULT_CLIENT_TAG, options.tls ?? TlsMode.Pinned, id.directory);
+    const clientTag = options.clientTag ?? DEFAULT_CLIENT_TAG;
+    return new DefaultBurrowClient(id.burrowUrl, new SignedAuthorizer(id.machineId, id.loadPrivateKey(), clientTag), options.tls ?? TlsMode.Pinned, id.directory);
 }
 /**
  * Connect with an explicit identity — for an app that manages its own key material rather than reading the
@@ -21,7 +23,21 @@ function open(target, options = {}) {
  */
 function connect(options) {
     const key = parseEd25519PrivateKey(options.privateKeyPem, "provided PEM");
-    return new DefaultBurrowClient(options.burrowUrl, options.machineId, key, options.clientTag ?? DEFAULT_CLIENT_TAG, options.tls ?? TlsMode.Pinned, options.pinStoreDir ?? null);
+    const clientTag = options.clientTag ?? DEFAULT_CLIENT_TAG;
+    return new DefaultBurrowClient(options.burrowUrl, new SignedAuthorizer(options.machineId, key, clientTag), options.tls ?? TlsMode.Pinned, options.pinStoreDir ?? null);
 }
-export const Burrow = Object.assign(open, { DEFAULT_CLIENT_TAG, connect });
+/**
+ * Connect with OIDC — for a CI workflow (GitHub Actions today) that reads secrets with no key. Each call
+ * mints a fresh provider token for {@link OidcConnectOptions.audience} and sends it as a bearer; the Burrow
+ * verifies it against the machine's trust policy. There is no key and nothing written to disk.
+ *
+ * TLS defaults to {@link OidcConnectOptions.fingerprint} when given (pin the burrow's public key, from its
+ * Network settings) and otherwise to system trust — trust-on-first-use is useless on an ephemeral runner.
+ */
+function oidc(options) {
+    const clientTag = options.clientTag ?? DEFAULT_CLIENT_TAG;
+    const tls = options.tls ?? (options.fingerprint ? TlsMode.PinnedTo(options.fingerprint) : TlsMode.SystemTrust);
+    return new DefaultBurrowClient(options.burrowUrl, new OidcAuthorizer(options.audience ?? options.burrowUrl, clientTag), tls, null);
+}
+export const Burrow = Object.assign(open, { DEFAULT_CLIENT_TAG, connect, oidc });
 //# sourceMappingURL=Burrow.js.map

package/dist/esm/Burrow.js.map

@@ -1 +1 @@
-{"version":3,"file":"Burrow.js","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,4GAA4G;AAC5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,WAAW,EAAE,CAAC;AA2BlE;;;;;GAKG;AACH,SAAS,IAAI,CAAC,MAAsB,EAAE,UAAyB,EAAE;IAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,mBAAmB,CAC5B,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,SAAS,EACZ,EAAE,CAAC,cAAc,EAAE,EACnB,OAAO,CAAC,SAAS,IAAI,kBAAkB,EACvC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAC7B,EAAE,CAAC,SAAS,CACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,OAAuB;IACtC,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,mBAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,EACjB,GAAG,EACH,OAAO,CAAC,SAAS,IAAI,kBAAkB,EACvC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAC7B,OAAO,CAAC,WAAW,IAAI,IAAI,CAC5B,CAAC;AACJ,CAAC;AAiCD,MAAM,CAAC,MAAM,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC"}
+{"version":3,"file":"Burrow.js","sourceRoot":"","sources":["../../src/Burrow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAqB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,4GAA4G;AAC5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,WAAW,EAAE,CAAC;AAuClE;;;;;GAKG;AACH,SAAS,IAAI,CAAC,MAAsB,EAAE,UAAyB,EAAE;IAC/D,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,OAAO,IAAI,mBAAmB,CAC5B,EAAE,CAAC,SAAS,EACZ,IAAI,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,SAAS,CAAC,EAClE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAC7B,EAAE,CAAC,SAAS,CACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,OAAuB;IACtC,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,OAAO,IAAI,mBAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,IAAI,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EACvD,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,EAC7B,OAAO,CAAC,WAAW,IAAI,IAAI,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,IAAI,CAAC,OAA2B;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/G,OAAO,IAAI,mBAAmB,CAC5B,OAAO,CAAC,SAAS,EACjB,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EACpE,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC;AAoCD,MAAM,CAAC,MAAM,MAAM,GAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/esm/BurrowClient.d.ts

@@ -1,14 +1,15 @@
-import type { KeyObject } from "node:crypto";
+import type { Authorizer } from "./Auth.js";
 import { ProjectAccess, Secret, SecretCoordinate } from "./Model.js";
 import type { TlsMode } from "./Tls.js";
 /**
- * Reads secrets from a Burrow as a machine identity. Every call is independently Ed25519-signed — there is
- * no session and no long-lived bearer token. Instances are reusable; construct one via `Burrow`.
+ * Reads secrets from a Burrow as a machine identity. Every call is independently authenticated — either an
+ * Ed25519 signature or a freshly-minted OIDC token — with no session held. Instances are reusable; construct
+ * one via `Burrow`.
  */
 export interface BurrowClient {
     /** The Burrow this client reads from. */
     readonly burrowUrl: string;
-    /** The machine identity this client acts as. */
+    /** The machine identity this client acts as. Empty when authenticating by OIDC (the Burrow resolves it). */
     readonly machineId: string;
     /**
      * Read a secret by its `project/env/NAME` coordinate, whole, in one signed call. Project the result
@@ -21,17 +22,16 @@ export interface BurrowClient {
     /** Every project this machine can read, and the environment categories it holds in each. */
     listProjects(): Promise<ProjectAccess[]>;
 }
-/** The default {@link BurrowClient}: signs each request and talks to the Burrow over the pinned transport. */
+/** The default {@link BurrowClient}: authenticates each request via its {@link Authorizer} and talks to the
+ *  Burrow over the pinned transport. */
 export declare class DefaultBurrowClient implements BurrowClient {
     readonly burrowUrl: string;
-    readonly machineId: string;
-    private readonly key;
-    private readonly clientTag;
-    private readonly now;
+    private readonly authorizer;
     private readonly transport;
-    constructor(burrowUrl: string, machineId: string, key: KeyObject, clientTag: string, tls: TlsMode, 
+    readonly machineId: string;
+    constructor(burrowUrl: string, authorizer: Authorizer, tls: TlsMode, 
     /** Where this Burrow's pinned key is kept — its identity directory. Null for a caller that has none. */
-    pinStoreDir: string | null, now?: () => number);
+    pinStoreDir: string | null);
     getSecret(coordinate: string): Promise<Secret>;
     listSecrets(): Promise<SecretCoordinate[]>;
     listProjects(): Promise<ProjectAccess[]>;

package/dist/esm/BurrowClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BurrowClient.d.ts","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGxC;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C,2EAA2E;IAC3E,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3C,4FAA4F;IAC5F,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC1C;AAED,8GAA8G;AAC9G,qBAAa,mBAAoB,YAAW,YAAY;IAIpD,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAI1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAG3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACT,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,EAClC,GAAG,EAAE,OAAO;IACZ,wGAAwG;IACxG,WAAW,EAAE,MAAM,GAAG,IAAI,EACT,GAAG,GAAE,MAAM,MAAiB;IAKzC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa9C,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAQ1C,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAe9C,OAAO,CAAC,SAAS;CAWlB"}
+{"version":3,"file":"BurrowClient.d.ts","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGxC;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,4GAA4G;IAC5G,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/C,2EAA2E;IAC3E,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3C,4FAA4F;IAC5F,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC1C;AAED;wCACwC;AACxC,qBAAa,mBAAoB,YAAW,YAAY;IAKpD,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAGhB,SAAS,EAAE,MAAM,EACT,UAAU,EAAE,UAAU,EACvC,GAAG,EAAE,OAAO;IACZ,wGAAwG;IACxG,WAAW,EAAE,MAAM,GAAG,IAAI;IAMtB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa9C,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAQ1C,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAehC,SAAS;CAIxB"}

package/dist/esm/BurrowClient.js

@@ -1,23 +1,19 @@
 import { BurrowTransportException } from "./Errors.js";
 import { ProjectAccess, Secret, SecretCoordinate } from "./Model.js";
-import { MachineSigner } from "./Signer.js";
 import { Transport } from "./Transport.js";
-/** The default {@link BurrowClient}: signs each request and talks to the Burrow over the pinned transport. */
+/** The default {@link BurrowClient}: authenticates each request via its {@link Authorizer} and talks to the
+ *  Burrow over the pinned transport. */
 export class DefaultBurrowClient {
     burrowUrl;
-    machineId;
-    key;
-    clientTag;
-    now;
+    authorizer;
     transport;
-    constructor(burrowUrl, machineId, key, clientTag, tls, 
+    machineId;
+    constructor(burrowUrl, authorizer, tls, 
     /** Where this Burrow's pinned key is kept — its identity directory. Null for a caller that has none. */
-    pinStoreDir, now = Date.now) {
+    pinStoreDir) {
         this.burrowUrl = burrowUrl;
-        this.machineId = machineId;
-        this.key = key;
-        this.clientTag = clientTag;
-        this.now = now;
+        this.authorizer = authorizer;
+        this.machineId = authorizer.machineId;
         this.transport = new Transport(burrowUrl, tls, pinStoreDir);
     }
     async getSecret(coordinate) {
@@ -48,8 +44,8 @@ export class DefaultBurrowClient {
             return new ProjectAccess(typeof o["project"] === "string" ? o["project"] : "", Array.isArray(categories) ? categories.filter((c) => typeof c === "string") : []);
         });
     }
-    signedGet(action, resource, path) {
-        const headers = MachineSigner.sign(this.machineId, this.key, action, resource, this.clientTag, this.now());
+    async signedGet(action, resource, path) {
+        const headers = await this.authorizer.authorize(action, resource);
         return this.transport.get(path, headers);
     }
 }

package/dist/esm/BurrowClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"BurrowClient.js","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA2B3C,8GAA8G;AAC9G,MAAM,OAAO,mBAAmB;IAInB;IACA;IACQ;IACA;IAIA;IAVF,SAAS,CAAY;IAEtC,YACW,SAAiB,EACjB,SAAiB,EACT,GAAc,EACd,SAAiB,EAClC,GAAY;IACZ,wGAAwG;IACxG,WAA0B,EACT,MAAoB,IAAI,CAAC,GAAG;QAPpC,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAQ;QACT,QAAG,GAAH,GAAG,CAAW;QACd,cAAS,GAAT,SAAS,CAAQ;QAIjB,QAAG,GAAH,GAAG,CAAyB;QAE7C,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,SAAS,CAAC,8DAA8D,UAAU,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,aAAa,EACb,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,IAAI,aAAa,CACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;QAChE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAChC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EACR,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,GAAG,EAAE,CACX,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,EACJ,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,wBAAwB,CAChC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,wBAAwB,CAAC,kDAAkD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAC"}
+{"version":3,"file":"BurrowClient.js","sourceRoot":"","sources":["../../src/BurrowClient.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAoB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvF,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA4B3C;wCACwC;AACxC,MAAM,OAAO,mBAAmB;IAKnB;IACQ;IALF,SAAS,CAAY;IAC7B,SAAS,CAAS;IAE3B,YACW,SAAiB,EACT,UAAsB,EACvC,GAAY;IACZ,wGAAwG;IACxG,WAA0B;QAJjB,cAAS,GAAT,SAAS,CAAQ;QACT,eAAU,GAAV,UAAU,CAAY;QAKvC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,SAAS,CAAC,8DAA8D,UAAU,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAC/B,aAAa,EACb,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAClC,uBAAuB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/C,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,IAAI,aAAa,CACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,EACJ,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EACpD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,wBAAwB,CAChC,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EACzE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,wBAAwB,CAAC,kDAAkD,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAC"}

package/dist/esm/Oidc.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Mints a provider OIDC token for the machine data plane — the CI path, where the client holds no key and
+ * proves itself with a short-lived token its provider signs. GitHub Actions is the provider today.
+ *
+ * The token's audience must be the value the Burrow's trust policy requires; the Burrow verifies the token's
+ * signature against the provider's keys and matches its claims (repository, workflow, environment) to that
+ * policy. Nothing here is a secret at rest: the token lives for minutes and is minted per request.
+ */
+/** Whether this process can mint an OIDC token right now (GitHub Actions with `id-token: write`). */
+export declare function oidcProviderDetected(): boolean;
+/** Request a token for `audience` from the detected provider. Throws if no provider is available. */
+export declare function mintOidcToken(audience: string): Promise<string>;
+//# sourceMappingURL=Oidc.d.ts.map

package/dist/esm/Oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Oidc.d.ts","sourceRoot":"","sources":["../../src/Oidc.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,qGAAqG;AACrG,wBAAgB,oBAAoB,IAAI,OAAO,CAK9C;AAED,qGAAqG;AACrG,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BrE"}

package/dist/esm/Oidc.js

@@ -0,0 +1,45 @@
+import { BurrowAuthException } from "./Errors.js";
+/**
+ * Mints a provider OIDC token for the machine data plane — the CI path, where the client holds no key and
+ * proves itself with a short-lived token its provider signs. GitHub Actions is the provider today.
+ *
+ * The token's audience must be the value the Burrow's trust policy requires; the Burrow verifies the token's
+ * signature against the provider's keys and matches its claims (repository, workflow, environment) to that
+ * policy. Nothing here is a secret at rest: the token lives for minutes and is minted per request.
+ */
+/** Whether this process can mint an OIDC token right now (GitHub Actions with `id-token: write`). */
+export function oidcProviderDetected() {
+    return ((process.env["ACTIONS_ID_TOKEN_REQUEST_URL"]?.length ?? 0) > 0 &&
+        (process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"]?.length ?? 0) > 0);
+}
+/** Request a token for `audience` from the detected provider. Throws if no provider is available. */
+export async function mintOidcToken(audience) {
+    const requestUrl = process.env["ACTIONS_ID_TOKEN_REQUEST_URL"];
+    const requestToken = process.env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"];
+    if (!requestUrl || !requestToken) {
+        throw new BurrowAuthException("no OIDC provider detected. In GitHub Actions the workflow needs 'permissions: id-token: write' " +
+            "(which sets ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN)");
+    }
+    const url = new URL(requestUrl);
+    if (audience.length > 0)
+        url.searchParams.set("audience", audience);
+    let response;
+    try {
+        // GitHub's token service, publicly trusted — ordinary TLS verification applies.
+        response = await fetch(url, {
+            headers: { Authorization: `Bearer ${requestToken}`, Accept: "application/json" },
+        });
+    }
+    catch (e) {
+        throw new BurrowAuthException(`requesting an OIDC token from the provider: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
+    }
+    if (!response.ok) {
+        throw new BurrowAuthException(`the OIDC token request failed (HTTP ${response.status})`);
+    }
+    const body = (await response.json().catch(() => ({})));
+    if (typeof body.value !== "string" || body.value.length === 0) {
+        throw new BurrowAuthException("the OIDC provider returned no token");
+    }
+    return body.value;
+}
+//# sourceMappingURL=Oidc.js.map

package/dist/esm/Oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Oidc.js","sourceRoot":"","sources":["../../src/Oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;GAOG;AAEH,qGAAqG;AACrG,MAAM,UAAU,oBAAoB;IAClC,OAAO,CACL,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC9D,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAC3B,iGAAiG;YAC/F,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEpE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,gFAAgF;QAChF,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,+CAA+C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3I,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,mBAAmB,CAAC,uCAAuC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwB,CAAC;IAC9E,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC"}

package/dist/esm/index.d.ts

@@ -1,5 +1,5 @@
 export { Burrow, DEFAULT_CLIENT_TAG, SDK_VERSION } from "./Burrow.js";
-export type { BurrowFactory, BurrowOptions, ConnectOptions } from "./Burrow.js";
+export type { BurrowFactory, BurrowOptions, ConnectOptions, OidcConnectOptions } from "./Burrow.js";
 export type { BurrowClient } from "./BurrowClient.js";
 export { ProjectAccess, Secret, SecretCoordinate } from "./Model.js";
 export type { SecretField } from "./Model.js";

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChF,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpG,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,aAAa,CAAC"}

package/package.json

@@ -1 +1 @@
-{"name":"@ratelkey/burrow-sdk","version":"0.1.0","description":"Read secrets from a self-hosted RatelKey Burrow with a machine identity.","type":"module","engines":{"node":">=18.17"},"main":"./dist/cjs/index.js","module":"./dist/esm/index.js","types":"./dist/esm/index.d.ts","exports":{".":{"types":"./dist/esm/index.d.ts","import":"./dist/esm/index.js","require":"./dist/cjs/index.js"},"./package.json":"./package.json"},"files":["dist","README.md"],"scripts":{"build":"node scripts/build.mjs","typecheck":"tsc -p tsconfig.json --noEmit","prepublishOnly":"npm run build"},"devDependencies":{"@types/node":"^22.10.0","typescript":"^5.7.0"},"keywords":["ratelkey","burrow","secrets","sdk"]}
+{"name":"@ratelkey/burrow-sdk","version":"0.2.0","description":"Read secrets from a self-hosted RatelKey Burrow with a machine identity.","type":"module","engines":{"node":">=18.17"},"main":"./dist/cjs/index.js","module":"./dist/esm/index.js","types":"./dist/esm/index.d.ts","exports":{".":{"types":"./dist/esm/index.d.ts","import":"./dist/esm/index.js","require":"./dist/cjs/index.js"},"./package.json":"./package.json"},"files":["dist","README.md"],"scripts":{"build":"node scripts/build.mjs","typecheck":"tsc -p tsconfig.json --noEmit","prepublishOnly":"npm run build"},"devDependencies":{"@types/node":"^22.10.0","typescript":"^5.7.0"},"keywords":["ratelkey","burrow","secrets","sdk"]}