@superdurable/connectors-sdk 0.0.0-stage → 0.1.1

package/dist/index.js

@@ -0,0 +1,376 @@
+import {
+  validateMutationDefinition,
+  validateQueryDefinition
+} from "./chunk-2NBM7P4T.js";
+import {
+  SecretString,
+  StaticCredentialProvider,
+  createCall,
+  resolveCredential,
+  resolveCredentialAfterRejection
+} from "./chunk-KD5DYYSU.js";
+import {
+  BranchDefinitionSchema,
+  CallIDNamespace,
+  CallIDSchema,
+  ConnectionRefSchema,
+  ConnectorConfigurationRefSchema,
+  ConnectorConfigurationUISchema,
+  ConnectorUIBindingSchema,
+  ConnectorUIUnitSchema,
+  DefectBranchID,
+  FailureKindSchema,
+  FailureSchema,
+  MutationDefinitionWireSchema,
+  MutationResultSchema,
+  OperationRefSchema,
+  QueryDefinitionWireSchema,
+  QueryResultSchema,
+  ReauthorizationRequiredError,
+  ReceiptSchema,
+  RetryError,
+  StepDefaultsWireSchema,
+  UncertainBranchID,
+  defaultConnectorStepExecuteRetryPolicy,
+  defaultIdempotencyKey,
+  deriveCallID,
+  newMutationBranch,
+  newMutationRetry,
+  newMutationUncertain,
+  newQueryBranch,
+  newQueryRetry,
+  retryPolicyToGoWire,
+  zeroReceipt
+} from "./chunk-SOXYPIMO.js";
+
+// src/run_operation.ts
+async function runQuery(operation, call, input) {
+  if (!operation) return defectResult(void 0, call, "connector query is required");
+  const definition = operation.definition();
+  try {
+    validateQueryDefinition(definition);
+  } catch (error) {
+    return defectResult(definition, call, `invalid query definition: ${safeErrorMessage(error)}`);
+  }
+  const invalidCall = validateCall(call, definition.operation);
+  if (invalidCall) return defectResult(definition, call, invalidCall);
+  const attempt = await operation.invoke(call, input);
+  return resultFromAttempt(definition, call, attempt, "query");
+}
+async function runMutation(operation, call, input) {
+  if (!operation) return defectResult(void 0, call, "connector mutation is required");
+  const definition = operation.definition();
+  try {
+    validateMutationDefinition(definition);
+  } catch (error) {
+    return defectResult(definition, call, `invalid mutation definition: ${safeErrorMessage(error)}`);
+  }
+  const invalidCall = validateCall(call, definition.operation);
+  if (invalidCall) return defectResult(definition, call, invalidCall);
+  const chosenKey = operation.idempotencyKey(call.id, input) || call.id;
+  if (!chosenKey.trim()) return defectResult(definition, call, "mutation returned an invalid idempotency key");
+  const mutationCall = { ...call, context: call.context, idempotencyKey: chosenKey };
+  Object.defineProperty(mutationCall, "context", { value: call.context, enumerable: false });
+  for (const method of ["reportProgress", "writeText", "hasProgressStream", "hasTextStream"]) Object.defineProperty(mutationCall, method, { value: call[method], enumerable: false });
+  const attempt = await operation.invoke(mutationCall, input);
+  return resultFromAttempt(definition, mutationCall, attempt, "mutation");
+}
+function resultFromAttempt(definition, call, attempt, operationKind) {
+  if (!attempt || typeof attempt !== "object") return defectResult(definition, call, `${operationKind} returned an invalid attempt`);
+  if (attempt.kind === "retry") {
+    const failure = FailureSchema.safeParse(attempt.failure);
+    if (!failure.success || !Number.isSafeInteger(attempt.retryAfterMs) || attempt.retryAfterMs < 0) return defectResult(definition, call, `${operationKind} returned an invalid retry attempt`);
+    throw new RetryError(failure.data, attempt.retryAfterMs);
+  }
+  if (attempt.kind === "branch" || operationKind === "mutation" && attempt.kind === "uncertain") {
+    const branch = attempt.kind === "uncertain" ? UncertainBranchID : attempt.branch;
+    if (!definition.branches.some((declared) => declared.id === branch)) {
+      return defectResult(definition, call, attempt.kind === "uncertain" ? "mutation returned uncertainty without declaring the uncertain branch" : `${operationKind} returned an unknown branch`);
+    }
+    const failure = "failure" in attempt && attempt.failure !== void 0 ? FailureSchema.safeParse(attempt.failure) : void 0;
+    if (failure && !failure.success) return defectResult(definition, call, `${operationKind} returned an invalid failure`);
+    if (attempt.kind === "uncertain" && !failure) return defectResult(definition, call, "mutation returned an invalid uncertainty failure");
+    let receipt;
+    try {
+      receipt = completeReceipt(attempt.receipt, call);
+    } catch (error) {
+      return defectResult(definition, call, safeErrorMessage(error));
+    }
+    const result = { branch, value: attempt.value, receipt };
+    if (failure?.success) result.failure = failure.data;
+    return result;
+  }
+  return defectResult(definition, call, `${operationKind} returned an invalid attempt`);
+}
+function completeReceipt(draft, call) {
+  if (draft.callId && draft.callId !== call.id) throw new TypeError("operation returned a receipt for another call");
+  if (draft.idempotencyKey && draft.idempotencyKey !== call.idempotencyKey) throw new TypeError("operation returned a receipt with another idempotency key");
+  return ReceiptSchema.parse({ ...draft, callId: call.id, ...call.idempotencyKey ? { idempotencyKey: call.idempotencyKey } : {}, provider: draft.provider || call.operation.connectorId, observedAt: draft.observedAt && draft.observedAt !== "0001-01-01T00:00:00Z" ? draft.observedAt : (/* @__PURE__ */ new Date()).toISOString() });
+}
+function validateCall(call, operation) {
+  if (!call) return "connector call is required";
+  if (!CallIDSchema.safeParse(call.id).success) return "call ID must be a UUID";
+  if (!ConnectionRefSchema.safeParse(call.connection).success) return "connection provider and name are required";
+  if (!OperationRefSchema.safeParse(call.operation).success || call.operation.connectorId !== operation.connectorId || call.operation.operationId !== operation.operationId) return "connector call operation does not match the definition";
+  return void 0;
+}
+function defectResult(definition, call, message) {
+  const operation = definition?.operation;
+  const failure = { kind: "LOCAL_DEFECT", provider: operation?.connectorId || "connector", operation: operation?.operationId || "invoke", message };
+  const receipt = call && CallIDSchema.safeParse(call.id).success ? completeReceipt({}, call) : void 0;
+  return { branch: DefectBranchID, value: void 0, receipt, failure };
+}
+function safeErrorMessage(error) {
+  return error instanceof Error ? error.message : "invalid value";
+}
+
+// src/step.ts
+import { StepRef, forceFail, goTo, retryAfter } from "@superdurable/dex";
+function goToBranch(branch, target) {
+  return target ? { branch, target } : { branch };
+}
+function stepRef(stepType) {
+  return new StepRef(stepType);
+}
+var QueryStep = class {
+  inputCodec;
+  #configuration;
+  #options;
+  #ui;
+  #targets;
+  #optional;
+  #identity;
+  /** Validate static wiring before registering the Step in a Flow. */
+  constructor(configuration) {
+    if (!configuration?.operation) throw new TypeError("query operation is required");
+    const definition = configuration.operation.definition();
+    validateQueryDefinition(definition);
+    validateFactoryConfiguration(configuration);
+    const routes = validateBranchTargets(definition.branches, configuration.branches);
+    this.#configuration = configuration;
+    this.#options = mergeStepOptions(definition.stepDefaults, configuration.stepOptionsOverride);
+    this.#ui = ConnectorConfigurationUISchema.parse(configuration.configurationUI ?? { units: [] });
+    this.#targets = routes.targets;
+    this.#optional = routes.optional;
+    this.#identity = { operation: definition.operation, connection: configuration.connection };
+    if (configuration.inputCodec) this.inputCodec = configuration.inputCodec;
+  }
+  /** Stable Dex Step type. */
+  getStepType() {
+    return this.#configuration.stepType;
+  }
+  /** Isolated Execute options, including connector retry defaults. */
+  getStepOptions() {
+    return cloneStepOptions(this.#options);
+  }
+  /** Group metadata for Connector Studio. */
+  annotations() {
+    return { ...this.#configuration.annotations };
+  }
+  /** Isolated connector UI composition. */
+  configurationUI() {
+    return structuredClone(this.#ui);
+  }
+  /** Invoke, persist the optional terminal Attribute, and route the selected branch. */
+  async execute(context, input) {
+    const operationInput = this.#configuration.mapToOperationInput(input);
+    const call = createCall(context, this.#identity.connection, this.#identity.operation, {
+      ...this.#configuration.progressStream ? { progressStream: this.#configuration.progressStream } : {},
+      ...this.#configuration.textStream ? { textStream: this.#configuration.textStream } : {},
+      ...this.#configuration.textOptions ? { textOptions: this.#configuration.textOptions } : {}
+    });
+    let result;
+    try {
+      result = await runQuery(this.#configuration.operation, call, operationInput);
+    } catch (error) {
+      throwDexRetry(error);
+    }
+    if (this.#configuration.resultAttribute) context.setAttribute(this.#configuration.resultAttribute, result);
+    return routeBranch(this.#targets, this.#optional, result, this.#identity, "query");
+  }
+};
+var MutationStep = class {
+  inputCodec;
+  #configuration;
+  #options;
+  #ui;
+  #targets;
+  #optional;
+  #identity;
+  /** Validate static wiring before registering the Step in a Flow. */
+  constructor(configuration) {
+    if (!configuration?.operation) throw new TypeError("mutation operation is required");
+    const definition = configuration.operation.definition();
+    validateMutationDefinition(definition);
+    validateFactoryConfiguration(configuration);
+    const routes = validateBranchTargets(definition.branches, configuration.branches);
+    this.#configuration = configuration;
+    this.#options = mergeStepOptions(definition.stepDefaults, configuration.stepOptionsOverride);
+    this.#ui = ConnectorConfigurationUISchema.parse(configuration.configurationUI ?? { units: [] });
+    this.#targets = routes.targets;
+    this.#optional = routes.optional;
+    this.#identity = { operation: definition.operation, connection: configuration.connection };
+    if (configuration.inputCodec) this.inputCodec = configuration.inputCodec;
+  }
+  /** Stable Dex Step type. */
+  getStepType() {
+    return this.#configuration.stepType;
+  }
+  /** Isolated Execute options, including connector retry defaults. */
+  getStepOptions() {
+    return cloneStepOptions(this.#options);
+  }
+  /** Group metadata for Connector Studio. */
+  annotations() {
+    return { ...this.#configuration.annotations };
+  }
+  /** Isolated connector UI composition. */
+  configurationUI() {
+    return structuredClone(this.#ui);
+  }
+  /** Invoke, persist the optional terminal Attribute, and route the selected branch. */
+  async execute(context, input) {
+    const operationInput = this.#configuration.mapToOperationInput(input);
+    const call = createCall(context, this.#identity.connection, this.#identity.operation, {
+      ...this.#configuration.progressStream ? { progressStream: this.#configuration.progressStream } : {},
+      ...this.#configuration.textStream ? { textStream: this.#configuration.textStream } : {},
+      ...this.#configuration.textOptions ? { textOptions: this.#configuration.textOptions } : {}
+    });
+    let result;
+    try {
+      result = await runMutation(this.#configuration.operation, call, operationInput);
+    } catch (error) {
+      throwDexRetry(error);
+    }
+    if (this.#configuration.resultAttribute) context.setAttribute(this.#configuration.resultAttribute, result);
+    return routeBranch(this.#targets, this.#optional, result, this.#identity, "mutation");
+  }
+};
+function newQueryStep(configuration) {
+  return new QueryStep(configuration);
+}
+function newMutationStep(configuration) {
+  return new MutationStep(configuration);
+}
+function validateFactoryConfiguration(configuration) {
+  if (!configuration.stepType?.trim()) throw new TypeError("stable Step type is required");
+  if (!/^[a-z][a-z0-9-]*$/.test(configuration.annotations?.groupId ?? "") || !configuration.annotations.groupLabel?.trim() || !configuration.annotations.explanation?.trim()) throw new TypeError("Step group, group label, and explanation are required");
+  ConnectionRefSchema.parse(configuration.connection);
+  if (typeof configuration.mapToOperationInput !== "function") throw new TypeError("mapToOperationInput is required");
+}
+function validateBranchTargets(definitions, routes) {
+  const expected = new Map(definitions.map((branch) => [branch.id, branch]));
+  const targets = /* @__PURE__ */ new Map();
+  const optional = new Set(definitions.filter((branch) => branch.optional).map((branch) => branch.id));
+  for (const route of routes) {
+    if (!expected.has(route.branch)) throw new TypeError(`branch target ${route.branch} is not declared by the operation`);
+    if (!route.target) {
+      if (!optional.has(route.branch)) throw new TypeError(`branch target ${route.branch} must name a Step`);
+      continue;
+    }
+    if (route.target instanceof StepRef && !route.target.stepType.trim()) throw new TypeError(`branch target ${route.branch} must name a Step`);
+    if (typeof route.target === "object" && !(route.target instanceof StepRef) && !route.target.getStepType().trim()) throw new TypeError(`branch target ${route.branch} must name a Step`);
+    if (targets.has(route.branch)) throw new TypeError(`branch target ${route.branch} is duplicated`);
+    targets.set(route.branch, route.target);
+  }
+  for (const branch of definitions) if (!branch.optional && !targets.has(branch.id)) throw new TypeError(`branch target ${branch.id} is required`);
+  return { targets, optional };
+}
+function mergeStepOptions(defaults, override) {
+  if (override && Object.keys(override).some((key) => key.startsWith("waitFor") && override[key] !== void 0)) throw new TypeError("execute-only connector Step rejects WaitFor options");
+  const merged = {
+    ...override?.executeMethodTimeoutMs || defaults.executeMethodTimeoutMs ? { executeMethodTimeoutMs: override?.executeMethodTimeoutMs || defaults.executeMethodTimeoutMs } : {},
+    ...override?.heartbeatTimeoutMs || defaults.heartbeatTimeoutMs ? { heartbeatTimeoutMs: override?.heartbeatTimeoutMs || defaults.heartbeatTimeoutMs } : {},
+    executeRetry: { ...override?.executeRetry ?? defaults.executeRetry ?? defaultConnectorStepExecuteRetryPolicy() },
+    ...override?.executeDurability || (defaults.executeDurability !== "default" ? defaults.executeDurability : void 0) ? { executeDurability: override?.executeDurability ?? defaults.executeDurability } : {},
+    ...override?.executeFailure ? { executeFailure: override.executeFailure } : {},
+    ...override?.executeLockAttributes ? { executeLockAttributes: override.executeLockAttributes } : {},
+    ...override?.executeLoadAttributeMaps ? { executeLoadAttributeMaps: override.executeLoadAttributeMaps } : {},
+    ...override?.executeLoadAttributeMapInstances ? { executeLoadAttributeMapInstances: override.executeLoadAttributeMapInstances } : {},
+    ...override?.executeLoadChannels ? { executeLoadChannels: override.executeLoadChannels } : {},
+    ...override?.executeLoadChannelMaps ? { executeLoadChannelMaps: override.executeLoadChannelMaps } : {},
+    ...override?.executeLoadChannelMapInstances ? { executeLoadChannelMapInstances: override.executeLoadChannelMapInstances } : {}
+  };
+  return cloneStepOptions(merged);
+}
+function cloneStepOptions(options) {
+  return {
+    ...options,
+    ...options.executeRetry ? { executeRetry: { ...options.executeRetry } } : {},
+    ...options.executeLockAttributes ? { executeLockAttributes: [...options.executeLockAttributes] } : {},
+    ...options.executeLoadAttributeMaps ? { executeLoadAttributeMaps: [...options.executeLoadAttributeMaps] } : {},
+    ...options.executeLoadAttributeMapInstances ? { executeLoadAttributeMapInstances: [...options.executeLoadAttributeMapInstances] } : {},
+    ...options.executeLoadChannels ? { executeLoadChannels: [...options.executeLoadChannels] } : {},
+    ...options.executeLoadChannelMaps ? { executeLoadChannelMaps: [...options.executeLoadChannelMaps] } : {},
+    ...options.executeLoadChannelMapInstances ? { executeLoadChannelMapInstances: [...options.executeLoadChannelMapInstances] } : {}
+  };
+}
+function routeBranch(targets, optional, result, identity, operationKind) {
+  const target = targets.get(result.branch);
+  if (target) return goTo(target, result);
+  if (optional.has(result.branch)) {
+    let reason = `${identity.operation.connectorId} ${identity.operation.operationId} (connection ${identity.connection.name}) selected branch ${result.branch} with no target`;
+    if (result.failure) reason += `: ${result.failure.kind}: ${boundedFailureMessage(result.failure.message)}`;
+    return forceFail(reason);
+  }
+  throw new TypeError(`${operationKind} result selected unconfigured branch ${result.branch}`);
+}
+function boundedFailureMessage(message) {
+  const bytes = Buffer.from(message);
+  if (bytes.length <= 1024) return message;
+  let end = 1024;
+  while (end > 0 && (bytes[end] & 192) === 128) end--;
+  return `${bytes.subarray(0, end).toString("utf8")} (truncated)`;
+}
+function throwDexRetry(error) {
+  if (error instanceof RetryError && error.retryAfterMs >= 1e3) throw retryAfter(Math.floor(error.retryAfterMs / 1e3), error);
+  throw error;
+}
+export {
+  BranchDefinitionSchema,
+  CallIDNamespace,
+  CallIDSchema,
+  ConnectionRefSchema,
+  ConnectorConfigurationRefSchema,
+  ConnectorConfigurationUISchema,
+  ConnectorUIBindingSchema,
+  ConnectorUIUnitSchema,
+  DefectBranchID,
+  FailureKindSchema,
+  FailureSchema,
+  MutationDefinitionWireSchema,
+  MutationResultSchema,
+  MutationStep,
+  OperationRefSchema,
+  QueryDefinitionWireSchema,
+  QueryResultSchema,
+  QueryStep,
+  ReauthorizationRequiredError,
+  ReceiptSchema,
+  RetryError,
+  SecretString,
+  StaticCredentialProvider,
+  StepDefaultsWireSchema,
+  UncertainBranchID,
+  createCall,
+  defaultConnectorStepExecuteRetryPolicy,
+  defaultIdempotencyKey,
+  deriveCallID,
+  goToBranch,
+  newMutationBranch,
+  newMutationRetry,
+  newMutationStep,
+  newMutationUncertain,
+  newQueryBranch,
+  newQueryRetry,
+  newQueryStep,
+  resolveCredential,
+  resolveCredentialAfterRejection,
+  retryPolicyToGoWire,
+  runMutation,
+  runQuery,
+  stepRef,
+  validateMutationDefinition,
+  validateQueryDefinition,
+  zeroReceipt
+};

package/dist/oauthtoken/index.d.ts

@@ -0,0 +1,90 @@
+import { KeyObject } from 'node:crypto';
+import { _ as SecretString } from '../credentials-vrvW0d4j.js';
+import 'zod';
+import '@superdurable/dex';
+
+/** Longest early-refresh window in milliseconds. */
+declare const RefreshSkewMs = 300000;
+/** OAuth token endpoint client authentication. */
+type ClientAuthenticationMethod = 'client_secret_post' | 'client_secret_basic' | 'none';
+/** OAuth client material kept outside durable Flow state. */
+interface ClientCredentials {
+    /** Public client identifier. */ id: string;
+    /** Client secret, omitted for a public client. */ secret?: SecretString;
+    /** RFC 7591 token endpoint authentication method. */ authenticationMethod: ClientAuthenticationMethod;
+}
+/** Successful replacement material from one OAuth grant. */
+declare class TokenResponse {
+    /** Replacement access token. */ readonly accessToken: SecretString;
+    /** Rotated refresh token, empty when the provider retained it. */ readonly refreshToken: SecretString;
+    /** Access lifetime in milliseconds; zero only when explicitly accepted. */ readonly expiresInMs: number;
+    /** Refresh token lifetime in milliseconds; zero when omitted. */ readonly refreshTokenExpiresInMs: number;
+    /** Returned scope string, possibly empty. */ readonly scope: string;
+    /** Returned token type, possibly empty when explicitly accepted. */ readonly tokenType: string;
+    /** Only explicitly retained non-standard response fields. */ readonly retainedFields: Readonly<Record<string, unknown>>;
+    /** Capture validated provider response fields. */
+    constructor(fields: {
+        accessToken: SecretString;
+        refreshToken: SecretString;
+        expiresInMs: number;
+        refreshTokenExpiresInMs: number;
+        scope: string;
+        tokenType: string;
+        retainedFields: Record<string, unknown>;
+    });
+    /** Keep the previous refresh token when no rotated value was returned. */
+    nextRefreshToken(prior: SecretString): SecretString;
+}
+/** One provider token endpoint and its declared response rules. */
+interface TokenEndpointOptions {
+    /** Safe provider name used in errors. */ providerName: string;
+    /** Absolute HTTPS URL, or HTTP only when explicitly allowed. */ url: string;
+    /** Provider error codes that require interactive reauthorization below HTTP 500. */ terminalErrorCodes?: readonly string[];
+    /** Accepted token types, case insensitive; defaults to Bearer. */ acceptedTokenTypes?: readonly string[];
+    /** Accept a successful response without token_type. */ acceptsMissingTokenType?: boolean;
+    /** Accept a successful response without expires_in. */ acceptsMissingExpiresIn?: boolean;
+    /** Non-standard, non-secret top-level fields to retain. */ retainedResponseFields?: readonly string[];
+    /** Send JSON instead of form encoding when the provider requires it. */ usesJSONRequestBody?: boolean;
+    /** Permit a declared HTTP endpoint, including private-network identity servers. */ allowsPlainHTTP?: boolean;
+    /** Fixed non-secret grant parameters that cannot override OAuth grant fields. */ additionalRequestParameters?: Readonly<Record<string, string>>;
+    /** Caller-owned fetch implementation for a proxy or local test. */ fetch?: typeof fetch;
+}
+/** Provider-neutral OAuth refresh and client-credentials exchanges. */
+declare class TokenEndpoint {
+    #private;
+    /** Capture endpoint rules without sending a request. */
+    constructor(options: TokenEndpointOptions);
+    /** Exchange a refresh token, preserving terminal-error classification. */
+    exchangeRefreshToken(client: ClientCredentials, refreshToken: SecretString, signal?: AbortSignal): Promise<TokenResponse>;
+    /** Obtain an access token with the OAuth client-credentials grant. */
+    exchangeClientCredentials(client: ClientCredentials, scopes?: readonly string[], signal?: AbortSignal): Promise<TokenResponse>;
+    /** Exchange a signed JWT bearer assertion without client credentials. */
+    exchangeJWTBearerAssertion(assertion: SecretString, signal?: AbortSignal): Promise<TokenResponse>;
+}
+/** Return min(five minutes, one quarter of a known positive token lifetime). */
+declare function proportionalRefreshSkewMs(issuedAt?: Date, expiresAt?: Date): number;
+/** Return min(one minute, one quarter of a known positive token lifetime). */
+declare function forcedRefreshFloorMs(issuedAt?: Date, expiresAt?: Date): number;
+/** Decide whether an absent or soon-expiring access token needs refresh. */
+declare function isRefreshRequired(hasAccessToken: boolean, expiresAt: Date | undefined, now: Date, missingExpiryRule: 'refresh' | 'keep', issuedAt?: Date): boolean;
+/** Decide with issue time so short-lived tokens use proportional skew. */
+declare function isRefreshRequiredWithIssueTime(hasAccessToken: boolean, issuedAt: Date | undefined, expiresAt: Date | undefined, now: Date, missingExpiryRule: 'refresh' | 'keep'): boolean;
+/** Check whether all required scopes appear in a returned space- or comma-separated set. */
+declare function hasAllScopes(returnedScope: string, requiredScopes: readonly string[]): boolean;
+/** Check set equality of returned and required scopes. */
+declare function hasExactScopes(returnedScope: string, requiredScopes: readonly string[]): boolean;
+/** Claims of an RS256 JWT bearer assertion. */
+interface JWTBearerAssertion {
+    /** iss claim. */ issuer: string;
+    /** Optional sub claim. */ subject?: string;
+    /** aud claim, usually the token URL. */ audience: string;
+    /** Optional scope claim. */ scope?: string;
+    /** iat claim. */ issuedAt: Date;
+    /** Positive lifetime in milliseconds. */ lifetimeMs: number;
+}
+/** Parse a PKCS #1 or PKCS #8 RSA PEM key without exposing key material in errors. */
+declare function parseRSAPrivateKeyPEM(pemText: string): KeyObject;
+/** Sign a JWT bearer grant assertion with RS256. */
+declare function signJWTBearerAssertion(assertion: JWTBearerAssertion, privateKey: KeyObject): SecretString;
+
+export { type ClientAuthenticationMethod, type ClientCredentials, type JWTBearerAssertion, RefreshSkewMs, TokenEndpoint, type TokenEndpointOptions, TokenResponse, forcedRefreshFloorMs, hasAllScopes, hasExactScopes, isRefreshRequired, isRefreshRequiredWithIssueTime, parseRSAPrivateKeyPEM, proportionalRefreshSkewMs, signJWTBearerAssertion };