@zitadel/sdk 4.1.0-beta.10

package/dist/auth/index.js

@@ -0,0 +1,11 @@
+export * from './authenticator.js';
+export * from './client-credentials-authenticator.js';
+export * from './client-credentials-authenticator-builder.js';
+export * from './noauth-authenticator.js';
+export * from './oauth-authenticator.js';
+export * from './oauth-authenticator-builder.js';
+export * from './openid.js';
+export * from './personal-access-authenticator.js';
+export * from './webtoken-authenticator.js';
+export * from './webtoken-authenticator-builder.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,uCAAuC,CAAC;AACtD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,aAAa,CAAC;AAC5B,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC"}

package/dist/auth/noauth-authenticator.d.ts

@@ -0,0 +1,20 @@
+import { Authenticator } from './authenticator.js';
+/**
+ * Dummy Authenticator for testing purposes.
+ *
+ * This authenticator does not apply any authentication to API requests.
+ */
+export declare class NoAuthAuthenticator extends Authenticator {
+    /**
+     * NoAuthAuthenticator constructor.
+     *
+     * @param host The base URL for all authentication endpoints.
+     */
+    constructor(host?: string);
+    /**
+     * Retrieve the authentication token needed for API requests.
+     *
+     * @returns The authentication token.
+     */
+    getAuthToken(): Promise<string>;
+}

package/dist/auth/noauth-authenticator.js

@@ -0,0 +1,25 @@
+import { Authenticator } from './authenticator.js';
+/**
+ * Dummy Authenticator for testing purposes.
+ *
+ * This authenticator does not apply any authentication to API requests.
+ */
+export class NoAuthAuthenticator extends Authenticator {
+    /**
+     * NoAuthAuthenticator constructor.
+     *
+     * @param host The base URL for all authentication endpoints.
+     */
+    constructor(host = 'http://localhost') {
+        super(host);
+    }
+    /**
+     * Retrieve the authentication token needed for API requests.
+     *
+     * @returns The authentication token.
+     */
+    getAuthToken() {
+        return Promise.resolve('');
+    }
+}
+//# sourceMappingURL=noauth-authenticator.js.map

package/dist/auth/noauth-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"noauth-authenticator.js","sourceRoot":"","sources":["../../src/auth/noauth-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IACpD;;;;OAIG;IACH,YAAmB,OAAe,kBAAkB;QAClD,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED;;;;OAIG;IACI,YAAY;QACjB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;CACF"}

package/dist/auth/oauth-authenticator-builder.d.ts

@@ -0,0 +1,29 @@
+import { OpenId } from './openid.js';
+import { OAuthAuthenticator } from './oauth-authenticator.js';
+/**
+ * Base builder for OAuth authenticators.
+ *
+ * Provides fluent methods to override the default token endpoint and scopes.
+ * Subclasses extend this builder to construct specific OAuthAuthenticator
+ * instances.
+ */
+export declare abstract class OAuthAuthenticatorBuilder {
+    protected readonly host: string;
+    protected authScopes: string;
+    protected openId: OpenId;
+    /**
+     * Constructs the builder with the required host.
+     *
+     * @param host The hostname of the OpenID provider.
+     */
+    protected constructor(host: string);
+    /**
+     * Overrides the default scopes.
+     *
+     * @param scopes A list of scopes for the token request.
+     * @returns The builder instance for chaining.
+     */
+    scopes(scopes: string | string[]): this;
+    protected discoverOpenId(): Promise<void>;
+    abstract build(): Promise<OAuthAuthenticator>;
+}

package/dist/auth/oauth-authenticator-builder.js

@@ -0,0 +1,37 @@
+import { OpenId } from './openid.js';
+/**
+ * Base builder for OAuth authenticators.
+ *
+ * Provides fluent methods to override the default token endpoint and scopes.
+ * Subclasses extend this builder to construct specific OAuthAuthenticator
+ * instances.
+ */
+export class OAuthAuthenticatorBuilder {
+    host;
+    authScopes = 'openid urn:zitadel:iam:org:project:id:zitadel:aud';
+    openId;
+    /**
+     * Constructs the builder with the required host.
+     *
+     * @param host The hostname of the OpenID provider.
+     */
+    constructor(host) {
+        this.host = host;
+    }
+    /**
+     * Overrides the default scopes.
+     *
+     * @param scopes A list of scopes for the token request.
+     * @returns The builder instance for chaining.
+     */
+    scopes(scopes) {
+        this.authScopes = Array.isArray(scopes) ? scopes.join(' ') : scopes;
+        return this;
+    }
+    async discoverOpenId() {
+        if (!this.openId) {
+            this.openId = await OpenId.discover(this.host);
+        }
+    }
+}
+//# sourceMappingURL=oauth-authenticator-builder.js.map

package/dist/auth/oauth-authenticator-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authenticator-builder.js","sourceRoot":"","sources":["../../src/auth/oauth-authenticator-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC;;;;;;GAMG;AACH,MAAM,OAAgB,yBAAyB;IAUJ;IAT/B,UAAU,GAClB,mDAAmD,CAAC;IAC5C,MAAM,CAAU;IAE1B;;;;OAIG;IACH,YAAyC,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAEzD;;;;;OAKG;IACI,MAAM,CAAC,MAAyB;QACrC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAES,KAAK,CAAC,cAAc;QAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CAGF"}

package/dist/auth/oauth-authenticator.d.ts

@@ -0,0 +1,47 @@
+import { Authenticator } from './authenticator.js';
+import * as oauth from 'oauth4webapi';
+/**
+ * Abstract base class for OAuth-based authenticators.
+ *
+ * Provides common functionality for OAuth authenticators, including token
+ * management and header construction.
+ */
+export declare abstract class OAuthAuthenticator extends Authenticator {
+    protected readonly authServer: oauth.AuthorizationServer;
+    protected readonly client: oauth.Client;
+    protected readonly scope: string;
+    /**
+     * The OAuth2 token.
+     */
+    protected token: oauth.TokenEndpointResponse | null;
+    /**
+     * The token's expiration timestamp.
+     */
+    protected tokenExpiry: number | null;
+    /**
+     * OAuthAuthenticator constructor.
+     *
+     * @param authServer The discovered authorization server metadata.
+     * @param client The OAuth2 client metadata.
+     * @param scope The scope for the token request.
+     */
+    protected constructor(authServer: oauth.AuthorizationServer, client: oauth.Client, scope: string);
+    /**
+     * Retrieve the authentication token using the OAuth2 flow.
+     *
+     * This method checks if a valid token is available and refreshes it if
+     * necessary.
+     *
+     * @returns The authentication token.
+     * @throws {Error} if token retrieval fails.
+     */
+    getAuthToken(): Promise<string>;
+    /**
+     * Refresh the access token using the configured grant type and options.
+     *
+     * @returns The refreshed access token response.
+     * @throws {Error} if token fetch fails or response is invalid.
+     */
+    refreshToken(): Promise<oauth.TokenEndpointResponse>;
+    protected abstract performTokenRequest(authServer: oauth.AuthorizationServer, client: oauth.Client): Promise<oauth.TokenEndpointResponse>;
+}

package/dist/auth/oauth-authenticator.js

@@ -0,0 +1,71 @@
+import { Authenticator } from './authenticator.js';
+import { ZitadelException } from '../zitadel-exception.js';
+/**
+ * Abstract base class for OAuth-based authenticators.
+ *
+ * Provides common functionality for OAuth authenticators, including token
+ * management and header construction.
+ */
+export class OAuthAuthenticator extends Authenticator {
+    authServer;
+    client;
+    scope;
+    /**
+     * The OAuth2 token.
+     */
+    token = null;
+    /**
+     * The token's expiration timestamp.
+     */
+    tokenExpiry = null;
+    /**
+     * OAuthAuthenticator constructor.
+     *
+     * @param authServer The discovered authorization server metadata.
+     * @param client The OAuth2 client metadata.
+     * @param scope The scope for the token request.
+     */
+    constructor(authServer, client, scope) {
+        super(authServer.issuer);
+        this.authServer = authServer;
+        this.client = client;
+        this.scope = scope;
+    }
+    /**
+     * Retrieve the authentication token using the OAuth2 flow.
+     *
+     * This method checks if a valid token is available and refreshes it if
+     * necessary.
+     *
+     * @returns The authentication token.
+     * @throws {Error} if token retrieval fails.
+     */
+    async getAuthToken() {
+        if (!this.token || !this.tokenExpiry || Date.now() >= this.tokenExpiry) {
+            await this.refreshToken();
+        }
+        if (!this.token?.access_token) {
+            throw new Error('Failed to retrieve a valid access token.');
+        }
+        return this.token.access_token;
+    }
+    /**
+     * Refresh the access token using the configured grant type and options.
+     *
+     * @returns The refreshed access token response.
+     * @throws {Error} if token fetch fails or response is invalid.
+     */
+    async refreshToken() {
+        try {
+            this.token = await this.performTokenRequest(this.authServer, this.client);
+            const expiresIn = this.token.expires_in ?? 3600;
+            const buffer = 30 * 1000;
+            this.tokenExpiry = Date.now() + expiresIn * 1000 - buffer;
+            return this.token;
+        }
+        catch (err) {
+            throw new ZitadelException('Token refresh failed: ', err);
+        }
+    }
+}
+//# sourceMappingURL=oauth-authenticator.js.map

package/dist/auth/oauth-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-authenticator.js","sourceRoot":"","sources":["../../src/auth/oauth-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,OAAgB,kBAAmB,SAAQ,aAAa;IAkBvC;IACA;IACA;IAnBrB;;OAEG;IACO,KAAK,GAAuC,IAAI,CAAC;IAC3D;;OAEG;IACO,WAAW,GAAkB,IAAI,CAAC;IAE5C;;;;;;OAMG;IACH,YACqB,UAAqC,EACrC,MAAoB,EACpB,KAAa;QAEhC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAJN,eAAU,GAAV,UAAU,CAA2B;QACrC,WAAM,GAAN,MAAM,CAAc;QACpB,UAAK,GAAL,KAAK,CAAQ;IAGlC,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,YAAY;QACvB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,YAAY;QACvB,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;YAChD,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAAC;YAE1D,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;CAMF"}

package/dist/auth/openid.d.ts

@@ -0,0 +1,68 @@
+import * as oauth from 'oauth4webapi';
+/**
+ * OpenId class is responsible for fetching and storing important OpenID
+ * configuration endpoints. It interacts with the OpenID provider's
+ * well-known configuration endpoint and retrieves the token, authorization,
+ * and userinfo endpoints.
+ */
+export declare class OpenId {
+    private readonly authServer;
+    /**
+     * @param authServer The discovered authorization server metadata.
+     */
+    private constructor();
+    /**
+     * Builds and returns a URL object from the provided hostname.
+     * If the hostname does not include a scheme, it defaults to "https".
+     */
+    private static buildHostname;
+    /**
+     * Builds the URL to the well-known OpenID configuration endpoint.
+     */
+    private static buildWellKnownUrl;
+    /**
+     * Fetches the OpenID configuration from the well-known endpoint.
+     */
+    private static fetchOpenIdConfiguration;
+    /**
+     * Discovers the OpenID configuration from a provider's hostname.
+     *
+     * This method accepts a hostname, fetches the OpenID configuration,
+     * and returns a new OpenId instance.
+     *
+     * @param hostname The hostname of the OpenID provider.
+     * @returns A promise that resolves to an OpenId instance.
+     * @throws {Error} If the provided hostname is empty, or if there's an
+     * error during the HTTP request or JSON parsing.
+     */
+    static discover(hostname: string): Promise<OpenId>;
+    /**
+     * Returns the discovered Authorization Server metadata.
+     */
+    getAuthorizationServer(): oauth.AuthorizationServer;
+    /**
+     * Returns the token endpoint URL.
+     *
+     * This method returns the URL for obtaining OpenID tokens.
+     *
+     * @returns The token endpoint URL.
+     */
+    getTokenEndpoint(): string;
+    /**
+     * Returns the authorization endpoint URL.
+     *
+     * This method returns the URL used for authorization requests.
+     *
+     * @returns The authorization endpoint URL.
+     */
+    getAuthorizationEndpoint(): string;
+    /**
+     * Returns the userinfo endpoint URL.
+     *
+     * This method returns the URL for fetching user information from the
+     * OpenID provider.
+     *
+     * @returns The userinfo endpoint URL.
+     */
+    getUserinfoEndpoint(): string;
+}

package/dist/auth/openid.js

@@ -0,0 +1,119 @@
+/**
+ * OpenId class is responsible for fetching and storing important OpenID
+ * configuration endpoints. It interacts with the OpenID provider's
+ * well-known configuration endpoint and retrieves the token, authorization,
+ * and userinfo endpoints.
+ */
+export class OpenId {
+    authServer;
+    /**
+     * @param authServer The discovered authorization server metadata.
+     */
+    constructor(authServer) {
+        this.authServer = authServer;
+        //
+    }
+    /**
+     * Builds and returns a URL object from the provided hostname.
+     * If the hostname does not include a scheme, it defaults to "https".
+     */
+    static buildHostname(hostname) {
+        if (!hostname.startsWith('http')) {
+            return new URL(`https://${hostname}`);
+        }
+        return new URL(hostname);
+    }
+    /**
+     * Builds the URL to the well-known OpenID configuration endpoint.
+     */
+    static buildWellKnownUrl(hostname) {
+        const url = this.buildHostname(hostname);
+        url.pathname = '/.well-known/openid-configuration';
+        return url.toString();
+    }
+    /**
+     * Fetches the OpenID configuration from the well-known endpoint.
+     */
+    static async fetchOpenIdConfiguration(hostname) {
+        const wellKnownUrl = this.buildWellKnownUrl(hostname);
+        const response = await fetch(wellKnownUrl);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch OpenID configuration: ${response.status} ${response.statusText}`);
+        }
+        try {
+            // Assign the JSON response to the specified type.
+            return (await response.json());
+        }
+        catch {
+            throw new Error('Failed to parse OpenID configuration JSON.');
+        }
+    }
+    /**
+     * Discovers the OpenID configuration from a provider's hostname.
+     *
+     * This method accepts a hostname, fetches the OpenID configuration,
+     * and returns a new OpenId instance.
+     *
+     * @param hostname The hostname of the OpenID provider.
+     * @returns A promise that resolves to an OpenId instance.
+     * @throws {Error} If the provided hostname is empty, or if there's an
+     * error during the HTTP request or JSON parsing.
+     */
+    static async discover(hostname) {
+        if (!hostname) {
+            throw new Error('Hostname cannot be empty.');
+        }
+        const authServer = await this.fetchOpenIdConfiguration(hostname);
+        return new OpenId(authServer);
+    }
+    /**
+     * Returns the discovered Authorization Server metadata.
+     */
+    getAuthorizationServer() {
+        return this.authServer;
+    }
+    // noinspection JSUnusedGlobalSymbols
+    /**
+     * Returns the token endpoint URL.
+     *
+     * This method returns the URL for obtaining OpenID tokens.
+     *
+     * @returns The token endpoint URL.
+     */
+    getTokenEndpoint() {
+        if (!this.authServer.token_endpoint) {
+            throw new Error('Token endpoint not found in OpenID configuration.');
+        }
+        return this.authServer.token_endpoint;
+    }
+    // noinspection JSUnusedGlobalSymbols
+    /**
+     * Returns the authorization endpoint URL.
+     *
+     * This method returns the URL used for authorization requests.
+     *
+     * @returns The authorization endpoint URL.
+     */
+    getAuthorizationEndpoint() {
+        if (!this.authServer.authorization_endpoint) {
+            throw new Error('Authorization endpoint not found in OpenID configuration.');
+        }
+        return this.authServer.authorization_endpoint;
+    }
+    // noinspection JSUnusedGlobalSymbols
+    /**
+     * Returns the userinfo endpoint URL.
+     *
+     * This method returns the URL for fetching user information from the
+     * OpenID provider.
+     *
+     * @returns The userinfo endpoint URL.
+     */
+    getUserinfoEndpoint() {
+        if (!this.authServer.userinfo_endpoint) {
+            throw new Error('Userinfo endpoint not found in OpenID configuration.');
+        }
+        return this.authServer.userinfo_endpoint;
+    }
+}
+//# sourceMappingURL=openid.js.map

package/dist/auth/openid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openid.js","sourceRoot":"","sources":["../../src/auth/openid.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,OAAO,MAAM;IAIoB;IAHrC;;OAEG;IACH,YAAqC,UAAqC;QAArC,eAAU,GAAV,UAAU,CAA2B;QACxE,EAAE;IACJ,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,aAAa,CAAC,QAAgB;QAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,GAAG,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,iBAAiB,CAAC,QAAgB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACzC,GAAG,CAAC,QAAQ,GAAG,mCAAmC,CAAC;QACnD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAC3C,QAAgB;QAEhB,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAE3C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAClF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,kDAAkD;YAClD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAgB;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACjE,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,qCAAqC;IACrC;;;;;;OAMG;IACI,gBAAgB;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;IACxC,CAAC;IAED,qCAAqC;IACrC;;;;;;OAMG;IACI,wBAAwB;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC;IAChD,CAAC;IAED,qCAAqC;IACrC;;;;;;;OAOG;IACI,mBAAmB;QACxB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;IAC3C,CAAC;CACF"}

package/dist/auth/personal-access-authenticator.d.ts

@@ -0,0 +1,22 @@
+import { Authenticator } from './authenticator.js';
+/**
+ * Personal Access Token Authenticator.
+ *
+ * Uses a static personal access token for API authentication.
+ */
+export declare class PersonalAccessAuthenticator extends Authenticator {
+    private readonly token;
+    /**
+     * PersonalAccessAuthenticator constructor.
+     *
+     * @param host The base URL for the API endpoints.
+     * @param token The personal access token.
+     */
+    constructor(host: string, token: string);
+    /**
+     * Retrieve authentication token using the personal access token.
+     *
+     * @returns The authentication token.
+     */
+    getAuthToken(): Promise<string>;
+}

package/dist/auth/personal-access-authenticator.js

@@ -0,0 +1,28 @@
+import { Authenticator } from './authenticator.js';
+/**
+ * Personal Access Token Authenticator.
+ *
+ * Uses a static personal access token for API authentication.
+ */
+export class PersonalAccessAuthenticator extends Authenticator {
+    token;
+    /**
+     * PersonalAccessAuthenticator constructor.
+     *
+     * @param host The base URL for the API endpoints.
+     * @param token The personal access token.
+     */
+    constructor(host, token) {
+        super(host);
+        this.token = token;
+    }
+    /**
+     * Retrieve authentication token using the personal access token.
+     *
+     * @returns The authentication token.
+     */
+    getAuthToken() {
+        return Promise.resolve(this.token);
+    }
+}
+//# sourceMappingURL=personal-access-authenticator.js.map

package/dist/auth/personal-access-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personal-access-authenticator.js","sourceRoot":"","sources":["../../src/auth/personal-access-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,OAAO,2BAA4B,SAAQ,aAAa;IASzC;IARnB;;;;;OAKG;IACH,YACE,IAAY,EACK,KAAa;QAE9B,KAAK,CAAC,IAAI,CAAC,CAAC;QAFK,UAAK,GAAL,KAAK,CAAQ;IAGhC,CAAC;IAED;;;;OAIG;IACI,YAAY;QACjB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/auth/webtoken-authenticator-builder.d.ts

@@ -0,0 +1,72 @@
+import { OAuthAuthenticatorBuilder } from './oauth-authenticator-builder.js';
+import { WebTokenAuthenticator } from './webtoken-authenticator.js';
+/**
+ * Builder for WebTokenAuthenticator.
+ *
+ * Provides a fluent API for configuring and constructing a
+ * WebTokenAuthenticator. This builder extends the base
+ * OAuthAuthenticatorBuilder.
+ *
+ * Usage:
+ * ```
+ * const authenticator = await WebTokenAuthenticator
+ * .builder("[https://api.example.com](https://api.example.com)", "issuer", "subject", "audience", privateKey)
+ * .scopes(["openid", "foo"])
+ * .tokenLifetimeSeconds(3600)
+ * .jwtAlgorithm("RS256")
+ * .build();
+ * ```
+ *
+ * A convenience method "fromJson" is provided to create the builder using a
+ * service account JSON file.
+ */
+export declare class WebTokenAuthenticatorBuilder extends OAuthAuthenticatorBuilder {
+    private readonly jwtIssuer;
+    private readonly jwtSubject;
+    private readonly jwtAudience;
+    private readonly privateKey;
+    private jwtAlg;
+    private lifetimeSeconds;
+    private kid?;
+    /**
+     * Constructs the builder with required parameters.
+     *
+     * @param host The base URL for API endpoints.
+     * @param jwtIssuer The issuer claim for the JWT.
+     * @param jwtSubject The subject claim for the JWT.
+     * @param jwtAudience The audience claim for the JWT.
+     * @param privateKey The PEM-formatted private key used to sign the JWT.
+     */
+    constructor(host: string, jwtIssuer: string, jwtSubject: string, jwtAudience: string, privateKey: string);
+    /**
+     * Sets the token lifetime in seconds.
+     *
+     * @param seconds The lifetime of the JWT in seconds.
+     * @returns The builder instance for chaining.
+     */
+    tokenLifetimeSeconds(seconds: number): this;
+    /**
+     * Sets the JWT signing algorithm.
+     *
+     * @param algorithm The JWT signing algorithm (e.g., "RS256").
+     * @returns The builder instance for chaining.
+     */
+    jwtAlgorithm(algorithm: string): this;
+    /**
+     * Sets the Key ID (kid) for the JWT header.
+     *
+     * @param keyId The Key ID.
+     * @returns The builder instance for chaining.
+     */
+    keyId(keyId: string): this;
+    /**
+     * Builds and returns a new WebTokenAuthenticator instance.
+     *
+     * Generates a JWT assertion using the provided parameters and then
+     * constructs a WebTokenAuthenticator.
+     *
+     * @returns The constructed WebTokenAuthenticator.
+     * @throws {Error} if JWT generation fails.
+     */
+    build(): Promise<WebTokenAuthenticator>;
+}

package/dist/auth/webtoken-authenticator-builder.js

@@ -0,0 +1,91 @@
+import { OAuthAuthenticatorBuilder } from './oauth-authenticator-builder.js';
+import { WebTokenAuthenticator } from './webtoken-authenticator.js';
+/**
+ * Builder for WebTokenAuthenticator.
+ *
+ * Provides a fluent API for configuring and constructing a
+ * WebTokenAuthenticator. This builder extends the base
+ * OAuthAuthenticatorBuilder.
+ *
+ * Usage:
+ * ```
+ * const authenticator = await WebTokenAuthenticator
+ * .builder("[https://api.example.com](https://api.example.com)", "issuer", "subject", "audience", privateKey)
+ * .scopes(["openid", "foo"])
+ * .tokenLifetimeSeconds(3600)
+ * .jwtAlgorithm("RS256")
+ * .build();
+ * ```
+ *
+ * A convenience method "fromJson" is provided to create the builder using a
+ * service account JSON file.
+ */
+export class WebTokenAuthenticatorBuilder extends OAuthAuthenticatorBuilder {
+    jwtIssuer;
+    jwtSubject;
+    jwtAudience;
+    privateKey;
+    jwtAlg = 'RS256';
+    lifetimeSeconds = 3600;
+    kid;
+    /**
+     * Constructs the builder with required parameters.
+     *
+     * @param host The base URL for API endpoints.
+     * @param jwtIssuer The issuer claim for the JWT.
+     * @param jwtSubject The subject claim for the JWT.
+     * @param jwtAudience The audience claim for the JWT.
+     * @param privateKey The PEM-formatted private key used to sign the JWT.
+     */
+    constructor(host, jwtIssuer, jwtSubject, jwtAudience, privateKey) {
+        super(host);
+        this.jwtIssuer = jwtIssuer;
+        this.jwtSubject = jwtSubject;
+        this.jwtAudience = jwtAudience;
+        this.privateKey = privateKey;
+    }
+    /**
+     * Sets the token lifetime in seconds.
+     *
+     * @param seconds The lifetime of the JWT in seconds.
+     * @returns The builder instance for chaining.
+     */
+    tokenLifetimeSeconds(seconds) {
+        this.lifetimeSeconds = seconds;
+        return this;
+    }
+    /**
+     * Sets the JWT signing algorithm.
+     *
+     * @param algorithm The JWT signing algorithm (e.g., "RS256").
+     * @returns The builder instance for chaining.
+     */
+    jwtAlgorithm(algorithm) {
+        this.jwtAlg = algorithm;
+        return this;
+    }
+    /**
+     * Sets the Key ID (kid) for the JWT header.
+     *
+     * @param keyId The Key ID.
+     * @returns The builder instance for chaining.
+     */
+    keyId(keyId) {
+        this.kid = keyId;
+        return this;
+    }
+    /**
+     * Builds and returns a new WebTokenAuthenticator instance.
+     *
+     * Generates a JWT assertion using the provided parameters and then
+     * constructs a WebTokenAuthenticator.
+     *
+     * @returns The constructed WebTokenAuthenticator.
+     * @throws {Error} if JWT generation fails.
+     */
+    async build() {
+        await this.discoverOpenId();
+        return WebTokenAuthenticator.create(this.openId, 'zitadel', this.authScopes, this.jwtIssuer, this.jwtSubject, this.jwtAudience, this.privateKey, this.lifetimeSeconds, this.jwtAlg, this.kid);
+    }
+}
+//# sourceMappingURL=webtoken-authenticator-builder.js.map