// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
// OAuth 2.1 / RFC 8693 Token Exchange bridge. Type definitions.
//
// This is a bridge and profile only. An APS delegation chain is expressed as
// RFC 8693 token-exchange `act` / `may_act` delegation claims at the edge, and
// recovered back. APS does not become OAuth. The mapping preserves authority
// and monotonic narrowing in both directions.
//
// Spec basis: RFC 8693 (Section 4.1 act, 4.4 may_act, Section 2 request/response).
// ── Token-type URNs (RFC 8693 Section 3, verbatim) ──
export const TOKEN_TYPE_URN = {
    access_token: 'urn:ietf:params:oauth:token-type:access_token',
    refresh_token: 'urn:ietf:params:oauth:token-type:refresh_token',
    id_token: 'urn:ietf:params:oauth:token-type:id_token',
    saml1: 'urn:ietf:params:oauth:token-type:saml1',
    saml2: 'urn:ietf:params:oauth:token-type:saml2',
    jwt: 'urn:ietf:params:oauth:token-type:jwt',
};
/** REQUIRED grant_type value for token exchange (RFC 8693 Section 2.1). */
export const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
// ── SPIFFE SVID identity input ──
/** Approved asymmetric JWT algorithms for a JWT-SVID (SPIFFE JWT-SVID spec). */
export const JWT_SVID_APPROVED_ALGS = [
    'RS256', 'RS384', 'RS512',
    'ES256', 'ES384', 'ES512',
    'PS256', 'PS384', 'PS512',
];
//# sourceMappingURL=types.js.map