Arbiter

Repositories

3

Projects Packages

@arbiter/oauth-s2s (0.1.0)

Published 2026-08-05 17:17:03 +00:00 by Dvorak

Installation

Set up this registry in your project .npmrc file:

@arbiter:registry=https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/

To install the package using npm, run the following command:

npm install @arbiter/oauth-s2s@0.1.0

or add it to the package.json file:

"@arbiter/oauth-s2s": "0.1.0"

For more information on the npm registry, see the documentation.

About this package

@arbiter/oauth-s2s

OAuth server-to-server / workload-identity / WIMSE / SPIFFE spec cluster. Pure protocol logic, independent of the HTTP layer.

Specs covered

• draft-ietf-wimse-s2s-protocol — WIT issuance, WPT verification, HTTP-signature proof, mTLS workload binding
• draft-ietf-wimse-arch
• draft-mw-spice-actor-chain
• draft-klrc-aiagent-auth
• spiffe-spire — node attestation, workload SVID, federation bundles
• draft-ietf-oauth-transaction-tokens, RFC 8693 (token exchange), RFC 9396 (RAR)
• OAuth 2.1 profile (via the oauthService port)

Conformance matrices and full spec text live in docs/standards/wimse-oauth/.

The port

The single external dependency is an oauthService exposing exactly three methods:

{
  generateToken(payload) -> signed token
  isTokenActive(jti) -> boolean
  resolveTokenRecord(jti) -> token record
}

Persistence backends (ReplayStore, FileBackedMapStore) are injectable and default to in-memory.

Usage

import { WorkloadSecurityService } from '@arbiter/oauth-s2s';

const svc = new WorkloadSecurityService({
  oauthService,
  trustDomain: 'prod.example.com',
  enforceSecureTrustAnchor: true,
  closedEnvironment: true
});

const wit = svc.issueWorkloadIdentityToken({
  workload_id: 'spiffe://prod.example.com/tenant/t1/app/a1/ns/sa/svc',
  audience: 'https://service.example.com'
});

Layout

• src/services/WorkloadSecurityService.js — facade over the three domain services
• src/services/s2s/ — compact token, replay store, HTTP-signature header/input, proof policy
• src/services/workload/ — identity, proof, and federation domain services (+ functional/ pure models)
• src/services/FileBackedMapStore.js — durable map backend
• docs/standards/wimse-oauth/ — spec matrices + full text

Test

npm test

Keywords

oauth s2s wimse workload-identity spiffe spire transaction-token http-signature authorization

Details

npm

2026-08-05 17:17:03 +00:00

5

ISC

34 KiB

Assets (1)

oauth-s2s-0.1.0.tgz 34 KiB

Versions (11) View all

0.1.10 2026-08-06

0.1.9 2026-08-06

0.1.8 2026-08-06

0.1.7 2026-08-06

0.1.6 2026-08-06