From 415a96a3e6f2a2000252df4c2d4e52e9863a9233 Mon Sep 17 00:00:00 2001
From: Yuri Mizushima <equanz@apache.org>
Date: Mon, 31 Aug 2026 13:40:03 +0900
Subject: [PATCH] feat: expose OAuth2 TLS client options

---
 index.d.ts |  3 +++
 tstest.ts  | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/index.d.ts b/index.d.ts
index 3cf4a1b..160fd52 100644
--- a/index.d.ts
+++ b/index.d.ts
@@ -324,10 +324,13 @@ export class AuthenticationToken {
 export class AuthenticationOauth2 {
   constructor(params: {
     type: string;
+    tokenEndpointAuthMethod?: 'client_secret_post' | 'tls_client_auth';
     issuer_url: string;
     client_id?: string;
     client_secret?: string;
     private_key?: string;
+    tls_cert_file?: string;
+    tls_key_file?: string;
     audience?: string;
     scope?: string;
   });
diff --git a/tstest.ts b/tstest.ts
index 5b1a85f..c58f660 100644
--- a/tstest.ts
+++ b/tstest.ts
@@ -66,6 +66,16 @@ import Pulsar = require('./index');
     scope: "scope"
   });
 
+  const authOauth2Tls: Pulsar.AuthenticationOauth2 = new Pulsar.AuthenticationOauth2({
+    type: "client_credentials",
+    tokenEndpointAuthMethod: "tls_client_auth",
+    issuer_url: "issuer-url",
+    tls_cert_file: "certificate-file-path",
+    tls_key_file: "private-key-file-path",
+    audience: "audience",
+    scope: "scope"
+  });
+
   const authToken: Pulsar.AuthenticationToken = new Pulsar.AuthenticationToken({
     token: async () => {
       return 'foobar';