client.oauth.exchangeToken(params: TokenExchangeParams): Promise<TokenSet>

import { AvnologyId } from "@avnology/sdk-typescript";

const adminClient = new AvnologyId({
  baseUrl: "https://api.id.avnology.com",
  clientId: "app_admin_portal",
  clientSecret: "sk_live_...",
});

// Exchange: admin token -> token acting as user
const delegatedTokens = await adminClient.oauth.exchangeToken({
  subjectToken: userAccessToken,          // The user's token
  subjectTokenType: "access_token",
  actorToken: adminAccessToken,           // The admin's token
  actorTokenType: "access_token",
  scopes: ["openid", "profile", "email"], // Limit to needed scopes
});

// The resulting token represents the user but includes act claim
const claims = adminClient.oauth.decodeIdToken(delegatedTokens.idToken);
console.log(claims.sub);     // "usr_user123" -- the user
console.log(claims.act.sub); // "usr_admin456" -- the admin acting

// Admin initiates impersonation
const impersonationTokens = await adminClient.oauth.exchangeToken({
  subjectToken: "eyJ...",  // Target user's access token
  subjectTokenType: "access_token",
  scopes: ["openid", "profile", "email"],
});

// Use the impersonation token to make API calls as the user
const userClient = new AvnologyId({
  baseUrl: "https://api.id.avnology.com",
  clientId: "app_admin_portal",
});
userClient.setTokens(impersonationTokens);

// This returns the user's data, not the admin's
const session = await userClient.getSession();
console.log(session.identity.email); // User's email