@37signals/basecamp 0.15.0 → 0.16.0

package/dist/oauth/exchange.js

@@ -4,9 +4,18 @@
  * Handles authorization code exchange and token refresh operations.
  * Supports both standard OAuth 2.0 and Basecamp's Launchpad legacy format.
  */
-import { MAX_TOKEN_LIFETIME_SECONDS } from "./limits.js";
+import { MAX_TOKEN_LIFETIME_SECONDS, raceAbort, resolveRequestTimeoutMs } from "./limits.js";
 import { BasecampError } from "../errors.js";
 import { isLocalhost } from "../security.js";
+/** Default per-request timeout (ms) for a token exchange/refresh round trip. */
+const DEFAULT_TOKEN_TIMEOUT_MS = 30_000;
+/**
+ * The redirects the token endpoint is refused (SPEC §16 "Token-Endpoint
+ * Transport Policy") — the same set the signed download hop refuses (§14).
+ * 304 is not in the set: it is a cache validator, not a redirect-with-
+ * Location, and falls through to the generic non-ok handling below.
+ */
+const REDIRECT_STATUSES = [301, 302, 303, 307, 308];
 /**
  * Exchanges an authorization code for access and refresh tokens.
  *
@@ -221,24 +230,54 @@ async function readResponseWithByteLimit(response, maxBytes, httpStatus) {
  */
 async function doTokenRequest(tokenEndpoint, body, options) {
     requireHTTPS(tokenEndpoint, "token endpoint");
-    const { fetch: customFetch = globalThis.fetch, timeoutMs = 30000 } = options;
-    // Create abort controller for timeout
+    const { fetch: customFetch = globalThis.fetch, timeoutMs = DEFAULT_TOKEN_TIMEOUT_MS } = options;
+    // Create abort controller for timeout. The clamp closes the unbounded
+    // hole an unvalidated timeoutMs left open: NaN/Infinity made setTimeout
+    // fire at ~1 ms (an instant abort masquerading as a network failure), and
+    // an oversized finite value could hold a stalled request open for weeks.
     const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    const timeoutId = setTimeout(() => controller.abort(), resolveRequestTimeoutMs(timeoutMs, DEFAULT_TOKEN_TIMEOUT_MS));
     try {
-        const response = await customFetch(tokenEndpoint, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/x-www-form-urlencoded",
-                Accept: "application/json",
-            },
-            body: body.toString(),
-            signal: controller.signal,
+        // The whole round trip runs INSIDE a race against the controller's
+        // signal, like the device flow's POSTs: a cooperative fetch rejects on
+        // abort anyway, but a custom fetch that ignores its AbortSignal must not
+        // hold the exchange past its timeout — the race rejects the moment the
+        // timeout fires, and a late settlement is discarded.
+        const { response, responseText } = await raceAbort(controller.signal, async () => {
+            const raced = await customFetch(tokenEndpoint, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    Accept: "application/json",
+                },
+                body: body.toString(),
+                signal: controller.signal,
+                // Never chase an attacker-influenced Location: the token endpoint may
+                // come from discovered metadata, and a followed 307/308 would re-POST
+                // the credentials wherever it points (SPEC §16).
+                redirect: "manual",
+            });
+            // A browser fetch answers redirect: "manual" with an opaqueredirect —
+            // type "opaqueredirect", status 0, no headers — rather than the 3xx
+            // Node hands back, so the status table below cannot see it. Refuse it
+            // by type; the real status is hidden, so the error carries none.
+            if (raced.type === "opaqueredirect") {
+                void raced.body?.cancel().catch(() => { });
+                throw new BasecampError("api_error", "redirect on the token endpoint is not followed (status hidden by the browser's opaque redirect)");
+            }
+            // A suppressed redirect is refused by status BEFORE any body read, so a
+            // 3xx whose body stalls forever cannot degrade into a timeout. Release
+            // the unread stream (non-blocking) so refusals don't retain sockets.
+            if (REDIRECT_STATUSES.includes(raced.status)) {
+                void raced.body?.cancel().catch(() => { });
+                throw new BasecampError("api_error", `redirect ${raced.status} on the token endpoint is not followed`, { httpStatus: raced.status });
+            }
+            const MAX_TOKEN_RESPONSE_BYTES = 1 * 1024 * 1024; // 1 MB
+            // Use streaming reader with true byte-level limit enforcement.
+            // This handles cases where Content-Length is absent or inaccurate.
+            const racedText = await readResponseWithByteLimit(raced, MAX_TOKEN_RESPONSE_BYTES, raced.status);
+            return { response: raced, responseText: racedText };
         });
-        const MAX_TOKEN_RESPONSE_BYTES = 1 * 1024 * 1024; // 1 MB
-        // Use streaming reader with true byte-level limit enforcement.
-        // This handles cases where Content-Length is absent or inaccurate.
-        const responseText = await readResponseWithByteLimit(response, MAX_TOKEN_RESPONSE_BYTES, response.status);
         let data;
         try {
             data = JSON.parse(responseText);

package/dist/oauth/exchange.js.map

@@ -1 +1 @@
-{"version":3,"file":"exchange.js","sourceRoot":"","sources":["../../src/oauth/exchange.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAmB7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAwB,EACxB,UAAwB,EAAE;IAE1B,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,+CAA+C;QAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,qBAAqB;QACrB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAuB,EACvB,UAAwB,EAAE;IAE1B,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;IACrE,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,+CAA+C;QAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,qBAAqB;QACrB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,GAAG,KAAK,oBAAoB,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa;YAAE,MAAM,GAAG,CAAC;QAC5C,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,WAAW,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,MAAqB;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,mDAAmD;IACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,sEAAsE;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CACtC,QAAkB,EAClB,QAAgB,EAChB,UAAkB;IAElB,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,kBAAkB,CAC3C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CACvC,CAAC;IAEF,oDAAoD;IACpD,IAAI,kBAAkB,KAAK,IAAI,IAAI,kBAAkB,GAAG,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,6CAA6C,kBAAkB,eAAe,QAAQ,GAAG,EACzF,EAAE,UAAU,EAAE,CACf,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,wFAAwF;QACxF,yDAAyD;QACzD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,6FAA6F,EAC7F,EAAE,UAAU,EAAE,CACf,CAAC;QACJ,CAAC;QACD,2DAA2D;QAC3D,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;YAC3B,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,6BAA6B,UAAU,gBAAgB,QAAQ,GAAG,EAClE,EAAE,UAAU,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,yBAAyB;IACzB,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,aAAqB,EACrB,IAAqB,EACrB,OAAqB;IAErB,YAAY,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAE9C,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAE7E,sCAAsC;IACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;QAEzD,+DAA+D;QAC/D,mEAAmE;QACnE,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAClD,QAAQ,EACR,wBAAwB,EACxB,QAAQ,CAAC,MAAM,CAChB,CAAC;QAEF,IAAI,IAA2C,CAAC;QAEhD,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,gCAAgC,EAAE;gBACrE,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,qCAAqC,EAAE;gBAC1E,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAA0B,CAAC;YAC7C,uEAAuE;YACvE,mEAAmE;YACnE,gDAAgD;YAChD,MAAM,UAAU,GACd,CAAC,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ,IAAI,SAAS,CAAC,iBAAiB,CAAC;gBAChF,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC;gBACxD,sBAAsB,CAAC;YACzB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;YAExF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACnE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,OAAO,EAAE;oBAChD,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,IAAI,EAAE,mEAAmE;iBAC1E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE;gBAC5C,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,IAAwB,CAAC;QAE3C,uEAAuE;QACvE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,IAAI,SAAS,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YAChF,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,mDAAmD,EAAE;gBACxF,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,kEAAkE;QAClE,qEAAqE;QACrE,IAAI,SAAS,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,KAAK,EAAE,CAAC,EAAE,CAAC;YAC9G,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,mEAAmE,EAAE;gBACxG,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,0CAA0C;QAC1C,IAAI,SAAS,CAAC,aAAa,IAAI,IAAI,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YACnF,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,+CAA+C,EAAE;gBACpF,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,uCAAuC,EAAE;gBAC5E,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,IACE,SAAS,CAAC,UAAU,IAAI,IAAI;YAC5B,CAAC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;gBACvC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC;gBACvC,SAAS,CAAC,UAAU,IAAI,CAAC;gBACzB,SAAS,CAAC,UAAU,GAAG,0BAA0B,CAAC,EACpD,CAAC;YACD,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,oFAAoF,0BAA0B,UAAU,EACxH,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAChC,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,IAAI,SAAS,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,iEAAiE,EAAE;gBACtG,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,kEAAkE;YAClE,sEAAsE;YACtE,YAAY,EAAE,SAAS,CAAC,aAAa,IAAI,SAAS;YAClD,SAAS,EAAE,SAAS,CAAC,UAAU,IAAI,QAAQ;YAC3C,SAAS,EAAE,SAAS,CAAC,UAAU;YAC/B,SAAS,EAAE,SAAS,CAAC,UAAU;gBAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;gBACpD,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS;YACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,SAAS;SAC1C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,yBAAyB,EAAE;oBAC5D,KAAK,EAAE,GAAG;oBACV,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;gBACzE,KAAK,EAAE,GAAG;gBACV,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,yCAAyC,EAAE;YAC5E,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,aAAa,GAAG,EAAE;IAClE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,0CAA0C;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"exchange.js","sourceRoot":"","sources":["../../src/oauth/exchange.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,0BAA0B,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAS7C,gFAAgF;AAChF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAYpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAwB,EACxB,UAAwB,EAAE;IAE1B,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,+CAA+C;QAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,qBAAqB;QACrB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAuB,EACvB,UAAwB,EAAE;IAE1B,2BAA2B;IAC3B,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;IACrE,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,+CAA+C;QAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,qBAAqB;QACrB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,GAAG,KAAK,oBAAoB,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa;YAAE,MAAM,GAAG,CAAC;QAC5C,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,WAAW,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,MAAqB;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,mDAAmD;IACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,sEAAsE;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CACtC,QAAkB,EAClB,QAAgB,EAChB,UAAkB;IAElB,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,kBAAkB,CAC3C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CACvC,CAAC;IAEF,oDAAoD;IACpD,IAAI,kBAAkB,KAAK,IAAI,IAAI,kBAAkB,GAAG,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,6CAA6C,kBAAkB,eAAe,QAAQ,GAAG,EACzF,EAAE,UAAU,EAAE,CACf,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,wFAAwF;QACxF,yDAAyD;QACzD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,6FAA6F,EAC7F,EAAE,UAAU,EAAE,CACf,CAAC;QACJ,CAAC;QACD,2DAA2D;QAC3D,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;YAC3B,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,6BAA6B,UAAU,gBAAgB,QAAQ,GAAG,EAClE,EAAE,UAAU,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,yBAAyB;IACzB,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,aAAqB,EACrB,IAAqB,EACrB,OAAqB;IAErB,YAAY,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAE9C,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,wBAAwB,EAAE,GAAG,OAAO,CAAC;IAEhG,sEAAsE;IACtE,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAC1B,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,uBAAuB,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAC7D,CAAC;IAEF,IAAI,CAAC;QACH,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC/E,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,sEAAsE;gBACtE,sEAAsE;gBACtE,iDAAiD;gBACjD,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YAEH,sEAAsE;YACtE,oEAAoE;YACpE,sEAAsE;YACtE,iEAAiE;YACjE,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACpC,KAAK,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC1C,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,iGAAiG,CAClG,CAAC;YACJ,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,KAAK,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC1C,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,YAAY,KAAK,CAAC,MAAM,wCAAwC,EAChE,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAC7B,CAAC;YACJ,CAAC;YAED,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;YAEzD,+DAA+D;YAC/D,mEAAmE;YACnE,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,KAAK,EACL,wBAAwB,EACxB,KAAK,CAAC,MAAM,CACb,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,IAAI,IAA2C,CAAC;QAEhD,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,gCAAgC,EAAE;gBACrE,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,qCAAqC,EAAE;gBAC1E,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAA0B,CAAC;YAC7C,uEAAuE;YACvE,mEAAmE;YACnE,gDAAgD;YAChD,MAAM,UAAU,GACd,CAAC,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ,IAAI,SAAS,CAAC,iBAAiB,CAAC;gBAChF,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC;gBACxD,sBAAsB,CAAC;YACzB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;YAExF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACnE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,OAAO,EAAE;oBAChD,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,IAAI,EAAE,mEAAmE;iBAC1E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE;gBAC5C,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,IAAwB,CAAC;QAE3C,uEAAuE;QACvE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,IAAI,SAAS,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YAChF,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,mDAAmD,EAAE;gBACxF,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,kEAAkE;QAClE,qEAAqE;QACrE,IAAI,SAAS,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,KAAK,EAAE,CAAC,EAAE,CAAC;YAC9G,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,mEAAmE,EAAE;gBACxG,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,sEAAsE;QACtE,uEAAuE;QACvE,0CAA0C;QAC1C,IAAI,SAAS,CAAC,aAAa,IAAI,IAAI,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YACnF,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,+CAA+C,EAAE;gBACpF,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,uCAAuC,EAAE;gBAC5E,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,IACE,SAAS,CAAC,UAAU,IAAI,IAAI;YAC5B,CAAC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;gBACvC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC;gBACvC,SAAS,CAAC,UAAU,IAAI,CAAC;gBACzB,SAAS,CAAC,UAAU,GAAG,0BAA0B,CAAC,EACpD,CAAC;YACD,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,oFAAoF,0BAA0B,UAAU,EACxH,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAChC,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,IAAI,SAAS,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,iEAAiE,EAAE;gBACtG,UAAU,EAAE,QAAQ,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,kEAAkE;YAClE,sEAAsE;YACtE,YAAY,EAAE,SAAS,CAAC,aAAa,IAAI,SAAS;YAClD,SAAS,EAAE,SAAS,CAAC,UAAU,IAAI,QAAQ;YAC3C,SAAS,EAAE,SAAS,CAAC,UAAU;YAC/B,SAAS,EAAE,SAAS,CAAC,UAAU;gBAC7B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;gBACpD,CAAC,CAAC,SAAS;YACb,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS;YACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,SAAS;SAC1C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,yBAAyB,EAAE;oBAC5D,KAAK,EAAE,GAAG;oBACV,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,OAAO,EAAE,EAAE;gBACzE,KAAK,EAAE,GAAG;gBACV,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,yCAAyC,EAAE;YAC5E,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,aAAa,GAAG,EAAE;IAClE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,0CAA0C;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC"}

package/dist/oauth/limits.d.ts

@@ -1,6 +1,9 @@
 /**
- * Shared OAuth limits (SPEC §16), split out so the token-exchange path can
- * import them without pulling the whole device-flow module.
+ * Shared OAuth request primitives (SPEC §16), split out so the token-exchange
+ * path can import them without pulling the whole device-flow module: the
+ * token-lifetime ceiling, the per-request timeout resolver, and the abort
+ * race that bounds a round trip even when a custom fetch ignores its
+ * AbortSignal.
  */
 /**
  * Upper bound (seconds) for an OAuth token's `expires_in`: 2_147_483_647 s
@@ -12,4 +15,32 @@
  * across all five SDKs.
  */
 export declare const MAX_TOKEN_LIFETIME_SECONDS = 2147483647;
+/**
+ * Ceiling (ms) for a caller-supplied per-request timeout: the shared 3600 s
+ * bound (Go's maxDeviceRequestTimeout, Python's _MAX_DEVICE_REQUEST_TIMEOUT,
+ * Ruby's Fetcher::MAX_REQUEST_TIMEOUT). A large finite value would hold a
+ * stalled request open for weeks, defeating the bounded-request guarantee.
+ */
+export declare const MAX_REQUEST_TIMEOUT_MS: number;
+/**
+ * Coerce a caller-supplied request timeout (ms) to a finite, positive,
+ * timer-safe value no greater than the shared ceiling. `setTimeout` silently
+ * coerces a non-finite delay (NaN/Infinity) or one beyond its 32-bit range to
+ * ~1 ms — an immediate abort that would masquerade as a transport failure.
+ * Fall back to the operation's own default instead, mirroring how the other
+ * SDKs normalize an invalid OAuth request timeout.
+ */
+export declare function resolveRequestTimeoutMs(timeoutMs: number, defaultMs: number): number;
+export declare function abortError(): Error;
+/**
+ * Races `run` against `signal`: rejects with AbortError the moment the signal
+ * fires, even if the underlying promise NEVER settles. A cooperative fetch
+ * already rejects on abort — this enforces the same contract on a custom fetch
+ * that ignores its AbortSignal, so a late 200 cannot hand back a result and a
+ * never-settling fetch cannot hold the public call past its timeout. An
+ * already-aborted signal rejects without invoking `run`. A late settlement is
+ * discarded (settling an already-settled promise is a no-op), and its
+ * rejection path stays handled — no unhandled rejection escapes.
+ */
+export declare function raceAbort<T>(signal: AbortSignal, run: () => Promise<T>): Promise<T>;
 //# sourceMappingURL=limits.d.ts.map

package/dist/oauth/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/oauth/limits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,aAAgB,CAAC"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/oauth/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,aAAgB,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAElD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAOpF;AAMD,wBAAgB,UAAU,IAAI,KAAK,CAIlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA8BnF"}

package/dist/oauth/limits.js

@@ -1,6 +1,9 @@
 /**
- * Shared OAuth limits (SPEC §16), split out so the token-exchange path can
- * import them without pulling the whole device-flow module.
+ * Shared OAuth request primitives (SPEC §16), split out so the token-exchange
+ * path can import them without pulling the whole device-flow module: the
+ * token-lifetime ceiling, the per-request timeout resolver, and the abort
+ * race that bounds a round trip even when a custom fetch ignores its
+ * AbortSignal.
  */
 /**
  * Upper bound (seconds) for an OAuth token's `expires_in`: 2_147_483_647 s
@@ -12,4 +15,75 @@
  * across all five SDKs.
  */
 export const MAX_TOKEN_LIFETIME_SECONDS = 2_147_483_647;
+/**
+ * Ceiling (ms) for a caller-supplied per-request timeout: the shared 3600 s
+ * bound (Go's maxDeviceRequestTimeout, Python's _MAX_DEVICE_REQUEST_TIMEOUT,
+ * Ruby's Fetcher::MAX_REQUEST_TIMEOUT). A large finite value would hold a
+ * stalled request open for weeks, defeating the bounded-request guarantee.
+ */
+export const MAX_REQUEST_TIMEOUT_MS = 3600 * 1000;
+/**
+ * Coerce a caller-supplied request timeout (ms) to a finite, positive,
+ * timer-safe value no greater than the shared ceiling. `setTimeout` silently
+ * coerces a non-finite delay (NaN/Infinity) or one beyond its 32-bit range to
+ * ~1 ms — an immediate abort that would masquerade as a transport failure.
+ * Fall back to the operation's own default instead, mirroring how the other
+ * SDKs normalize an invalid OAuth request timeout.
+ */
+export function resolveRequestTimeoutMs(timeoutMs, defaultMs) {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_REQUEST_TIMEOUT_MS) {
+        return defaultMs;
+    }
+    // Whole milliseconds, at least 1: timers truncate fractional delays toward
+    // 0, so 0.5 would become an immediate abort.
+    return Math.max(1, Math.floor(timeoutMs));
+}
+// A plain Error tagged "AbortError" rather than `new DOMException(...)`:
+// DOMException is not guaranteed in every JS runtime that can run this SDK
+// (referencing it there throws ReferenceError). isAbort() matches on
+// `name === "AbortError"`, so cancellation stays runtime-agnostic.
+export function abortError() {
+    const err = new Error("Aborted");
+    err.name = "AbortError";
+    return err;
+}
+/**
+ * Races `run` against `signal`: rejects with AbortError the moment the signal
+ * fires, even if the underlying promise NEVER settles. A cooperative fetch
+ * already rejects on abort — this enforces the same contract on a custom fetch
+ * that ignores its AbortSignal, so a late 200 cannot hand back a result and a
+ * never-settling fetch cannot hold the public call past its timeout. An
+ * already-aborted signal rejects without invoking `run`. A late settlement is
+ * discarded (settling an already-settled promise is a no-op), and its
+ * rejection path stays handled — no unhandled rejection escapes.
+ */
+export function raceAbort(signal, run) {
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(abortError());
+        if (signal.aborted) {
+            onAbort();
+            return;
+        }
+        signal.addEventListener("abort", onAbort, { once: true });
+        // Microtask wrapper: a user-provided seam (custom fetch/sleepFn) can
+        // throw SYNCHRONOUSLY despite the TS type — without this, that throw
+        // would escape before the handlers attach and strand the listener.
+        Promise.resolve()
+            .then(() => {
+            // The abort can win between entry and this microtask (the outer
+            // promise has already rejected) — never invoke the seam post-abort;
+            // an AbortSignal-ignoring fetch would still send the POST.
+            if (signal.aborted)
+                throw abortError();
+            return run();
+        })
+            .then((value) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(value);
+        }, (err) => {
+            signal.removeEventListener("abort", onAbort);
+            reject(err);
+        });
+    });
+}
 //# sourceMappingURL=limits.js.map

package/dist/oauth/limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/oauth/limits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,aAAa,CAAC"}
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/oauth/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,aAAa,CAAC;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,SAAiB;IAC1E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,GAAG,sBAAsB,EAAE,CAAC;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,6CAA6C;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,mEAAmE;AACnE,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC;IACxB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAI,MAAmB,EAAE,GAAqB;IACrE,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE;YACT,gEAAgE;YAChE,oEAAoE;YACpE,2DAA2D;YAC3D,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,UAAU,EAAE,CAAC;YACvC,OAAO,GAAG,EAAE,CAAC;QACf,CAAC,CAAC;aACD,IAAI,CACH,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@37signals/basecamp",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "TypeScript SDK for the Basecamp API",
   "type": "module",
   "main": "dist/index.js",
@@ -71,7 +71,7 @@
   "overrides": {
     "minimatch": ">=10.2.1",
     "brace-expansion": ">=5.0.9",
-    "fast-uri": ">=3.1.5 <4",
+    "fast-uri": ">=3.1.7 <4",
     "js-yaml": ">=4.3.1 <5"
   }
 }

package/src/generated/metadata.ts

@@ -37,7 +37,7 @@ export interface MetadataOutput {
 const metadata: MetadataOutput = {
   "$schema": "https://basecamp.com/schemas/sdk-metadata.json",
   "version": "1.0.0",
-  "generated": "2026-08-12T19:58:34.423Z",
+  "generated": "2026-09-03T02:27:35.641Z",
   "operations": {
     "GetAccount": {
       "retry": {
@@ -1612,6 +1612,17 @@ const metadata: MetadataOutput = {
         "maxPageSize": 50
       }
     },
+    "ListRecentProjects": {
+      "retry": {
+        "maxAttempts": 3,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      }
+    },
     "MarkAsRead": {
       "retry": {
         "maxAttempts": 2,
@@ -1842,6 +1853,20 @@ const metadata: MetadataOutput = {
         "natural": true
       }
     },
+    "RecordProjectVisit": {
+      "retry": {
+        "maxAttempts": 3,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      },
+      "idempotent": {
+        "natural": true
+      }
+    },
     "UnarchiveProject": {
       "retry": {
         "maxAttempts": 3,
@@ -2180,6 +2205,34 @@ const metadata: MetadataOutput = {
         ]
       }
     },
+    "CreateBubbleUp": {
+      "retry": {
+        "maxAttempts": 3,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      },
+      "idempotent": {
+        "natural": true
+      }
+    },
+    "DeleteBubbleUp": {
+      "retry": {
+        "maxAttempts": 3,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      },
+      "idempotent": {
+        "natural": true
+      }
+    },
     "SetClientVisibility": {
       "retry": {
         "maxAttempts": 3,
@@ -2264,6 +2317,34 @@ const metadata: MetadataOutput = {
         ]
       }
     },
+    "SpotlightRecording": {
+      "retry": {
+        "maxAttempts": 3,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      },
+      "idempotent": {
+        "natural": true
+      }
+    },
+    "UnspotlightRecording": {
+      "retry": {
+        "maxAttempts": 3,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      },
+      "idempotent": {
+        "natural": true
+      }
+    },
     "UnarchiveRecording": {
       "retry": {
         "maxAttempts": 3,
@@ -2705,6 +2786,39 @@ const metadata: MetadataOutput = {
         "natural": true
       }
     },
+    "GetTemplateLibrary": {
+      "retry": {
+        "maxAttempts": 3,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      }
+    },
+    "CreateTemplateLibraryCopy": {
+      "retry": {
+        "maxAttempts": 2,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      }
+    },
+    "GetTemplateLibraryCopy": {
+      "retry": {
+        "maxAttempts": 3,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      }
+    },
     "ListTemplates": {
       "retry": {
         "maxAttempts": 3,