@hawcx/oauth-client 0.2.0 → 5.1.0

package/dist/delegation/client.d.ts

@@ -1,116 +0,0 @@
-/**
- * Client for sending secure, ECIES-encrypted and signed delegation requests to an IDP
- */
-import { Verifier, EciesX25519Encryptor, EciesX25519Decryptor, Ed25519Signer, RsaPssSigner } from './crypto';
-export type Signer = Ed25519Signer | RsaPssSigner;
-/**
- * Options for sending secure delegation requests
- */
-export interface SecureRequestOptions {
-    /** API endpoint path (e.g., "/mfa/update" or "/device/revoke") */
-    endpoint: string;
-    /** Request payload dictionary to be encrypted and sent */
-    payload: Record<string, any>;
-    /** If true, prepends base_url to endpoint (default: true) */
-    includeBaseUrl?: boolean;
-    /** Optional additional HTTP headers (e.g., API keys) */
-    extraHeaders?: Record<string, string>;
-}
-/**
- * Client for sending secure, ECIES-encrypted and signed delegation requests to an IDP.
- */
-export declare class IdpDelegationClient {
-    private baseUrl;
-    private signer;
-    private verifier;
-    private encryptor;
-    private decryptor;
-    private spId;
-    private timeout;
-    constructor(options: {
-        baseUrl: string;
-        signer: Signer;
-        verifier: Verifier;
-        encryptor: EciesX25519Encryptor;
-        decryptor: EciesX25519Decryptor;
-        spId: string;
-        timeout?: number;
-    });
-    /**
-     * Send an encrypted and signed delegation request to the IDP.
-     *
-     * This method automatically handles all cryptographic operations:
-     * - ECIES (X25519 + AES-GCM) encryption of the request payload
-     * - Ed25519/RSA-PSS detached signature generation
-     * - HTTP header construction with delegation metadata
-     * - Response signature verification
-     * - ECIES decryption of the response
-     *
-     * @param options - Request configuration options
-     * @returns Decrypted and verified response dictionary from the IDP
-     * @throws DelegationRequestError - If request preparation or sending fails
-     * @throws DelegationResponseError - If response verification or decryption fails
-     *
-     * @example
-     * ```typescript
-     * // Initialize client
-     * const client = new IdpDelegationClient({
-     *   baseUrl: "https://idp.example.com",
-     *   signer, verifier,
-     *   encryptor, decryptor,
-     *   spId: "my-sp"
-     * });
-     *
-     * // Send secure request with automatic crypto
-     * const response = await client.sendSecureRequest({
-     *   endpoint: "/mfa/update",
-     *   payload: {
-     *     userid: "user@example.com",
-     *     mfa_method: "sms",
-     *     contact: "+15551234567"
-     *   }
-     * });
-     * console.log(response); // { success: true, session_id: '...' }
-     * ```
-     *
-     * Security Notes:
-     * - All requests are encrypted with ECIES (X25519 + AES-GCM)
-     * - All requests include a detached signature (Ed25519 or RSA-PSS)
-     * - All responses are verified and decrypted automatically
-     * - Timestamps are included to prevent replay attacks
-     */
-    sendSecureRequest(options: SecureRequestOptions): Promise<Record<string, any>>;
-    /**
-     * Request an MFA method update for a user.
-     *
-     * @param options - MFA update configuration
-     * @returns The decrypted acknowledgment response from the IDP
-     */
-    mfaUpdate(options: {
-        userId: string;
-        method: string;
-        enabled: boolean;
-        reason: string;
-        requestedBy?: string;
-    }): Promise<Record<string, any>>;
-    /**
-     * Request the current MFA status for a user.
-     *
-     * @param userId - The ID of the user to query
-     * @returns The decrypted acknowledgment response from the IDP containing the MFA status
-     */
-    mfaGetStatus(userId: string): Promise<Record<string, any>>;
-    /**
-     * Request to revoke a user's device.
-     *
-     * @param options - Device revocation configuration
-     * @returns The decrypted acknowledgment response from the IDP
-     */
-    deviceRevoke(options: {
-        userId: string;
-        deviceId: string;
-        reason: string;
-        requestedBy?: string;
-    }): Promise<Record<string, any>>;
-}
-//# sourceMappingURL=client.d.ts.map

package/dist/delegation/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/delegation/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAEL,QAAQ,EACR,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,UAAU,CAAC;AAGlB,MAAM,MAAM,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,QAAQ,CAAC;QACnB,SAAS,EAAE,oBAAoB,CAAC;QAChC,SAAS,EAAE,oBAAoB,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;IAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACG,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAyGpF;;;;;OAKG;IACG,SAAS,CAAC,OAAO,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAqBhC;;;;;OAKG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAmBhE;;;;;OAKG;IACG,YAAY,CAAC,OAAO,EAAE;QAC1B,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAoBjC"}

package/dist/delegation/client.js

@@ -1,227 +0,0 @@
-"use strict";
-/**
- * Client for sending secure, ECIES-encrypted and signed delegation requests to an IDP
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IdpDelegationClient = void 0;
-const axios_1 = __importDefault(require("axios"));
-const uuid_1 = require("uuid");
-const crypto_1 = require("./crypto");
-const exceptions_1 = require("./exceptions");
-/**
- * Client for sending secure, ECIES-encrypted and signed delegation requests to an IDP.
- */
-class IdpDelegationClient {
-    constructor(options) {
-        this.baseUrl = options.baseUrl.replace(/\/$/, '');
-        this.signer = options.signer;
-        this.verifier = options.verifier;
-        this.encryptor = options.encryptor;
-        this.decryptor = options.decryptor;
-        this.spId = options.spId;
-        this.timeout = options.timeout || 15;
-    }
-    /**
-     * Send an encrypted and signed delegation request to the IDP.
-     *
-     * This method automatically handles all cryptographic operations:
-     * - ECIES (X25519 + AES-GCM) encryption of the request payload
-     * - Ed25519/RSA-PSS detached signature generation
-     * - HTTP header construction with delegation metadata
-     * - Response signature verification
-     * - ECIES decryption of the response
-     *
-     * @param options - Request configuration options
-     * @returns Decrypted and verified response dictionary from the IDP
-     * @throws DelegationRequestError - If request preparation or sending fails
-     * @throws DelegationResponseError - If response verification or decryption fails
-     *
-     * @example
-     * ```typescript
-     * // Initialize client
-     * const client = new IdpDelegationClient({
-     *   baseUrl: "https://idp.example.com",
-     *   signer, verifier,
-     *   encryptor, decryptor,
-     *   spId: "my-sp"
-     * });
-     *
-     * // Send secure request with automatic crypto
-     * const response = await client.sendSecureRequest({
-     *   endpoint: "/mfa/update",
-     *   payload: {
-     *     userid: "user@example.com",
-     *     mfa_method: "sms",
-     *     contact: "+15551234567"
-     *   }
-     * });
-     * console.log(response); // { success: true, session_id: '...' }
-     * ```
-     *
-     * Security Notes:
-     * - All requests are encrypted with ECIES (X25519 + AES-GCM)
-     * - All requests include a detached signature (Ed25519 or RSA-PSS)
-     * - All responses are verified and decrypted automatically
-     * - Timestamps are included to prevent replay attacks
-     */
-    async sendSecureRequest(options) {
-        const { endpoint, payload, includeBaseUrl = true, extraHeaders = {} } = options;
-        let encryptedEnv;
-        let headers;
-        try {
-            // Step 1: Serialize and encrypt the payload
-            const body = Buffer.from(JSON.stringify(payload));
-            encryptedEnv = this.encryptor.encrypt(body);
-            // Step 2: Generate timestamp and signature
-            const ts = (0, crypto_1.nowS)();
-            const sig = this.signer.signDetached(encryptedEnv, ts);
-            // Step 3: Build delegation headers
-            headers = {
-                'Content-Type': 'application/json',
-                'X-Enc-Alg': 'x25519-aesgcm',
-                'X-SP-Id': this.spId,
-                'X-Timestamp': String(ts),
-                'X-Signature-Alg': sig.alg,
-                'X-Signature': sig.signatureB64,
-            };
-            if (sig.kid) {
-                headers['X-Key-Id'] = sig.kid;
-            }
-            // Merge extra headers (e.g., API authentication headers)
-            Object.assign(headers, extraHeaders);
-        }
-        catch (error) {
-            throw new exceptions_1.DelegationRequestError(`Failed to prepare secure request: ${error}`);
-        }
-        // Step 4: Send encrypted request to IDP
-        let response;
-        try {
-            const url = includeBaseUrl ? this.baseUrl + endpoint : endpoint;
-            response = await axios_1.default.post(url, encryptedEnv, {
-                headers,
-                timeout: this.timeout * 1000,
-                validateStatus: () => true, // Don't throw on any status
-                responseType: 'arraybuffer',
-            });
-        }
-        catch (error) {
-            if (axios_1.default.isAxiosError(error)) {
-                throw new exceptions_1.DelegationRequestError(`Request to IDP failed: ${error.message}`);
-            }
-            throw new exceptions_1.DelegationRequestError(`Request to IDP failed: ${error}`);
-        }
-        // Step 5: Verify and decrypt response (even for error statuses)
-        try {
-            const respTs = parseInt(response.headers['x-timestamp'] || String((0, crypto_1.nowS)()));
-            const respSig = response.headers['x-signature'];
-            const respAlg = response.headers['x-signature-alg'];
-            const respKid = response.headers['x-key-id'];
-            if (!respSig || !respAlg) {
-                throw new exceptions_1.DelegationResponseError('Missing signature headers in IDP response');
-            }
-            this.verifier.verify(Buffer.from(response.data), respTs, respSig, respAlg, respKid);
-            // Step 6: Verify encryption and decrypt response
-            if (response.headers['x-enc-alg'] !== 'x25519-aesgcm') {
-                throw new exceptions_1.DelegationResponseError('IDP response must be ECIES encrypted');
-            }
-            const plaintext = this.decryptor.decrypt(Buffer.from(response.data));
-            const decryptedData = JSON.parse(plaintext.toString('utf-8'));
-            // Now check HTTP status and include decrypted error message if available
-            if (response.status >= 400) {
-                const errorDetail = decryptedData.detail || JSON.stringify(decryptedData);
-                throw new exceptions_1.DelegationRequestError(`IDP returned ${response.status}: ${errorDetail}`, response.status, errorDetail);
-            }
-            return decryptedData;
-        }
-        catch (error) {
-            if (error instanceof exceptions_1.DelegationRequestError) {
-                throw error;
-            }
-            if (error instanceof exceptions_1.DelegationResponseError) {
-                throw error;
-            }
-            // If we can't decrypt, fall back to raw response
-            if (response.status >= 400) {
-                const responseText = Buffer.from(response.data).toString('utf-8').substring(0, 500);
-                throw new exceptions_1.DelegationRequestError(`IDP returned ${response.status}: ${responseText}`, response.status);
-            }
-            throw new exceptions_1.DelegationResponseError(`Failed to process secure response: ${error}`);
-        }
-    }
-    /**
-     * Request an MFA method update for a user.
-     *
-     * @param options - MFA update configuration
-     * @returns The decrypted acknowledgment response from the IDP
-     */
-    async mfaUpdate(options) {
-        const { userId, method, enabled, reason, requestedBy } = options;
-        const payload = {
-            v: '1',
-            type: 'delegation.request',
-            action: 'mfa.update',
-            sp: { id: this.spId, kid: this.signer.kid },
-            subject: { user_id: userId },
-            params: { method, enabled: Boolean(enabled) },
-            audit: { reason, requested_by: requestedBy || userId },
-            jti: (0, uuid_1.v4)().replace(/-/g, ''),
-            iat: (0, crypto_1.nowS)(),
-        };
-        return this.sendSecureRequest({
-            endpoint: '/mfa/update',
-            payload,
-        });
-    }
-    /**
-     * Request the current MFA status for a user.
-     *
-     * @param userId - The ID of the user to query
-     * @returns The decrypted acknowledgment response from the IDP containing the MFA status
-     */
-    async mfaGetStatus(userId) {
-        const payload = {
-            v: '1',
-            type: 'delegation.request',
-            action: 'mfa.get_status',
-            sp: { id: this.spId, kid: this.signer.kid },
-            subject: { user_id: userId },
-            params: {},
-            audit: { reason: 'User status query', requested_by: userId },
-            jti: (0, uuid_1.v4)().replace(/-/g, ''),
-            iat: (0, crypto_1.nowS)(),
-        };
-        return this.sendSecureRequest({
-            endpoint: '/mfa/get',
-            payload,
-        });
-    }
-    /**
-     * Request to revoke a user's device.
-     *
-     * @param options - Device revocation configuration
-     * @returns The decrypted acknowledgment response from the IDP
-     */
-    async deviceRevoke(options) {
-        const { userId, deviceId, reason, requestedBy } = options;
-        const payload = {
-            v: '1',
-            type: 'delegation.request',
-            action: 'device.revoke',
-            sp: { id: this.spId, kid: this.signer.kid },
-            subject: { user_id: userId, device_id: deviceId },
-            params: {},
-            audit: { reason, requested_by: requestedBy || userId },
-            jti: (0, uuid_1.v4)().replace(/-/g, ''),
-            iat: (0, crypto_1.nowS)(),
-        };
-        return this.sendSecureRequest({
-            endpoint: '/device/revoke',
-            payload,
-        });
-    }
-}
-exports.IdpDelegationClient = IdpDelegationClient;
-//# sourceMappingURL=client.js.map

package/dist/delegation/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/delegation/client.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;AAEH,kDAA0B;AAC1B,+BAAoC;AACpC,qCAOkB;AAClB,6CAA+E;AAkB/E;;GAEG;AACH,MAAa,mBAAmB;IAS9B,YAAY,OAQX;QACC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAA6B;QACnD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QAEhF,IAAI,YAAoB,CAAC;QACzB,IAAI,OAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,4CAA4C;YAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAE5C,2CAA2C;YAC3C,MAAM,EAAE,GAAG,IAAA,aAAI,GAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAEvD,mCAAmC;YACnC,OAAO,GAAG;gBACR,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,eAAe;gBAC5B,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;gBACzB,iBAAiB,EAAE,GAAG,CAAC,GAAG;gBAC1B,aAAa,EAAE,GAAG,CAAC,YAAY;aAChC,CAAC;YAEF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YAED,yDAAyD;YACzD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,wCAAwC;QACxC,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChE,QAAQ,GAAG,MAAM,eAAK,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE;gBAC7C,OAAO;gBACP,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI;gBAC5B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,4BAA4B;gBACxD,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,mCAAsB,CAAC,0BAA0B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,IAAA,aAAI,GAAE,CAAC,CAAC,CAAC;YAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAE7C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAI,oCAAuB,CAAC,2CAA2C,CAAC,CAAC;YACjF,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAEpF,iDAAiD;YACjD,IAAI,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,eAAe,EAAE,CAAC;gBACtD,MAAM,IAAI,oCAAuB,CAAC,sCAAsC,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAE9D,yEAAyE;YACzE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBAC1E,MAAM,IAAI,mCAAsB,CAC9B,gBAAgB,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,EACjD,QAAQ,CAAC,MAAM,EACf,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mCAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,oCAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,iDAAiD;YACjD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpF,MAAM,IAAI,mCAAsB,CAC9B,gBAAgB,QAAQ,CAAC,MAAM,KAAK,YAAY,EAAE,EAClD,QAAQ,CAAC,MAAM,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,oCAAuB,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,OAMf;QACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAEjE,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,GAAG;YACN,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,YAAY;YACpB,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC3C,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;YAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7C,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,IAAI,MAAM,EAAE;YACtD,GAAG,EAAE,IAAA,SAAM,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/B,GAAG,EAAE,IAAA,aAAI,GAAE;SACZ,CAAC;QAEF,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,QAAQ,EAAE,aAAa;YACvB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,GAAG;YACN,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,gBAAgB;YACxB,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC3C,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;YAC5B,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,EAAE;YAC5D,GAAG,EAAE,IAAA,SAAM,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/B,GAAG,EAAE,IAAA,aAAI,GAAE;SACZ,CAAC;QAEF,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,QAAQ,EAAE,UAAU;YACpB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,OAKlB;QACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAE1D,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,GAAG;YACN,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,eAAe;YACvB,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC3C,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;YACjD,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,IAAI,MAAM,EAAE;YACtD,GAAG,EAAE,IAAA,SAAM,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/B,GAAG,EAAE,IAAA,aAAI,GAAE;SACZ,CAAC;QAEF,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,QAAQ,EAAE,gBAAgB;YAC1B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;CACF;AAxQD,kDAwQC"}

package/dist/exceptions.d.ts

@@ -1,52 +0,0 @@
-/**
- * Custom exceptions for the Hawcx OAuth Client SDK
- */
-/**
- * Base exception for all hawcx_oauth_client errors
- */
-export declare class HawcxOAuthError extends Error {
-    constructor(message: string);
-}
-/**
- * Raised when the OAuth code exchange fails.
- *
- * This can happen due to:
- * - Invalid or expired authorization code
- * - Network connectivity issues
- * - OAuth server errors
- * - Malformed responses
- */
-export declare class OAuthExchangeError extends HawcxOAuthError {
-    statusCode?: number;
-    responseBody?: any;
-    constructor(message: string, statusCode?: number, responseBody?: any);
-    toString(): string;
-}
-/**
- * Raised when JWT signature or claims verification fails.
- *
- * This can happen due to:
- * - Invalid JWT signature (tampering detected)
- * - Expired token
- * - Wrong audience or issuer
- * - Token not yet valid (nbf claim)
- * - Malformed JWT structure
- */
-export declare class JWTVerificationError extends HawcxOAuthError {
-    originalError?: Error;
-    constructor(message: string, originalError?: Error);
-}
-/**
- * Raised when the provided public key is invalid or unreadable.
- *
- * This can happen due to:
- * - File not found
- * - Invalid PEM format
- * - Wrong key algorithm
- * - Permission denied
- * - Empty key
- */
-export declare class InvalidPublicKeyError extends HawcxOAuthError {
-    constructor(message: string);
-}
-//# sourceMappingURL=exceptions.d.ts.map

package/dist/exceptions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../src/exceptions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAK5B;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,GAAG,CAAC;gBAEP,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,GAAG;IAQpE,QAAQ,IAAI,MAAM;CAOnB;AAED;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,SAAQ,eAAe;IACvD,aAAa,CAAC,EAAE,KAAK,CAAC;gBAEV,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK;CAMnD;AAED;;;;;;;;;GASG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,OAAO,EAAE,MAAM;CAK5B"}

package/dist/exceptions.js

@@ -1,81 +0,0 @@
-"use strict";
-/**
- * Custom exceptions for the Hawcx OAuth Client SDK
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidPublicKeyError = exports.JWTVerificationError = exports.OAuthExchangeError = exports.HawcxOAuthError = void 0;
-/**
- * Base exception for all hawcx_oauth_client errors
- */
-class HawcxOAuthError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'HawcxOAuthError';
-        Object.setPrototypeOf(this, HawcxOAuthError.prototype);
-    }
-}
-exports.HawcxOAuthError = HawcxOAuthError;
-/**
- * Raised when the OAuth code exchange fails.
- *
- * This can happen due to:
- * - Invalid or expired authorization code
- * - Network connectivity issues
- * - OAuth server errors
- * - Malformed responses
- */
-class OAuthExchangeError extends HawcxOAuthError {
-    constructor(message, statusCode, responseBody) {
-        super(message);
-        this.name = 'OAuthExchangeError';
-        this.statusCode = statusCode;
-        this.responseBody = responseBody;
-        Object.setPrototypeOf(this, OAuthExchangeError.prototype);
-    }
-    toString() {
-        let base = this.message;
-        if (this.statusCode) {
-            base = `${base} (HTTP ${this.statusCode})`;
-        }
-        return base;
-    }
-}
-exports.OAuthExchangeError = OAuthExchangeError;
-/**
- * Raised when JWT signature or claims verification fails.
- *
- * This can happen due to:
- * - Invalid JWT signature (tampering detected)
- * - Expired token
- * - Wrong audience or issuer
- * - Token not yet valid (nbf claim)
- * - Malformed JWT structure
- */
-class JWTVerificationError extends HawcxOAuthError {
-    constructor(message, originalError) {
-        super(message);
-        this.name = 'JWTVerificationError';
-        this.originalError = originalError;
-        Object.setPrototypeOf(this, JWTVerificationError.prototype);
-    }
-}
-exports.JWTVerificationError = JWTVerificationError;
-/**
- * Raised when the provided public key is invalid or unreadable.
- *
- * This can happen due to:
- * - File not found
- * - Invalid PEM format
- * - Wrong key algorithm
- * - Permission denied
- * - Empty key
- */
-class InvalidPublicKeyError extends HawcxOAuthError {
-    constructor(message) {
-        super(message);
-        this.name = 'InvalidPublicKeyError';
-        Object.setPrototypeOf(this, InvalidPublicKeyError.prototype);
-    }
-}
-exports.InvalidPublicKeyError = InvalidPublicKeyError;
-//# sourceMappingURL=exceptions.js.map

package/dist/exceptions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../src/exceptions.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH;;GAEG;AACH,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;CACF;AAND,0CAMC;AAED;;;;;;;;GAQG;AACH,MAAa,kBAAmB,SAAQ,eAAe;IAIrD,YAAY,OAAe,EAAE,UAAmB,EAAE,YAAkB;QAClE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,QAAQ;QACN,IAAI,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,GAAG,GAAG,IAAI,UAAU,IAAI,CAAC,UAAU,GAAG,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAnBD,gDAmBC;AAED;;;;;;;;;GASG;AACH,MAAa,oBAAqB,SAAQ,eAAe;IAGvD,YAAY,OAAe,EAAE,aAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;CACF;AATD,oDASC;AAED;;;;;;;;;GASG;AACH,MAAa,qBAAsB,SAAQ,eAAe;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF;AAND,sDAMC"}

package/dist/utils.d.ts

@@ -1,61 +0,0 @@
-/**
- * Internal utilities for the Hawcx OAuth Client SDK
- */
-/**
- * Load public key from string or file.
- *
- * @param keyInput - Either a PEM-formatted public key string or a path to a key file
- * @returns PEM-formatted public key string
- * @throws InvalidPublicKeyError if the key cannot be loaded or is invalid
- *
- * @example
- * ```typescript
- * // From file
- * const key = loadPublicKey('keys/public.pem');
- *
- * // From string
- * const key = loadPublicKey(process.env.PUBLIC_KEY!);
- * ```
- */
-export declare function loadPublicKey(keyInput: string): string;
-/**
- * Fetch JWKS (JSON Web Key Set) from a URL with caching.
- *
- * @param jwksUrl - URL to fetch JWKS from (e.g., https://example.com/.well-known/jwks.json)
- * @param timeout - Request timeout in milliseconds (default: 10000)
- * @param ttl - Cache TTL in milliseconds (default: 3600000)
- * @returns JWKS object containing 'keys' array
- * @throws InvalidPublicKeyError if JWKS cannot be fetched or is invalid
- *
- * @example
- * ```typescript
- * const jwks = await fetchJwks('https://example.com/.well-known/jwks.json');
- * console.log(jwks.keys[0].kid);
- * ```
- */
-export declare function fetchJwks(jwksUrl: string, timeout?: number, ttl?: number): Promise<any>;
-/**
- * Extract a public key from JWKS and convert to PEM format.
- *
- * @param jwks - JWKS object (must contain 'keys' array)
- * @param kid - Key ID to search for (optional). If not provided, uses first key.
- * @returns PEM-formatted public key string
- * @throws InvalidPublicKeyError if key cannot be found or converted
- *
- * @example
- * ```typescript
- * const jwks = await fetchJwks('https://example.com/.well-known/jwks.json');
- * const pemKey = getKeyFromJwks(jwks, 'key-123');
- * ```
- */
-export declare function getKeyFromJwks(jwks: any, kid?: string): string;
-/**
- * Convert a JWK (JSON Web Key) to PEM format.
- * Supports RSA and EC (Elliptic Curve) keys.
- *
- * @param jwk - JWK object
- * @returns PEM-formatted public key string
- * @throws InvalidPublicKeyError if JWK cannot be converted
- */
-export declare function jwkToPem(jwk: any): string;
-//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgCtD;AAuCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,MAAc,EACvB,GAAG,GAAE,MAAuB,GAC3B,OAAO,CAAC,GAAG,CAAC,CA2Cd;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAyB9D;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CA+BzC"}