@hawcx/oauth-client 4.0.1 → 5.1.0

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2024 Hawcx
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/README.md

@@ -4,6 +4,7 @@ Simple, production-ready OAuth client SDK for Hawcx authentication.
 
 ## Features
 
+- **OIDC Discovery** - `HawcxOAuth.fromIssuer(...)` resolves endpoints from `/.well-known/openid-configuration` and enforces signature + `iss` + `aud` + `exp` + `nbf` on verify
 - **Simple JWT Verification** - Uses `jose` library for automatic JWKS caching and signature handling
 - **PKCE Support** - Native PKCE (RFC 7636) support for enhanced OAuth security
 - **Delegation API** - Server-to-server user management (MFA, devices)
@@ -17,19 +18,89 @@ Simple, production-ready OAuth client SDK for Hawcx authentication.
 npm install @hawcx/oauth-client
 ```
 
-## Quick Start
+## Quick Start (OIDC discovery, recommended)
+
+`HawcxOAuth.fromIssuer(...)` does the discovery fetch once at startup and
+gives you a client whose `exchangeCode` + `verifyToken` enforce all the
+standard OIDC claim checks. Construct once and reuse.
 
 ```typescript
 import { HawcxOAuth } from '@hawcx/oauth-client';
 
-const oauth = new HawcxOAuth({ configId: 'your-config-id' });
+const oauth = await HawcxOAuth.fromIssuer({
+  issuer: 'https://api.hawcx.com',        // → discovery + expected `iss`
+  configId: process.env.HAWCX_CONFIG_ID!, // → X-Config-Id header
+  clientId: process.env.HAWCX_CLIENT_ID!, // → expected `aud` on id_tokens
+});
 
-// Exchange authorization code for tokens
 const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
 console.log(claims.sub);   // user ID
 console.log(claims.email); // user email
 ```
 
+> **`configId` vs `clientId` — they are different values.**
+> Hawcx separates the tenant routing key from the audience claim:
+>
+> - **`configId`** — the per-tenant config identifier. Sent as the
+>   `X-Config-Id` header on the token-exchange POST so the OAuth server
+>   can look up the tenant.
+> - **`clientId`** — the value the tenant has configured (in the Hawcx
+>   admin console) as the `aud` claim on issued id_tokens. The verifier
+>   matches the token's `aud` against this exact string.
+>
+> Passing the same value for both fails verification with
+> `Unexpected JWT audience` unless your tenant happens to use identical
+> strings.
+
+## Quick Start (legacy)
+
+The legacy single-arg constructor still works for backward compatibility
+with 4.x callers. It verifies the JWT signature only — `iss` and `aud`
+are not checked. Prefer `fromIssuer` for new code.
+
+```typescript
+import { HawcxOAuth } from '@hawcx/oauth-client';
+
+const oauth = new HawcxOAuth({ configId: 'your-config-id' });
+
+const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
+```
+
+---
+
+## Confidential clients (`private_key_jwt`)
+
+If your project is registered in the Hawcx admin console with **Client
+authentication = Signing key (`private_key_jwt`)**, attach an Ed25519 signer.
+The SDK then signs an RFC 7523 `client_assertion` on every token exchange
+(PKCE is still sent). Public clients omit this and keep using PKCE only.
+
+```typescript
+import { HawcxOAuth, ClientAssertionSigner } from '@hawcx/oauth-client';
+
+const privateJwk = JSON.parse(process.env.HAWCX_PRIVATE_JWK!); // OKP/Ed25519, with kid
+
+const oauth = (
+  await HawcxOAuth.fromIssuer({
+    issuer: 'https://dev-demo-api.hawcx.com',
+    configId: process.env.HAWCX_CONFIG_ID!,
+    clientId: process.env.HAWCX_CLIENT_ID!,
+  })
+).withClientAssertion(ClientAssertionSigner.ed25519FromJwk(privateJwk));
+
+const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
+```
+
+The private key must be Ed25519 (`kty: 'OKP', crv: 'Ed25519'`, with a `kid`);
+its public JWK is what you register in the admin console. The assertion's `aud`
+is the discovered `token_endpoint`, and EdDSA is the only accepted algorithm.
+`clientId` must be the confidential client's id — it becomes the assertion
+`iss`/`sub` and the id_token `aud`.
+
+> If you bound a `nonce` at `/authorize`, pass it as the 4th argument to
+> `exchangeCode(code, verifier, redirectUri?, expectedNonce)` — verification
+> refuses a nonce-bearing token when none is supplied (OIDC Core §3.1.3.7).
+
 ---
 
 ## Modules
@@ -46,21 +117,45 @@ console.log(claims.email); // user email
 
 Core module for OAuth 2.1 + PKCE authentication.
 
-### `HawcxOAuth`
+### Construction
+
+#### Discovery mode (recommended)
 
 ```typescript
 import { HawcxOAuth } from '@hawcx/oauth-client';
 
+const oauth = await HawcxOAuth.fromIssuer({
+  issuer: 'https://api.hawcx.com',     // Required: discovery + expected `iss`
+  configId: 'your-config-id',          // Required: X-Config-Id header
+  clientId: 'your-client-id',          // Required: expected `aud` on id_tokens
+  timeout: 10000,                       // Optional: per-request timeout in ms
+  discoveryTimeout: 5000,               // Optional: discovery fetch timeout in ms
+});
+
+oauth.discoveryMetadata; // resolved OIDC discovery doc, for diagnostics
+```
+
+Throws `DiscoveryError` if the discovery document is unreachable, returns
+non-2xx, isn't valid JSON, or is missing any of `token_endpoint`,
+`jwks_uri`, `id_token_signing_alg_values_supported`.
+
+#### Legacy mode
+
+```typescript
 const oauth = new HawcxOAuth({
-  configId: 'your-config-id',        // Required: Your Hawcx config ID
-  baseUrl: 'https://api.hawcx.com',  // Optional: API base URL
-  timeout: 10000,                     // Optional: Request timeout in ms
+  configId: 'your-config-id',        // Required
+  baseUrl: 'https://api.hawcx.com',  // Optional: defaults to api.hawcx.com
+  timeout: 10000,                     // Optional
 });
 ```
 
+Hits the fixed endpoints `<baseUrl>/oauth2/token` and `<baseUrl>/keys`
+directly. **Signature-only verification** — `iss` and `aud` are not
+checked. Kept for backward compatibility with 4.x callers.
+
 ### Methods
 
-#### `exchangeCode(code, codeVerifier): Promise<ExchangeResult>`
+#### `exchangeCode(code, codeVerifier, redirectUri?): Promise<ExchangeResult>`
 
 Exchange an authorization code for tokens.
 
@@ -69,6 +164,13 @@ const { idToken, claims } = await oauth.exchangeCode(
   'authorization-code',
   'pkce-code-verifier'
 );
+
+// With redirect_uri (RFC 6749 §4.1.3) when your auth request registered one:
+const { idToken, claims } = await oauth.exchangeCode(
+  'authorization-code',
+  'pkce-code-verifier',
+  'https://app.example.com/auth/callback'
+);
 ```
 
 **Returns:**
@@ -79,12 +181,16 @@ interface ExchangeResult {
 }
 ```
 
-#### `verifyToken(token): Promise<JwtClaims>`
+#### `verifyToken(token, options?): Promise<JwtClaims>`
 
-Verify an existing JWT token.
+Verify an existing JWT token. In discovery mode, enforces signature + `iss` +
+`aud` + `exp` + `nbf`. In legacy mode, only the signature is checked.
 
 ```typescript
 const claims = await oauth.verifyToken(idToken);
+
+// With expected nonce (useful for flows that bind a nonce to the auth request):
+const claims = await oauth.verifyToken(idToken, { nonce: 'expected-nonce' });
 ```
 
 **Returns:**
@@ -99,34 +205,46 @@ interface JwtClaims {
   name?: string;           // User name
   amr?: string[];          // Authentication methods
   mfa_method?: string;     // MFA method used
+  nonce?: string;          // Nonce (if bound)
 }
 ```
 
-#### `clearCache(): void`
+#### `refreshJwks(): void`
 
-Clear the JWKS cache (useful for testing or key rotation).
+Reset the JWKS cache so the next verification refetches keys (useful for testing
+or key rotation).
 
 ```typescript
-oauth.clearCache();
+oauth.refreshJwks();
 ```
 
+> **Deprecated:** `clearCache()` is a deprecated passthrough that calls
+> `refreshJwks()` (and emits a one-time `console.warn`). It still works but will be
+> removed in 6.0.0 — prefer `refreshJwks()`.
+
 ### Errors
 
 ```typescript
 import {
   HawcxOAuthError,        // Base error class
+  DiscoveryError,         // OIDC discovery resolution failed (fromIssuer only)
   TokenExchangeError,     // Code exchange failed
   TokenVerificationError  // JWT verification failed
 } from '@hawcx/oauth-client';
 
 try {
+  const oauth = await HawcxOAuth.fromIssuer({ issuer, configId, clientId });
   await oauth.exchangeCode(code, verifier);
 } catch (error) {
+  if (error instanceof DiscoveryError) {
+    console.log(error.cause); // original network / parse error
+  }
   if (error instanceof TokenExchangeError) {
     console.log(error.statusCode); // HTTP status code
   }
   if (error instanceof TokenVerificationError) {
-    console.log(error.message); // "Token expired", "Invalid signature", etc.
+    // "Token expired", "Invalid signature", "Unexpected JWT audience: ...", etc.
+    console.log(error.message);
   }
 }
 ```
@@ -551,7 +669,7 @@ The SDK automatically caches JWKS (JSON Web Key Set) for JWT verification:
 - Keys are fetched lazily on first `verifyToken()` call
 - Cached in memory for the lifetime of the `HawcxOAuth` instance
 - Auto-refreshes if a key ID isn't found (handles key rotation)
-- Call `clearCache()` to force a refresh
+- Call `refreshJwks()` to force a refresh (`clearCache()` is a deprecated alias — see above)
 
 ```typescript
 // Keys fetched once, cached thereafter
@@ -560,7 +678,7 @@ const claims2 = await oauth.verifyToken(token2); // Uses cache
 const claims3 = await oauth.verifyToken(token3); // Uses cache
 
 // Force refresh if needed
-oauth.clearCache();
+oauth.refreshJwks();
 const claims4 = await oauth.verifyToken(token4); // Fetches JWKS again
 ```
 

package/dist/client-assertion.d.ts

@@ -0,0 +1,45 @@
+import type { KeyObject } from 'node:crypto';
+import { type JWK } from 'jose';
+/** RFC 7523 §2.2 assertion type for the `private_key_jwt` method. */
+export declare const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+export declare class ClientAssertionSigner {
+    private readonly importKeyFn;
+    private readonly kid;
+    private readonly lifetimeSeconds;
+    /** Lazily-imported signing key, memoised across sign() calls. */
+    private keyPromise?;
+    private constructor();
+    /**
+     * Build a signer from an Ed25519 *private* JWK (RFC 8037):
+     * `{ kty: 'OKP', crv: 'Ed25519', d, x, kid }`. The `kid` is read from the
+     * JWK. This is the canonical Hawcx key format (what the admin console
+     * generates/downloads). Accepts either a JWK object or its JSON string.
+     */
+    static ed25519FromJwk(privateJwk: JWK | string): ClientAssertionSigner;
+    /**
+     * Build a signer from a PKCS#8 PEM-encoded Ed25519 private key plus its `kid`.
+     * The key type is validated (must be Ed25519) on first use.
+     */
+    static ed25519FromPem(pkcs8Pem: string, kid: string): ClientAssertionSigner;
+    /**
+     * Build a signer from an already-loaded Ed25519 private `KeyObject`
+     * (e.g. from `crypto.createPrivateKey(...)`) plus its `kid`.
+     */
+    static ed25519(privateKey: KeyObject, kid: string): ClientAssertionSigner;
+    /**
+     * Return a copy of this signer using `seconds` as the assertion lifetime
+     * (iat→exp). Clamped to [1, 120] (the OP maximum). Defaults to 60; most
+     * callers never need this.
+     */
+    withLifetimeSeconds(seconds: number): ClientAssertionSigner;
+    private importKey;
+    /**
+     * Build and Ed25519-sign the `client_assertion` JWT for one token exchange.
+     *
+     * @param clientId - becomes `iss` and `sub` (RFC 7523 §3)
+     * @param audience - the OP's token endpoint, exactly as advertised in
+     *   discovery (the OP pins `aud` to that string)
+     */
+    sign(clientId: string, audience: string): Promise<string>;
+}
+//# sourceMappingURL=client-assertion.d.ts.map

package/dist/client-assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-assertion.d.ts","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAmC,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAKjE,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,2DACwB,CAAC;AAK3D,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,iEAAiE;IACjE,OAAO,CAAC,UAAU,CAAC,CAAuB;IAE1C,OAAO;IAUP;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,GAAG,MAAM,GAAG,qBAAqB;IA0BtE;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB;IAkB3E;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB;IAazE;;;;OAIG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB;IAK3D,OAAO,CAAC,SAAS;IAYjB;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAYhE"}

package/dist/client-assertion.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientAssertionSigner = exports.CLIENT_ASSERTION_TYPE = void 0;
+/**
+ * RFC 7523 / OIDC Core §9 `client_assertion` signer for the
+ * `private_key_jwt` token-endpoint authentication method.
+ *
+ * EdDSA over Ed25519 is the only algorithm the Hawcx OP accepts at the token
+ * endpoint, so it is the only one supported here. Obtain an instance via
+ * {@link ClientAssertionSigner.ed25519FromJwk} (or `ed25519FromPem` /
+ * `ed25519`) and attach it with `HawcxOAuth.withClientAssertion(signer)`.
+ *
+ * @beta This `private_key_jwt` surface is experimental and may change before
+ *   it is marked stable.
+ */
+const node_crypto_1 = require("node:crypto");
+const jose_1 = require("jose");
+/** RFC 7523 §2.2 assertion type for the `private_key_jwt` method. */
+exports.CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+const DEFAULT_LIFETIME_SECONDS = 60;
+const MAX_LIFETIME_SECONDS = 120; // OP cap (ASSERTION_MAX_TTL_SECONDS)
+class ClientAssertionSigner {
+    constructor(importKeyFn, kid, lifetimeSeconds) {
+        this.importKeyFn = importKeyFn;
+        this.kid = kid;
+        this.lifetimeSeconds = lifetimeSeconds;
+    }
+    /**
+     * Build a signer from an Ed25519 *private* JWK (RFC 8037):
+     * `{ kty: 'OKP', crv: 'Ed25519', d, x, kid }`. The `kid` is read from the
+     * JWK. This is the canonical Hawcx key format (what the admin console
+     * generates/downloads). Accepts either a JWK object or its JSON string.
+     */
+    static ed25519FromJwk(privateJwk) {
+        let jwk;
+        if (typeof privateJwk === 'string') {
+            try {
+                jwk = JSON.parse(privateJwk);
+            }
+            catch (err) {
+                throw new Error(`private JWK is not valid JSON: ${String(err)}`);
+            }
+        }
+        else {
+            jwk = privateJwk;
+        }
+        if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {
+            throw new Error(`client assertion key must be an Ed25519 OKP JWK (got kty=${String(jwk.kty)}, crv=${String(jwk.crv)})`);
+        }
+        if (typeof jwk.d !== 'string' || jwk.d.length === 0) {
+            throw new Error("client assertion JWK has no 'd' (not a private key)");
+        }
+        if (typeof jwk.kid !== 'string' || jwk.kid.length === 0) {
+            throw new Error("client assertion JWK is missing 'kid'");
+        }
+        const kid = jwk.kid;
+        return new ClientAssertionSigner(() => (0, jose_1.importJWK)(jwk, 'EdDSA'), kid, DEFAULT_LIFETIME_SECONDS);
+    }
+    /**
+     * Build a signer from a PKCS#8 PEM-encoded Ed25519 private key plus its `kid`.
+     * The key type is validated (must be Ed25519) on first use.
+     */
+    static ed25519FromPem(pkcs8Pem, kid) {
+        if (!kid)
+            throw new Error('kid is required');
+        return new ClientAssertionSigner(async () => {
+            let key;
+            try {
+                key = await (0, jose_1.importPKCS8)(pkcs8Pem, 'EdDSA');
+            }
+            catch (err) {
+                throw new Error(`not a valid PKCS#8 PEM private key: ${String(err)}`);
+            }
+            assertEd25519(key);
+            return key;
+        }, kid, DEFAULT_LIFETIME_SECONDS);
+    }
+    /**
+     * Build a signer from an already-loaded Ed25519 private `KeyObject`
+     * (e.g. from `crypto.createPrivateKey(...)`) plus its `kid`.
+     */
+    static ed25519(privateKey, kid) {
+        if (!kid)
+            throw new Error('kid is required');
+        if (privateKey.asymmetricKeyType !== 'ed25519') {
+            throw new Error(`private key must be Ed25519 (got ${String(privateKey.asymmetricKeyType)})`);
+        }
+        // Round-trip through a JWK so the key flows through jose's own importJWK
+        // rather than an unchecked cast into jose's KeyLike union.
+        const jwk = privateKey.export({ format: 'jwk' });
+        return new ClientAssertionSigner(() => (0, jose_1.importJWK)(jwk, 'EdDSA'), kid, DEFAULT_LIFETIME_SECONDS);
+    }
+    /**
+     * Return a copy of this signer using `seconds` as the assertion lifetime
+     * (iat→exp). Clamped to [1, 120] (the OP maximum). Defaults to 60; most
+     * callers never need this.
+     */
+    withLifetimeSeconds(seconds) {
+        const clamped = Math.max(1, Math.min(MAX_LIFETIME_SECONDS, Math.floor(seconds)));
+        return new ClientAssertionSigner(this.importKeyFn, this.kid, clamped);
+    }
+    importKey() {
+        if (!this.keyPromise) {
+            // Don't memoise a rejection — a transient/structural import failure must
+            // not permanently poison the signer. Reset so the next sign() retries.
+            this.keyPromise = this.importKeyFn().catch((err) => {
+                this.keyPromise = undefined;
+                throw err;
+            });
+        }
+        return this.keyPromise;
+    }
+    /**
+     * Build and Ed25519-sign the `client_assertion` JWT for one token exchange.
+     *
+     * @param clientId - becomes `iss` and `sub` (RFC 7523 §3)
+     * @param audience - the OP's token endpoint, exactly as advertised in
+     *   discovery (the OP pins `aud` to that string)
+     */
+    async sign(clientId, audience) {
+        const key = await this.importKey();
+        return new jose_1.SignJWT({})
+            .setProtectedHeader({ alg: 'EdDSA', typ: 'JWT', kid: this.kid })
+            .setIssuer(clientId)
+            .setSubject(clientId)
+            .setAudience(audience)
+            .setIssuedAt()
+            .setExpirationTime(`${this.lifetimeSeconds}s`)
+            .setJti((0, node_crypto_1.randomUUID)())
+            .sign(key);
+    }
+}
+exports.ClientAssertionSigner = ClientAssertionSigner;
+function assertEd25519(key) {
+    // Node's importPKCS8 yields a KeyObject; reject non-Ed25519 with a clean message.
+    const type = key.asymmetricKeyType;
+    if (type !== undefined && type !== 'ed25519') {
+        throw new Error(`PEM key is not Ed25519 (got ${String(type)})`);
+    }
+}
+//# sourceMappingURL=client-assertion.js.map

package/dist/client-assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-assertion.js","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,6CAAyC;AAEzC,+BAAiE;AAKjE,qEAAqE;AACxD,QAAA,qBAAqB,GAChC,wDAAwD,CAAC;AAE3D,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,oBAAoB,GAAG,GAAG,CAAC,CAAC,qCAAqC;AAEvE,MAAa,qBAAqB;IAOhC,YACE,WAAuC,EACvC,GAAW,EACX,eAAuB;QAEvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,UAAwB;QAC5C,IAAI,GAAQ,CAAC;QACb,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAQ,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAgB,EAAE,GAAW;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,OAAO,IAAI,qBAAqB,CAC9B,KAAK,IAAI,EAAE;YACT,IAAI,GAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAA,kBAAW,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,GAAG,CAAC;QACb,CAAC,EACD,GAAG,EACH,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,UAAqB,EAAE,GAAW;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAC5E,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAQ,CAAC;QACxD,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACjG,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,OAAe;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,yEAAyE;YACzE,uEAAuE;YACvE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAC1D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC5B,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,QAAgB;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,OAAO,IAAI,cAAO,CAAC,EAAE,CAAC;aACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC/D,SAAS,CAAC,QAAQ,CAAC;aACnB,UAAU,CAAC,QAAQ,CAAC;aACpB,WAAW,CAAC,QAAQ,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,IAAI,CAAC,eAAe,GAAG,CAAC;aAC7C,MAAM,CAAC,IAAA,wBAAU,GAAE,CAAC;aACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;CACF;AAjID,sDAiIC;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,kFAAkF;IAClF,MAAM,IAAI,GAAI,GAA0B,CAAC,iBAAiB,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/delegation/hawcx.d.ts

@@ -42,12 +42,6 @@ export interface MfaVerifyOptions {
     /** One-time password entered by user (6 digits) */
     otp: string;
 }
-export interface UpdatePhoneOptions {
-    /** User identifier (userid or email) */
-    userId: string;
-    /** New phone number in E.164 format (e.g. "+14155551234"). Pass null to clear. */
-    newPhoneNumber: string | null;
-}
 export interface DeviceOperationOptions {
     /** User identifier (typically email address) */
     userId: string;
@@ -83,8 +77,6 @@ export declare class DelegationClient {
     };
     readonly users: {
         getCredentials: (userId: string) => Promise<JsonObject>;
-        getPhone: (userId: string) => Promise<JsonObject>;
-        updatePhone: (options: UpdatePhoneOptions) => Promise<JsonObject>;
     };
     readonly devices: {
         list: (userId: string) => Promise<JsonObject>;

package/dist/delegation/hawcx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hawcx.d.ts","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAuD,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGvG,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,qBAAqB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB,CAAC,QAAQ,SAAS,UAAU;IACnE,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,MAAM,CAAC,CAAS;IAExB,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE;QAAE,SAAS,EAAE,mBAAmB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAMzF,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,gCAAgC,GAAG,gBAAgB;IAMjF,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,gBAAgB;IAMtE,OAAO,CAAC,gBAAgB;IAQlB,OAAO,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EAC5D,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKhB,SAAgB,GAAG;4BACS,kBAAkB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAmC1C,gBAAgB,KAAG,OAAO,CAAC,UAAU,CAAC;MAkB9D;IAEF,SAAgB,KAAK;iCACY,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;2BAOlC,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;+BAOxB,kBAAkB,KAAG,OAAO,CAAC,UAAU,CAAC;MAUrE;IAEF,SAAgB,OAAO;uBACA,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;0BAOzB,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;4BAO1C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAO9C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;MAOpE;CACH"}
+{"version":3,"file":"hawcx.d.ts","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAuD,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGvG,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,qBAAqB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB,CAAC,QAAQ,SAAS,UAAU;IACnE,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,MAAM,CAAC,CAAS;IAExB,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE;QAAE,SAAS,EAAE,mBAAmB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAMzF,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,gCAAgC,GAAG,gBAAgB;IAMjF,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,gBAAgB;IAMtE,OAAO,CAAC,gBAAgB;IAQlB,OAAO,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EAC5D,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKhB,SAAgB,GAAG;4BACS,kBAAkB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAmC1C,gBAAgB,KAAG,OAAO,CAAC,UAAU,CAAC;MAkB9D;IAEF,SAAgB,KAAK;iCACY,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;MAO3D;IAEF,SAAgB,OAAO;uBACA,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;0BAOzB,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;4BAO1C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAO9C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;MAOpE;CACH"}

package/dist/delegation/hawcx.js

@@ -65,23 +65,6 @@ class DelegationClient {
                     payload,
                 });
             },
-            getPhone: async (userId) => {
-                const payload = { userid: userId };
-                return await this.request({
-                    endpoint: '/hc_auth/v5/management/users/phone',
-                    payload,
-                });
-            },
-            updatePhone: async (options) => {
-                const payload = {
-                    userid: options.userId,
-                    new_phone_number: options.newPhoneNumber,
-                };
-                return await this.request({
-                    endpoint: '/hc_auth/v5/management/users/phone',
-                    payload,
-                });
-            },
         };
         this.devices = {
             list: async (userId) => {

package/dist/delegation/hawcx.js.map

@@ -1 +1 @@
-{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,uCAAuG;AACvG,6CAAsD;AAEtD,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AAmED,MAAa,gBAAgB;IAM3B,YAAY,OAA6E;QAiCzE,QAAG,GAAG;YACpB,QAAQ,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhE,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAErE,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,mCAAsB,CAC9B,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;gBAED,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnD,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,YAAY;iBACzB,CAAC;gBAEF,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;gBAChC,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;gBACzC,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAAyB,EAAuB,EAAE;gBAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;gBAE3C,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,mCAAsB,CAAC,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,OAAO,GAAG;oBACd,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,SAAS;oBACrB,GAAG;iBACJ,CAAC;gBAEF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,UAAK,GAAG;YACtB,cAAc,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAC5D,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,8BAA8B;oBACxC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBACtD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,oCAAoC;oBAC9C,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,WAAW,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACtE,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,gBAAgB,EAAE,OAAO,CAAC,cAAc;iBACzC,CAAC;gBACF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,oCAAoC;oBAC9C,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,YAAO,GAAG;YACxB,IAAI,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,4BAA4B;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACvE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAhJA,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAyC;QAC5D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAEO,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAuC;QAEvC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAa,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;CAmHF;AAxJD,4CAwJC"}
+{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,uCAAuG;AACvG,6CAAsD;AAEtD,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AA4DD,MAAa,gBAAgB;IAM3B,YAAY,OAA6E;QAiCzE,QAAG,GAAG;YACpB,QAAQ,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhE,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAErE,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,mCAAsB,CAC9B,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;gBAED,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnD,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,YAAY;iBACzB,CAAC;gBAEF,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;gBAChC,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;gBACzC,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAAyB,EAAuB,EAAE;gBAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;gBAE3C,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,mCAAsB,CAAC,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,OAAO,GAAG;oBACd,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,SAAS;oBACrB,GAAG;iBACJ,CAAC;gBAEF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,UAAK,GAAG;YACtB,cAAc,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAC5D,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,8BAA8B;oBACxC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,YAAO,GAAG;YACxB,IAAI,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,4BAA4B;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACvE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QA/HA,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAyC;QAC5D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAEO,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAuC;QAEvC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAa,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;CAkGF;AAvID,4CAuIC"}

package/dist/delegation/index.d.ts

@@ -2,7 +2,7 @@
  * Hawcx OAuth Client SDK - Delegation Module
  */
 export { DelegationClient, MfaMethod, } from './hawcx';
-export type { DelegationClientBaseOptions, DelegationClientSecretKeyOptions, DelegationClientKeyOptions, MfaInitiateOptions, MfaVerifyOptions, UpdatePhoneOptions, DeviceOperationOptions, DelegationRequestOptions, } from './hawcx';
+export type { DelegationClientBaseOptions, DelegationClientSecretKeyOptions, DelegationClientKeyOptions, MfaInitiateOptions, MfaVerifyOptions, DeviceOperationOptions, DelegationRequestOptions, } from './hawcx';
 export { parseHawcxSecretKey, generateCredentialBlob, } from './credentials';
 export type { ParsedCredentials, HawcxCredentialBlob, } from './credentials';
 export { DelegationError, DelegationCryptoError, DelegationRequestError, DelegationResponseError, } from './exceptions';

package/dist/delegation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}

package/dist/delegation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,iCAGiB;AAFf,yGAAA,gBAAgB,OAAA;AAChB,kGAAA,SAAS,OAAA;AAaX,6CAGuB;AAFrB,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AAOxB,2CAKsB;AAJpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,iCAGiB;AAFf,yGAAA,gBAAgB,OAAA;AAChB,kGAAA,SAAS,OAAA;AAYX,6CAGuB;AAFrB,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AAOxB,2CAKsB;AAJpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA"}

package/dist/errors.d.ts

@@ -1,14 +1,62 @@
 /**
  * Hawcx OAuth Errors
  */
-export declare class HawcxOAuthError extends Error {
+/**
+ * Optional structured fields shared across the Hawcx OAuth error hierarchy.
+ * `error` is a stable machine-readable code callers can dispatch on (e.g.
+ * `'state_mismatch'`, `'state_missing'`, or an IdP-supplied OAuth error such as
+ * `'access_denied'`); `errorDescription` is the human-readable detail when one
+ * is available. Both are optional and never affect `.message`.
+ */
+export interface HawcxOAuthErrorFields {
+    /** Machine-readable error code (e.g. `'state_mismatch'`, `'access_denied'`). */
+    error?: string;
+    /** Human-readable error description, when one is available. */
+    errorDescription?: string;
+}
+/**
+ * Canonical root for every Hawcx SDK error, aligned with the Java/Python SDKs
+ * (`HawcxError`). Catch this to handle any SDK-originated failure.
+ */
+export declare class HawcxError extends Error {
     constructor(message: string);
 }
+/**
+ * Historical base, retained for back-compat. Now a subclass of {@link HawcxError};
+ * every SDK error is catchable via either. New code can catch `HawcxError`.
+ *
+ * Carries optional structured {@link HawcxOAuthErrorFields} (`error` /
+ * `errorDescription`) so callers can dispatch on a stable code without parsing
+ * `.message`. These are populated at the relevant raise sites and never alter
+ * the thrown message string.
+ */
+export declare class HawcxOAuthError extends HawcxError {
+    /** Machine-readable error code, when set at the raise site. */
+    readonly error?: string;
+    /** Human-readable error description, when available. */
+    readonly errorDescription?: string;
+    constructor(message: string, fields?: HawcxOAuthErrorFields);
+}
 export declare class TokenExchangeError extends HawcxOAuthError {
     readonly statusCode?: number;
-    constructor(message: string, statusCode?: number);
+    constructor(message: string, statusCode?: number, fields?: HawcxOAuthErrorFields);
 }
 export declare class TokenVerificationError extends HawcxOAuthError {
-    constructor(message: string);
+    constructor(message: string, fields?: HawcxOAuthErrorFields);
+}
+/**
+ * Thrown when OIDC discovery (`HawcxOAuth.fromIssuer`) cannot resolve a usable
+ * provider configuration — DNS / TLS / network failure, non-2xx response from
+ * `/.well-known/openid-configuration`, malformed JSON, or a discovery document
+ * missing required fields (`token_endpoint`, `jwks_uri`,
+ * `id_token_signing_alg_values_supported`).
+ *
+ * The original failure (when present) is attached as `cause`, so the full
+ * diagnostic stack survives.
+ */
+export declare class DiscoveryError extends HawcxOAuthError {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    } & HawcxOAuthErrorFields);
 }
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAKjD;AAED,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAM5D;AAED,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAKjF;AAED,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAI5D;AAED;;;;;;;;;GASG;AACH,qBAAa,cAAe,SAAQ,eAAe;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,qBAAqB;CAOnF"}