@hawcx/oauth-client 4.0.1 → 5.2.0

package/dist/client-assertion.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientAssertionSigner = exports.CLIENT_ASSERTION_TYPE = void 0;
+/**
+ * RFC 7523 / OIDC Core §9 `client_assertion` signer for the
+ * `private_key_jwt` token-endpoint authentication method.
+ *
+ * EdDSA over Ed25519 is the only algorithm the Hawcx OP accepts at the token
+ * endpoint, so it is the only one supported here. Obtain an instance via
+ * {@link ClientAssertionSigner.ed25519FromJwk} (or `ed25519FromPem` /
+ * `ed25519`) and attach it with `HawcxOAuth.withClientAssertion(signer)`.
+ *
+ * @beta This `private_key_jwt` surface is experimental and may change before
+ *   it is marked stable.
+ */
+const node_crypto_1 = require("node:crypto");
+const jose_1 = require("jose");
+/** RFC 7523 §2.2 assertion type for the `private_key_jwt` method. */
+exports.CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+const DEFAULT_LIFETIME_SECONDS = 60;
+const MAX_LIFETIME_SECONDS = 120; // OP cap (ASSERTION_MAX_TTL_SECONDS)
+class ClientAssertionSigner {
+    constructor(importKeyFn, kid, lifetimeSeconds) {
+        this.importKeyFn = importKeyFn;
+        this.kid = kid;
+        this.lifetimeSeconds = lifetimeSeconds;
+    }
+    /**
+     * Build a signer from an Ed25519 *private* JWK (RFC 8037):
+     * `{ kty: 'OKP', crv: 'Ed25519', d, x, kid }`. The `kid` is read from the
+     * JWK. This is the canonical Hawcx key format (what the admin console
+     * generates/downloads). Accepts either a JWK object or its JSON string.
+     */
+    static ed25519FromJwk(privateJwk) {
+        let jwk;
+        if (typeof privateJwk === 'string') {
+            try {
+                jwk = JSON.parse(privateJwk);
+            }
+            catch (err) {
+                throw new Error(`private JWK is not valid JSON: ${String(err)}`);
+            }
+        }
+        else {
+            jwk = privateJwk;
+        }
+        if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {
+            throw new Error(`client assertion key must be an Ed25519 OKP JWK (got kty=${String(jwk.kty)}, crv=${String(jwk.crv)})`);
+        }
+        if (typeof jwk.d !== 'string' || jwk.d.length === 0) {
+            throw new Error("client assertion JWK has no 'd' (not a private key)");
+        }
+        if (typeof jwk.kid !== 'string' || jwk.kid.length === 0) {
+            throw new Error("client assertion JWK is missing 'kid'");
+        }
+        const kid = jwk.kid;
+        return new ClientAssertionSigner(() => (0, jose_1.importJWK)(jwk, 'EdDSA'), kid, DEFAULT_LIFETIME_SECONDS);
+    }
+    /**
+     * Build a signer from a PKCS#8 PEM-encoded Ed25519 private key plus its `kid`.
+     * The key type is validated (must be Ed25519) on first use.
+     */
+    static ed25519FromPem(pkcs8Pem, kid) {
+        if (!kid)
+            throw new Error('kid is required');
+        return new ClientAssertionSigner(async () => {
+            let key;
+            try {
+                key = await (0, jose_1.importPKCS8)(pkcs8Pem, 'EdDSA');
+            }
+            catch (err) {
+                throw new Error(`not a valid PKCS#8 PEM private key: ${String(err)}`);
+            }
+            assertEd25519(key);
+            return key;
+        }, kid, DEFAULT_LIFETIME_SECONDS);
+    }
+    /**
+     * Build a signer from an already-loaded Ed25519 private `KeyObject`
+     * (e.g. from `crypto.createPrivateKey(...)`) plus its `kid`.
+     */
+    static ed25519(privateKey, kid) {
+        if (!kid)
+            throw new Error('kid is required');
+        if (privateKey.asymmetricKeyType !== 'ed25519') {
+            throw new Error(`private key must be Ed25519 (got ${String(privateKey.asymmetricKeyType)})`);
+        }
+        // Round-trip through a JWK so the key flows through jose's own importJWK
+        // rather than an unchecked cast into jose's KeyLike union.
+        const jwk = privateKey.export({ format: 'jwk' });
+        return new ClientAssertionSigner(() => (0, jose_1.importJWK)(jwk, 'EdDSA'), kid, DEFAULT_LIFETIME_SECONDS);
+    }
+    /**
+     * Return a copy of this signer using `seconds` as the assertion lifetime
+     * (iat→exp). Clamped to [1, 120] (the OP maximum). Defaults to 60; most
+     * callers never need this.
+     */
+    withLifetimeSeconds(seconds) {
+        const clamped = Math.max(1, Math.min(MAX_LIFETIME_SECONDS, Math.floor(seconds)));
+        return new ClientAssertionSigner(this.importKeyFn, this.kid, clamped);
+    }
+    importKey() {
+        if (!this.keyPromise) {
+            // Don't memoise a rejection — a transient/structural import failure must
+            // not permanently poison the signer. Reset so the next sign() retries.
+            this.keyPromise = this.importKeyFn().catch((err) => {
+                this.keyPromise = undefined;
+                throw err;
+            });
+        }
+        return this.keyPromise;
+    }
+    /**
+     * Build and Ed25519-sign the `client_assertion` JWT for one token exchange.
+     *
+     * @param clientId - becomes `iss` and `sub` (RFC 7523 §3)
+     * @param audience - the OP's token endpoint, exactly as advertised in
+     *   discovery (the OP pins `aud` to that string)
+     */
+    async sign(clientId, audience) {
+        const key = await this.importKey();
+        return new jose_1.SignJWT({})
+            .setProtectedHeader({ alg: 'EdDSA', typ: 'JWT', kid: this.kid })
+            .setIssuer(clientId)
+            .setSubject(clientId)
+            .setAudience(audience)
+            .setIssuedAt()
+            .setExpirationTime(`${this.lifetimeSeconds}s`)
+            .setJti((0, node_crypto_1.randomUUID)())
+            .sign(key);
+    }
+}
+exports.ClientAssertionSigner = ClientAssertionSigner;
+function assertEd25519(key) {
+    // Node's importPKCS8 yields a KeyObject; reject non-Ed25519 with a clean message.
+    const type = key.asymmetricKeyType;
+    if (type !== undefined && type !== 'ed25519') {
+        throw new Error(`PEM key is not Ed25519 (got ${String(type)})`);
+    }
+}
+//# sourceMappingURL=client-assertion.js.map

package/dist/client-assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-assertion.js","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,6CAAyC;AAEzC,+BAAiE;AAKjE,qEAAqE;AACxD,QAAA,qBAAqB,GAChC,wDAAwD,CAAC;AAE3D,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,oBAAoB,GAAG,GAAG,CAAC,CAAC,qCAAqC;AAEvE,MAAa,qBAAqB;IAOhC,YACE,WAAuC,EACvC,GAAW,EACX,eAAuB;QAEvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,UAAwB;QAC5C,IAAI,GAAQ,CAAC;QACb,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAQ,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAgB,EAAE,GAAW;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,OAAO,IAAI,qBAAqB,CAC9B,KAAK,IAAI,EAAE;YACT,IAAI,GAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAA,kBAAW,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,GAAG,CAAC;QACb,CAAC,EACD,GAAG,EACH,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,UAAqB,EAAE,GAAW;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAC5E,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAQ,CAAC;QACxD,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACjG,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,OAAe;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,yEAAyE;YACzE,uEAAuE;YACvE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAC1D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC5B,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,QAAgB;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,OAAO,IAAI,cAAO,CAAC,EAAE,CAAC;aACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC/D,SAAS,CAAC,QAAQ,CAAC;aACnB,UAAU,CAAC,QAAQ,CAAC;aACpB,WAAW,CAAC,QAAQ,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,IAAI,CAAC,eAAe,GAAG,CAAC;aAC7C,MAAM,CAAC,IAAA,wBAAU,GAAE,CAAC;aACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;CACF;AAjID,sDAiIC;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,kFAAkF;IAClF,MAAM,IAAI,GAAI,GAA0B,CAAC,iBAAiB,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/delegation/hawcx.d.ts

@@ -42,12 +42,6 @@ export interface MfaVerifyOptions {
     /** One-time password entered by user (6 digits) */
     otp: string;
 }
-export interface UpdatePhoneOptions {
-    /** User identifier (userid or email) */
-    userId: string;
-    /** New phone number in E.164 format (e.g. "+14155551234"). Pass null to clear. */
-    newPhoneNumber: string | null;
-}
 export interface DeviceOperationOptions {
     /** User identifier (typically email address) */
     userId: string;
@@ -83,8 +77,6 @@ export declare class DelegationClient {
     };
     readonly users: {
         getCredentials: (userId: string) => Promise<JsonObject>;
-        getPhone: (userId: string) => Promise<JsonObject>;
-        updatePhone: (options: UpdatePhoneOptions) => Promise<JsonObject>;
     };
     readonly devices: {
         list: (userId: string) => Promise<JsonObject>;

package/dist/delegation/hawcx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hawcx.d.ts","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAuD,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGvG,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,qBAAqB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB,CAAC,QAAQ,SAAS,UAAU;IACnE,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,MAAM,CAAC,CAAS;IAExB,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE;QAAE,SAAS,EAAE,mBAAmB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAMzF,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,gCAAgC,GAAG,gBAAgB;IAMjF,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,gBAAgB;IAMtE,OAAO,CAAC,gBAAgB;IAQlB,OAAO,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EAC5D,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKhB,SAAgB,GAAG;4BACS,kBAAkB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAmC1C,gBAAgB,KAAG,OAAO,CAAC,UAAU,CAAC;MAkB9D;IAEF,SAAgB,KAAK;iCACY,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;2BAOlC,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;+BAOxB,kBAAkB,KAAG,OAAO,CAAC,UAAU,CAAC;MAUrE;IAEF,SAAgB,OAAO;uBACA,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;0BAOzB,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;4BAO1C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAO9C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;MAOpE;CACH"}
+{"version":3,"file":"hawcx.d.ts","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAuD,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGvG,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,qBAAqB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB,CAAC,QAAQ,SAAS,UAAU;IACnE,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,MAAM,CAAC,CAAS;IAExB,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE;QAAE,SAAS,EAAE,mBAAmB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAMzF,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,gCAAgC,GAAG,gBAAgB;IAMjF,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,gBAAgB;IAMtE,OAAO,CAAC,gBAAgB;IAQlB,OAAO,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EAC5D,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKhB,SAAgB,GAAG;4BACS,kBAAkB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAmC1C,gBAAgB,KAAG,OAAO,CAAC,UAAU,CAAC;MAkB9D;IAEF,SAAgB,KAAK;iCACY,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;MAO3D;IAEF,SAAgB,OAAO;uBACA,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;0BAOzB,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;4BAO1C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAO9C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;MAOpE;CACH"}

package/dist/delegation/hawcx.js

@@ -65,23 +65,6 @@ class DelegationClient {
                     payload,
                 });
             },
-            getPhone: async (userId) => {
-                const payload = { userid: userId };
-                return await this.request({
-                    endpoint: '/hc_auth/v5/management/users/phone',
-                    payload,
-                });
-            },
-            updatePhone: async (options) => {
-                const payload = {
-                    userid: options.userId,
-                    new_phone_number: options.newPhoneNumber,
-                };
-                return await this.request({
-                    endpoint: '/hc_auth/v5/management/users/phone',
-                    payload,
-                });
-            },
         };
         this.devices = {
             list: async (userId) => {

package/dist/delegation/hawcx.js.map

@@ -1 +1 @@
-{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,uCAAuG;AACvG,6CAAsD;AAEtD,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AAmED,MAAa,gBAAgB;IAM3B,YAAY,OAA6E;QAiCzE,QAAG,GAAG;YACpB,QAAQ,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhE,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAErE,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,mCAAsB,CAC9B,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;gBAED,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnD,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,YAAY;iBACzB,CAAC;gBAEF,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;gBAChC,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;gBACzC,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAAyB,EAAuB,EAAE;gBAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;gBAE3C,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,mCAAsB,CAAC,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,OAAO,GAAG;oBACd,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,SAAS;oBACrB,GAAG;iBACJ,CAAC;gBAEF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,UAAK,GAAG;YACtB,cAAc,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAC5D,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,8BAA8B;oBACxC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBACtD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,oCAAoC;oBAC9C,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,WAAW,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACtE,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,gBAAgB,EAAE,OAAO,CAAC,cAAc;iBACzC,CAAC;gBACF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,oCAAoC;oBAC9C,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,YAAO,GAAG;YACxB,IAAI,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,4BAA4B;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACvE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAhJA,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAyC;QAC5D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAEO,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAuC;QAEvC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAa,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;CAmHF;AAxJD,4CAwJC"}
+{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,uCAAuG;AACvG,6CAAsD;AAEtD,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AA4DD,MAAa,gBAAgB;IAM3B,YAAY,OAA6E;QAiCzE,QAAG,GAAG;YACpB,QAAQ,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhE,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAErE,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,mCAAsB,CAC9B,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;gBAED,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnD,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,YAAY;iBACzB,CAAC;gBAEF,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;gBAChC,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;gBACzC,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAAyB,EAAuB,EAAE;gBAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;gBAE3C,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,mCAAsB,CAAC,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,OAAO,GAAG;oBACd,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,SAAS;oBACrB,GAAG;iBACJ,CAAC;gBAEF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,UAAK,GAAG;YACtB,cAAc,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAC5D,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,8BAA8B;oBACxC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,YAAO,GAAG;YACxB,IAAI,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,4BAA4B;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACvE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QA/HA,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAyC;QAC5D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAEO,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAuC;QAEvC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAa,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;CAkGF;AAvID,4CAuIC"}

package/dist/delegation/index.d.ts

@@ -2,7 +2,7 @@
  * Hawcx OAuth Client SDK - Delegation Module
  */
 export { DelegationClient, MfaMethod, } from './hawcx';
-export type { DelegationClientBaseOptions, DelegationClientSecretKeyOptions, DelegationClientKeyOptions, MfaInitiateOptions, MfaVerifyOptions, UpdatePhoneOptions, DeviceOperationOptions, DelegationRequestOptions, } from './hawcx';
+export type { DelegationClientBaseOptions, DelegationClientSecretKeyOptions, DelegationClientKeyOptions, MfaInitiateOptions, MfaVerifyOptions, DeviceOperationOptions, DelegationRequestOptions, } from './hawcx';
 export { parseHawcxSecretKey, generateCredentialBlob, } from './credentials';
 export type { ParsedCredentials, HawcxCredentialBlob, } from './credentials';
 export { DelegationError, DelegationCryptoError, DelegationRequestError, DelegationResponseError, } from './exceptions';

package/dist/delegation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}

package/dist/delegation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,iCAGiB;AAFf,yGAAA,gBAAgB,OAAA;AAChB,kGAAA,SAAS,OAAA;AAaX,6CAGuB;AAFrB,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AAOxB,2CAKsB;AAJpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,iCAGiB;AAFf,yGAAA,gBAAgB,OAAA;AAChB,kGAAA,SAAS,OAAA;AAYX,6CAGuB;AAFrB,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AAOxB,2CAKsB;AAJpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA"}

package/dist/errors.d.ts

@@ -1,14 +1,62 @@
 /**
  * Hawcx OAuth Errors
  */
-export declare class HawcxOAuthError extends Error {
+/**
+ * Optional structured fields shared across the Hawcx OAuth error hierarchy.
+ * `error` is a stable machine-readable code callers can dispatch on (e.g.
+ * `'state_mismatch'`, `'state_missing'`, or an IdP-supplied OAuth error such as
+ * `'access_denied'`); `errorDescription` is the human-readable detail when one
+ * is available. Both are optional and never affect `.message`.
+ */
+export interface HawcxOAuthErrorFields {
+    /** Machine-readable error code (e.g. `'state_mismatch'`, `'access_denied'`). */
+    error?: string;
+    /** Human-readable error description, when one is available. */
+    errorDescription?: string;
+}
+/**
+ * Canonical root for every Hawcx SDK error, aligned with the Java/Python SDKs
+ * (`HawcxError`). Catch this to handle any SDK-originated failure.
+ */
+export declare class HawcxError extends Error {
     constructor(message: string);
 }
+/**
+ * Historical base, retained for back-compat. Now a subclass of {@link HawcxError};
+ * every SDK error is catchable via either. New code can catch `HawcxError`.
+ *
+ * Carries optional structured {@link HawcxOAuthErrorFields} (`error` /
+ * `errorDescription`) so callers can dispatch on a stable code without parsing
+ * `.message`. These are populated at the relevant raise sites and never alter
+ * the thrown message string.
+ */
+export declare class HawcxOAuthError extends HawcxError {
+    /** Machine-readable error code, when set at the raise site. */
+    readonly error?: string;
+    /** Human-readable error description, when available. */
+    readonly errorDescription?: string;
+    constructor(message: string, fields?: HawcxOAuthErrorFields);
+}
 export declare class TokenExchangeError extends HawcxOAuthError {
     readonly statusCode?: number;
-    constructor(message: string, statusCode?: number);
+    constructor(message: string, statusCode?: number, fields?: HawcxOAuthErrorFields);
 }
 export declare class TokenVerificationError extends HawcxOAuthError {
-    constructor(message: string);
+    constructor(message: string, fields?: HawcxOAuthErrorFields);
+}
+/**
+ * Thrown when OIDC discovery (`HawcxOAuth.fromIssuer`) cannot resolve a usable
+ * provider configuration — DNS / TLS / network failure, non-2xx response from
+ * `/.well-known/openid-configuration`, malformed JSON, or a discovery document
+ * missing required fields (`token_endpoint`, `jwks_uri`,
+ * `id_token_signing_alg_values_supported`).
+ *
+ * The original failure (when present) is attached as `cause`, so the full
+ * diagnostic stack survives.
+ */
+export declare class DiscoveryError extends HawcxOAuthError {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    } & HawcxOAuthErrorFields);
 }
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAKjD;AAED,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,UAAU;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAM5D;AAED,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAKjF;AAED,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB;CAI5D;AAED;;;;;;;;;GASG;AACH,qBAAa,cAAe,SAAQ,eAAe;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,qBAAqB;CAOnF"}

package/dist/errors.js

@@ -3,27 +3,71 @@
  * Hawcx OAuth Errors
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenVerificationError = exports.TokenExchangeError = exports.HawcxOAuthError = void 0;
-class HawcxOAuthError extends Error {
+exports.DiscoveryError = exports.TokenVerificationError = exports.TokenExchangeError = exports.HawcxOAuthError = exports.HawcxError = void 0;
+/**
+ * Canonical root for every Hawcx SDK error, aligned with the Java/Python SDKs
+ * (`HawcxError`). Catch this to handle any SDK-originated failure.
+ */
+class HawcxError extends Error {
     constructor(message) {
+        super(message);
+        this.name = 'HawcxError';
+    }
+}
+exports.HawcxError = HawcxError;
+/**
+ * Historical base, retained for back-compat. Now a subclass of {@link HawcxError};
+ * every SDK error is catchable via either. New code can catch `HawcxError`.
+ *
+ * Carries optional structured {@link HawcxOAuthErrorFields} (`error` /
+ * `errorDescription`) so callers can dispatch on a stable code without parsing
+ * `.message`. These are populated at the relevant raise sites and never alter
+ * the thrown message string.
+ */
+class HawcxOAuthError extends HawcxError {
+    constructor(message, fields) {
         super(message);
         this.name = 'HawcxOAuthError';
+        if (fields?.error !== undefined)
+            this.error = fields.error;
+        if (fields?.errorDescription !== undefined)
+            this.errorDescription = fields.errorDescription;
     }
 }
 exports.HawcxOAuthError = HawcxOAuthError;
 class TokenExchangeError extends HawcxOAuthError {
-    constructor(message, statusCode) {
-        super(message);
+    constructor(message, statusCode, fields) {
+        super(message, fields);
         this.name = 'TokenExchangeError';
         this.statusCode = statusCode;
     }
 }
 exports.TokenExchangeError = TokenExchangeError;
 class TokenVerificationError extends HawcxOAuthError {
-    constructor(message) {
-        super(message);
+    constructor(message, fields) {
+        super(message, fields);
         this.name = 'TokenVerificationError';
     }
 }
 exports.TokenVerificationError = TokenVerificationError;
+/**
+ * Thrown when OIDC discovery (`HawcxOAuth.fromIssuer`) cannot resolve a usable
+ * provider configuration — DNS / TLS / network failure, non-2xx response from
+ * `/.well-known/openid-configuration`, malformed JSON, or a discovery document
+ * missing required fields (`token_endpoint`, `jwks_uri`,
+ * `id_token_signing_alg_values_supported`).
+ *
+ * The original failure (when present) is attached as `cause`, so the full
+ * diagnostic stack survives.
+ */
+class DiscoveryError extends HawcxOAuthError {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'DiscoveryError';
+        if (options?.cause !== undefined) {
+            this.cause = options.cause;
+        }
+    }
+}
+exports.DiscoveryError = DiscoveryError;
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AALD,0CAKC;AAED,MAAa,kBAAmB,SAAQ,eAAe;IAGrD,YAAY,OAAe,EAAE,UAAmB;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AARD,gDAQC;AAED,MAAa,sBAAuB,SAAQ,eAAe;IACzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAgBH;;;GAGG;AACH,MAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AALD,gCAKC;AAED;;;;;;;;GAQG;AACH,MAAa,eAAgB,SAAQ,UAAU;IAM7C,YAAY,OAAe,EAAE,MAA8B;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3D,IAAI,MAAM,EAAE,gBAAgB,KAAK,SAAS;YAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAC9F,CAAC;CACF;AAZD,0CAYC;AAED,MAAa,kBAAmB,SAAQ,eAAe;IAGrD,YAAY,OAAe,EAAE,UAAmB,EAAE,MAA8B;QAC9E,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AARD,gDAQC;AAED,MAAa,sBAAuB,SAAQ,eAAe;IACzD,YAAY,OAAe,EAAE,MAA8B;QACzD,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED;;;;;;;;;GASG;AACH,MAAa,cAAe,SAAQ,eAAe;IACjD,YAAY,OAAe,EAAE,OAAqD;QAChF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAA4B,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACtD,CAAC;IACH,CAAC;CACF;AARD,wCAQC"}

package/dist/index.d.ts

@@ -13,9 +13,11 @@
  * ```
  */
 export { HawcxOAuth } from './oauth';
-export type { HawcxOAuthConfig, ExchangeResult, JwtClaims } from './oauth';
-export { HawcxOAuthError, TokenExchangeError, TokenVerificationError } from './errors';
+export type { HawcxOAuthConfig, HawcxOAuthIssuerConfig, ExchangeResult, JwtClaims, DiscoveryMetadata, VerifyTokenOptions, } from './oauth';
+export { HawcxError, HawcxOAuthError, TokenExchangeError, TokenVerificationError, DiscoveryError, } from './errors';
+export type { HawcxOAuthErrorFields } from './errors';
+export { ClientAssertionSigner, CLIENT_ASSERTION_TYPE } from './client-assertion';
 export * from './delegation';
 export * from './stepup';
-export declare const VERSION = "4.0.1";
+export declare const VERSION = "5.2.0";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAGvF,cAAc,cAAc,CAAC;AAG7B,cAAc,UAAU,CAAC;AAEzB,eAAO,MAAM,OAAO,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGlF,cAAc,cAAc,CAAC;AAG7B,cAAc,UAAU,CAAC;AAEzB,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/index.js

@@ -28,16 +28,21 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VERSION = exports.TokenVerificationError = exports.TokenExchangeError = exports.HawcxOAuthError = exports.HawcxOAuth = void 0;
+exports.VERSION = exports.CLIENT_ASSERTION_TYPE = exports.ClientAssertionSigner = exports.DiscoveryError = exports.TokenVerificationError = exports.TokenExchangeError = exports.HawcxOAuthError = exports.HawcxError = exports.HawcxOAuth = void 0;
 var oauth_1 = require("./oauth");
 Object.defineProperty(exports, "HawcxOAuth", { enumerable: true, get: function () { return oauth_1.HawcxOAuth; } });
 var errors_1 = require("./errors");
+Object.defineProperty(exports, "HawcxError", { enumerable: true, get: function () { return errors_1.HawcxError; } });
 Object.defineProperty(exports, "HawcxOAuthError", { enumerable: true, get: function () { return errors_1.HawcxOAuthError; } });
 Object.defineProperty(exports, "TokenExchangeError", { enumerable: true, get: function () { return errors_1.TokenExchangeError; } });
 Object.defineProperty(exports, "TokenVerificationError", { enumerable: true, get: function () { return errors_1.TokenVerificationError; } });
+Object.defineProperty(exports, "DiscoveryError", { enumerable: true, get: function () { return errors_1.DiscoveryError; } });
+var client_assertion_1 = require("./client-assertion");
+Object.defineProperty(exports, "ClientAssertionSigner", { enumerable: true, get: function () { return client_assertion_1.ClientAssertionSigner; } });
+Object.defineProperty(exports, "CLIENT_ASSERTION_TYPE", { enumerable: true, get: function () { return client_assertion_1.CLIENT_ASSERTION_TYPE; } });
 // Delegation module
 __exportStar(require("./delegation"), exports);
 // Step-up module
 __exportStar(require("./stepup"), exports);
-exports.VERSION = '4.0.1';
+exports.VERSION = '5.2.0';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;AAEH,iCAAqC;AAA5B,mGAAA,UAAU,OAAA;AAEnB,mCAAuF;AAA9E,yGAAA,eAAe,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAAE,gHAAA,sBAAsB,OAAA;AAEpE,oBAAoB;AACpB,+CAA6B;AAE7B,iBAAiB;AACjB,2CAAyB;AAEZ,QAAA,OAAO,GAAG,OAAO,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;AAEH,iCAAqC;AAA5B,mGAAA,UAAU,OAAA;AASnB,mCAMkB;AALhB,oGAAA,UAAU,OAAA;AACV,yGAAA,eAAe,OAAA;AACf,4GAAA,kBAAkB,OAAA;AAClB,gHAAA,sBAAsB,OAAA;AACtB,wGAAA,cAAc,OAAA;AAIhB,uDAAkF;AAAzE,yHAAA,qBAAqB,OAAA;AAAE,yHAAA,qBAAqB,OAAA;AAErD,oBAAoB;AACpB,+CAA6B;AAE7B,iBAAiB;AACjB,2CAAyB;AAEZ,QAAA,OAAO,GAAG,OAAO,CAAC"}

package/dist/management/jwt_transport.d.ts

@@ -0,0 +1,109 @@
+/**
+ * JWT-bearer transport for the Hawcx management API (Path A: private_key_jwt).
+ *
+ * Each request is authenticated with a per-request EdDSA JWT whose `aud` is
+ * the full request URL, carrying a `body_sha256` claim over the EXACT bytes
+ * sent.  This mirrors the wire contract verified end-to-end against hx_auth
+ * (see spec.md §management-api-auth / Python SDK Path A implementation).
+ *
+ * Construction:
+ *   const transport = new JwtBearerTransport({
+ *     baseUrl: 'https://api.hawcx.com',
+ *     configId: 'your-config-id',
+ *     clientId: 'your-client-id',
+ *     oidcSigningKey: pkcs8Pem,   // Ed25519 PKCS#8 PEM — same key registered in admin console
+ *     kid: 'key-id',
+ *   });
+ *
+ * The `http` constructor option accepts an injectable fetch-compatible function
+ * (same signature as the global `fetch`) for testing.
+ */
+import { type JWK } from 'jose';
+import type { KeyLike } from 'jose';
+import type { JsonObject } from '../delegation/transport';
+/**
+ * A fetch-compatible callable — accepts `(url: string, init: RequestInit)`
+ * and returns a `Promise<Response>`.  Mirrors the global `fetch` signature so
+ * the real `fetch` can be passed unchanged.
+ */
+export type HttpFetch = (url: string, init: RequestInit) => Promise<Response>;
+export interface JwtBearerTransportOptions {
+    /** Base URL of the management API, e.g. `https://api.hawcx.com` */
+    baseUrl: string;
+    /** Tenant config identifier; forwarded as `X-Config-Id`. */
+    configId: string;
+    /**
+     * Ed25519 private signing key.  Accepts:
+     *   - PKCS#8 PEM string (e.g. `"-----BEGIN PRIVATE KEY-----\n…"`)
+     *   - JWK object `{ kty:'OKP', crv:'Ed25519', d, x, kid? }`
+     *   - jose `KeyLike` / `CryptoKey` already imported
+     */
+    oidcSigningKey: string | JWK | KeyLike;
+    /** Key ID embedded in the JWT `kid` header. */
+    kid: string;
+    /** OAuth client ID; used as both `iss` and `sub` in the per-request JWT. */
+    clientId: string;
+    /**
+     * JWT time-to-live in seconds (default: 60).  The server rejects tokens
+     * older than its configured TTL; do not set this above 120.
+     */
+    jwtTtlSeconds?: number;
+    /**
+     * Per-request timeout in seconds (default: 15).  A stalled
+     * (connected-but-silent) server would otherwise hang the call forever and
+     * can exhaust connection pools server-side.  Mirrors the ECIES
+     * `DelegationTransport`'s 15s `AbortController`.
+     */
+    timeoutSeconds?: number;
+    /**
+     * Injectable fetch implementation.  Defaults to the global `fetch`
+     * (Node >= 18).  Pass a capturing fake in tests.
+     */
+    http?: HttpFetch;
+}
+/**
+ * Drop-in transport for the management API that authenticates via a per-request
+ * EdDSA JWT (`private_key_jwt`, Path A).
+ *
+ * The `send` method has the same name and signature as `DelegationTransport.send`
+ * so the factory can swap transports behind `StepUpClient` without any change to
+ * the business-method layer.
+ */
+export declare class JwtBearerTransport {
+    private readonly baseUrl;
+    private readonly configId;
+    private readonly kid;
+    private readonly clientId;
+    private readonly jwtTtlSeconds;
+    private readonly timeoutMs;
+    private readonly http;
+    /** Lazily-imported (and memoised) signing key. */
+    private keyPromise?;
+    private readonly importKeyFn;
+    constructor(options: JwtBearerTransportOptions);
+    private importKey;
+    /**
+     * Mint a per-request EdDSA JWT.
+     *
+     * @param audience - full request URL (`baseUrl + endpoint`), pinned per-call
+     * @param bodySha256 - base64url (no-padding) of SHA-256 over the exact body bytes
+     */
+    private mintJwt;
+    /**
+     * Send an authenticated POST to `endpoint` with `payload` serialised as JSON.
+     *
+     * Matches the signature of `DelegationTransport.send` so the two transports
+     * are drop-in substitutes behind `StepUpClient`.
+     *
+     * @param options.endpoint - API path, e.g. `/v1/management/stepup/start-token`
+     * @param options.payload  - request body; serialised once and hashed; the
+     *   EXACT same bytes are sent and hashed — no double-serialisation.
+     * @param options.headers  - optional extra headers merged last (win over built-ins)
+     */
+    send<TReq extends JsonObject, TRes extends JsonObject>(options: {
+        endpoint: string;
+        payload: TReq;
+        headers?: Record<string, string>;
+    }): Promise<TRes>;
+}
+//# sourceMappingURL=jwt_transport.d.ts.map

package/dist/management/jwt_transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt_transport.d.ts","sourceRoot":"","sources":["../../src/management/jwt_transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAAmC,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAK1D;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE9E,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC;IACvC,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAY;IAEjC,kDAAkD;IAClD,OAAO,CAAC,UAAU,CAAC,CAAuB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;gBAE7C,OAAO,EAAE,yBAAyB;IAyB9C,OAAO,CAAC,SAAS;IAajB;;;;;OAKG;YACW,OAAO;IAiBrB;;;;;;;;;;OAUG;IACG,IAAI,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EAAE,OAAO,EAAE;QACpE,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,IAAI,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,IAAI,CAAC;CAiFlB"}