@hawcx/oauth-client 4.0.1 → 5.2.0

package/dist/oauth.js

@@ -2,64 +2,322 @@
 /**
  * Hawcx OAuth Client
  *
- * Simple, clean implementation using the jose library for JWT verification.
+ * Two construction paths:
+ *
+ *   1. OIDC discovery (recommended) — `HawcxOAuth.fromIssuer(...)` fetches
+ *      `<issuer>/.well-known/openid-configuration` once at startup and wires
+ *      up a verifier that enforces signature + iss + aud + exp + nbf on every
+ *      subsequent `verifyToken` call.
+ *
+ *   2. Legacy — `new HawcxOAuth({ configId, baseUrl })` hits the fixed
+ *      endpoints `/oauth2/token` and `/keys` directly. Backward-compatible
+ *      with v4.x callers, but does NOT verify `iss` or `aud` — the JWT's
+ *      signature is the only check.
+ *
+ * Both modes are safe to share across requests.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HawcxOAuth = void 0;
 const jose_1 = require("jose");
+const client_assertion_1 = require("./client-assertion");
 const errors_1 = require("./errors");
 const DEFAULT_BASE_URL = 'https://api.hawcx.com';
+const DEFAULT_TIMEOUT_MS = 10000;
+/** Bound the discovery fetch so an unreachable issuer fails fast at startup. */
+const DEFAULT_DISCOVERY_TIMEOUT_MS = 5000;
+/**
+ * Spec.md §3.3 recommends a default clock-tolerance of 10 seconds for
+ * `exp` / `nbf` checks during JWT verification. Without it jose defaults
+ * to 0 and tokens minted under normal NTP drift between issuer and verifier
+ * fail at the very first millisecond — the symptom that drove the
+ * `exchangeCodeTolerant` workaround in hawcx_admin_console pre-5.0.
+ */
+const DEFAULT_CLOCK_TOLERANCE_SECONDS = 10;
+/**
+ * Closed id_token signing-algorithm allowlist (spec.md §3.3). Algorithms
+ * outside this set — including HS256 and the rest of the symmetric family,
+ * RS512, PS*, none — are refused even if a Hawcx issuer advertises them.
+ * Mirrors {@code JwtVerifier.DEFAULT_ALGORITHMS} in the Java SDK.
+ */
+const DEFAULT_ID_TOKEN_ALGS = Object.freeze([
+    'RS256',
+    'ES256',
+    'ES384',
+    'ES512',
+    'EdDSA',
+]);
+/**
+ * Require https on a discovery-related URL. Plaintext http is permitted only
+ * for loopback hosts (localhost / 127.0.0.1 / ::1) to support local dev and
+ * tests. OIDC Discovery §4 / OAuth 2.1 §7.4: an http issuer lets an on-path
+ * attacker swap the discovery doc and redirect token_endpoint / jwks_uri.
+ */
+function requireSecureUrl(label, url) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch (err) {
+        throw new errors_1.DiscoveryError(`${label} is not a valid URL: ${url}`, { cause: err });
+    }
+    if (u.protocol === 'https:')
+        return;
+    const loopback = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '::1' || u.hostname === '[::1]';
+    if (u.protocol === 'http:' && loopback)
+        return;
+    throw new errors_1.DiscoveryError(`${label} must use https (got: ${url}). Plaintext http is permitted only for loopback hosts.`);
+}
 /**
  * Hawcx OAuth Client
  *
- * Handles code exchange and JWT verification using the jose library.
+ * Discovery-mode usage (recommended):
  *
- * @example
  * ```typescript
- * const oauth = new HawcxOAuth({ configId: 'your-api-key' });
- *
- * // Exchange authorization code for tokens
+ * const oauth = await HawcxOAuth.fromIssuer({
+ *   issuer: 'https://api.hawcx.com',
+ *   configId: process.env.HAWCX_CONFIG_ID!,
+ *   clientId: process.env.HAWCX_CLIENT_ID!,
+ * });
  * const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
- * console.log(claims.sub); // user ID
+ * ```
+ *
+ * Legacy usage (no discovery; aud/iss are not checked):
  *
- * // Later, verify an existing token
- * const claims = await oauth.verifyToken(idToken);
+ * ```typescript
+ * const oauth = new HawcxOAuth({ configId: process.env.HAWCX_CONFIG_ID! });
+ * const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
  * ```
  */
 class HawcxOAuth {
-    constructor(config) {
+    constructor(config, discoveryInit) {
         this.jwks = null;
+        this.clearCacheWarned = false;
         if (!config.configId) {
             throw new Error('configId is required');
         }
         this.configId = config.configId;
-        this.baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, '');
-        this.timeout = config.timeout ?? 10000;
+        this.timeout = config.timeout ?? DEFAULT_TIMEOUT_MS;
+        this.clockToleranceSeconds =
+            config.clockToleranceSeconds ?? DEFAULT_CLOCK_TOLERANCE_SECONDS;
+        if (discoveryInit) {
+            this.tokenEndpoint = discoveryInit.metadata.token_endpoint;
+            this.jwksUrl = discoveryInit.metadata.jwks_uri;
+            this.expectedAudience = discoveryInit.clientId;
+            this.expectedIssuer = discoveryInit.metadata.issuer;
+            this.discoveryMetadata = discoveryInit.metadata;
+            this.allowedAlgorithms = discoveryInit.allowedAlgorithms;
+            this.clientAssertionSigner = discoveryInit.signer ?? null;
+        }
+        else {
+            const baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, '');
+            this.tokenEndpoint = `${baseUrl}/oauth2/token`;
+            this.jwksUrl = `${baseUrl}/keys`;
+            this.expectedAudience = null;
+            this.expectedIssuer = null;
+            this.discoveryMetadata = null;
+            this.allowedAlgorithms = null;
+            this.clientAssertionSigner = null;
+        }
+    }
+    /**
+     * Construct a client via OIDC discovery.
+     *
+     * Fetches `<issuer>/.well-known/openid-configuration`, reads the token
+     * endpoint, JWKS URI, and supported id_token signing algorithm, and wires
+     * a verifier that enforces signature + `iss` + `aud` + `exp` + `nbf` on
+     * subsequent {@link verifyToken} calls.
+     *
+     * **Discovery is bounded** at `discoveryTimeout` ms (default 5000) so an
+     * unreachable issuer fails fast with {@link DiscoveryError} rather than
+     * hanging your bootstrap.
+     *
+     * @throws {DiscoveryError} if discovery fails to resolve or the document
+     *   is missing required fields (`token_endpoint`, `jwks_uri`,
+     *   `id_token_signing_alg_values_supported`).
+     */
+    static async fromIssuer(config) {
+        if (!config.issuer)
+            throw new Error('issuer is required');
+        if (!config.configId)
+            throw new Error('configId is required');
+        if (!config.clientId)
+            throw new Error('clientId is required');
+        if (config.clockToleranceSeconds !== undefined && config.clockToleranceSeconds < 0) {
+            throw new Error('clockToleranceSeconds must be >= 0');
+        }
+        const issuer = config.issuer.replace(/\/$/, '');
+        requireSecureUrl('issuer', issuer);
+        const discoveryUrl = `${issuer}/.well-known/openid-configuration`;
+        const timeout = config.discoveryTimeout ?? DEFAULT_DISCOVERY_TIMEOUT_MS;
+        let response;
+        try {
+            response = await fetch(discoveryUrl, {
+                method: 'GET',
+                headers: { Accept: 'application/json' },
+                signal: AbortSignal.timeout(timeout),
+            });
+        }
+        catch (err) {
+            throw new errors_1.DiscoveryError(`OIDC discovery failed at ${discoveryUrl}: ${err}`, { cause: err });
+        }
+        if (!response.ok) {
+            throw new errors_1.DiscoveryError(`OIDC discovery returned HTTP ${response.status} at ${discoveryUrl}`);
+        }
+        let raw;
+        try {
+            raw = (await response.json());
+        }
+        catch (err) {
+            throw new errors_1.DiscoveryError(`OIDC discovery document at ${discoveryUrl} is not valid JSON`, { cause: err });
+        }
+        const required = (field) => {
+            const value = raw[field];
+            if (typeof value !== 'string' || value.length === 0) {
+                throw new errors_1.DiscoveryError(`Discovery document at ${discoveryUrl} is missing required field '${field}'`);
+            }
+            return value;
+        };
+        const tokenEndpoint = required('token_endpoint');
+        const jwksUri = required('jwks_uri');
+        // The discovered endpoints must also be https (loopback excepted) — a
+        // plaintext issuer could otherwise advertise plaintext sub-resources.
+        requireSecureUrl('token_endpoint', tokenEndpoint);
+        requireSecureUrl('jwks_uri', jwksUri);
+        const algsValue = raw['id_token_signing_alg_values_supported'];
+        if (!Array.isArray(algsValue) ||
+            algsValue.length === 0 ||
+            !algsValue.every((a) => typeof a === 'string')) {
+            throw new errors_1.DiscoveryError(`Discovery document at ${discoveryUrl} is missing required field ` +
+                `'id_token_signing_alg_values_supported' (must be a non-empty string array)`);
+        }
+        // spec.md §3.3: the algorithm allowlist MUST be a closed set
+        // ({RS256, ES256, ES384, ES512, EdDSA}). Intersect the issuer's advertised
+        // list with our allowlist — refuse to construct a client if no overlap.
+        // Without this, an issuer advertising only RS512 / PS256 / a symmetric alg
+        // would be silently trusted at verify time. Forecloses key-confusion /
+        // algorithm-substitution attacks where the JWKS happens to serve a key
+        // type matching whatever alg the JWT header advertises.
+        const allowedAlgorithms = Object.freeze(algsValue.filter((a) => DEFAULT_ID_TOKEN_ALGS.includes(a)));
+        if (allowedAlgorithms.length === 0) {
+            throw new errors_1.DiscoveryError(`Discovery document at ${discoveryUrl} advertises id_token signing algorithms ` +
+                `${JSON.stringify(algsValue)} — none are in the SDK allowlist ` +
+                `${JSON.stringify(DEFAULT_ID_TOKEN_ALGS)} (per spec.md §3.3). ` +
+                `Refusing to construct a verifier.`);
+        }
+        // RFC 8414 §3.3 / OIDC Discovery §4.3: the `issuer` value in the metadata
+        // document MUST be identical to the issuer URL the request was made to.
+        // Without this cross-check, a discovery document that advertises a different
+        // `issuer` (e.g., a shared base URL on a multi-tenant deployment) would be
+        // silently trusted, and `verifyToken` would later accept tokens issued by
+        // that *other* issuer — a cross-tenant token-acceptance bypass.
+        if (typeof raw['issuer'] !== 'string' || raw['issuer'].length === 0) {
+            throw new errors_1.DiscoveryError(`Discovery document at ${discoveryUrl} is missing required field 'issuer'`);
+        }
+        const issuerFromDoc = raw['issuer'].replace(/\/$/, '');
+        if (issuerFromDoc !== issuer) {
+            throw new errors_1.DiscoveryError(`Discovery document issuer '${issuerFromDoc}' does not match the issuer ` +
+                `requested ('${issuer}'). RFC 8414 §3.3 requires these to be identical.`);
+        }
+        const metadata = {
+            ...raw,
+            issuer: issuerFromDoc,
+            token_endpoint: tokenEndpoint,
+            jwks_uri: jwksUri,
+            id_token_signing_alg_values_supported: algsValue,
+        };
+        return new HawcxOAuth({
+            configId: config.configId,
+            timeout: config.timeout,
+            clockToleranceSeconds: config.clockToleranceSeconds,
+        }, { metadata, clientId: config.clientId, allowedAlgorithms });
+    }
+    /**
+     * Opt into `private_key_jwt` client authentication (discovery mode only).
+     * When set, the token exchange signs and attaches an RFC 7523
+     * `client_assertion` (in addition to PKCE). Without it, the exchange stays
+     * public-client + PKCE.
+     *
+     * Intended to be called once right after {@link fromIssuer}, before the
+     * client is shared. Returns `this` for chaining.
+     */
+    /**
+     * @beta Experimental `private_key_jwt` surface; may change before stable.
+     *
+     * Returns a **new** discovery-mode client configured with the signer (sharing
+     * this client's resolved discovery state); the original is unchanged, so a
+     * configured client is immutable. Chained usage
+     * (`(await fromIssuer(...)).withClientAssertion(...)`) is unaffected.
+     *
+     * Refuses if the OP's discovery doc advertises
+     * `token_endpoint_auth_methods_supported` without `private_key_jwt`
+     * (the assertion would be silently ignored).
+     */
+    withClientAssertion(signer) {
+        if (this.discoveryMetadata === null) {
+            throw new Error('withClientAssertion requires a discovery-mode client built via HawcxOAuth.fromIssuer(...)');
+        }
+        const methods = this.discoveryMetadata['token_endpoint_auth_methods_supported'];
+        if (Array.isArray(methods) && methods.length > 0 && !methods.includes('private_key_jwt')) {
+            throw new errors_1.DiscoveryError(`The OP does not advertise 'private_key_jwt' in token_endpoint_auth_methods_supported ` +
+                `(${JSON.stringify(methods)}); refusing to attach a client_assertion that would be ` +
+                `ignored. Register the client for private_key_jwt in the Hawcx admin console.`);
+        }
+        return new HawcxOAuth({
+            configId: this.configId,
+            timeout: this.timeout,
+            clockToleranceSeconds: this.clockToleranceSeconds,
+        }, {
+            metadata: this.discoveryMetadata,
+            clientId: this.expectedAudience,
+            allowedAlgorithms: this.allowedAlgorithms,
+            signer,
+        });
     }
     /**
      * Exchange authorization code for id_token and verified claims.
      *
      * @param code - Authorization code from auth flow
      * @param codeVerifier - PKCE code verifier
-     * @returns id_token and verified claims
+     * @param redirectUri - Optional. If your original authorization request
+     *   registered a `redirect_uri`, RFC 6749 §4.1.3 requires the token
+     *   request to carry the same value. Omit if the auth request also omitted it.
+     * @param expectedNonce - Optional. If your authorization request bound a
+     *   `nonce`, pass it here so the returned id_token's `nonce` is verified.
+     *   Required whenever the token carries a nonce (verification refuses
+     *   otherwise — OIDC Core §3.1.3.7).
      */
-    async exchangeCode(code, codeVerifier) {
+    async exchangeCode(code, codeVerifier, redirectUri, expectedNonce) {
         if (!code)
             throw new errors_1.TokenExchangeError('code is required');
         if (!codeVerifier)
             throw new errors_1.TokenExchangeError('codeVerifier is required');
-        // Exchange code for token
-        const tokenUrl = `${this.baseUrl}/oauth2/token`;
         const body = new URLSearchParams();
+        body.append('grant_type', 'authorization_code');
         body.append('code', code);
         body.append('code_verifier', codeVerifier);
+        if (redirectUri) {
+            body.append('redirect_uri', redirectUri);
+        }
+        const signer = this.clientAssertionSigner;
+        if (signer !== null && this.discoveryMetadata !== null) {
+            // private_key_jwt: include client_id (parity with the demo RP) + the
+            // signed assertion. aud is the discovered token_endpoint string exactly,
+            // which the OP pins for the assertion. PKCE fields above are retained.
+            // In this guarded branch discoveryMetadata !== null, so expectedAudience
+            // is the clientId (non-null). Assert rather than mask with ''.
+            const clientId = this.expectedAudience;
+            body.append('client_id', clientId);
+            body.append('client_assertion_type', client_assertion_1.CLIENT_ASSERTION_TYPE);
+            body.append('client_assertion', await signer.sign(clientId, this.discoveryMetadata.token_endpoint));
+        }
         let response;
         try {
-            response = await fetch(tokenUrl, {
+            response = await fetch(this.tokenEndpoint, {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/x-www-form-urlencoded',
                     'X-Config-Id': this.configId,
+                    Accept: 'application/json',
                 },
                 body: body.toString(),
                 signal: AbortSignal.timeout(this.timeout),
@@ -70,81 +328,170 @@ class HawcxOAuth {
         }
         if (!response.ok) {
             let errorMsg = `HTTP ${response.status}`;
-            try {
-                const data = (await response.json());
-                errorMsg = data.error_description || data.error || errorMsg;
-            }
-            catch {
-                // ignore parse errors
+            // Read the body as text first so a non-JSON error (e.g. an HTML 502 from
+            // a gateway) is preserved in the message instead of being swallowed.
+            const rawBody = await response.text().catch(() => '');
+            let errCode;
+            let errDesc;
+            if (rawBody) {
+                try {
+                    const data = JSON.parse(rawBody);
+                    errCode = data.error;
+                    errDesc = data.error_description;
+                    errorMsg = data.error_description || data.error || `${errorMsg}: ${rawBody}`;
+                }
+                catch {
+                    errorMsg = `${errorMsg}: ${rawBody}`;
+                }
             }
-            throw new errors_1.TokenExchangeError(errorMsg, response.status);
+            throw new errors_1.TokenExchangeError(errorMsg, response.status, {
+                error: errCode,
+                errorDescription: errDesc,
+            });
         }
         const data = (await response.json());
         const idToken = data.id_token;
         if (!idToken) {
             throw new errors_1.TokenExchangeError('Response missing id_token');
         }
-        // Verify the token
-        const claims = await this.verifyToken(idToken);
+        const claims = await this.verifyToken(idToken, expectedNonce !== undefined ? { nonce: expectedNonce } : undefined);
         return { idToken, claims };
     }
     /**
      * Verify a JWT token and return its claims.
      *
-     * Uses the jose library which handles all signature formats automatically,
-     * including ECDSA signature conversion between P1363 and DER formats.
+     * In **discovery mode**, enforces signature + `iss` + `aud` + `exp` + `nbf`
+     * (and the optional `nonce` claim if `options.nonce` is provided).
      *
-     * @param token - JWT token to verify
-     * @returns Verified claims
+     * In **legacy mode**, only the signature is verified. Audience and issuer
+     * claims are not checked, matching the pre-5.x behavior.
      */
-    async verifyToken(token) {
+    async verifyToken(token, options) {
         if (!token)
             throw new errors_1.TokenVerificationError('token is required');
         try {
-            // Get or create the JWKS
             const jwks = this.getJwks();
-            // Verify the token using jose - handles all the crypto automatically
-            const { payload } = await (0, jose_1.jwtVerify)(token, jwks);
+            const { payload } = await (0, jose_1.jwtVerify)(token, jwks, {
+                ...(this.expectedIssuer !== null && { issuer: this.expectedIssuer }),
+                ...(this.expectedAudience !== null && { audience: this.expectedAudience }),
+                // Enforce the allowlist that fromIssuer pinned at construction time.
+                // Without this, jose accepts any algorithm whose key happens to be
+                // present in the JWKS — a key-confusion / alg-substitution path.
+                // `as string[]` because jose's type is mutable; ours is readonly.
+                ...(this.allowedAlgorithms !== null && {
+                    algorithms: this.allowedAlgorithms,
+                }),
+                // Fail closed on a token with no `exp`/`iat` (jose only checks them
+                // when present). In discovery mode we require both; legacy mode keeps
+                // 4.x behavior. A missing exp would otherwise read as never-expiring.
+                ...(this.discoveryMetadata !== null && { requiredClaims: ['exp', 'iat'] }),
+                clockTolerance: this.clockToleranceSeconds,
+            });
+            if (options?.nonce !== undefined) {
+                if (payload.nonce !== options.nonce) {
+                    throw new errors_1.TokenVerificationError(`Token nonce mismatch (expected '${options.nonce}', got '${payload.nonce ?? '<missing>'}')`);
+                }
+            }
+            else if (payload.nonce !== undefined && payload.nonce !== null) {
+                // OIDC Core §3.1.3.7 step 11: a present nonce MUST be verified. We have
+                // no expected value, so refuse rather than silently accept — pass the
+                // nonce you bound at /authorize via options.nonce (or exchangeCode's
+                // expectedNonce). Only RPs that actually use a nonce hit this.
+                throw new errors_1.TokenVerificationError('Token carries a nonce but none was provided to verify against. ' +
+                    'Pass the expected nonce (options.nonce / exchangeCode expectedNonce).');
+            }
             return payload;
         }
         catch (err) {
             if (err instanceof errors_1.TokenVerificationError)
                 throw err;
             const message = err instanceof Error ? err.message : String(err);
+            // jose exposes machine-readable codes via `(err as any).code` for
+            // common JWT failures. Prefer that over string matching when present;
+            // fall back to substring sniffs for older versions / wrapped errors.
+            const code = err instanceof Error ? err.code : undefined;
             // Map jose errors to our error types
-            if (message.includes('expired')) {
+            if (code === 'ERR_JWT_EXPIRED' || message.includes('expired')) {
                 throw new errors_1.TokenVerificationError('Token expired');
             }
+            if (code === 'ERR_JWT_CLAIM_VALIDATION_FAILED') {
+                // The `claim` property tells us which claim mismatched
+                const claim = err.claim;
+                if (claim === 'iss')
+                    throw new errors_1.TokenVerificationError(`Unexpected JWT issuer: ${message}`);
+                if (claim === 'aud')
+                    throw new errors_1.TokenVerificationError(`Unexpected JWT audience: ${message}`);
+                if (claim === 'nbf')
+                    throw new errors_1.TokenVerificationError('Token not yet valid');
+            }
             if (message.includes('not yet valid') || message.includes('nbf')) {
                 throw new errors_1.TokenVerificationError('Token not yet valid');
             }
             if (message.includes('signature')) {
                 throw new errors_1.TokenVerificationError('Invalid signature');
             }
+            if (message.includes('audience') || message.includes('"aud"')) {
+                throw new errors_1.TokenVerificationError(`Unexpected JWT audience: ${message}`);
+            }
+            if (message.includes('issuer') || message.includes('"iss"')) {
+                throw new errors_1.TokenVerificationError(`Unexpected JWT issuer: ${message}`);
+            }
             throw new errors_1.TokenVerificationError(`Token verification failed: ${message}`);
         }
     }
     /**
-     * Get or create the remote JWKS.
-     * The jose library handles caching internally.
+     * Get or create the remote JWKS. jose handles caching + concurrent-fetch
+     * coalescing internally.
+     *
+     * No single-flight guard is needed here: this method is fully synchronous
+     * (no `await` between the null-check and the assignment), so within Node's
+     * single-threaded event loop the first caller assigns `this.jwks` before any
+     * other code runs. Two concurrent `verifyToken` calls therefore cannot create
+     * duplicate `RemoteJWKSet` instances.
      */
     getJwks() {
         if (!this.jwks) {
-            const jwksUrl = new URL(`${this.baseUrl}/keys`);
+            const jwksUrl = new URL(this.jwksUrl);
+            // Only set the X-Config-Id header for the legacy `/keys` endpoint; the
+            // OIDC-discovered `/.well-known/jwks.json` is public and tenant-agnostic.
+            const isLegacyKeysEndpoint = this.discoveryMetadata === null;
             this.jwks = (0, jose_1.createRemoteJWKSet)(jwksUrl, {
-                headers: {
-                    'X-Config-Id': this.configId,
-                },
+                // Bound the JWKS fetch explicitly (jose's default is 5s; pin it to the
+                // configured request timeout so a stalled keys endpoint can't hang
+                // verification longer than intended).
+                timeoutDuration: this.timeout,
+                ...(isLegacyKeysEndpoint && {
+                    headers: { 'X-Config-Id': this.configId },
+                }),
             });
         }
         return this.jwks;
     }
     /**
-     * Clear the JWKS cache (useful for testing or key rotation).
+     * Drop the cached JWKS so the next `verifyToken` re-fetches it. Useful after
+     * an operator-triggered signing-key rotation, or in tests.
+     *
+     * Canonical name, aligned with the Java (`refreshJwks`) and Python
+     * (`refresh_jwks`) SDKs.
      */
-    clearCache() {
+    refreshJwks() {
         this.jwks = null;
     }
+    /**
+     * @deprecated since 5.1.0 — renamed to {@link refreshJwks} for cross-SDK
+     *   consistency. Will be removed in 6.0.0. Behaviour is identical.
+     */
+    clearCache() {
+        // One-time deprecation nudge per instance (per-instance so tests and
+        // multi-tenant setups each get warned, while a single instance doesn't spam).
+        if (!this.clearCacheWarned) {
+            this.clearCacheWarned = true;
+            // eslint-disable-next-line no-console
+            console.warn('[@hawcx/oauth-client] clearCache() is deprecated; use refreshJwks(). ' +
+                'clearCache() will be removed in 6.0.0.');
+        }
+        this.refreshJwks();
+    }
 }
 exports.HawcxOAuth = HawcxOAuth;
 //# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEH,+BAAsE;AACtE,qCAAsE;AAEtE,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAmDjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,UAAU;IAMrB,YAAY,MAAwB;QAF5B,SAAI,GAAiD,IAAI,CAAC;QAGhE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,KAAM,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,YAAoB;QACnD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,2BAAkB,CAAC,0BAA0B,CAAC,CAAC;QAE5E,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,OAAO,eAAe,CAAC;QAEhD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAE3C,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,IAAI,CAAC,QAAQ;iBAC7B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;gBACtD,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;QAED,mBAAmB;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAE/C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAE5B,qEAAqE;YACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAEjD,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,+BAAsB;gBAAE,MAAM,GAAG,CAAC;YAErD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEjE,qCAAqC;YACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,+BAAsB,CAAC,eAAe,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,IAAI,+BAAsB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,CAAC,CAAC;YAEhD,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,OAAO,EAAE;gBACtC,OAAO,EAAE;oBACP,aAAa,EAAE,IAAI,CAAC,QAAQ;iBAC7B;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAvID,gCAuIC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAEH,+BAAsE;AACtE,yDAAkF;AAClF,qCAAsF;AAEtF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAClC,gFAAgF;AAChF,MAAM,4BAA4B,GAAG,IAAK,CAAC;AAC3C;;;;;;GAMG;AACH,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAqHH;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,GAAW;IAClD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAc,CAAC,GAAG,KAAK,wBAAwB,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACpC,MAAM,QAAQ,GACZ,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC7G,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ;QAAE,OAAO;IAC/C,MAAM,IAAI,uBAAc,CACtB,GAAG,KAAK,yBAAyB,GAAG,yDAAyD,CAC9F,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,UAAU;IA4CrB,YAAY,MAAwB,EAAE,aAA6B;QArB3D,SAAI,GAAiD,IAAI,CAAC;QAme1D,qBAAgB,GAAG,KAAK,CAAC;QA7c/B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,kBAAkB,CAAC;QACpD,IAAI,CAAC,qBAAqB;YACxB,MAAM,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;QAElE,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC3D,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAChD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,qBAAqB,GAAG,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,aAAa,GAAG,GAAG,OAAO,eAAe,CAAC;YAC/C,IAAI,CAAC,OAAO,GAAG,GAAG,OAAO,OAAO,CAAC;YACjC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAA8B;QACpD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,GAAG,MAAM,mCAAmC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,4BAA4B,CAAC;QAExE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;gBACnC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CAAC,4BAA4B,YAAY,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAc,CACtB,gCAAgC,QAAQ,CAAC,MAAM,OAAO,YAAY,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CACtB,8BAA8B,YAAY,oBAAoB,EAC9D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,+BAA+B,KAAK,GAAG,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,sEAAsE;QACtE,sEAAsE;QACtE,gBAAgB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAClD,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,uCAAuC,CAAC,CAAC;QAC/D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACzB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,6BAA6B;gBAChE,4EAA4E,CAC/E,CAAC;QACJ,CAAC;QACD,6DAA6D;QAC7D,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CACxD,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC3D,CAAC;QACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,0CAA0C;gBAC7E,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,mCAAmC;gBAC/D,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,uBAAuB;gBAC/D,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,qCAAqC,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAI,GAAG,CAAC,QAAQ,CAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAc,CACtB,8BAA8B,aAAa,8BAA8B;gBACvE,eAAe,MAAM,mDAAmD,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,GAAG,GAAG;YACN,MAAM,EAAE,aAAa;YACrB,cAAc,EAAE,aAAa;YAC7B,QAAQ,EAAE,OAAO;YACjB,qCAAqC,EAAE,SAAS;SACjD,CAAC;QAEF,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,EACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAA6B;QAC/C,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,uBAAc,CACtB,uFAAuF;gBACrF,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yDAAyD;gBACpF,8EAA8E,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,EACD;YACE,QAAQ,EAAE,IAAI,CAAC,iBAAiB;YAChC,QAAQ,EAAE,IAAI,CAAC,gBAA0B;YACzC,iBAAiB,EAAE,IAAI,CAAC,iBAAsC;YAC9D,MAAM;SACP,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,YAAoB,EACpB,WAAoB,EACpB,aAAsB;QAEtB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,2BAAkB,CAAC,0BAA0B,CAAC,CAAC;QAE5E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACvD,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAiB,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,wCAAqB,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CACT,kBAAkB,EAClB,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,IAAI,CAAC,QAAQ;oBAC5B,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzC,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,OAA2B,CAAC;YAChC,IAAI,OAA2B,CAAC;YAChC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;oBACrB,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;oBACjC,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;gBACtD,KAAK,EAAE,OAAO;gBACd,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,OAAO,EACP,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAA4B;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAE5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1E,qEAAqE;gBACrE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI;oBACrC,UAAU,EAAE,IAAI,CAAC,iBAA6B;iBAC/C,CAAC;gBACF,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1E,cAAc,EAAE,IAAI,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;oBACpC,MAAM,IAAI,+BAAsB,CAC9B,mCAAmC,OAAO,CAAC,KAAK,WAAW,OAAO,CAAC,KAAK,IAAI,WAAW,IAAI,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACjE,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,IAAI,+BAAsB,CAC9B,iEAAiE;oBAC/D,uEAAuE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,+BAAsB;gBAAE,MAAM,GAAG,CAAC;YAErD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAEhF,qCAAqC;YACrC,IAAI,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,eAAe,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;gBAC/C,uDAAuD;gBACvD,MAAM,KAAK,GAAI,GAA0B,CAAC,KAAK,CAAC;gBAChD,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;gBAC3F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;gBAC7F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,IAAI,+BAAsB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtC,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,OAAO,EAAE;gBACtC,uEAAuE;gBACvE,mEAAmE;gBACnE,sCAAsC;gBACtC,eAAe,EAAE,IAAI,CAAC,OAAO;gBAC7B,GAAG,CAAC,oBAAoB,IAAI;oBAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,WAAW;QACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,qEAAqE;QACrE,8EAA8E;QAC9E,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,uEAAuE;gBACrE,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;CAGF;AA3fD,gCA2fC"}

package/dist/stepup/client.d.ts

@@ -1,6 +1,15 @@
-import { DelegationTransport } from '../delegation/transport';
+import { type JsonObject, type SecureRequestOptions } from '../delegation/transport';
 import { DelegationKeyMaterial } from '../delegation/factory';
+import { type JwtBearerTransportOptions } from '../management/jwt_transport';
 import { StepUpClientBaseOptions, StepUpConsumeOptions, StepUpConsumeResponse, StepUpStartOptions, StepUpStartTokenResponse } from './types';
+/**
+ * Structural interface satisfied by both `DelegationTransport` (ECIES) and
+ * `JwtBearerTransport` (private_key_jwt).  Allows `StepUpClient` to accept
+ * either transport without a hard dependency on the concrete types.
+ */
+interface StepUpTransport {
+    send<TReq extends JsonObject, TRes extends JsonObject>(options: Pick<SecureRequestOptions<TReq>, 'endpoint' | 'payload' | 'headers'>): Promise<TRes>;
+}
 export interface StepUpClientSecretKeyOptions extends StepUpClientBaseOptions {
     secretKey: string;
     apiKey?: string;
@@ -8,19 +17,69 @@ export interface StepUpClientSecretKeyOptions extends StepUpClientBaseOptions {
 export type StepUpClientKeyOptions = StepUpClientBaseOptions & DelegationKeyMaterial & {
     apiKey?: string;
 };
+/**
+ * Options for {@link StepUpClient.withPrivateKeyJwt}.  Combines the
+ * JWT-bearer transport credentials with the standard step-up base options.
+ */
+export interface StepUpClientPrivateKeyJwtOptions extends StepUpClientBaseOptions {
+    /** Ed25519 private signing key (PKCS#8 PEM, JWK object, or jose KeyLike). */
+    oidcSigningKey: JwtBearerTransportOptions['oidcSigningKey'];
+    /** Key ID embedded in the JWT `kid` header. */
+    kid: string;
+    /** OAuth client ID (`iss` / `sub` in the per-request JWT). */
+    clientId: string;
+    /** Tenant config identifier; forwarded as `X-Config-Id`. */
+    configId: string;
+    /** Optional API key forwarded as `apikey` header. */
+    apiKey?: string;
+    /** JWT time-to-live in seconds (default: 60). */
+    jwtTtlSeconds?: number;
+}
 export declare class StepUpClient {
     private transport;
     private options;
     private apiKey?;
     constructor(options: {
-        transport: DelegationTransport;
+        transport: StepUpTransport;
         clientOptions: StepUpClientBaseOptions;
         apiKey?: string;
     });
+    /**
+     * @deprecated since 5.2.0 — the ECIES secret-key credential format is
+     *   proprietary and will be removed in a future major version.  Migrate to
+     *   {@link StepUpClient.withPrivateKeyJwt}, which reuses the standard OIDC
+     *   Ed25519 `private_key_jwt` signing key already registered in the admin
+     *   console (one key, standards-based).
+     */
     static fromSecretKey(options: StepUpClientSecretKeyOptions): StepUpClient;
+    /**
+     * @deprecated since 5.2.0 — the ECIES key-material format is proprietary
+     *   and will be removed in a future major version.  Migrate to
+     *   {@link StepUpClient.withPrivateKeyJwt}.
+     */
     static fromKeys(options: StepUpClientKeyOptions): StepUpClient;
+    /**
+     * Build a `StepUpClient` authenticated via EdDSA `private_key_jwt` (Path A).
+     *
+     * Reuses the same Ed25519 signing key registered in the Hawcx admin console
+     * for OIDC `private_key_jwt` — one key, standards-based, no separate ECIES
+     * credential blob required.
+     *
+     * @example
+     * ```typescript
+     * const stepUp = StepUpClient.withPrivateKeyJwt({
+     *   baseUrl: 'https://api.hawcx.com',
+     *   configId: process.env.HAWCX_CONFIG_ID!,
+     *   clientId: process.env.HAWCX_CLIENT_ID!,
+     *   oidcSigningKey: JSON.parse(process.env.HAWCX_PRIVATE_JWK!),
+     *   kid: 'your-key-id',
+     * });
+     * ```
+     */
+    static withPrivateKeyJwt(options: StepUpClientPrivateKeyJwtOptions): StepUpClient;
     private buildExtraHeaders;
     startToken(options: StepUpStartOptions): Promise<StepUpStartTokenResponse>;
     consumeReceipt(options: StepUpConsumeOptions): Promise<StepUpConsumeResponse>;
 }
+export {};
 //# sourceMappingURL=client.d.ts.map