@hawcx/oauth-client 5.1.0 → 6.0.0

package/dist/delegation/exceptions.d.ts

@@ -36,4 +36,38 @@ export declare class DelegationRequestError extends DelegationError {
 export declare class DelegationResponseError extends DelegationError {
     constructor(message: string, options?: DelegationErrorOptions);
 }
+/**
+ * Stable machine-readable reasons for management-API response-signature
+ * failures (TOB-HSDK-11).  See {@link ResponseSignatureInvalidError} and
+ * {@link ResponseSignatureUnavailableError}.
+ */
+export type ResponseSignatureErrorCode = 'response_signature_invalid' | 'response_signature_unavailable';
+/**
+ * The management API response's `X-Response-Signature` is missing, empty, or
+ * does not verify (bad signature, disallowed `alg`, kid absent from a freshly
+ * fetched JWKS, stale/future `iat`, body hash mismatch, wrong token type).
+ * Treat the response as untrusted.
+ */
+export declare class ResponseSignatureInvalidError extends DelegationResponseError {
+    readonly code: ResponseSignatureErrorCode;
+    constructor(message: string, options?: DelegationErrorOptions);
+}
+/**
+ * The response signature could not be checked because the verification
+ * infrastructure was unavailable: the issuer JWKS fetch failed or timed out,
+ * returned a non-200 or malformed document, or the signing `kid` was unknown
+ * while a refetch was suppressed by the JWKS refetch cooldown (e.g. during
+ * key rotation).
+ *
+ * **The server already processed the request.**  For a non-idempotent write
+ * (e.g. `StepUpClient.consumeReceipt`) the operation may have been applied
+ * even though this error is thrown — reconcile state rather than blindly
+ * retrying.  This error does NOT imply the response was genuine: its body is
+ * never returned, and an on-path party that can inject responses can also
+ * induce this error (e.g. with an unknown `kid`).
+ */
+export declare class ResponseSignatureUnavailableError extends DelegationResponseError {
+    readonly code: ResponseSignatureErrorCode;
+    constructor(message: string, options?: DelegationErrorOptions);
+}
 //# sourceMappingURL=exceptions.d.ts.map

package/dist/delegation/exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/delegation/exceptions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,eAAgB,SAAQ,eAAe;IAClD,SAAgB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAMlE;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;gBAGpB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAAsB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO;IASvF,QAAQ,IAAI,MAAM;CAOnB;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;gBAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE"}
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/delegation/exceptions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,eAAgB,SAAQ,eAAe;IAClD,SAAgB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAMlE;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;gBAGpB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAAsB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO;IASvF,QAAQ,IAAI,MAAM;CAOnB;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;gBAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE;AAED;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,4BAA4B,GAAG,gCAAgC,CAAC;AAEzG;;;;;GAKG;AACH,qBAAa,6BAA8B,SAAQ,uBAAuB;IACxE,SAAgB,IAAI,EAAE,0BAA0B,CAAgC;gBAEpE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iCAAkC,SAAQ,uBAAuB;IAC5E,SAAgB,IAAI,EAAE,0BAA0B,CAAoC;gBAExE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE"}

package/dist/delegation/exceptions.js

@@ -3,7 +3,7 @@
  * Custom exceptions for the Delegation module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = void 0;
+exports.ResponseSignatureUnavailableError = exports.ResponseSignatureInvalidError = exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = void 0;
 const errors_1 = require("../errors");
 class DelegationError extends errors_1.HawcxOAuthError {
     constructor(message, options = {}) {
@@ -56,4 +56,42 @@ class DelegationResponseError extends DelegationError {
     }
 }
 exports.DelegationResponseError = DelegationResponseError;
+/**
+ * The management API response's `X-Response-Signature` is missing, empty, or
+ * does not verify (bad signature, disallowed `alg`, kid absent from a freshly
+ * fetched JWKS, stale/future `iat`, body hash mismatch, wrong token type).
+ * Treat the response as untrusted.
+ */
+class ResponseSignatureInvalidError extends DelegationResponseError {
+    constructor(message, options = {}) {
+        super(message, options);
+        this.code = 'response_signature_invalid';
+        this.name = 'ResponseSignatureInvalidError';
+        Object.setPrototypeOf(this, ResponseSignatureInvalidError.prototype);
+    }
+}
+exports.ResponseSignatureInvalidError = ResponseSignatureInvalidError;
+/**
+ * The response signature could not be checked because the verification
+ * infrastructure was unavailable: the issuer JWKS fetch failed or timed out,
+ * returned a non-200 or malformed document, or the signing `kid` was unknown
+ * while a refetch was suppressed by the JWKS refetch cooldown (e.g. during
+ * key rotation).
+ *
+ * **The server already processed the request.**  For a non-idempotent write
+ * (e.g. `StepUpClient.consumeReceipt`) the operation may have been applied
+ * even though this error is thrown — reconcile state rather than blindly
+ * retrying.  This error does NOT imply the response was genuine: its body is
+ * never returned, and an on-path party that can inject responses can also
+ * induce this error (e.g. with an unknown `kid`).
+ */
+class ResponseSignatureUnavailableError extends DelegationResponseError {
+    constructor(message, options = {}) {
+        super(message, options);
+        this.code = 'response_signature_unavailable';
+        this.name = 'ResponseSignatureUnavailableError';
+        Object.setPrototypeOf(this, ResponseSignatureUnavailableError.prototype);
+    }
+}
+exports.ResponseSignatureUnavailableError = ResponseSignatureUnavailableError;
 //# sourceMappingURL=exceptions.js.map

package/dist/delegation/exceptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/delegation/exceptions.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,sCAA4C;AAS5C,MAAa,eAAgB,SAAQ,wBAAe;IAGlD,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;CACF;AATD,0CASC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,eAAe;IACxD,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF;AAND,sDAMC;AAED;;GAEG;AACH,MAAa,sBAAuB,SAAQ,eAAe;IAIzD,YACE,OAAe,EACf,UAAmF,EAAE;QAErF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,QAAQ;QACN,IAAI,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,GAAG,GAAG,IAAI,UAAU,IAAI,CAAC,UAAU,GAAG,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAtBD,wDAsBC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACF;AAND,0DAMC"}
+{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/delegation/exceptions.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,sCAA4C;AAS5C,MAAa,eAAgB,SAAQ,wBAAe;IAGlD,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;CACF;AATD,0CASC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,eAAe;IACxD,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF;AAND,sDAMC;AAED;;GAEG;AACH,MAAa,sBAAuB,SAAQ,eAAe;IAIzD,YACE,OAAe,EACf,UAAmF,EAAE;QAErF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,QAAQ;QACN,IAAI,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,GAAG,GAAG,IAAI,UAAU,IAAI,CAAC,UAAU,GAAG,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAtBD,wDAsBC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACF;AAND,0DAMC;AASD;;;;;GAKG;AACH,MAAa,6BAA8B,SAAQ,uBAAuB;IAGxE,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAHV,SAAI,GAA+B,4BAA4B,CAAC;QAI9E,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;CACF;AARD,sEAQC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAa,iCAAkC,SAAQ,uBAAuB;IAG5E,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAHV,SAAI,GAA+B,gCAAgC,CAAC;QAIlF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;QAChD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iCAAiC,CAAC,SAAS,CAAC,CAAC;IAC3E,CAAC;CACF;AARD,8EAQC"}

package/dist/delegation/hawcx.d.ts

@@ -49,11 +49,15 @@ export interface DeviceOperationOptions {
     deviceId: string;
 }
 export interface DelegationRequestOptions<TPayload extends JsonObject> {
-    /** API endpoint path (e.g., "/hc_auth/v5/update/initiate") */
+    /**
+     * API endpoint path relative to the base URL (e.g., "/hc_auth/v5/update/initiate").
+     * Must start with a single "/". When `includeBaseUrl` is false this is an
+     * absolute https URL instead.
+     */
     endpoint: string;
     /** Request payload dictionary to be encrypted and sent */
     payload: TPayload;
-    /** If true, prepends base_url to endpoint (default: true) */
+    /** If true, joins endpoint onto the base URL (default: true) */
     includeBaseUrl?: boolean;
     /** Optional additional HTTP headers (e.g., API keys) */
     headers?: Record<string, string>;

package/dist/delegation/hawcx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hawcx.d.ts","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAuD,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGvG,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,qBAAqB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB,CAAC,QAAQ,SAAS,UAAU;IACnE,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,MAAM,CAAC,CAAS;IAExB,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE;QAAE,SAAS,EAAE,mBAAmB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAMzF,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,gCAAgC,GAAG,gBAAgB;IAMjF,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,gBAAgB;IAMtE,OAAO,CAAC,gBAAgB;IAQlB,OAAO,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EAC5D,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKhB,SAAgB,GAAG;4BACS,kBAAkB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAmC1C,gBAAgB,KAAG,OAAO,CAAC,UAAU,CAAC;MAkB9D;IAEF,SAAgB,KAAK;iCACY,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;MAO3D;IAEF,SAAgB,OAAO;uBACA,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;0BAOzB,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;4BAO1C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAO9C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;MAOpE;CACH"}
+{"version":3,"file":"hawcx.d.ts","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAuD,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGvG,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,qBAAqB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB,CAAC,QAAQ,SAAS,UAAU;IACnE;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,MAAM,CAAC,CAAS;IAExB,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE;QAAE,SAAS,EAAE,mBAAmB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAMzF,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,gCAAgC,GAAG,gBAAgB;IAMjF,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,gBAAgB;IAMtE,OAAO,CAAC,gBAAgB;IAQlB,OAAO,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EAC5D,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKhB,SAAgB,GAAG;4BACS,kBAAkB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAmC1C,gBAAgB,KAAG,OAAO,CAAC,UAAU,CAAC;MAkB9D;IAEF,SAAgB,KAAK;iCACY,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;MAO3D;IAEF,SAAgB,OAAO;uBACA,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;0BAOzB,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;4BAO1C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAO9C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;MAOpE;CACH"}

package/dist/delegation/hawcx.js.map

@@ -1 +1 @@
-{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,uCAAuG;AACvG,6CAAsD;AAEtD,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AA4DD,MAAa,gBAAgB;IAM3B,YAAY,OAA6E;QAiCzE,QAAG,GAAG;YACpB,QAAQ,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhE,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAErE,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,mCAAsB,CAC9B,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;gBAED,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnD,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,YAAY;iBACzB,CAAC;gBAEF,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;gBAChC,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;gBACzC,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAAyB,EAAuB,EAAE;gBAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;gBAE3C,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,mCAAsB,CAAC,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,OAAO,GAAG;oBACd,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,SAAS;oBACrB,GAAG;iBACJ,CAAC;gBAEF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,UAAK,GAAG;YACtB,cAAc,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAC5D,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,8BAA8B;oBACxC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,YAAO,GAAG;YACxB,IAAI,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,4BAA4B;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACvE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QA/HA,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAyC;QAC5D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAEO,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAuC;QAEvC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAa,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;CAkGF;AAvID,4CAuIC"}
+{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,uCAAuG;AACvG,6CAAsD;AAEtD,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AAgED,MAAa,gBAAgB;IAM3B,YAAY,OAA6E;QAiCzE,QAAG,GAAG;YACpB,QAAQ,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhE,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAErE,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,mCAAsB,CAC9B,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;gBAED,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnD,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,YAAY;iBACzB,CAAC;gBAEF,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;gBAChC,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;gBACzC,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAAyB,EAAuB,EAAE;gBAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;gBAE3C,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,mCAAsB,CAAC,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,OAAO,GAAG;oBACd,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,SAAS;oBACrB,GAAG;iBACJ,CAAC;gBAEF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,UAAK,GAAG;YACtB,cAAc,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAC5D,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,8BAA8B;oBACxC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,YAAO,GAAG;YACxB,IAAI,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,4BAA4B;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACvE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QA/HA,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAyC;QAC5D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAEO,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAuC;QAEvC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAa,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;CAkGF;AAvID,4CAuIC"}

package/dist/delegation/index.d.ts

@@ -5,5 +5,6 @@ export { DelegationClient, MfaMethod, } from './hawcx';
 export type { DelegationClientBaseOptions, DelegationClientSecretKeyOptions, DelegationClientKeyOptions, MfaInitiateOptions, MfaVerifyOptions, DeviceOperationOptions, DelegationRequestOptions, } from './hawcx';
 export { parseHawcxSecretKey, generateCredentialBlob, } from './credentials';
 export type { ParsedCredentials, HawcxCredentialBlob, } from './credentials';
-export { DelegationError, DelegationCryptoError, DelegationRequestError, DelegationResponseError, } from './exceptions';
+export { DelegationError, DelegationCryptoError, DelegationRequestError, DelegationResponseError, ResponseSignatureInvalidError, ResponseSignatureUnavailableError, } from './exceptions';
+export type { ResponseSignatureErrorCode } from './exceptions';
 //# sourceMappingURL=index.d.ts.map

package/dist/delegation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,GAClC,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC"}

package/dist/delegation/index.js

@@ -3,7 +3,7 @@
  * Hawcx OAuth Client SDK - Delegation Module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = exports.generateCredentialBlob = exports.parseHawcxSecretKey = exports.MfaMethod = exports.DelegationClient = void 0;
+exports.ResponseSignatureUnavailableError = exports.ResponseSignatureInvalidError = exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = exports.generateCredentialBlob = exports.parseHawcxSecretKey = exports.MfaMethod = exports.DelegationClient = void 0;
 var hawcx_1 = require("./hawcx");
 Object.defineProperty(exports, "DelegationClient", { enumerable: true, get: function () { return hawcx_1.DelegationClient; } });
 Object.defineProperty(exports, "MfaMethod", { enumerable: true, get: function () { return hawcx_1.MfaMethod; } });
@@ -15,4 +15,6 @@ Object.defineProperty(exports, "DelegationError", { enumerable: true, get: funct
 Object.defineProperty(exports, "DelegationCryptoError", { enumerable: true, get: function () { return exceptions_1.DelegationCryptoError; } });
 Object.defineProperty(exports, "DelegationRequestError", { enumerable: true, get: function () { return exceptions_1.DelegationRequestError; } });
 Object.defineProperty(exports, "DelegationResponseError", { enumerable: true, get: function () { return exceptions_1.DelegationResponseError; } });
+Object.defineProperty(exports, "ResponseSignatureInvalidError", { enumerable: true, get: function () { return exceptions_1.ResponseSignatureInvalidError; } });
+Object.defineProperty(exports, "ResponseSignatureUnavailableError", { enumerable: true, get: function () { return exceptions_1.ResponseSignatureUnavailableError; } });
 //# sourceMappingURL=index.js.map

package/dist/delegation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,iCAGiB;AAFf,yGAAA,gBAAgB,OAAA;AAChB,kGAAA,SAAS,OAAA;AAYX,6CAGuB;AAFrB,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AAOxB,2CAKsB;AAJpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,iCAGiB;AAFf,yGAAA,gBAAgB,OAAA;AAChB,kGAAA,SAAS,OAAA;AAYX,6CAGuB;AAFrB,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AAOxB,2CAOsB;AANpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA;AACvB,2HAAA,6BAA6B,OAAA;AAC7B,+HAAA,iCAAiC,OAAA"}

package/dist/delegation/transport.d.ts

@@ -5,11 +5,15 @@ import { Verifier, EciesX25519Encryptor, EciesX25519Decryptor, Ed25519Signer, Rs
 export type Signer = Ed25519Signer | RsaPssSigner;
 export type JsonObject = Record<string, unknown> | object;
 export interface SecureRequestOptions<TPayload extends JsonObject> {
-    /** API endpoint path (e.g., "/mfa/update" or "/device/revoke") */
+    /**
+     * API endpoint path relative to the base URL (e.g., "/mfa/update").  Must
+     * start with a single "/".  When `includeBaseUrl` is false this is instead
+     * an absolute URL, which must be https (http only for loopback hosts).
+     */
     endpoint: string;
     /** Request payload dictionary to be encrypted and sent */
     payload: TPayload;
-    /** If true, prepends base_url to endpoint (default: true) */
+    /** If true, joins endpoint onto the base URL (default: true) */
     includeBaseUrl?: boolean;
     /** Optional additional HTTP headers (e.g., API keys) */
     headers?: Record<string, string>;

package/dist/delegation/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/delegation/transport.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,QAAQ,EACR,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,UAAU,CAAC;AAGlB,MAAM,MAAM,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,oBAAoB,CAAC,QAAQ,SAAS,UAAU;IAC/D,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,oBAAoB,CAAC;IAChC,SAAS,EAAE,oBAAoB,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,gBAAgB,CAAS;gBAErB,OAAO,EAAE,0BAA0B;IAU/C;;OAEG;IACG,IAAI,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EACzD,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAClC,OAAO,CAAC,IAAI,CAAC;CAkHjB"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/delegation/transport.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,QAAQ,EACR,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,UAAU,CAAC;AAclB,MAAM,MAAM,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,oBAAoB,CAAC,QAAQ,SAAS,UAAU;IAC/D;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,oBAAoB,CAAC;IAChC,SAAS,EAAE,oBAAoB,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,gBAAgB,CAAS;gBAErB,OAAO,EAAE,0BAA0B;IAW/C;;OAEG;IACG,IAAI,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EACzD,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAClC,OAAO,CAAC,IAAI,CAAC;CAsHjB"}

package/dist/delegation/transport.js

@@ -6,9 +6,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DelegationTransport = void 0;
 const crypto_1 = require("./crypto");
 const exceptions_1 = require("./exceptions");
+const url_1 = require("../internal/url");
+/** Config/URL errors surface as `DelegationRequestError`, like other request failures. */
+const urlError = (message, cause) => new exceptions_1.DelegationRequestError(message, cause === undefined ? {} : { cause });
 class DelegationTransport {
     constructor(options) {
-        this.baseUrl = options.baseUrl.replace(/\/$/, '');
+        // Validated once (TOB-HSDK-13); requests are joined structurally below.
+        this.baseUrl = (0, url_1.parseSecureBaseUrl)('baseUrl', options.baseUrl, urlError);
         this.signer = options.signer;
         this.verifier = options.verifier;
         this.encryptor = options.encryptor;
@@ -21,6 +25,10 @@ class DelegationTransport {
      */
     async send(options) {
         const { endpoint, payload, includeBaseUrl = true, headers: extraHeaders = {} } = options;
+        // Resolve and validate the target before signing anything (fail closed).
+        const url = includeBaseUrl
+            ? (0, url_1.safeJoinUrl)(this.baseUrl, endpoint, 'endpoint', urlError)
+            : (0, url_1.assertSecureUrl)('endpoint', endpoint, urlError).href;
         let encryptedEnv;
         let headers;
         try {
@@ -46,7 +54,6 @@ class DelegationTransport {
         let response;
         let responseData;
         try {
-            const url = includeBaseUrl ? this.baseUrl + endpoint : endpoint;
             const controller = new AbortController();
             const timeoutId = setTimeout(() => controller.abort(), this.timeoutSeconds * 1000);
             try {

package/dist/delegation/transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/delegation/transport.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,qCAOkB;AAClB,6CAA+E;AA0B/E,MAAa,mBAAmB;IAS9B,YAAY,OAAmC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,OAAmC;QAEnC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QAEzF,IAAI,YAAoB,CAAC;QACzB,IAAI,OAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAElD,MAAM,EAAE,GAAG,IAAA,aAAI,GAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAEvD,OAAO,GAAG;gBACR,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,eAAe;gBAC5B,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;gBACzB,iBAAiB,EAAE,GAAG,CAAC,GAAG;gBAC1B,aAAa,EAAE,GAAG,CAAC,YAAY;aAChC,CAAC;YAEF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YAED,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;YAEnF,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAC1B,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YAED,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1C,MAAM,IAAI,oCAAuB,CAAC,2CAA2C,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,oCAAuB,CAAC,4BAA4B,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAA,aAAI,GAAE,GAAG,MAAM,CAAC,CAAC;YACvC,IAAI,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACjC,MAAM,IAAI,oCAAuB,CAC/B,4CAA4C,IAAI,CAAC,gBAAgB,IAAI,CACtE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC;YAEnF,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAAuB,CAAC,sCAAsC,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS,CAAC;YAEtE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAI,aAAyC,EAAE,MAAM,CAAC;gBACvE,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBACpF,MAAM,IAAI,mCAAsB,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAClE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mCAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,oCAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtE,MAAM,IAAI,mCAAsB,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAClE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,YAAY,EAAE,YAAY;oBAC1B,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,oCAAuB,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF;AA1ID,kDA0IC"}
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/delegation/transport.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,qCAOkB;AAClB,6CAA+E;AAC/E,yCAMyB;AAEzB,0FAA0F;AAC1F,MAAM,QAAQ,GAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACnD,IAAI,mCAAsB,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AA8B5E,MAAa,mBAAmB;IAS9B,YAAY,OAAmC;QAC7C,wEAAwE;QACxE,IAAI,CAAC,OAAO,GAAG,IAAA,wBAAkB,EAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,OAAmC;QAEnC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QAEzF,yEAAyE;QACzE,MAAM,GAAG,GAAG,cAAc;YACxB,CAAC,CAAC,IAAA,iBAAW,EAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC;YAC3D,CAAC,CAAC,IAAA,qBAAe,EAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;QAEzD,IAAI,YAAoB,CAAC;QACzB,IAAI,OAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAElD,MAAM,EAAE,GAAG,IAAA,aAAI,GAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAEvD,OAAO,GAAG;gBACR,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,eAAe;gBAC5B,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;gBACzB,iBAAiB,EAAE,GAAG,CAAC,GAAG;gBAC1B,aAAa,EAAE,GAAG,CAAC,YAAY;aAChC,CAAC;YAEF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YAED,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;YAEnF,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAC1B,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YAED,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1C,MAAM,IAAI,oCAAuB,CAAC,2CAA2C,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,oCAAuB,CAAC,4BAA4B,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAA,aAAI,GAAE,GAAG,MAAM,CAAC,CAAC;YACvC,IAAI,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACjC,MAAM,IAAI,oCAAuB,CAC/B,4CAA4C,IAAI,CAAC,gBAAgB,IAAI,CACtE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC;YAEnF,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAAuB,CAAC,sCAAsC,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS,CAAC;YAEtE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAI,aAAyC,EAAE,MAAM,CAAC;gBACvE,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBACpF,MAAM,IAAI,mCAAsB,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAClE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mCAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,oCAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtE,MAAM,IAAI,mCAAsB,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAClE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,YAAY,EAAE,YAAY;oBAC1B,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,oCAAuB,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF;AA/ID,kDA+IC"}

package/dist/index.d.ts

@@ -19,5 +19,5 @@ export type { HawcxOAuthErrorFields } from './errors';
 export { ClientAssertionSigner, CLIENT_ASSERTION_TYPE } from './client-assertion';
 export * from './delegation';
 export * from './stepup';
-export declare const VERSION = "5.1.0";
+export declare const VERSION = "6.0.0";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -44,5 +44,5 @@ Object.defineProperty(exports, "CLIENT_ASSERTION_TYPE", { enumerable: true, get:
 __exportStar(require("./delegation"), exports);
 // Step-up module
 __exportStar(require("./stepup"), exports);
-exports.VERSION = '5.1.0';
+exports.VERSION = '6.0.0';
 //# sourceMappingURL=index.js.map

package/dist/internal/url.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Structured URL validation and joining for security-relevant URLs
+ * (TOB-HSDK-13).
+ *
+ * Every URL the SDK sends a credential, a signed request, or an
+ * authorization code to — or fetches verification keys from — is built and
+ * checked here with the WHATWG `URL` parser instead of string concatenation
+ * and prefix/substring checks.  String concatenation lets a malformed base or
+ * path change the request host, e.g.
+ *
+ *   'https://api.hawcx.com' + '.attacker.example/v1/x'
+ *     → https://api.hawcx.com.attacker.example/v1/x
+ *   'https://api.hawcx.com' + '@attacker.example/v1/x'
+ *     → https://attacker.example/v1/x   (api.hawcx.com becomes userinfo)
+ *
+ * Invariants enforced by this module:
+ *  - A base URL is absolute, `https:` (or `http:` only for the exact loopback
+ *    hostnames `localhost`, `127.0.0.1`, `[::1]`), carries no userinfo, and no
+ *    query or fragment.
+ *  - A joined URL is built from a *relative path* only (leading `/`, not `//`,
+ *    no backslash, no whitespace/control characters, no fragment, and no
+ *    percent-encoded `/`, `.` or `\` in the path), and the
+ *    result is re-parsed and asserted to have exactly the base's origin and to
+ *    stay under the base's path prefix.  Any failure throws (fail closed).
+ *
+ * Not part of the public API (not re-exported from the package index).
+ */
+/** Builds the module-appropriate error for a rejected URL. */
+export type UrlErrorFactory = (message: string, cause?: unknown) => Error;
+/** True when `hostname` is one of the exact loopback hostnames. */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Parse `raw` and require it to be a secure absolute URL: `https:`, or
+ * `http:` only for an exact loopback hostname; no username/password.
+ *
+ * Query and fragment are permitted here (e.g. a discovered `jwks_uri` may
+ * legitimately carry a query); use {@link parseSecureBaseUrl} for a base that
+ * paths are appended to.
+ *
+ * @returns the parsed URL
+ */
+export declare function assertSecureUrl(label: string, raw: string, makeError: UrlErrorFactory): URL;
+/**
+ * A validated base URL that relative paths are joined onto.  `origin` and
+ * `pathPrefix` are derived from the parsed URL; `pathPrefix` has no trailing
+ * slash (`''` for a bare origin).
+ */
+export interface SecureBaseUrl {
+    readonly origin: string;
+    readonly pathPrefix: string;
+}
+/**
+ * Validate a base URL (see {@link assertSecureUrl}) and additionally reject a
+ * query or fragment, which would otherwise swallow any appended path.
+ */
+export declare function parseSecureBaseUrl(label: string, raw: string, makeError: UrlErrorFactory): SecureBaseUrl;
+/**
+ * Join a relative `path` onto a validated base and return the absolute URL
+ * string.  For a canonical base (lower-case host, no default port) this is
+ * byte-identical to the historical `base.replace(/\/$/, '') + path`.
+ *
+ * Throws unless `path` is a plain relative path and the result keeps the
+ * base's exact origin and stays under its path prefix.
+ */
+export declare function safeJoinUrl(base: SecureBaseUrl, path: string, label: string, makeError: UrlErrorFactory): string;
+//# sourceMappingURL=url.d.ts.map

package/dist/internal/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../../src/internal/url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;AAiB1E,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,GAAG,GAAG,CAsB3F;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,eAAe,GACzB,aAAa,CAYf;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,eAAe,GACzB,MAAM,CAyCR"}

package/dist/internal/url.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * Structured URL validation and joining for security-relevant URLs
+ * (TOB-HSDK-13).
+ *
+ * Every URL the SDK sends a credential, a signed request, or an
+ * authorization code to — or fetches verification keys from — is built and
+ * checked here with the WHATWG `URL` parser instead of string concatenation
+ * and prefix/substring checks.  String concatenation lets a malformed base or
+ * path change the request host, e.g.
+ *
+ *   'https://api.hawcx.com' + '.attacker.example/v1/x'
+ *     → https://api.hawcx.com.attacker.example/v1/x
+ *   'https://api.hawcx.com' + '@attacker.example/v1/x'
+ *     → https://attacker.example/v1/x   (api.hawcx.com becomes userinfo)
+ *
+ * Invariants enforced by this module:
+ *  - A base URL is absolute, `https:` (or `http:` only for the exact loopback
+ *    hostnames `localhost`, `127.0.0.1`, `[::1]`), carries no userinfo, and no
+ *    query or fragment.
+ *  - A joined URL is built from a *relative path* only (leading `/`, not `//`,
+ *    no backslash, no whitespace/control characters, no fragment, and no
+ *    percent-encoded `/`, `.` or `\` in the path), and the
+ *    result is re-parsed and asserted to have exactly the base's origin and to
+ *    stay under the base's path prefix.  Any failure throws (fail closed).
+ *
+ * Not part of the public API (not re-exported from the package index).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLoopbackHostname = isLoopbackHostname;
+exports.assertSecureUrl = assertSecureUrl;
+exports.parseSecureBaseUrl = parseSecureBaseUrl;
+exports.safeJoinUrl = safeJoinUrl;
+/** Exact hostnames (as reported by `URL#hostname`) allowed to use plain http. */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** C0 controls, space and DEL — stripped or rewritten silently by the URL parser. */
+// eslint-disable-next-line no-control-regex
+const CONTROL_OR_SPACE = /[\u0000- \u007f]/;
+/**
+ * Percent-encoded path separators and dots (`%2f`, `%2e`, `%5c`, any case).
+ * WHATWG resolves `%2e%2e` as a dot segment but leaves `%2f` encoded, so e.g.
+ * `/..%2fevil` keeps the origin yet lands outside the intended prefix once a
+ * server or proxy decodes it.  No legitimate endpoint needs these.
+ */
+const ENCODED_SEPARATOR_OR_DOT = /%(2f|2e|5c)/i;
+/** True when `hostname` is one of the exact loopback hostnames. */
+function isLoopbackHostname(hostname) {
+    return LOOPBACK_HOSTNAMES.has(hostname);
+}
+/**
+ * Parse `raw` and require it to be a secure absolute URL: `https:`, or
+ * `http:` only for an exact loopback hostname; no username/password.
+ *
+ * Query and fragment are permitted here (e.g. a discovered `jwks_uri` may
+ * legitimately carry a query); use {@link parseSecureBaseUrl} for a base that
+ * paths are appended to.
+ *
+ * @returns the parsed URL
+ */
+function assertSecureUrl(label, raw, makeError) {
+    if (typeof raw !== 'string' || raw.length === 0) {
+        throw makeError(`${label} must be a non-empty URL string`);
+    }
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch (err) {
+        throw makeError(`${label} is not a valid URL: ${raw}`, err);
+    }
+    if (u.username !== '' || u.password !== '') {
+        throw makeError(`${label} must not contain credentials (userinfo): ${redact(u)}`);
+    }
+    if (u.protocol === 'https:') {
+        return u;
+    }
+    if (u.protocol === 'http:' && isLoopbackHostname(u.hostname)) {
+        return u;
+    }
+    throw makeError(`${label} must use https (got: ${raw}). Plaintext http is permitted only for loopback hosts.`);
+}
+/**
+ * Validate a base URL (see {@link assertSecureUrl}) and additionally reject a
+ * query or fragment, which would otherwise swallow any appended path.
+ */
+function parseSecureBaseUrl(label, raw, makeError) {
+    const u = assertSecureUrl(label, raw, makeError);
+    // `u.search`/`u.hash` are '' for both "no ?" and a bare trailing "?", so
+    // check the raw string too.
+    if (u.search !== '' || u.hash !== '' || raw.includes('?') || raw.includes('#')) {
+        throw makeError(`${label} must not contain a query or fragment: ${raw}`);
+    }
+    // Strip a single trailing slash — the same normalisation the SDK has always
+    // applied with `.replace(/\/$/, '')` — so valid bases join to the exact same
+    // string as before.
+    const pathPrefix = u.pathname.replace(/\/$/, '');
+    return { origin: u.origin, pathPrefix };
+}
+/**
+ * Join a relative `path` onto a validated base and return the absolute URL
+ * string.  For a canonical base (lower-case host, no default port) this is
+ * byte-identical to the historical `base.replace(/\/$/, '') + path`.
+ *
+ * Throws unless `path` is a plain relative path and the result keeps the
+ * base's exact origin and stays under its path prefix.
+ */
+function safeJoinUrl(base, path, label, makeError) {
+    if (typeof path !== 'string' || !path.startsWith('/')) {
+        throw makeError(`${label} must be a relative path starting with '/' (got: ${String(path)})`);
+    }
+    if (path.startsWith('//')) {
+        throw makeError(`${label} must not be scheme-relative ('//'): ${path}`);
+    }
+    if (path.includes('\\')) {
+        throw makeError(`${label} must not contain a backslash: ${path}`);
+    }
+    if (CONTROL_OR_SPACE.test(path)) {
+        throw makeError(`${label} must not contain whitespace or control characters`);
+    }
+    if (path.includes('#')) {
+        throw makeError(`${label} must not contain a fragment: ${path}`);
+    }
+    // Path part only: a query string cannot move the origin or the path.
+    const pathPart = path.split('?', 1)[0];
+    if (ENCODED_SEPARATOR_OR_DOT.test(pathPart)) {
+        throw makeError(`${label} must not contain percent-encoded '/', '.' or '\\' in its path: ${path}`);
+    }
+    // Build from the parsed origin + prefix, never from the caller's raw base
+    // string: the path always begins after a complete authority.
+    let joined;
+    try {
+        joined = new URL(base.origin + base.pathPrefix + path);
+    }
+    catch (err) {
+        throw makeError(`${label} produced an invalid URL`, err);
+    }
+    // Fail closed: the request must not leave the configured origin…
+    if (joined.origin !== base.origin || joined.username !== '' || joined.password !== '') {
+        throw makeError(`${label} resolves outside the configured origin ${base.origin}`);
+    }
+    // …nor climb out of the configured path prefix via dot segments
+    // (including percent-encoded `%2e%2e`, which the URL parser resolves).
+    if (base.pathPrefix !== '' && !joined.pathname.startsWith(base.pathPrefix + '/')) {
+        throw makeError(`${label} resolves outside the configured base path ${base.pathPrefix}`);
+    }
+    return joined.href;
+}
+/** Render a URL for an error message with any credentials removed. */
+function redact(u) {
+    const copy = new URL(u.href);
+    copy.username = '';
+    copy.password = '';
+    return copy.href;
+}
+//# sourceMappingURL=url.js.map

package/dist/internal/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/internal/url.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AAqBH,gDAEC;AAYD,0CAsBC;AAgBD,gDAgBC;AAUD,kCA8CC;AA5ID,iFAAiF;AACjF,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7F,qFAAqF;AACrF,4CAA4C;AAC5C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEhD,mEAAmE;AACnE,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,KAAa,EAAE,GAAW,EAAE,SAA0B;IACpF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,CAAC,GAAG,KAAK,wBAAwB,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,CAAC,GAAG,KAAK,6CAA6C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,SAAS,CACb,GAAG,KAAK,yBAAyB,GAAG,yDAAyD,CAC9F,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,KAAa,EACb,GAAW,EACX,SAA0B;IAE1B,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjD,yEAAyE;IACzE,4BAA4B;IAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/E,MAAM,SAAS,CAAC,GAAG,KAAK,0CAA0C,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,oBAAoB;IACpB,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CACzB,IAAmB,EACnB,IAAY,EACZ,KAAa,EACb,SAA0B;IAE1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,SAAS,CAAC,GAAG,KAAK,oDAAoD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,CAAC,GAAG,KAAK,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,CAAC,GAAG,KAAK,kCAAkC,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,CAAC,GAAG,KAAK,iCAAiC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,CAAC,GAAG,KAAK,mEAAmE,IAAI,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,CAAC,GAAG,KAAK,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,iEAAiE;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACtF,MAAM,SAAS,CAAC,GAAG,KAAK,2CAA2C,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,gEAAgE;IAChE,uEAAuE;IACvE,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,SAAS,CAAC,GAAG,KAAK,8CAA8C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,sEAAsE;AACtE,SAAS,MAAM,CAAC,CAAM;IACpB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC"}