@hawcx/oauth-client 5.2.0 → 6.0.0

package/CHANGELOG.md

@@ -5,6 +5,232 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [6.0.0] - 2026-10-10
+
+First public release since 5.2.0. **Major version** because of the BREAKING
+entries below, which change behaviour for configurations that 5.2.0 accepted.
+It contains everything from the internal release candidates 6.0.0-rc.1 and
+6.0.0-rc.2, plus one fix to `ClientAssertionSigner` made after rc.2.
+
+### Breaking — action needed when upgrading from 5.2.0
+
+- **Management API response signatures are verified by default
+  (TOB-HSDK-11).** `JwtBearerTransport` and `StepUpClient.withPrivateKeyJwt`
+  now verify `X-Response-Signature` on every successful response. This
+  reverses the 5.2.0 note that callers "may" verify the header themselves.
+  The SDK checks the following:
+  - the JWS uses ES256, ES384 or ES512 and verifies against
+    `${issuer}/.well-known/jwks.json`;
+  - `iat` is within `clockSkewSeconds` (default 300);
+  - `body_sha256` matches the exact response bytes;
+  - the token carries no `aud`, `sub` or `nonce`.
+
+  Responses with status 400 and above are not verified. hx_auth signs every
+  jwt-mode 2xx, so production traffic is unaffected. **Action needed** if any
+  of these apply:
+  - A gateway, CDN or proxy strips response headers. Every call fails with
+    `ResponseSignatureInvalidError`; let `X-Response-Signature` through.
+  - Mocks, stubs or contract-test harnesses built against 5.2.0 return
+    unsigned 2xx responses. Sign the responses, or disable verification in the
+    test harness.
+  - `baseUrl` is not the OP host, such as an internal service URL or local dev
+    with separate ports. The JWKS is fetched from `baseUrl` by default, so set
+    `issuer`.
+- **`baseUrl` (and `issuer`) values that used to be accepted now throw at
+  construction (TOB-HSDK-13).** The affected classes are `JwtBearerTransport`
+  and `StepUpClient.withPrivateKeyJwt` (`DelegationRequestError`),
+  `DelegationTransport` and the `DelegationClient`/`StepUpClient` ECIES
+  factories (`DelegationRequestError`), legacy `HawcxOAuth`
+  (`HawcxOAuthError`), and `HawcxOAuth.fromIssuer` (`DiscoveryError`):
+  - **Plain `http:` on a non-loopback host.** Examples:
+    `http://hawcx-api:8080` (docker-compose service name),
+    `http://0.0.0.0:8080`, `http://host.docker.internal:8080`, and in-cluster
+    service URLs behind a TLS-terminating gateway. Only `localhost`,
+    `127.0.0.1` and `[::1]` may use `http:`. **Action needed:** use `https:`,
+    or point the SDK at a loopback address.
+  - **Userinfo, query or fragment in the base.** For example
+    `https://user:pw@api.hawcx.com`, `https://api.hawcx.com?tenant=x` or
+    `https://api.hawcx.com#x`. **Action needed:** remove them.
+- **The signed JWT `aud` string changes for non-canonical base spellings
+  (TOB-HSDK-13).** Host case and default ports are now normalised, so
+  `baseUrl: 'https://API.Hawcx.com:443'` produces
+  `aud = https://api.hawcx.com/v1/...`, where 5.2.0 produced
+  `https://API.Hawcx.com:443/v1/...`. The new value is the one `fetch`
+  actually sends. **Action needed** only if a server compares `aud` by exact
+  string against a configured non-canonical value: update that value, or use
+  a canonical `baseUrl`. Canonical bases (lower-case host, no default port,
+  with or without a trailing slash or a path prefix) produce byte-identical
+  URLs and `aud`.
+
+### Added
+
+- New options on `JwtBearerTransport` and `StepUpClient.withPrivateKeyJwt`:
+  `issuer` (defaults to `baseUrl`), `verifyResponseSignature` (defaults to
+  `true`) and `clockSkewSeconds`. `verifyResponseSignature: false` is an
+  **emergency escape hatch** that restores the 5.2.0 behaviour and emits a
+  one-time process warning. `withPrivateKeyJwt` now also passes
+  `clockSkewSeconds` through to the transport.
+- New error classes, both subclasses of `DelegationResponseError`, exported
+  with a stable `code`:
+  - `ResponseSignatureInvalidError` (`response_signature_invalid`).
+  - `ResponseSignatureUnavailableError` (`response_signature_unavailable`).
+    It means the signing keys could not be fetched, and **the request may
+    already have been applied** server-side.
+
+### Changed
+
+- Every security-relevant URL is now parsed and joined with the WHATWG `URL`
+  API rather than by string concatenation (TOB-HSDK-13). This covers
+  `JwtBearerTransport` and `DelegationTransport` (`baseUrl` + endpoint),
+  legacy `new HawcxOAuth({ baseUrl })` (`/oauth2/token` and `/keys`), and the
+  `fromIssuer` issuer and discovery URL. Each joined URL must keep the base's
+  origin and stay under the base path prefix, or the SDK throws (fail
+  closed). An endpoint must be a relative path that starts with a single
+  `/`. It may not contain `//`, a backslash, whitespace or control
+  characters, a fragment, or a percent-encoded `/`, `.` or `\` (`%2f`,
+  `%2e`, `%5c`, any case) in its path.
+- Discovered `token_endpoint` and `jwks_uri` values carrying userinfo are now
+  rejected (`DiscoveryError`).
+- The `clearCache()` deprecation warning now says it will be removed in a
+  future major version rather than in 6.0.0. It is still deprecated (use
+  `refreshJwks()`) and still present in 6.0.0.
+
+### Fixed
+
+- **Discovery mode now sends `client_id` on the public-client (PKCE) token
+  exchange.** Previously `exchangeCode()` added `client_id` to the token form
+  only when a `private_key_jwt` signer was set; a public PKCE exchange sent
+  only the `X-Config-Id` header. The OP then fell back to the project's
+  default client (`token.legacy_config_id_fallback`) and stamped the id_token
+  `aud` with that client's id, so on a project with more than one public OIDC
+  client, an app using a non-default client failed verification with
+  "Unexpected JWT audience". `exchangeCode()` now always sends the configured
+  `clientId` as `client_id` in discovery mode (RFC 6749 §4.1.3), for public
+  and `private_key_jwt` clients alike; the OP resolves that specific client
+  and stamps `aud` with it. `X-Config-Id` is still sent.
+  - Single-client projects are unaffected: their `clientId` is the default
+    client, so the resolved client and `aud` are the same as before.
+  - Legacy mode (`new HawcxOAuth({ configId, baseUrl })`) has no `clientId`
+    and is unchanged: it sends no `client_id`.
+- `ClientAssertionSigner.sign()` now reads the clock once for `iat` and `exp`.
+  Two separate reads could straddle a second boundary and make the assertion
+  one second longer than its lifetime; at `withLifetimeSeconds(120)` that
+  exceeds the OP's 120s cap and the token exchange is rejected.
+
+## [6.0.0-rc.2] - 2026-10-10
+
+> **Release candidate, internal only.** Published to AWS CodeArtifact
+> (`npm-internal`), not public npm; the release workflow refuses to publish a
+> prerelease publicly. Contains everything in 6.0.0-rc.1 plus the fix below.
+> To install, point the `@hawcx` scope at CodeArtifact
+> (`aws codeartifact login --tool npm --domain hawcx --repository npm-internal --namespace @hawcx`)
+> and run `npm install @hawcx/oauth-client@6.0.0-rc.2`.
+
+### Fixed
+
+- **Discovery mode now sends `client_id` on the public-client (PKCE) token
+  exchange.** Previously `exchangeCode()` added `client_id` to the token form
+  only when a `private_key_jwt` signer was set; a public PKCE exchange sent
+  only the `X-Config-Id` header. The OP then fell back to the project's
+  default client (`token.legacy_config_id_fallback`) and stamped the id_token
+  `aud` with that client's id, so on a project with more than one public OIDC
+  client, an app using a non-default client failed verification with
+  "Unexpected JWT audience". `exchangeCode()` now always sends the configured
+  `clientId` as `client_id` in discovery mode (RFC 6749 §4.1.3), for public
+  and `private_key_jwt` clients alike; the OP resolves that specific client
+  and stamps `aud` with it. `X-Config-Id` is still sent.
+  - Single-client projects are unaffected: their `clientId` is the default
+    client, so the resolved client and `aud` are the same as before.
+  - Legacy mode (`new HawcxOAuth({ configId, baseUrl })`) has no `clientId`
+    and is unchanged: it sends no `client_id`.
+
+## [6.0.0-rc.1] - 2026-10-07
+
+> **Release candidate, internal only.** Published to AWS CodeArtifact
+> (`npm-internal`), not public npm; the release workflow refuses to publish a
+> prerelease publicly. **Major version** because of the BREAKING entries below,
+> which change behaviour for configurations that 5.2.0 accepted. To install,
+> point the `@hawcx` scope at CodeArtifact
+> (`aws codeartifact login --tool npm --domain hawcx --repository npm-internal --namespace @hawcx`)
+> and run `npm install @hawcx/oauth-client@6.0.0-rc.1`.
+
+### Security — management API response signatures are verified by default (TOB-HSDK-11)
+
+- **BREAKING — `JwtBearerTransport` and `StepUpClient.withPrivateKeyJwt` now
+  verify `X-Response-Signature` on every successful response, and this is on
+  by default.** This reverses the 5.2.0 note that callers "may" verify the
+  header themselves. The SDK checks the following:
+  - the JWS uses ES256, ES384 or ES512 and verifies against
+    `${issuer}/.well-known/jwks.json`;
+  - `iat` is within `clockSkewSeconds` (default 300);
+  - `body_sha256` matches the exact response bytes;
+  - the token carries no `aud`, `sub` or `nonce`.
+
+  Responses with status 400 and above are not verified. hx_auth signs every
+  jwt-mode 2xx, so production traffic is unaffected. The following will
+  **break**:
+  - A gateway, CDN or proxy that strips response headers. Every call fails
+    with `ResponseSignatureInvalidError`.
+  - Customer mocks, stubs and contract-test harnesses built against 5.2.0 that
+    return unsigned 2xx responses. Sign the responses, or disable verification
+    in the test harness.
+  - A `baseUrl` that is not the OP host, such as an internal service URL or
+    local dev with separate ports. The JWKS is fetched from `baseUrl` by
+    default, so set `issuer`.
+- New options on both: `issuer` (defaults to `baseUrl`),
+  `verifyResponseSignature` (defaults to `true`) and `clockSkewSeconds`.
+  `verifyResponseSignature: false` is an **emergency escape hatch** that
+  restores the 5.2.0 behaviour and emits a one-time process warning.
+  `withPrivateKeyJwt` now also passes `clockSkewSeconds` through to the
+  transport.
+- New error classes, both subclasses of `DelegationResponseError`, exported
+  with a stable `code`:
+  - `ResponseSignatureInvalidError` (`response_signature_invalid`).
+  - `ResponseSignatureUnavailableError` (`response_signature_unavailable`).
+    It means the signing keys could not be fetched, and **the request may
+    already have been applied** server-side.
+
+### Security — structured URL validation and joining (TOB-HSDK-13)
+
+- Every security-relevant URL is now parsed and joined with the WHATWG `URL`
+  API rather than by string concatenation. This covers `JwtBearerTransport`
+  and `DelegationTransport` (`baseUrl` + endpoint), legacy
+  `new HawcxOAuth({ baseUrl })` (`/oauth2/token` and `/keys`), and the
+  `fromIssuer` issuer and discovery URL. Each joined URL must keep the base's
+  origin and stay under the base path prefix, or the SDK throws (fail
+  closed). An endpoint must be a relative path that starts with a single
+  `/`. It may not contain `//`, a backslash, whitespace or control
+  characters, a fragment, or a percent-encoded `/`, `.` or `\` (`%2f`,
+  `%2e`, `%5c`, any case) in its path.
+- **BREAKING — `baseUrl` (and `issuer`) values that used to be accepted now
+  throw at construction.** The affected classes are `JwtBearerTransport` and
+  `StepUpClient.withPrivateKeyJwt` (`DelegationRequestError`),
+  `DelegationTransport` and the `DelegationClient`/`StepUpClient`
+  ECIES factories (`DelegationRequestError`), legacy `HawcxOAuth`
+  (`HawcxOAuthError`), and `HawcxOAuth.fromIssuer` (`DiscoveryError`):
+  - **Plain `http:` on a non-loopback host.** Examples:
+    `http://hawcx-api:8080` (docker-compose service name),
+    `http://0.0.0.0:8080`, `http://host.docker.internal:8080`, and in-cluster
+    service URLs behind a TLS-terminating gateway. Only `localhost`,
+    `127.0.0.1` and `[::1]` may use `http:`. Use `https:`, or point the SDK
+    at a loopback address.
+  - **Userinfo, query or fragment in the base.** For example
+    `https://user:pw@api.hawcx.com`, `https://api.hawcx.com?tenant=x` or
+    `https://api.hawcx.com#x`.
+- **BREAKING — the signed JWT `aud` string changes for non-canonical base
+  spellings.** Host case and default ports are now normalised, so
+  `baseUrl: 'https://API.Hawcx.com:443'` produces
+  `aud = https://api.hawcx.com/v1/...`, where 5.2.0 produced
+  `https://API.Hawcx.com:443/v1/...`. The new value is the one `fetch`
+  actually sends. A server that compares `aud` by exact string against a
+  configured non-canonical value will reject the new form. Canonical bases
+  (lower-case host, no default port, with or without a trailing slash or a
+  path prefix) produce byte-identical URLs and `aud`.
+- Discovered `token_endpoint` and `jwks_uri` values carrying userinfo are now
+  rejected (`DiscoveryError`).
+
 ## [5.2.0] - 2026-06-26
 
 ### Added — Management API authentication via `private_key_jwt` (Path A)

package/README.md

@@ -479,6 +479,36 @@ object, a PKCS#8 PEM string, or a pre-imported jose `KeyLike`.
 Each request is signed with a short-lived per-request EdDSA JWT whose `aud` is the
 full request URL and whose `body_sha256` claim covers the exact bytes sent.
 
+Every successful response is authenticated too. The SDK verifies the
+`X-Response-Signature` JWS (ES256/ES384/ES512) against
+`${issuer}/.well-known/jwks.json`. It also checks that the JWS `iat` is within
+`clockSkewSeconds` (default 300) and that its `body_sha256` matches the exact
+response bytes. `issuer` defaults to `baseUrl`, because the management API and
+the OP share a host in every Hawcx environment. Set `issuer` explicitly if they
+differ, for example in local development.
+
+> **Scope:** by default the JWKS comes from the **same origin as the API**.
+> Verification therefore protects against tampering *between* that origin and
+> you: caches, proxies and gateways, or a compromised downstream service. It
+> does **not** protect against a compromised origin. If you need that, pin
+> `issuer` to a separately trusted host.
+
+Failures throw one of two subclasses of `DelegationResponseError`, each with a
+stable `code`:
+
+- `ResponseSignatureInvalidError` (`code: 'response_signature_invalid'`): the
+  header is missing or empty, or the signature does not verify. Treat the
+  response as untrusted.
+- `ResponseSignatureUnavailableError` (`code: 'response_signature_unavailable'`):
+  the signing keys could not be obtained. The JWKS fetch failed, timed out or
+  returned something unusable, or a newly rotated `kid` arrived while refetching
+  was cooling down. **The server has already processed the request**, so a
+  non-idempotent write such as `consumeReceipt` may have been applied. Reconcile
+  state rather than retrying blindly.
+
+`verifyResponseSignature: false` turns verification off. It is an emergency
+escape hatch only, and it logs a one-time process warning.
+
 ### Methods
 
 #### `stepUp.startToken(options): Promise<StepUpStartTokenResponse>`

package/dist/client-assertion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-assertion.d.ts","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAmC,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAKjE,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,2DACwB,CAAC;AAK3D,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,iEAAiE;IACjE,OAAO,CAAC,UAAU,CAAC,CAAuB;IAE1C,OAAO;IAUP;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,GAAG,MAAM,GAAG,qBAAqB;IA0BtE;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB;IAkB3E;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB;IAazE;;;;OAIG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB;IAK3D,OAAO,CAAC,SAAS;IAYjB;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAYhE"}
+{"version":3,"file":"client-assertion.d.ts","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAmC,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAKjE,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,2DACwB,CAAC;AAK3D,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,iEAAiE;IACjE,OAAO,CAAC,UAAU,CAAC,CAAuB;IAE1C,OAAO;IAUP;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,GAAG,MAAM,GAAG,qBAAqB;IA0BtE;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB;IAkB3E;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB;IAazE;;;;OAIG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB;IAK3D,OAAO,CAAC,SAAS;IAYjB;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAgBhE"}

package/dist/client-assertion.js

@@ -119,13 +119,17 @@ class ClientAssertionSigner {
      */
     async sign(clientId, audience) {
         const key = await this.importKey();
+        // One clock read for both claims: separate reads can straddle a second
+        // boundary and make exp - iat one second longer than the lifetime, which at
+        // the 120s maximum exceeds the OP's cap.
+        const now = Math.floor(Date.now() / 1000);
         return new jose_1.SignJWT({})
             .setProtectedHeader({ alg: 'EdDSA', typ: 'JWT', kid: this.kid })
             .setIssuer(clientId)
             .setSubject(clientId)
             .setAudience(audience)
-            .setIssuedAt()
-            .setExpirationTime(`${this.lifetimeSeconds}s`)
+            .setIssuedAt(now)
+            .setExpirationTime(now + this.lifetimeSeconds)
             .setJti((0, node_crypto_1.randomUUID)())
             .sign(key);
     }

package/dist/client-assertion.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-assertion.js","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,6CAAyC;AAEzC,+BAAiE;AAKjE,qEAAqE;AACxD,QAAA,qBAAqB,GAChC,wDAAwD,CAAC;AAE3D,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,oBAAoB,GAAG,GAAG,CAAC,CAAC,qCAAqC;AAEvE,MAAa,qBAAqB;IAOhC,YACE,WAAuC,EACvC,GAAW,EACX,eAAuB;QAEvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,UAAwB;QAC5C,IAAI,GAAQ,CAAC;QACb,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAQ,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAgB,EAAE,GAAW;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,OAAO,IAAI,qBAAqB,CAC9B,KAAK,IAAI,EAAE;YACT,IAAI,GAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAA,kBAAW,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,GAAG,CAAC;QACb,CAAC,EACD,GAAG,EACH,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,UAAqB,EAAE,GAAW;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAC5E,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAQ,CAAC;QACxD,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACjG,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,OAAe;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,yEAAyE;YACzE,uEAAuE;YACvE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAC1D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC5B,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,QAAgB;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,OAAO,IAAI,cAAO,CAAC,EAAE,CAAC;aACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC/D,SAAS,CAAC,QAAQ,CAAC;aACnB,UAAU,CAAC,QAAQ,CAAC;aACpB,WAAW,CAAC,QAAQ,CAAC;aACrB,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,IAAI,CAAC,eAAe,GAAG,CAAC;aAC7C,MAAM,CAAC,IAAA,wBAAU,GAAE,CAAC;aACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;CACF;AAjID,sDAiIC;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,kFAAkF;IAClF,MAAM,IAAI,GAAI,GAA0B,CAAC,iBAAiB,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}
+{"version":3,"file":"client-assertion.js","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,6CAAyC;AAEzC,+BAAiE;AAKjE,qEAAqE;AACxD,QAAA,qBAAqB,GAChC,wDAAwD,CAAC;AAE3D,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,oBAAoB,GAAG,GAAG,CAAC,CAAC,qCAAqC;AAEvE,MAAa,qBAAqB;IAOhC,YACE,WAAuC,EACvC,GAAW,EACX,eAAuB;QAEvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,UAAwB;QAC5C,IAAI,GAAQ,CAAC;QACb,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAQ,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,UAAU,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACpB,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,QAAgB,EAAE,GAAW;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,OAAO,IAAI,qBAAqB,CAC9B,KAAK,IAAI,EAAE;YACT,IAAI,GAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAA,kBAAW,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,GAAG,CAAC;QACb,CAAC,EACD,GAAG,EACH,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,UAAqB,EAAE,GAAW;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAC5E,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAQ,CAAC;QACxD,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACjG,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,OAAe;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,yEAAyE;YACzE,uEAAuE;YACvE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAC1D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC5B,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,QAAgB;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,uEAAuE;QACvE,4EAA4E;QAC5E,yCAAyC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,OAAO,IAAI,cAAO,CAAC,EAAE,CAAC;aACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC/D,SAAS,CAAC,QAAQ,CAAC;aACnB,UAAU,CAAC,QAAQ,CAAC;aACpB,WAAW,CAAC,QAAQ,CAAC;aACrB,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC;aAC7C,MAAM,CAAC,IAAA,wBAAU,GAAE,CAAC;aACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;CACF;AArID,sDAqIC;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,kFAAkF;IAClF,MAAM,IAAI,GAAI,GAA0B,CAAC,iBAAiB,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/delegation/exceptions.d.ts

@@ -36,4 +36,38 @@ export declare class DelegationRequestError extends DelegationError {
 export declare class DelegationResponseError extends DelegationError {
     constructor(message: string, options?: DelegationErrorOptions);
 }
+/**
+ * Stable machine-readable reasons for management-API response-signature
+ * failures (TOB-HSDK-11).  See {@link ResponseSignatureInvalidError} and
+ * {@link ResponseSignatureUnavailableError}.
+ */
+export type ResponseSignatureErrorCode = 'response_signature_invalid' | 'response_signature_unavailable';
+/**
+ * The management API response's `X-Response-Signature` is missing, empty, or
+ * does not verify (bad signature, disallowed `alg`, kid absent from a freshly
+ * fetched JWKS, stale/future `iat`, body hash mismatch, wrong token type).
+ * Treat the response as untrusted.
+ */
+export declare class ResponseSignatureInvalidError extends DelegationResponseError {
+    readonly code: ResponseSignatureErrorCode;
+    constructor(message: string, options?: DelegationErrorOptions);
+}
+/**
+ * The response signature could not be checked because the verification
+ * infrastructure was unavailable: the issuer JWKS fetch failed or timed out,
+ * returned a non-200 or malformed document, or the signing `kid` was unknown
+ * while a refetch was suppressed by the JWKS refetch cooldown (e.g. during
+ * key rotation).
+ *
+ * **The server already processed the request.**  For a non-idempotent write
+ * (e.g. `StepUpClient.consumeReceipt`) the operation may have been applied
+ * even though this error is thrown — reconcile state rather than blindly
+ * retrying.  This error does NOT imply the response was genuine: its body is
+ * never returned, and an on-path party that can inject responses can also
+ * induce this error (e.g. with an unknown `kid`).
+ */
+export declare class ResponseSignatureUnavailableError extends DelegationResponseError {
+    readonly code: ResponseSignatureErrorCode;
+    constructor(message: string, options?: DelegationErrorOptions);
+}
 //# sourceMappingURL=exceptions.d.ts.map

package/dist/delegation/exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/delegation/exceptions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,eAAgB,SAAQ,eAAe;IAClD,SAAgB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAMlE;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;gBAGpB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAAsB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO;IASvF,QAAQ,IAAI,MAAM;CAOnB;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;gBAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE"}
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/delegation/exceptions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,eAAgB,SAAQ,eAAe;IAClD,SAAgB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAMlE;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;gBAGpB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAAsB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO;IASvF,QAAQ,IAAI,MAAM;CAOnB;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;gBAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE;AAED;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,4BAA4B,GAAG,gCAAgC,CAAC;AAEzG;;;;;GAKG;AACH,qBAAa,6BAA8B,SAAQ,uBAAuB;IACxE,SAAgB,IAAI,EAAE,0BAA0B,CAAgC;gBAEpE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iCAAkC,SAAQ,uBAAuB;IAC5E,SAAgB,IAAI,EAAE,0BAA0B,CAAoC;gBAExE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,sBAA2B;CAKlE"}

package/dist/delegation/exceptions.js

@@ -3,7 +3,7 @@
  * Custom exceptions for the Delegation module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = void 0;
+exports.ResponseSignatureUnavailableError = exports.ResponseSignatureInvalidError = exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = void 0;
 const errors_1 = require("../errors");
 class DelegationError extends errors_1.HawcxOAuthError {
     constructor(message, options = {}) {
@@ -56,4 +56,42 @@ class DelegationResponseError extends DelegationError {
     }
 }
 exports.DelegationResponseError = DelegationResponseError;
+/**
+ * The management API response's `X-Response-Signature` is missing, empty, or
+ * does not verify (bad signature, disallowed `alg`, kid absent from a freshly
+ * fetched JWKS, stale/future `iat`, body hash mismatch, wrong token type).
+ * Treat the response as untrusted.
+ */
+class ResponseSignatureInvalidError extends DelegationResponseError {
+    constructor(message, options = {}) {
+        super(message, options);
+        this.code = 'response_signature_invalid';
+        this.name = 'ResponseSignatureInvalidError';
+        Object.setPrototypeOf(this, ResponseSignatureInvalidError.prototype);
+    }
+}
+exports.ResponseSignatureInvalidError = ResponseSignatureInvalidError;
+/**
+ * The response signature could not be checked because the verification
+ * infrastructure was unavailable: the issuer JWKS fetch failed or timed out,
+ * returned a non-200 or malformed document, or the signing `kid` was unknown
+ * while a refetch was suppressed by the JWKS refetch cooldown (e.g. during
+ * key rotation).
+ *
+ * **The server already processed the request.**  For a non-idempotent write
+ * (e.g. `StepUpClient.consumeReceipt`) the operation may have been applied
+ * even though this error is thrown — reconcile state rather than blindly
+ * retrying.  This error does NOT imply the response was genuine: its body is
+ * never returned, and an on-path party that can inject responses can also
+ * induce this error (e.g. with an unknown `kid`).
+ */
+class ResponseSignatureUnavailableError extends DelegationResponseError {
+    constructor(message, options = {}) {
+        super(message, options);
+        this.code = 'response_signature_unavailable';
+        this.name = 'ResponseSignatureUnavailableError';
+        Object.setPrototypeOf(this, ResponseSignatureUnavailableError.prototype);
+    }
+}
+exports.ResponseSignatureUnavailableError = ResponseSignatureUnavailableError;
 //# sourceMappingURL=exceptions.js.map

package/dist/delegation/exceptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/delegation/exceptions.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,sCAA4C;AAS5C,MAAa,eAAgB,SAAQ,wBAAe;IAGlD,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;CACF;AATD,0CASC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,eAAe;IACxD,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF;AAND,sDAMC;AAED;;GAEG;AACH,MAAa,sBAAuB,SAAQ,eAAe;IAIzD,YACE,OAAe,EACf,UAAmF,EAAE;QAErF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,QAAQ;QACN,IAAI,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,GAAG,GAAG,IAAI,UAAU,IAAI,CAAC,UAAU,GAAG,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAtBD,wDAsBC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACF;AAND,0DAMC"}
+{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/delegation/exceptions.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,sCAA4C;AAS5C,MAAa,eAAgB,SAAQ,wBAAe;IAGlD,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;CACF;AATD,0CASC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,eAAe;IACxD,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF;AAND,sDAMC;AAED;;GAEG;AACH,MAAa,sBAAuB,SAAQ,eAAe;IAIzD,YACE,OAAe,EACf,UAAmF,EAAE;QAErF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,QAAQ;QACN,IAAI,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,GAAG,GAAG,IAAI,UAAU,IAAI,CAAC,UAAU,GAAG,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAtBD,wDAsBC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACF;AAND,0DAMC;AASD;;;;;GAKG;AACH,MAAa,6BAA8B,SAAQ,uBAAuB;IAGxE,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAHV,SAAI,GAA+B,4BAA4B,CAAC;QAI9E,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;CACF;AARD,sEAQC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAa,iCAAkC,SAAQ,uBAAuB;IAG5E,YAAY,OAAe,EAAE,UAAkC,EAAE;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAHV,SAAI,GAA+B,gCAAgC,CAAC;QAIlF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;QAChD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iCAAiC,CAAC,SAAS,CAAC,CAAC;IAC3E,CAAC;CACF;AARD,8EAQC"}

package/dist/delegation/hawcx.d.ts

@@ -49,11 +49,15 @@ export interface DeviceOperationOptions {
     deviceId: string;
 }
 export interface DelegationRequestOptions<TPayload extends JsonObject> {
-    /** API endpoint path (e.g., "/hc_auth/v5/update/initiate") */
+    /**
+     * API endpoint path relative to the base URL (e.g., "/hc_auth/v5/update/initiate").
+     * Must start with a single "/". When `includeBaseUrl` is false this is an
+     * absolute https URL instead.
+     */
     endpoint: string;
     /** Request payload dictionary to be encrypted and sent */
     payload: TPayload;
-    /** If true, prepends base_url to endpoint (default: true) */
+    /** If true, joins endpoint onto the base URL (default: true) */
     includeBaseUrl?: boolean;
     /** Optional additional HTTP headers (e.g., API keys) */
     headers?: Record<string, string>;

package/dist/delegation/hawcx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hawcx.d.ts","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAuD,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGvG,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,qBAAqB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB,CAAC,QAAQ,SAAS,UAAU;IACnE,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,MAAM,CAAC,CAAS;IAExB,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE;QAAE,SAAS,EAAE,mBAAmB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAMzF,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,gCAAgC,GAAG,gBAAgB;IAMjF,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,gBAAgB;IAMtE,OAAO,CAAC,gBAAgB;IAQlB,OAAO,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EAC5D,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKhB,SAAgB,GAAG;4BACS,kBAAkB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAmC1C,gBAAgB,KAAG,OAAO,CAAC,UAAU,CAAC;MAkB9D;IAEF,SAAgB,KAAK;iCACY,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;MAO3D;IAEF,SAAgB,OAAO;uBACA,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;0BAOzB,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;4BAO1C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAO9C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;MAOpE;CACH"}
+{"version":3,"file":"hawcx.d.ts","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAuD,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGvG,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,2BAA2B;IACnF,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,qBAAqB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB,CAAC,QAAQ,SAAS,UAAU;IACnE;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,MAAM,CAAC,CAAS;IAExB,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE;QAAE,SAAS,EAAE,mBAAmB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAMzF,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,gCAAgC,GAAG,gBAAgB;IAMjF,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,gBAAgB;IAMtE,OAAO,CAAC,gBAAgB;IAQlB,OAAO,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EAC5D,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKhB,SAAgB,GAAG;4BACS,kBAAkB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAmC1C,gBAAgB,KAAG,OAAO,CAAC,UAAU,CAAC;MAkB9D;IAEF,SAAgB,KAAK;iCACY,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;MAO3D;IAEF,SAAgB,OAAO;uBACA,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;0BAOzB,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;4BAO1C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;0BAO9C,sBAAsB,KAAG,OAAO,CAAC,UAAU,CAAC;MAOpE;CACH"}

package/dist/delegation/hawcx.js.map

@@ -1 +1 @@
-{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,uCAAuG;AACvG,6CAAsD;AAEtD,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AA4DD,MAAa,gBAAgB;IAM3B,YAAY,OAA6E;QAiCzE,QAAG,GAAG;YACpB,QAAQ,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhE,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAErE,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,mCAAsB,CAC9B,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;gBAED,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnD,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,YAAY;iBACzB,CAAC;gBAEF,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;gBAChC,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;gBACzC,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAAyB,EAAuB,EAAE;gBAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;gBAE3C,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,mCAAsB,CAAC,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,OAAO,GAAG;oBACd,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,SAAS;oBACrB,GAAG;iBACJ,CAAC;gBAEF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,UAAK,GAAG;YACtB,cAAc,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAC5D,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,8BAA8B;oBACxC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,YAAO,GAAG;YACxB,IAAI,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,4BAA4B;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACvE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QA/HA,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAyC;QAC5D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAEO,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAuC;QAEvC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAa,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;CAkGF;AAvID,4CAuIC"}
+{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAGH,uCAAuG;AACvG,6CAAsD;AAEtD,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AAgED,MAAa,gBAAgB;IAM3B,YAAY,OAA6E;QAiCzE,QAAG,GAAG;YACpB,QAAQ,EAAE,KAAK,EAAE,OAA2B,EAAuB,EAAE;gBACnE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;gBAEhE,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAErE,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,mCAAsB,CAC9B,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;gBAED,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnD,MAAM,IAAI,mCAAsB,CAAC,qCAAqC,CAAC,CAAC;gBAC1E,CAAC;gBAED,MAAM,OAAO,GAA4B;oBACvC,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,YAAY;iBACzB,CAAC;gBAEF,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;gBAChC,CAAC;gBAED,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;gBACzC,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAAyB,EAAuB,EAAE;gBAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;gBAE3C,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,mCAAsB,CAAC,4BAA4B,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,OAAO,GAAG;oBACd,MAAM,EAAE,MAAM;oBACd,UAAU,EAAE,SAAS;oBACrB,GAAG;iBACJ,CAAC;gBAEF,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,UAAK,GAAG;YACtB,cAAc,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAC5D,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,8BAA8B;oBACxC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QAEc,YAAO,GAAG;YACxB,IAAI,EAAE,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,4BAA4B;oBACtC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACvE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,6BAA6B;oBACvC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,OAA+B,EAAuB,EAAE;gBACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC;oBACxB,QAAQ,EAAE,2BAA2B;oBACrC,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;SACF,CAAC;QA/HA,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAyC;QAC5D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACpC,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAEO,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAuC;QAEvC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAa,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;CAkGF;AAvID,4CAuIC"}

package/dist/delegation/index.d.ts

@@ -5,5 +5,6 @@ export { DelegationClient, MfaMethod, } from './hawcx';
 export type { DelegationClientBaseOptions, DelegationClientSecretKeyOptions, DelegationClientKeyOptions, MfaInitiateOptions, MfaVerifyOptions, DeviceOperationOptions, DelegationRequestOptions, } from './hawcx';
 export { parseHawcxSecretKey, generateCredentialBlob, } from './credentials';
 export type { ParsedCredentials, HawcxCredentialBlob, } from './credentials';
-export { DelegationError, DelegationCryptoError, DelegationRequestError, DelegationResponseError, } from './exceptions';
+export { DelegationError, DelegationCryptoError, DelegationRequestError, DelegationResponseError, ResponseSignatureInvalidError, ResponseSignatureUnavailableError, } from './exceptions';
+export type { ResponseSignatureErrorCode } from './exceptions';
 //# sourceMappingURL=index.d.ts.map

package/dist/delegation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,EAC7B,iCAAiC,GAClC,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC"}

package/dist/delegation/index.js

@@ -3,7 +3,7 @@
  * Hawcx OAuth Client SDK - Delegation Module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = exports.generateCredentialBlob = exports.parseHawcxSecretKey = exports.MfaMethod = exports.DelegationClient = void 0;
+exports.ResponseSignatureUnavailableError = exports.ResponseSignatureInvalidError = exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = exports.generateCredentialBlob = exports.parseHawcxSecretKey = exports.MfaMethod = exports.DelegationClient = void 0;
 var hawcx_1 = require("./hawcx");
 Object.defineProperty(exports, "DelegationClient", { enumerable: true, get: function () { return hawcx_1.DelegationClient; } });
 Object.defineProperty(exports, "MfaMethod", { enumerable: true, get: function () { return hawcx_1.MfaMethod; } });
@@ -15,4 +15,6 @@ Object.defineProperty(exports, "DelegationError", { enumerable: true, get: funct
 Object.defineProperty(exports, "DelegationCryptoError", { enumerable: true, get: function () { return exceptions_1.DelegationCryptoError; } });
 Object.defineProperty(exports, "DelegationRequestError", { enumerable: true, get: function () { return exceptions_1.DelegationRequestError; } });
 Object.defineProperty(exports, "DelegationResponseError", { enumerable: true, get: function () { return exceptions_1.DelegationResponseError; } });
+Object.defineProperty(exports, "ResponseSignatureInvalidError", { enumerable: true, get: function () { return exceptions_1.ResponseSignatureInvalidError; } });
+Object.defineProperty(exports, "ResponseSignatureUnavailableError", { enumerable: true, get: function () { return exceptions_1.ResponseSignatureUnavailableError; } });
 //# sourceMappingURL=index.js.map

package/dist/delegation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,iCAGiB;AAFf,yGAAA,gBAAgB,OAAA;AAChB,kGAAA,SAAS,OAAA;AAYX,6CAGuB;AAFrB,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AAOxB,2CAKsB;AAJpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,iCAGiB;AAFf,yGAAA,gBAAgB,OAAA;AAChB,kGAAA,SAAS,OAAA;AAYX,6CAGuB;AAFrB,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AAOxB,2CAOsB;AANpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA;AACvB,2HAAA,6BAA6B,OAAA;AAC7B,+HAAA,iCAAiC,OAAA"}

package/dist/delegation/transport.d.ts

@@ -5,11 +5,15 @@ import { Verifier, EciesX25519Encryptor, EciesX25519Decryptor, Ed25519Signer, Rs
 export type Signer = Ed25519Signer | RsaPssSigner;
 export type JsonObject = Record<string, unknown> | object;
 export interface SecureRequestOptions<TPayload extends JsonObject> {
-    /** API endpoint path (e.g., "/mfa/update" or "/device/revoke") */
+    /**
+     * API endpoint path relative to the base URL (e.g., "/mfa/update").  Must
+     * start with a single "/".  When `includeBaseUrl` is false this is instead
+     * an absolute URL, which must be https (http only for loopback hosts).
+     */
     endpoint: string;
     /** Request payload dictionary to be encrypted and sent */
     payload: TPayload;
-    /** If true, prepends base_url to endpoint (default: true) */
+    /** If true, joins endpoint onto the base URL (default: true) */
     includeBaseUrl?: boolean;
     /** Optional additional HTTP headers (e.g., API keys) */
     headers?: Record<string, string>;

package/dist/delegation/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/delegation/transport.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,QAAQ,EACR,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,UAAU,CAAC;AAGlB,MAAM,MAAM,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,oBAAoB,CAAC,QAAQ,SAAS,UAAU;IAC/D,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,oBAAoB,CAAC;IAChC,SAAS,EAAE,oBAAoB,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,gBAAgB,CAAS;gBAErB,OAAO,EAAE,0BAA0B;IAU/C;;OAEG;IACG,IAAI,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EACzD,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAClC,OAAO,CAAC,IAAI,CAAC;CAkHjB"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/delegation/transport.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,QAAQ,EACR,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,UAAU,CAAC;AAclB,MAAM,MAAM,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,oBAAoB,CAAC,QAAQ,SAAS,UAAU;IAC/D;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC;IAClB,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,oBAAoB,CAAC;IAChC,SAAS,EAAE,oBAAoB,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,gBAAgB,CAAS;gBAErB,OAAO,EAAE,0BAA0B;IAW/C;;OAEG;IACG,IAAI,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EACzD,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAClC,OAAO,CAAC,IAAI,CAAC;CAsHjB"}

package/dist/delegation/transport.js

@@ -6,9 +6,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DelegationTransport = void 0;
 const crypto_1 = require("./crypto");
 const exceptions_1 = require("./exceptions");
+const url_1 = require("../internal/url");
+/** Config/URL errors surface as `DelegationRequestError`, like other request failures. */
+const urlError = (message, cause) => new exceptions_1.DelegationRequestError(message, cause === undefined ? {} : { cause });
 class DelegationTransport {
     constructor(options) {
-        this.baseUrl = options.baseUrl.replace(/\/$/, '');
+        // Validated once (TOB-HSDK-13); requests are joined structurally below.
+        this.baseUrl = (0, url_1.parseSecureBaseUrl)('baseUrl', options.baseUrl, urlError);
         this.signer = options.signer;
         this.verifier = options.verifier;
         this.encryptor = options.encryptor;
@@ -21,6 +25,10 @@ class DelegationTransport {
      */
     async send(options) {
         const { endpoint, payload, includeBaseUrl = true, headers: extraHeaders = {} } = options;
+        // Resolve and validate the target before signing anything (fail closed).
+        const url = includeBaseUrl
+            ? (0, url_1.safeJoinUrl)(this.baseUrl, endpoint, 'endpoint', urlError)
+            : (0, url_1.assertSecureUrl)('endpoint', endpoint, urlError).href;
         let encryptedEnv;
         let headers;
         try {
@@ -46,7 +54,6 @@ class DelegationTransport {
         let response;
         let responseData;
         try {
-            const url = includeBaseUrl ? this.baseUrl + endpoint : endpoint;
             const controller = new AbortController();
             const timeoutId = setTimeout(() => controller.abort(), this.timeoutSeconds * 1000);
             try {

package/dist/delegation/transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/delegation/transport.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,qCAOkB;AAClB,6CAA+E;AA0B/E,MAAa,mBAAmB;IAS9B,YAAY,OAAmC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,OAAmC;QAEnC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QAEzF,IAAI,YAAoB,CAAC;QACzB,IAAI,OAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAElD,MAAM,EAAE,GAAG,IAAA,aAAI,GAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAEvD,OAAO,GAAG;gBACR,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,eAAe;gBAC5B,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;gBACzB,iBAAiB,EAAE,GAAG,CAAC,GAAG;gBAC1B,aAAa,EAAE,GAAG,CAAC,YAAY;aAChC,CAAC;YAEF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YAED,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;YAEnF,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAC1B,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YAED,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1C,MAAM,IAAI,oCAAuB,CAAC,2CAA2C,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,oCAAuB,CAAC,4BAA4B,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAA,aAAI,GAAE,GAAG,MAAM,CAAC,CAAC;YACvC,IAAI,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACjC,MAAM,IAAI,oCAAuB,CAC/B,4CAA4C,IAAI,CAAC,gBAAgB,IAAI,CACtE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC;YAEnF,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAAuB,CAAC,sCAAsC,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS,CAAC;YAEtE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAI,aAAyC,EAAE,MAAM,CAAC;gBACvE,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBACpF,MAAM,IAAI,mCAAsB,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAClE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mCAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,oCAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtE,MAAM,IAAI,mCAAsB,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAClE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,YAAY,EAAE,YAAY;oBAC1B,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,oCAAuB,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF;AA1ID,kDA0IC"}
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/delegation/transport.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,qCAOkB;AAClB,6CAA+E;AAC/E,yCAMyB;AAEzB,0FAA0F;AAC1F,MAAM,QAAQ,GAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACnD,IAAI,mCAAsB,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AA8B5E,MAAa,mBAAmB;IAS9B,YAAY,OAAmC;QAC7C,wEAAwE;QACxE,IAAI,CAAC,OAAO,GAAG,IAAA,wBAAkB,EAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,OAAmC;QAEnC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QAEzF,yEAAyE;QACzE,MAAM,GAAG,GAAG,cAAc;YACxB,CAAC,CAAC,IAAA,iBAAW,EAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC;YAC3D,CAAC,CAAC,IAAA,qBAAe,EAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;QAEzD,IAAI,YAAoB,CAAC;QACzB,IAAI,OAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAElD,MAAM,EAAE,GAAG,IAAA,aAAI,GAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAEvD,OAAO,GAAG;gBACR,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,eAAe;gBAC5B,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;gBACzB,iBAAiB,EAAE,GAAG,CAAC,GAAG;gBAC1B,aAAa,EAAE,GAAG,CAAC,YAAY;aAChC,CAAC;YAEF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;YAChC,CAAC;YAED,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;YAEnF,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAC1B,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YAED,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1C,MAAM,IAAI,oCAAuB,CAAC,2CAA2C,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,oCAAuB,CAAC,4BAA4B,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAA,aAAI,GAAE,GAAG,MAAM,CAAC,CAAC;YACvC,IAAI,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACjC,MAAM,IAAI,oCAAuB,CAC/B,4CAA4C,IAAI,CAAC,gBAAgB,IAAI,CACtE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC;YAEnF,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAAuB,CAAC,sCAAsC,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS,CAAC;YAEtE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,WAAW,GAAI,aAAyC,EAAE,MAAM,CAAC;gBACvE,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBACpF,MAAM,IAAI,mCAAsB,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAClE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mCAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,oCAAuB,EAAE,CAAC;gBAC7C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtE,MAAM,IAAI,mCAAsB,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,EAAE;oBAClE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,YAAY,EAAE,YAAY;oBAC1B,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,oCAAuB,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF;AA/ID,kDA+IC"}

package/dist/index.d.ts

@@ -19,5 +19,5 @@ export type { HawcxOAuthErrorFields } from './errors';
 export { ClientAssertionSigner, CLIENT_ASSERTION_TYPE } from './client-assertion';
 export * from './delegation';
 export * from './stepup';
-export declare const VERSION = "5.2.0";
+export declare const VERSION = "6.0.0";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -44,5 +44,5 @@ Object.defineProperty(exports, "CLIENT_ASSERTION_TYPE", { enumerable: true, get:
 __exportStar(require("./delegation"), exports);
 // Step-up module
 __exportStar(require("./stepup"), exports);
-exports.VERSION = '5.2.0';
+exports.VERSION = '6.0.0';
 //# sourceMappingURL=index.js.map