@hawcx/oauth-client 5.2.0 → 6.0.0

package/dist/management/response_signature.js

@@ -0,0 +1,170 @@
+"use strict";
+/**
+ * Verification of the management API's `X-Response-Signature` (TOB-HSDK-11).
+ *
+ * Every successful jwt-mode (Path A) management response from hx_auth carries
+ * `X-Response-Signature`: a compact JWS signed with the shared OAuth signing
+ * key that the OP publishes at `${issuer}/.well-known/jwks.json` — the same
+ * JWKS that verifies ID tokens.  Its payload is exactly
+ *
+ *   { "body_sha256": base64url(sha256(<exact response body bytes>)), "iat": <unix s> }
+ *
+ * Verifying it restores the response authentication the legacy ECIES
+ * transport always had (signature + timestamp skew on every response).
+ *
+ * Checks, all fail-closed:
+ *  - the header is present and is a compact JWS whose protected header names
+ *    a `kid`;
+ *  - `alg` is one of ES256 / ES384 / ES512 (the server's KMS key is an EC key
+ *    and the alg follows its curve).  `none`, HS*, RS*, EdDSA are rejected —
+ *    this forecloses alg-substitution / key-confusion;
+ *  - the signature verifies against the issuer JWKS (jose `RemoteJWKSet`:
+ *    cached, and refetched once when the `kid` is unknown — key rotation);
+ *  - `iat` is present and within ±clockSkewSeconds of local time;
+ *  - the payload is a response signature, not some other token minted with
+ *    the same key (TOB-HSDK-9 type confusion): `body_sha256` is required and
+ *    `aud`, `sub`, `nonce` must be absent — an ID token always carries
+ *    `aud`/`sub`;
+ *  - `body_sha256` equals base64url(sha256(raw body bytes)), compared in
+ *    constant time.  The hash is taken over the raw bytes as received, before
+ *    any decoding or JSON parsing.
+ *
+ * Failures are split so callers can react correctly:
+ *  - {@link ResponseSignatureInvalidError} (`code: 'response_signature_invalid'`)
+ *    — missing/empty header or a signature that does not verify;
+ *  - {@link ResponseSignatureUnavailableError}
+ *    (`code: 'response_signature_unavailable'`) — the signing keys could not
+ *    be obtained (JWKS fetch failed / timed out / non-200 / malformed, or the
+ *    kid is unknown while jose's refetch cooldown suppresses a refetch).  The
+ *    request may already have been applied server-side.
+ * Both subclass `DelegationResponseError` and carry fixed, non-leaky messages.
+ *
+ * Not part of the public API (not re-exported from the package index).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResponseSignatureVerifier = exports.RESPONSE_SIGNATURE_HEADER = void 0;
+const node_crypto_1 = require("node:crypto");
+const jose_1 = require("jose");
+const exceptions_1 = require("../delegation/exceptions");
+/** Response-signature header name (HTTP headers are case-insensitive). */
+exports.RESPONSE_SIGNATURE_HEADER = 'X-Response-Signature';
+/** EC algorithms the server's KMS signing key can produce — nothing else. */
+const ALLOWED_ALGS = Object.freeze(['ES256', 'ES384', 'ES512']);
+/**
+ * Claims that mark a token as something other than a response signature.
+ * Deliberately `aud` is forbidden rather than repurposed: request binding
+ * (anti-replay within the iat window) is designed server-side in
+ * hawcx/hx_auth#278 as dedicated custom claims (`req_jti` / `htm` / `htu` /
+ * `cid`), explicitly NOT `aud` — keep this list as is.
+ */
+const FORBIDDEN_CLAIMS = Object.freeze(['aud', 'sub', 'nonce']);
+/** Generic, non-leaky messages; detail (if any) is attached as `cause`. */
+const MSG_MISSING = 'Management API response is missing its signature';
+const MSG_INVALID = 'Management API response signature verification failed';
+const MSG_UNAVAILABLE = 'Management API response signature could not be verified: signing keys unavailable';
+class ResponseSignatureVerifier {
+    constructor(options) {
+        // jose handles caching (10 min max age), concurrent-fetch coalescing, and a
+        // single refetch on an unknown `kid` (rate-limited by its 30s cooldown) —
+        // the same machinery HawcxOAuth uses for ID-token verification.
+        this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(options.jwksUri), {
+            timeoutDuration: options.timeoutMs,
+        });
+        this.clockSkewSeconds = options.clockSkewSeconds;
+    }
+    /**
+     * Verify `signature` (the header value, or null when absent) over the EXACT
+     * response body bytes.  Resolves on success; throws
+     * {@link ResponseSignatureInvalidError} or
+     * {@link ResponseSignatureUnavailableError} otherwise.
+     */
+    async verify(signature, body) {
+        if (!signature) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_MISSING);
+        }
+        // Set by the key resolver when the keys could not be obtained, as opposed
+        // to a signature that was checked and found bad.
+        let keysUnavailable = false;
+        let payloadBytes;
+        try {
+            const result = await (0, jose_1.compactVerify)(signature, async (protectedHeader, token) => {
+                if (typeof protectedHeader.kid !== 'string' || protectedHeader.kid.length === 0) {
+                    throw new Error('response signature has no kid');
+                }
+                // If jose may refetch on a miss (not cooling down), a miss means the
+                // kid is absent from a freshly fetched JWKS → invalid.  If the
+                // cooldown suppresses the refetch, the kid may simply be newer than
+                // our cache (rotation) → unavailable.
+                const canRefetch = !this.jwks.coolingDown;
+                try {
+                    return await this.jwks(protectedHeader, token);
+                }
+                catch (err) {
+                    if (err instanceof jose_1.errors.JWKSNoMatchingKey) {
+                        keysUnavailable = !canRefetch;
+                    }
+                    else if (!(err instanceof jose_1.errors.JWKSMultipleMatchingKeys)) {
+                        // Fetch failure, timeout, non-200, malformed JWKS, network error.
+                        keysUnavailable = true;
+                    }
+                    throw err;
+                }
+            }, { algorithms: [...ALLOWED_ALGS] });
+            payloadBytes = result.payload;
+        }
+        catch (err) {
+            if (keysUnavailable) {
+                throw new exceptions_1.ResponseSignatureUnavailableError(MSG_UNAVAILABLE, { cause: err });
+            }
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, { cause: err });
+        }
+        let claims;
+        try {
+            const parsed = JSON.parse(Buffer.from(payloadBytes).toString('utf-8'));
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                throw new Error('payload is not a JSON object');
+            }
+            claims = parsed;
+        }
+        catch (err) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, { cause: err });
+        }
+        // Type-confusion guard (TOB-HSDK-9): only a response signature qualifies.
+        for (const claim of FORBIDDEN_CLAIMS) {
+            if (Object.prototype.hasOwnProperty.call(claims, claim)) {
+                throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                    cause: new Error(`unexpected '${claim}' claim in response signature`),
+                });
+            }
+        }
+        const claimedHash = claims['body_sha256'];
+        if (typeof claimedHash !== 'string' || claimedHash.length === 0) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error("response signature has no 'body_sha256' claim"),
+            });
+        }
+        // Freshness: `iat` required, within the configured skew either way.
+        const iat = claims['iat'];
+        if (typeof iat !== 'number' || !Number.isFinite(iat)) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error("response signature has no numeric 'iat' claim"),
+            });
+        }
+        const nowSec = Date.now() / 1000;
+        if (iat > nowSec + this.clockSkewSeconds || iat < nowSec - this.clockSkewSeconds) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error(`response signature 'iat' outside allowed skew (${this.clockSkewSeconds}s)`),
+            });
+        }
+        // Body binding: base64url(sha256(raw bytes)), no padding, constant-time.
+        const actual = Buffer.from((0, node_crypto_1.createHash)('sha256').update(body).digest('base64url').replace(/=+$/, ''), 'utf-8');
+        const claimed = Buffer.from(claimedHash, 'utf-8');
+        if (actual.length !== claimed.length || !(0, node_crypto_1.timingSafeEqual)(actual, claimed)) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error('response body does not match the signed body_sha256'),
+            });
+        }
+    }
+}
+exports.ResponseSignatureVerifier = ResponseSignatureVerifier;
+//# sourceMappingURL=response_signature.js.map

package/dist/management/response_signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response_signature.js","sourceRoot":"","sources":["../../src/management/response_signature.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;;;AAEH,6CAA0D;AAC1D,+BAA+E;AAC/E,yDAGkC;AAElC,0EAA0E;AAC7D,QAAA,yBAAyB,GAAG,sBAAsB,CAAC;AAEhE,6EAA6E;AAC7E,MAAM,YAAY,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnF,2EAA2E;AAC3E,MAAM,WAAW,GAAG,kDAAkD,CAAC;AACvE,MAAM,WAAW,GAAG,uDAAuD,CAAC;AAC5E,MAAM,eAAe,GACnB,mFAAmF,CAAC;AAWtF,MAAa,yBAAyB;IAIpC,YAAY,OAAyC;QACnD,4EAA4E;QAC5E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YACvD,eAAe,EAAE,OAAO,CAAC,SAAS;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,SAAwB,EAAE,IAAgB;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,0CAA6B,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC;QAED,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,eAAe,GAAG,KAAK,CAAC;QAE5B,IAAI,YAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,oBAAa,EAChC,SAAS,EACT,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE;gBAC/B,IAAI,OAAO,eAAe,CAAC,GAAG,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,CAAC;gBACD,qEAAqE;gBACrE,+DAA+D;gBAC/D,oEAAoE;gBACpE,sCAAsC;gBACtC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC1C,IAAI,CAAC;oBACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,aAAU,CAAC,iBAAiB,EAAE,CAAC;wBAChD,eAAe,GAAG,CAAC,UAAU,CAAC;oBAChC,CAAC;yBAAM,IAAI,CAAC,CAAC,GAAG,YAAY,aAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;wBACjE,kEAAkE;wBAClE,eAAe,GAAG,IAAI,CAAC;oBACzB,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,EACD,EAAE,UAAU,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAClC,CAAC;YACF,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,8CAAiC,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,GAAG,MAAiC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,0EAA0E;QAC1E,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE;oBACnD,KAAK,EAAE,IAAI,KAAK,CAAC,eAAe,KAAK,+BAA+B,CAAC;iBACtE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,KAAK,CAAC,+CAA+C,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QAED,oEAAoE;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,KAAK,CAAC,+CAA+C,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACjC,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjF,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,KAAK,CAAC,kDAAkD,IAAI,CAAC,gBAAgB,IAAI,CAAC;aAC9F,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EACxE,OAAO,CACR,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,IAAA,6BAAe,EAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,0CAA6B,CAAC,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,KAAK,CAAC,qDAAqD,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AApHD,8DAoHC"}

package/dist/oauth.d.ts

@@ -257,7 +257,7 @@ export declare class HawcxOAuth {
     refreshJwks(): void;
     /**
      * @deprecated since 5.1.0 — renamed to {@link refreshJwks} for cross-SDK
-     *   consistency. Will be removed in 6.0.0. Behaviour is identical.
+     *   consistency. Will be removed in a future major version. Behaviour is identical.
      */
     clearCache(): void;
     private clearCacheWarned;

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,oBAAoB,CAAC;AA6BlF,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,sBAAsB;IACrC,gHAAgH;IAChH,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,sBAAsB;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAE/C,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgB;IACjD,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAE7D,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAErD,OAAO,CAAC,IAAI,CAAsD;IAElE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA+B;IAErE;;;OAGG;gBACS,MAAM,EAAE,gBAAgB;IAqCpC;;;;;;;;;;;;;;;OAeG;WACU,UAAU,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC;IAyH5E;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,UAAU;IA6B9D;;;;;;;;;;;;OAYG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC;IAkF1B;;;;;;;;OAQG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC;IA8ElF;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAoBf;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAInB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAclB,OAAO,CAAC,gBAAgB,CAAS;CAClC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,oBAAoB,CAAC;AAmClF,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,sBAAsB;IACrC,gHAAgH;IAChH,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,sBAAsB;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAE/C,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgB;IACjD,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAE7D,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAErD,OAAO,CAAC,IAAI,CAAsD;IAElE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA+B;IAErE;;;OAGG;gBACS,MAAM,EAAE,gBAAgB;IAuCpC;;;;;;;;;;;;;;;OAeG;WACU,UAAU,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC;IAgI5E;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,UAAU;IA6B9D;;;;;;;;;;;;OAYG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC;IA4F1B;;;;;;;;OAQG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC;IA8ElF;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAoBf;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAInB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAclB,OAAO,CAAC,gBAAgB,CAAS;CAClC"}

package/dist/oauth.js

@@ -21,6 +21,7 @@ exports.HawcxOAuth = void 0;
 const jose_1 = require("jose");
 const client_assertion_1 = require("./client-assertion");
 const errors_1 = require("./errors");
+const url_1 = require("./internal/url");
 const DEFAULT_BASE_URL = 'https://api.hawcx.com';
 const DEFAULT_TIMEOUT_MS = 10000;
 /** Bound the discovery fetch so an unreachable issuer fails fast at startup. */
@@ -48,25 +49,22 @@ const DEFAULT_ID_TOKEN_ALGS = Object.freeze([
 ]);
 /**
  * Require https on a discovery-related URL. Plaintext http is permitted only
- * for loopback hosts (localhost / 127.0.0.1 / ::1) to support local dev and
- * tests. OIDC Discovery §4 / OAuth 2.1 §7.4: an http issuer lets an on-path
+ * for the exact loopback hosts (localhost / 127.0.0.1 / [::1]) to support
+ * local dev and tests; URLs carrying userinfo (user:pass@) are rejected. OIDC Discovery §4 / OAuth 2.1 §7.4: an http issuer lets an on-path
  * attacker swap the discovery doc and redirect token_endpoint / jwks_uri.
  */
 function requireSecureUrl(label, url) {
-    let u;
-    try {
-        u = new URL(url);
-    }
-    catch (err) {
-        throw new errors_1.DiscoveryError(`${label} is not a valid URL: ${url}`, { cause: err });
-    }
-    if (u.protocol === 'https:')
-        return;
-    const loopback = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '::1' || u.hostname === '[::1]';
-    if (u.protocol === 'http:' && loopback)
-        return;
-    throw new errors_1.DiscoveryError(`${label} must use https (got: ${url}). Plaintext http is permitted only for loopback hosts.`);
+    (0, url_1.assertSecureUrl)(label, url, discoveryUrlError);
 }
+/** URL validation failures during discovery surface as {@link DiscoveryError}. */
+const discoveryUrlError = (message, cause) => new errors_1.DiscoveryError(message, cause === undefined ? undefined : { cause });
+/** An invalid legacy-mode `baseUrl` surfaces as {@link HawcxOAuthError}. */
+const legacyUrlError = (message, cause) => {
+    const err = new errors_1.HawcxOAuthError(message);
+    if (cause !== undefined)
+        err.cause = cause;
+    return err;
+};
 /**
  * Hawcx OAuth Client
  *
@@ -109,9 +107,11 @@ class HawcxOAuth {
             this.clientAssertionSigner = discoveryInit.signer ?? null;
         }
         else {
-            const baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, '');
-            this.tokenEndpoint = `${baseUrl}/oauth2/token`;
-            this.jwksUrl = `${baseUrl}/keys`;
+            // Structured parse + join (TOB-HSDK-13): the authorization code is
+            // POSTed to, and signing keys fetched from, these URLs.
+            const base = (0, url_1.parseSecureBaseUrl)('baseUrl', config.baseUrl || DEFAULT_BASE_URL, legacyUrlError);
+            this.tokenEndpoint = (0, url_1.safeJoinUrl)(base, '/oauth2/token', 'token endpoint', legacyUrlError);
+            this.jwksUrl = (0, url_1.safeJoinUrl)(base, '/keys', 'jwks endpoint', legacyUrlError);
             this.expectedAudience = null;
             this.expectedIssuer = null;
             this.discoveryMetadata = null;
@@ -146,8 +146,10 @@ class HawcxOAuth {
             throw new Error('clockToleranceSeconds must be >= 0');
         }
         const issuer = config.issuer.replace(/\/$/, '');
-        requireSecureUrl('issuer', issuer);
-        const discoveryUrl = `${issuer}/.well-known/openid-configuration`;
+        // RFC 8414 §2: the issuer has no query or fragment. Join structurally so
+        // the discovery URL cannot leave the issuer's origin (TOB-HSDK-13).
+        const issuerBase = (0, url_1.parseSecureBaseUrl)('issuer', issuer, discoveryUrlError);
+        const discoveryUrl = (0, url_1.safeJoinUrl)(issuerBase, '/.well-known/openid-configuration', 'discovery URL', discoveryUrlError);
         const timeout = config.discoveryTimeout ?? DEFAULT_DISCOVERY_TIMEOUT_MS;
         let response;
         try {
@@ -298,15 +300,24 @@ class HawcxOAuth {
         if (redirectUri) {
             body.append('redirect_uri', redirectUri);
         }
+        // Discovery mode: always identify the client with `client_id` in the form,
+        // for public (PKCE) and private_key_jwt alike (RFC 6749 §4.1.3). Without
+        // it the OP resolves the client from `X-Config-Id` alone, falls back to
+        // the project's DEFAULT client, and stamps the id_token `aud` with that
+        // client's id, so a non-default client fails `aud` verification.
+        // Legacy mode has no clientId (expectedAudience is null) and sends no
+        // `client_id`, exactly as before.
+        if (this.expectedAudience !== null) {
+            body.append('client_id', this.expectedAudience);
+        }
         const signer = this.clientAssertionSigner;
         if (signer !== null && this.discoveryMetadata !== null) {
-            // private_key_jwt: include client_id (parity with the demo RP) + the
+            // private_key_jwt: client_id is already in the form (above); add the
             // signed assertion. aud is the discovered token_endpoint string exactly,
             // which the OP pins for the assertion. PKCE fields above are retained.
             // In this guarded branch discoveryMetadata !== null, so expectedAudience
             // is the clientId (non-null). Assert rather than mask with ''.
             const clientId = this.expectedAudience;
-            body.append('client_id', clientId);
             body.append('client_assertion_type', client_assertion_1.CLIENT_ASSERTION_TYPE);
             body.append('client_assertion', await signer.sign(clientId, this.discoveryMetadata.token_endpoint));
         }
@@ -479,7 +490,7 @@ class HawcxOAuth {
     }
     /**
      * @deprecated since 5.1.0 — renamed to {@link refreshJwks} for cross-SDK
-     *   consistency. Will be removed in 6.0.0. Behaviour is identical.
+     *   consistency. Will be removed in a future major version. Behaviour is identical.
      */
     clearCache() {
         // One-time deprecation nudge per instance (per-instance so tests and
@@ -488,7 +499,7 @@ class HawcxOAuth {
             this.clearCacheWarned = true;
             // eslint-disable-next-line no-console
             console.warn('[@hawcx/oauth-client] clearCache() is deprecated; use refreshJwks(). ' +
-                'clearCache() will be removed in 6.0.0.');
+                'clearCache() will be removed in a future major version.');
         }
         this.refreshJwks();
     }

package/dist/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAEH,+BAAsE;AACtE,yDAAkF;AAClF,qCAAsF;AAEtF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAClC,gFAAgF;AAChF,MAAM,4BAA4B,GAAG,IAAK,CAAC;AAC3C;;;;;;GAMG;AACH,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAqHH;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,GAAW;IAClD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAc,CAAC,GAAG,KAAK,wBAAwB,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACpC,MAAM,QAAQ,GACZ,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC7G,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ;QAAE,OAAO;IAC/C,MAAM,IAAI,uBAAc,CACtB,GAAG,KAAK,yBAAyB,GAAG,yDAAyD,CAC9F,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,UAAU;IA4CrB,YAAY,MAAwB,EAAE,aAA6B;QArB3D,SAAI,GAAiD,IAAI,CAAC;QAme1D,qBAAgB,GAAG,KAAK,CAAC;QA7c/B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,kBAAkB,CAAC;QACpD,IAAI,CAAC,qBAAqB;YACxB,MAAM,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;QAElE,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC3D,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAChD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,qBAAqB,GAAG,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,aAAa,GAAG,GAAG,OAAO,eAAe,CAAC;YAC/C,IAAI,CAAC,OAAO,GAAG,GAAG,OAAO,OAAO,CAAC;YACjC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAA8B;QACpD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,GAAG,MAAM,mCAAmC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,4BAA4B,CAAC;QAExE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;gBACnC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CAAC,4BAA4B,YAAY,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAc,CACtB,gCAAgC,QAAQ,CAAC,MAAM,OAAO,YAAY,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CACtB,8BAA8B,YAAY,oBAAoB,EAC9D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,+BAA+B,KAAK,GAAG,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,sEAAsE;QACtE,sEAAsE;QACtE,gBAAgB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAClD,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,uCAAuC,CAAC,CAAC;QAC/D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACzB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,6BAA6B;gBAChE,4EAA4E,CAC/E,CAAC;QACJ,CAAC;QACD,6DAA6D;QAC7D,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CACxD,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC3D,CAAC;QACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,0CAA0C;gBAC7E,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,mCAAmC;gBAC/D,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,uBAAuB;gBAC/D,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,qCAAqC,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAI,GAAG,CAAC,QAAQ,CAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAc,CACtB,8BAA8B,aAAa,8BAA8B;gBACvE,eAAe,MAAM,mDAAmD,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,GAAG,GAAG;YACN,MAAM,EAAE,aAAa;YACrB,cAAc,EAAE,aAAa;YAC7B,QAAQ,EAAE,OAAO;YACjB,qCAAqC,EAAE,SAAS;SACjD,CAAC;QAEF,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,EACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAA6B;QAC/C,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,uBAAc,CACtB,uFAAuF;gBACrF,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yDAAyD;gBACpF,8EAA8E,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,EACD;YACE,QAAQ,EAAE,IAAI,CAAC,iBAAiB;YAChC,QAAQ,EAAE,IAAI,CAAC,gBAA0B;YACzC,iBAAiB,EAAE,IAAI,CAAC,iBAAsC;YAC9D,MAAM;SACP,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,YAAoB,EACpB,WAAoB,EACpB,aAAsB;QAEtB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,2BAAkB,CAAC,0BAA0B,CAAC,CAAC;QAE5E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACvD,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAiB,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,wCAAqB,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CACT,kBAAkB,EAClB,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,IAAI,CAAC,QAAQ;oBAC5B,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzC,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,OAA2B,CAAC;YAChC,IAAI,OAA2B,CAAC;YAChC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;oBACrB,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;oBACjC,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;gBACtD,KAAK,EAAE,OAAO;gBACd,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,OAAO,EACP,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAA4B;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAE5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1E,qEAAqE;gBACrE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI;oBACrC,UAAU,EAAE,IAAI,CAAC,iBAA6B;iBAC/C,CAAC;gBACF,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1E,cAAc,EAAE,IAAI,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;oBACpC,MAAM,IAAI,+BAAsB,CAC9B,mCAAmC,OAAO,CAAC,KAAK,WAAW,OAAO,CAAC,KAAK,IAAI,WAAW,IAAI,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACjE,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,IAAI,+BAAsB,CAC9B,iEAAiE;oBAC/D,uEAAuE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,+BAAsB;gBAAE,MAAM,GAAG,CAAC;YAErD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAEhF,qCAAqC;YACrC,IAAI,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,eAAe,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;gBAC/C,uDAAuD;gBACvD,MAAM,KAAK,GAAI,GAA0B,CAAC,KAAK,CAAC;gBAChD,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;gBAC3F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;gBAC7F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,IAAI,+BAAsB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtC,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,OAAO,EAAE;gBACtC,uEAAuE;gBACvE,mEAAmE;gBACnE,sCAAsC;gBACtC,eAAe,EAAE,IAAI,CAAC,OAAO;gBAC7B,GAAG,CAAC,oBAAoB,IAAI;oBAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,WAAW;QACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,qEAAqE;QACrE,8EAA8E;QAC9E,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,uEAAuE;gBACrE,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;CAGF;AA3fD,gCA2fC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAEH,+BAAsE;AACtE,yDAAkF;AAClF,qCAKkB;AAClB,wCAAwG;AAExG,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAClC,gFAAgF;AAChF,MAAM,4BAA4B,GAAG,IAAK,CAAC;AAC3C;;;;;;GAMG;AACH,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAqHH;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,GAAW;IAClD,IAAA,qBAAe,EAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,MAAM,iBAAiB,GAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAC5D,IAAI,uBAAc,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAE3E,4EAA4E;AAC5E,MAAM,cAAc,GAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;IACzD,MAAM,GAAG,GAAG,IAAI,wBAAe,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAG,GAA2B,CAAC,KAAK,GAAG,KAAK,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAqBF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,UAAU;IA4CrB,YAAY,MAAwB,EAAE,aAA6B;QArB3D,SAAI,GAAiD,IAAI,CAAC;QAsf1D,qBAAgB,GAAG,KAAK,CAAC;QAhe/B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,kBAAkB,CAAC;QACpD,IAAI,CAAC,qBAAqB;YACxB,MAAM,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;QAElE,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC3D,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAChD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,qBAAqB,GAAG,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,wDAAwD;YACxD,MAAM,IAAI,GAAG,IAAA,wBAAkB,EAAC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB,EAAE,cAAc,CAAC,CAAC;YAC/F,IAAI,CAAC,aAAa,GAAG,IAAA,iBAAW,EAAC,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;YAC1F,IAAI,CAAC,OAAO,GAAG,IAAA,iBAAW,EAAC,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;YAC3E,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAA8B;QACpD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,UAAU,GAAG,IAAA,wBAAkB,EAAC,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,YAAY,GAAG,IAAA,iBAAW,EAC9B,UAAU,EACV,mCAAmC,EACnC,eAAe,EACf,iBAAiB,CAClB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,4BAA4B,CAAC;QAExE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;gBACnC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CAAC,4BAA4B,YAAY,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAc,CACtB,gCAAgC,QAAQ,CAAC,MAAM,OAAO,YAAY,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CACtB,8BAA8B,YAAY,oBAAoB,EAC9D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,+BAA+B,KAAK,GAAG,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,sEAAsE;QACtE,sEAAsE;QACtE,gBAAgB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAClD,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,uCAAuC,CAAC,CAAC;QAC/D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACzB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,6BAA6B;gBAChE,4EAA4E,CAC/E,CAAC;QACJ,CAAC;QACD,6DAA6D;QAC7D,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CACxD,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC3D,CAAC;QACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,0CAA0C;gBAC7E,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,mCAAmC;gBAC/D,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,uBAAuB;gBAC/D,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,qCAAqC,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAI,GAAG,CAAC,QAAQ,CAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAc,CACtB,8BAA8B,aAAa,8BAA8B;gBACvE,eAAe,MAAM,mDAAmD,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,GAAG,GAAG;YACN,MAAM,EAAE,aAAa;YACrB,cAAc,EAAE,aAAa;YAC7B,QAAQ,EAAE,OAAO;YACjB,qCAAqC,EAAE,SAAS;SACjD,CAAC;QAEF,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,EACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAA6B;QAC/C,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,uBAAc,CACtB,uFAAuF;gBACrF,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yDAAyD;gBACpF,8EAA8E,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,EACD;YACE,QAAQ,EAAE,IAAI,CAAC,iBAAiB;YAChC,QAAQ,EAAE,IAAI,CAAC,gBAA0B;YACzC,iBAAiB,EAAE,IAAI,CAAC,iBAAsC;YAC9D,MAAM;SACP,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,YAAoB,EACpB,WAAoB,EACpB,aAAsB;QAEtB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,2BAAkB,CAAC,0BAA0B,CAAC,CAAC;QAE5E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,iEAAiE;QACjE,sEAAsE;QACtE,kCAAkC;QAClC,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACvD,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAiB,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,wCAAqB,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CACT,kBAAkB,EAClB,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,IAAI,CAAC,QAAQ;oBAC5B,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzC,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,OAA2B,CAAC;YAChC,IAAI,OAA2B,CAAC;YAChC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;oBACrB,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;oBACjC,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;gBACtD,KAAK,EAAE,OAAO;gBACd,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,OAAO,EACP,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAA4B;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAE5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1E,qEAAqE;gBACrE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI;oBACrC,UAAU,EAAE,IAAI,CAAC,iBAA6B;iBAC/C,CAAC;gBACF,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1E,cAAc,EAAE,IAAI,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;oBACpC,MAAM,IAAI,+BAAsB,CAC9B,mCAAmC,OAAO,CAAC,KAAK,WAAW,OAAO,CAAC,KAAK,IAAI,WAAW,IAAI,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACjE,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,IAAI,+BAAsB,CAC9B,iEAAiE;oBAC/D,uEAAuE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,+BAAsB;gBAAE,MAAM,GAAG,CAAC;YAErD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAEhF,qCAAqC;YACrC,IAAI,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,eAAe,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;gBAC/C,uDAAuD;gBACvD,MAAM,KAAK,GAAI,GAA0B,CAAC,KAAK,CAAC;gBAChD,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;gBAC3F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;gBAC7F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,IAAI,+BAAsB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtC,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,OAAO,EAAE;gBACtC,uEAAuE;gBACvE,mEAAmE;gBACnE,sCAAsC;gBACtC,eAAe,EAAE,IAAI,CAAC,OAAO;gBAC7B,GAAG,CAAC,oBAAoB,IAAI;oBAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,WAAW;QACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,qEAAqE;QACrE,8EAA8E;QAC9E,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,uEAAuE;gBACrE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;CAGF;AA9gBD,gCA8gBC"}

package/dist/stepup/client.d.ts

@@ -34,6 +34,17 @@ export interface StepUpClientPrivateKeyJwtOptions extends StepUpClientBaseOption
     apiKey?: string;
     /** JWT time-to-live in seconds (default: 60). */
     jwtTtlSeconds?: number;
+    /**
+     * OIDC issuer whose `/.well-known/jwks.json` verifies response signatures
+     * (default: `baseUrl`).  See {@link JwtBearerTransportOptions.issuer}.
+     */
+    issuer?: string;
+    /**
+     * Verify `X-Response-Signature` on every successful response (default:
+     * `true`).  Emergency escape hatch only — see
+     * {@link JwtBearerTransportOptions.verifyResponseSignature}.
+     */
+    verifyResponseSignature?: boolean;
 }
 export declare class StepUpClient {
     private transport;

package/dist/stepup/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/stepup/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAuD,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnH,OAAO,EAAsB,KAAK,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACjG,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,SAAS,CAAC;AAEjB;;;;GAIG;AACH,UAAU,eAAe;IACvB,IAAI,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EACnD,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC,GAC5E,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,4BAA6B,SAAQ,uBAAuB;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,GAAG,qBAAqB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3G;;;GAGG;AACH,MAAM,WAAW,gCAAiC,SAAQ,uBAAuB;IAC/E,6EAA6E;IAC7E,cAAc,EAAE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAC5D,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,MAAM,CAAC,CAAS;gBAEZ,OAAO,EAAE;QACnB,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,uBAAuB,CAAC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAMD;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,4BAA4B,GAAG,YAAY;IAezE;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,YAAY;IAe9D;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,gCAAgC,GAAG,YAAY;IAiBjF,OAAO,CAAC,iBAAiB;IAmBnB,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAuB1E,cAAc,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAoBpF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/stepup/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAuD,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnH,OAAO,EAAsB,KAAK,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACjG,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,SAAS,CAAC;AAEjB;;;;GAIG;AACH,UAAU,eAAe;IACvB,IAAI,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EACnD,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC,GAC5E,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,4BAA6B,SAAQ,uBAAuB;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,GAAG,qBAAqB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3G;;;GAGG;AACH,MAAM,WAAW,gCAAiC,SAAQ,uBAAuB;IAC/E,6EAA6E;IAC7E,cAAc,EAAE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAC5D,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,MAAM,CAAC,CAAS;gBAEZ,OAAO,EAAE;QACnB,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,uBAAuB,CAAC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAMD;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,4BAA4B,GAAG,YAAY;IAezE;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,YAAY;IAe9D;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,gCAAgC,GAAG,YAAY;IAgCjF,OAAO,CAAC,iBAAiB;IAmBnB,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAuB1E,cAAc,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAoBpF"}

package/dist/stepup/client.js

@@ -63,7 +63,7 @@ class StepUpClient {
      * ```
      */
     static withPrivateKeyJwt(options) {
-        const { apiKey, oidcSigningKey, kid, clientId, configId, jwtTtlSeconds, ...clientOptions } = options;
+        const { apiKey, oidcSigningKey, kid, clientId, configId, jwtTtlSeconds, issuer, verifyResponseSignature, ...clientOptions } = options;
         const transport = new jwt_transport_1.JwtBearerTransport({
             baseUrl: clientOptions.baseUrl,
             configId,
@@ -75,6 +75,11 @@ class StepUpClient {
             // stays in clientOptions and the JWT transport falls back to its 15s
             // default regardless of what the caller passed (parity with fromKeys).
             timeoutSeconds: clientOptions.timeoutSeconds,
+            // Response-signature verification (TOB-HSDK-11): `clockSkewSeconds` is
+            // the same option that bounds ECIES response timestamps.
+            issuer,
+            verifyResponseSignature,
+            clockSkewSeconds: clientOptions.clockSkewSeconds,
         });
         return new StepUpClient({ transport, clientOptions, apiKey });
     }

package/dist/stepup/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/stepup/client.ts"],"names":[],"mappings":";;;AACA,mDAAmH;AACnH,yDAAmF;AACnF,+DAAiG;AA8CjG,MAAa,YAAY;IAKvB,YAAY,OAIX;QACC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAAC,OAAqC;QACxD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,mBAAmB,GAAG,IAAI,CAAC;YAC3B,OAAO,CAAC,WAAW,CACjB,gFAAgF;gBAC9E,yFAAyF;gBACzF,4DAA4D,EAC9D,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,OAA+B;QAC7C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,IAAI,CAAC;YACtB,OAAO,CAAC,WAAW,CACjB,2EAA2E;gBACzE,yFAAyF;gBACzF,uDAAuD,EACzD,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,iBAAiB,CAAC,OAAyC;QAChE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;QACrG,MAAM,SAAS,GAAG,IAAI,kCAAkB,CAAC;YACvC,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,QAAQ;YACR,QAAQ;YACR,cAAc;YACd,GAAG;YACH,aAAa;YACb,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,cAAc,EAAE,aAAa,CAAC,cAAc;SAC7C,CAAC,CAAC;QACH,OAAO,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IAEO,iBAAiB;QACvB,MAAM,OAAO,GAA2B;YACtC,0BAA0B,EAAE,GAAG;YAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;SACrC,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAA2B;QAC1C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;YAClD,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAG/B;gBACA,QAAQ,EAAE,GAAG,SAAS,gCAAgC;gBACtD,OAAO,EAAE;oBACP,cAAc,EAAE,OAAO,CAAC,MAAM;oBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,cAAc,EAAE,OAAO,CAAC,YAAY;iBACrC;gBACD,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAClC,CAAC,CAA6B,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAA6B;QAChD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;YAClD,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAG/B;gBACA,QAAQ,EAAE,GAAG,SAAS,4BAA4B;gBAClD,OAAO,EAAE;oBACP,eAAe,EAAE,OAAO,CAAC,OAAO;iBACjC;gBACD,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAClC,CAAC,CAA0B,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;CACF;AA1JD,oCA0JC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,8DAA8D;AAC9D,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAChC,IAAI,cAAc,GAAG,KAAK,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/stepup/client.ts"],"names":[],"mappings":";;;AACA,mDAAmH;AACnH,yDAAmF;AACnF,+DAAiG;AAyDjG,MAAa,YAAY;IAKvB,YAAY,OAIX;QACC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAAC,OAAqC;QACxD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,mBAAmB,GAAG,IAAI,CAAC;YAC3B,OAAO,CAAC,WAAW,CACjB,gFAAgF;gBAC9E,yFAAyF;gBACzF,4DAA4D,EAC9D,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,OAA+B;QAC7C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,IAAI,CAAC;YACtB,OAAO,CAAC,WAAW,CACjB,2EAA2E;gBACzE,yFAAyF;gBACzF,uDAAuD,EACzD,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,iBAAiB,CAAC,OAAyC;QAChE,MAAM,EACJ,MAAM,EACN,cAAc,EACd,GAAG,EACH,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,MAAM,EACN,uBAAuB,EACvB,GAAG,aAAa,EACjB,GAAG,OAAO,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,kCAAkB,CAAC;YACvC,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,QAAQ;YACR,QAAQ;YACR,cAAc;YACd,GAAG;YACH,aAAa;YACb,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,cAAc,EAAE,aAAa,CAAC,cAAc;YAC5C,uEAAuE;YACvE,yDAAyD;YACzD,MAAM;YACN,uBAAuB;YACvB,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;SACjD,CAAC,CAAC;QACH,OAAO,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IAEO,iBAAiB;QACvB,MAAM,OAAO,GAA2B;YACtC,0BAA0B,EAAE,GAAG;YAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;SACrC,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAA2B;QAC1C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;YAClD,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAG/B;gBACA,QAAQ,EAAE,GAAG,SAAS,gCAAgC;gBACtD,OAAO,EAAE;oBACP,cAAc,EAAE,OAAO,CAAC,MAAM;oBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,cAAc,EAAE,OAAO,CAAC,YAAY;iBACrC;gBACD,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAClC,CAAC,CAA6B,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAA6B;QAChD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;YAClD,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAG/B;gBACA,QAAQ,EAAE,GAAG,SAAS,4BAA4B;gBAClD,OAAO,EAAE;oBACP,eAAe,EAAE,OAAO,CAAC,OAAO;iBACjC;gBACD,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAClC,CAAC,CAA0B,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;CACF;AAzKD,oCAyKC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,8DAA8D;AAC9D,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAChC,IAAI,cAAc,GAAG,KAAK,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hawcx/oauth-client",
-  "version": "5.2.0",
+  "version": "6.0.0",
   "description": "Simple OAuth client for Hawcx authentication with delegation support",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",